From mdounin at mdounin.ru  Thu Aug  1 07:36:58 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Thu, 01 Aug 2024 10:36:58 +0300
Subject: [PATCH] Tests: fixed proxy_cache_age.t with older Perl versions
Message-ID: <d715aff0b61d4c3f48f6.1722497818@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722497739 -10800
#      Thu Aug 01 10:35:39 2024 +0300
# Node ID d715aff0b61d4c3f48f6de84cd06aa7847e1f711
# Parent  a8c4d48a4073e5ec6745e4bddd2d4a844af3c0b7
Tests: fixed proxy_cache_age.t with older Perl versions.

The test used regular expressions with "{,n}" quantifier with empty
lower bound, which is only available starting with Perl 5.34.0.  Further,
it used variable-length look-behind assertions, which are only available
starting with Perl 5.30.0 and emit experimental warning till Perl 5.36.0.

Fix is to rewrite regular expressions in question using "(?>pattern)"
instead (an independent subexpression), which is available since at least
Perl 5.005.

diff --git a/proxy_cache_age.t b/proxy_cache_age.t
--- a/proxy_cache_age.t
+++ b/proxy_cache_age.t
@@ -123,11 +123,11 @@ like(get('/ignore/noage'), qr/HIT/, 'noa
 
 sleep(2);
 
-like(http_get('/fresh'), qr/(?<!Age:.{,200})Age: 9[1-5](?!.*Age:)/ms,
+like(http_get('/fresh'), qr/^(?>.*?Age:) 9[1-5](?!.*Age:)/s,
 	'cached age updated');
-like(http_get('/stale'), qr/(?<!Age:.{,200})Age: 110(?!.*Age:)/ms,
+like(http_get('/stale'), qr/^(?>.*?Age:) 110(?!.*Age:)/s,
 	'not cached age preserved');
-like(http_get('/noage'), qr/(?<!Age:.{,200})Age: [1-5](?!.*Age:)/ms,
+like(http_get('/noage'), qr/^(?>.*?Age:) [1-5](?!.*Age:)/s,
 	'noage age added');
 
 like(http_get('/revalidate'), qr/REVALIDATED(?!.*Age:)/ms,


From mdounin at mdounin.ru  Thu Aug  1 07:37:49 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Thu, 01 Aug 2024 10:37:49 +0300
Subject: [PATCH] Tests: fixed prerequisites for regular expressions in maps
Message-ID: <6b1222de82860405a156.1722497869@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722497840 -10800
#      Thu Aug 01 10:37:20 2024 +0300
# Node ID 6b1222de82860405a1563d7f3cdb79765a53ec09
# Parent  d715aff0b61d4c3f48f6de84cd06aa7847e1f711
Tests: fixed prerequisites for regular expressions in maps.

Regular expressions in maps are only recognized when nginx is compiled
with the PCRE library.  The simplest way to make sure it is the case
is to require the rewrite module, which cannot be compiled in without
the PCRE library.

diff --git a/proxy_protocol2_tlv.t b/proxy_protocol2_tlv.t
--- a/proxy_protocol2_tlv.t
+++ b/proxy_protocol2_tlv.t
@@ -23,7 +23,7 @@ use Test::Nginx;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/http map/)->plan(14)
+my $t = Test::Nginx->new()->has(qw/http map rewrite/)->plan(14)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%
diff --git a/stream_map.t b/stream_map.t
--- a/stream_map.t
+++ b/stream_map.t
@@ -23,7 +23,7 @@ use Test::Nginx::Stream qw/ stream /;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/stream stream_return stream_map/)
+my $t = Test::Nginx->new()->has(qw/stream stream_return stream_map rewrite/)
 	->has(qw/http rewrite/);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
diff --git a/stream_proxy_protocol2_tlv.t b/stream_proxy_protocol2_tlv.t
--- a/stream_proxy_protocol2_tlv.t
+++ b/stream_proxy_protocol2_tlv.t
@@ -24,7 +24,8 @@ use Test::Nginx::Stream qw/ stream /;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/stream stream_return map/)->plan(14)
+my $t = Test::Nginx->new()
+	->has(qw/stream stream_return stream_map rewrite/)->plan(14)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%


From mdounin at mdounin.ru  Wed Aug  7 01:03:45 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:45 +0300
Subject: [PATCH 00 of 11] various build improvements
Message-ID: <patchbomb.1722992625@vm-bsd.mdounin.ru>

Hello!

The following patch series introduces various minor build improvements.
In particular, it fixes miscompilation observed with Sun C compiler,
resolves some warnings as seen with "-Wpedantic" GCC switch, and
simplifies building on Windows.

-- 
Maxim Dounin


From mdounin at mdounin.ru  Wed Aug  7 01:03:46 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:46 +0300
Subject: [PATCH 01 of 11] Configure: added latest Sun C version
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <d2b87352e5a75d8b22fa.1722992626@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992181 -10800
#      Wed Aug 07 03:56:21 2024 +0300
# Node ID d2b87352e5a75d8b22fa61588942f7201b3c98e1
# Parent  3c71158f5a34af7a354690fb853c73dc8e0d49e8
Configure: added latest Sun C version.

diff --git a/auto/cc/sunc b/auto/cc/sunc
--- a/auto/cc/sunc
+++ b/auto/cc/sunc
@@ -12,6 +12,7 @@
 # Sun C 5.12 SunOS_i386 2011/11/16        Oracle Solaris Studio 12.3
 # Sun C 5.13 SunOS_i386 2014/10/20        Oracle Solaris Studio 12.4
 # Sun C 5.14 SunOS_i386 2016/05/31        Oracle Developer Studio 12.5
+# Sun C 5.15 SunOS_i386 2017/05/30        Oracle Developer Studio 12.6
 
 NGX_SUNC_VER=`$CC -V 2>&1 | grep 'Sun C' 2>&1 \
                           | sed -e 's/^.* Sun C \(.*\)/\1/'`


From mdounin at mdounin.ru  Wed Aug  7 01:03:47 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:47 +0300
Subject: [PATCH 02 of 11] Configure: adjusted optimization level for Sun C
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <92e14ce71b72be32a436.1722992627@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992183 -10800
#      Wed Aug 07 03:56:23 2024 +0300
# Node ID 92e14ce71b72be32a4369eeeab618cc77e2723c5
# Parent  d2b87352e5a75d8b22fa61588942f7201b3c98e1
Configure: adjusted optimization level for Sun C.

With "-fast" (and with "-xbuiltin=%all -xO4"), Sun C miscompiles
ngx_http_script_add_copy_code(), which is inlined into
ngx_http_script_compile().  From the assembly code it looks like
the code uses uninitialized register when calculating new p value
after memcpy:

movq %r15,%rdi
call _memcpy
leaq (%r15,rbx),%rax
movq (%r12),%rbx
movb $0x0000000000000000,(%rax)

Note that %rax is set to (%r15 + %rbx), but %rbx is only set after
it is used.  As such, "*p = '\0'" tries to modify an unrelated memory
address, leading to a segmentation fault.

The issue was seen in tests which use null-terminated complex values:
proxy_ssl_certificate_vars.t, uwsgi_ssl_certificate_vars.t,
stream_proxy_ssl_certificate_vars.t.  Tested with Sun C compilers
from Sun Studio 12.3, 12.4, 12.5, and 12.6.

Restructuring code, such as splitting ngx_cpymem() with a separate
"p += value->len" increment, fixes things, but it is not clear if its
the only place where such miscompilation can happen.

Fix is to use "-fast -xO3".  Since IPO requires "-xO5", it is commented
out.

diff --git a/auto/cc/sunc b/auto/cc/sunc
--- a/auto/cc/sunc
+++ b/auto/cc/sunc
@@ -73,14 +73,16 @@ MODULE_LINK="-G"
 # 20736 == 0x5100, Sun Studio 12.1
 
 if [ "$ngx_sunc_ver" -ge 20736 ]; then
-    ngx_fast="-fast"
+    ngx_fast="-fast -xO3"
 
 else
     # older versions had problems with bit-fields
-    ngx_fast="-fast -xalias_level=any"
+    ngx_fast="-fast -xO3 -xalias_level=any"
 fi
 
-IPO=-xipo
+IPO=
+#IPO=-xipo
+
 CFLAGS="$CFLAGS $ngx_fast $IPO"
 CORE_LINK="$CORE_LINK $ngx_fast $IPO"
 


From mdounin at mdounin.ru  Wed Aug  7 01:03:48 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:48 +0300
Subject: [PATCH 03 of 11] Core: changed ngx_buf_tag_t to uintptr_t
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <ebebc1d680464f36a8a3.1722992628@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992186 -10800
#      Wed Aug 07 03:56:26 2024 +0300
# Node ID ebebc1d680464f36a8a305443f1207965338bca3
# Parent  92e14ce71b72be32a4369eeeab618cc77e2723c5
Core: changed ngx_buf_tag_t to uintptr_t.

There is no real difference, but "void *" as previously used results
in "ISO C forbids conversion of function pointer to object pointer type"
warnings with -Wpedantic when a function pointer is used as a tag.

Changing the type to uintptr_t makes the conversion always valid, since
any pointer type can be converted to an integer type.

diff --git a/src/core/ngx_buf.h b/src/core/ngx_buf.h
--- a/src/core/ngx_buf.h
+++ b/src/core/ngx_buf.h
@@ -13,7 +13,7 @@
 #include <ngx_core.h>
 
 
-typedef void *            ngx_buf_tag_t;
+typedef uintptr_t         ngx_buf_tag_t;
 
 typedef struct ngx_buf_s  ngx_buf_t;
 


From mdounin at mdounin.ru  Wed Aug  7 01:03:49 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:49 +0300
Subject: [PATCH 04 of 11] Events: fixed warnings with -Wpedantic in epoll
 notify
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <0ad3dde839478e1cf715.1722992629@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992191 -10800
#      Wed Aug 07 03:56:31 2024 +0300
# Node ID 0ad3dde839478e1cf715117b7544d5cef752d122
# Parent  ebebc1d680464f36a8a305443f1207965338bca3
Events: fixed warnings with -Wpedantic in epoll notify.

Added casts through uintptr_t to suppress "ISO C forbids assignment
between function pointer and 'void *'" warnings as seen with -Wpedantic
in ngx_epoll_notify() and ngx_epoll_notify_handler().

Additionally, it resolves "assignment type mismatch" warnings as seen
with Sun Studio on Linux, "pointer to function... "=" pointer to void"
and "pointer to void "=" pointer to function...".

diff --git a/src/event/modules/ngx_epoll_module.c b/src/event/modules/ngx_epoll_module.c
--- a/src/event/modules/ngx_epoll_module.c
+++ b/src/event/modules/ngx_epoll_module.c
@@ -452,7 +452,7 @@ ngx_epoll_notify_handler(ngx_event_t *ev
         }
     }
 
-    handler = ev->data;
+    handler = (ngx_event_handler_pt) (uintptr_t) ev->data;
     handler(ev);
 }
 
@@ -766,7 +766,7 @@ ngx_epoll_notify(ngx_event_handler_pt ha
 {
     static uint64_t inc = 1;
 
-    notify_event.data = handler;
+    notify_event.data = (void *) (uintptr_t) handler;
 
     if ((size_t) write(notify_fd, &inc, sizeof(uint64_t)) != sizeof(uint64_t)) {
         ngx_log_error(NGX_LOG_ALERT, notify_event.log, ngx_errno,


From mdounin at mdounin.ru  Wed Aug  7 01:03:50 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:50 +0300
Subject: [PATCH 05 of 11] Changed script length code casts to work with
 -Wpedantic
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <098019656024089ed9d3.1722992630@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992198 -10800
#      Wed Aug 07 03:56:38 2024 +0300
# Node ID 098019656024089ed9d36bb06d89278305893f50
# Parent  0ad3dde839478e1cf715117b7544d5cef752d122
Changed script length code casts to work with -Wpedantic.

Script length code casts though "void *", as introduced in
7271:9e25a5380a21 to silence -Wcast-function-type warnings, result
in "ISO C forbids conversion of function pointer to object pointer type"
warnings with -Wpedantic.  Fix is to cast though uintptr_t instead.

diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c
--- a/src/http/modules/ngx_http_fastcgi_module.c
+++ b/src/http/modules/ngx_http_fastcgi_module.c
@@ -3436,7 +3436,7 @@ ngx_http_fastcgi_init_params(ngx_conf_t 
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
@@ -3446,7 +3446,7 @@ ngx_http_fastcgi_init_params(ngx_conf_t 
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].skip_empty;
 
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
--- a/src/http/modules/ngx_http_grpc_module.c
+++ b/src/http/modules/ngx_http_grpc_module.c
@@ -4677,7 +4677,7 @@ ngx_http_grpc_init_headers(ngx_conf_t *c
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
--- a/src/http/modules/ngx_http_proxy_module.c
+++ b/src/http/modules/ngx_http_proxy_module.c
@@ -4047,7 +4047,7 @@ ngx_http_proxy_init_headers(ngx_conf_t *
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c
--- a/src/http/modules/ngx_http_scgi_module.c
+++ b/src/http/modules/ngx_http_scgi_module.c
@@ -1820,7 +1820,7 @@ ngx_http_scgi_init_params(ngx_conf_t *cf
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len + 1;
 
@@ -1830,7 +1830,7 @@ ngx_http_scgi_init_params(ngx_conf_t *cf
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].skip_empty;
 
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
--- a/src/http/modules/ngx_http_uwsgi_module.c
+++ b/src/http/modules/ngx_http_uwsgi_module.c
@@ -2118,7 +2118,7 @@ ngx_http_uwsgi_init_params(ngx_conf_t *c
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
@@ -2128,7 +2128,7 @@ ngx_http_uwsgi_init_params(ngx_conf_t *c
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].skip_empty;
 
diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -822,7 +822,7 @@ ngx_http_script_add_copy_code(ngx_http_s
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
     code->len = len;
 
@@ -912,7 +912,7 @@ ngx_http_script_add_var_code(ngx_http_sc
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                              ngx_http_script_copy_var_len_code;
     code->index = (uintptr_t) index;
 
@@ -1308,7 +1308,7 @@ ngx_http_script_add_capture_code(ngx_htt
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                          ngx_http_script_copy_capture_len_code;
     code->n = 2 * n;
 
@@ -1423,7 +1423,7 @@ ngx_http_script_add_full_name_code(ngx_h
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                             ngx_http_script_full_name_len_code;
     code->conf_prefix = sc->conf_prefix;
 
diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c
--- a/src/stream/ngx_stream_script.c
+++ b/src/stream/ngx_stream_script.c
@@ -686,7 +686,7 @@ ngx_stream_script_add_copy_code(ngx_stre
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                                ngx_stream_script_copy_len_code;
     code->len = len;
 
@@ -777,7 +777,7 @@ ngx_stream_script_add_var_code(ngx_strea
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                            ngx_stream_script_copy_var_len_code;
     code->index = (uintptr_t) index;
 
@@ -867,7 +867,7 @@ ngx_stream_script_add_capture_code(ngx_s
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                        ngx_stream_script_copy_capture_len_code;
     code->n = 2 * n;
 
@@ -959,7 +959,7 @@ ngx_stream_script_add_full_name_code(ngx
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                           ngx_stream_script_full_name_len_code;
     code->conf_prefix = sc->conf_prefix;
 


From mdounin at mdounin.ru  Wed Aug  7 01:03:51 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:51 +0300
Subject: [PATCH 06 of 11] Win32: building with Clang
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <7c350e5171682e6fb079.1722992631@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992209 -10800
#      Wed Aug 07 03:56:49 2024 +0300
# Node ID 7c350e5171682e6fb079408c4f3258074d973df6
# Parent  098019656024089ed9d36bb06d89278305893f50
Win32: building with Clang.

diff --git a/auto/os/win32 b/auto/os/win32
--- a/auto/os/win32
+++ b/auto/os/win32
@@ -18,7 +18,7 @@ ngx_binext=".exe"
 
 case "$NGX_CC_NAME" in
 
-    gcc)
+    gcc | clang)
         CORE_LIBS="$CORE_LIBS -ladvapi32 -lws2_32"
         MAIN_LINK="$MAIN_LINK -Wl,--export-all-symbols"
         MAIN_LINK="$MAIN_LINK -Wl,--out-implib=$NGX_OBJS/libnginx.a"


From mdounin at mdounin.ru  Wed Aug  7 01:03:52 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:52 +0300
Subject: [PATCH 07 of 11] Win32: improved MinGW/MinGW-w64 GCC checks
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <32a5186a27058925bfa9.1722992632@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992219 -10800
#      Wed Aug 07 03:56:59 2024 +0300
# Node ID 32a5186a27058925bfa9280215ecee114a56d6be
# Parent  7c350e5171682e6fb079408c4f3258074d973df6
Win32: improved MinGW/MinGW-w64 GCC checks.

Previously, __GNUC__ was checked, which is now replaced with __MINGW32__
checks.  The difference is that __MINGW32__ is defined when using MinGW
(or MinGW-w64) header files regardless of the compiler being used.  And,
more importantly, it is not defined when Clang is being used (which
pretends to be GCC by default) with Windows SDK header files.

With this change, it is now possible to compile nginx with native Clang
on Windows.  This current requires --with-ld-opt="-lkernel32 -luser32"
though, since native Clang on Windows uses MSVC linker, which does
not link kernel32.lib and user32.lib automatically.

diff --git a/src/os/win32/ngx_atomic.h b/src/os/win32/ngx_atomic.h
--- a/src/os/win32/ngx_atomic.h
+++ b/src/os/win32/ngx_atomic.h
@@ -21,7 +21,7 @@ typedef volatile ngx_atomic_uint_t  ngx_
 #define NGX_ATOMIC_T_LEN            (sizeof("-2147483648") - 1)
 
 
-#if defined( __WATCOMC__ ) || defined( __BORLANDC__ ) || defined(__GNUC__)    \
+#if defined( __WATCOMC__ ) || defined( __BORLANDC__ ) || defined(__MINGW32__) \
     || ( _MSC_VER >= 1300 )
 
 /* the new SDK headers */
diff --git a/src/os/win32/ngx_win32_config.h b/src/os/win32/ngx_win32_config.h
--- a/src/os/win32/ngx_win32_config.h
+++ b/src/os/win32/ngx_win32_config.h
@@ -47,7 +47,7 @@
 /* GCC MinGW-w64 supports _FILE_OFFSET_BITS */
 #define _FILE_OFFSET_BITS 64
 
-#elif defined __GNUC__
+#elif defined __MINGW32__
 
 /* GCC MinGW's stdio.h includes sys/types.h */
 #define _OFF_T_
@@ -58,7 +58,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdarg.h>
-#ifdef __GNUC__
+#ifdef __MINGW32__
 #include <stdint.h>
 #endif
 #include <ctype.h>
@@ -198,7 +198,7 @@ typedef unsigned int        ino_t;
 #endif
 
 
-#ifndef __GNUC__
+#ifndef __MINGW32__
 #ifdef _WIN64
 typedef __int64             ssize_t;
 #else


From mdounin at mdounin.ru  Wed Aug  7 01:03:53 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:53 +0300
Subject: [PATCH 08 of 11] Support for Clang with "-fgnuc-version=0"
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <d286426eab1a2953b271.1722992633@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992310 -10800
#      Wed Aug 07 03:58:30 2024 +0300
# Node ID d286426eab1a2953b27161829dbca27ce578c706
# Parent  32a5186a27058925bfa9280215ecee114a56d6be
Support for Clang with "-fgnuc-version=0".

Previously, the code assumed that Clang pretends to be GCC and defines
the __GNUC__ macro, which might not be the case if the "-fgnuc-version=0"
flag is used.  Fix is to explicitly check for __clang__ as well.

In practice, with this change ngx_cpuinfo() is now available on Linux
with "-fgnuc-version=0".

diff --git a/src/core/ngx_cpuinfo.c b/src/core/ngx_cpuinfo.c
--- a/src/core/ngx_cpuinfo.c
+++ b/src/core/ngx_cpuinfo.c
@@ -9,7 +9,8 @@
 #include <ngx_core.h>
 
 
-#if (( __i386__ || __amd64__ ) && ( __GNUC__ || __INTEL_COMPILER ))
+#if (( __i386__ || __amd64__ )                                                \
+    && ( __GNUC__ || __clang__ || __INTEL_COMPILER ))
 
 
 static ngx_inline void ngx_cpuid(uint32_t i, uint32_t *buf);
diff --git a/src/event/modules/ngx_iocp_module.c b/src/event/modules/ngx_iocp_module.c
--- a/src/event/modules/ngx_iocp_module.c
+++ b/src/event/modules/ngx_iocp_module.c
@@ -172,7 +172,7 @@ ngx_iocp_timer(void *data)
 #endif
     }
 
-#if defined(__WATCOMC__) || defined(__GNUC__)
+#if defined(__WATCOMC__) || defined(__GNUC__) || defined(__clang__)
     return 0;
 #endif
 }
diff --git a/src/os/unix/ngx_atomic.h b/src/os/unix/ngx_atomic.h
--- a/src/os/unix/ngx_atomic.h
+++ b/src/os/unix/ngx_atomic.h
@@ -153,7 +153,7 @@ ngx_cpu_pause(void);
 #define ngx_memory_barrier()        __asm (".volatile"); __asm (".nonvolatile")
 
 
-#else /* ( __GNUC__ || __INTEL_COMPILER ) */
+#else /* ( __GNUC__ || __clang__ || __INTEL_COMPILER ) */
 
 #define NGX_HAVE_ATOMIC_OPS  1
 
@@ -194,7 +194,7 @@ ngx_cpu_pause(void);
 #define ngx_memory_barrier()        __asm (".volatile"); __asm (".nonvolatile")
 
 
-#else /* ( __GNUC__ || __INTEL_COMPILER ) */
+#else /* ( __GNUC__ || __clang__ || __INTEL_COMPILER ) */
 
 #define NGX_HAVE_ATOMIC_OPS  1
 
@@ -229,7 +229,7 @@ typedef volatile ngx_atomic_uint_t  ngx_
 #include "ngx_sunpro_atomic_sparc64.h"
 
 
-#else /* ( __GNUC__ || __INTEL_COMPILER ) */
+#else /* ( __GNUC__ || __clang__ || __INTEL_COMPILER ) */
 
 #define NGX_HAVE_ATOMIC_OPS  1
 


From mdounin at mdounin.ru  Wed Aug  7 01:03:54 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:54 +0300
Subject: [PATCH 09 of 11] Win32: checking for system PCRE, zlib,
 and OpenSSL libs
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <b40149d062cba9d047f2.1722992634@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992330 -10800
#      Wed Aug 07 03:58:50 2024 +0300
# Node ID b40149d062cba9d047f21325ba769498e2c2386b
# Parent  d286426eab1a2953b27161829dbca27ce578c706
Win32: checking for system PCRE, zlib, and OpenSSL libs.

Checking for system libs on Windows is beneficial when compiling in
MSYS2 environments with GCC or Clang, as most libraries are readily
available.

diff --git a/auto/lib/openssl/conf b/auto/lib/openssl/conf
--- a/auto/lib/openssl/conf
+++ b/auto/lib/openssl/conf
@@ -55,96 +55,94 @@ if [ $OPENSSL != NONE ]; then
 
 else
 
-    if [ "$NGX_PLATFORM" != win32 ]; then
-
-        OPENSSL=NO
+    OPENSSL=NO
 
-        ngx_feature="OpenSSL library"
-        ngx_feature_name="NGX_OPENSSL"
-        ngx_feature_run=no
-        ngx_feature_incs="#include <openssl/ssl.h>"
-        ngx_feature_path=
-        ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL $NGX_LIBPTHREAD"
-        ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
-        . auto/feature
+    ngx_feature="OpenSSL library"
+    ngx_feature_name="NGX_OPENSSL"
+    ngx_feature_run=no
+    ngx_feature_incs="#include <openssl/ssl.h>"
+    ngx_feature_path=
+    ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL $NGX_LIBPTHREAD"
+    ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+    . auto/feature
 
-        if [ $ngx_found = no ]; then
+    if [ $ngx_found = no ]; then
+
+        # FreeBSD port
+
+        ngx_feature="OpenSSL library in /usr/local/"
+        ngx_feature_path="/usr/local/include"
 
-            # FreeBSD port
+        if [ $NGX_RPATH = YES ]; then
+            ngx_feature_libs="-R/usr/local/lib -L/usr/local/lib -lssl -lcrypto"
+        else
+            ngx_feature_libs="-L/usr/local/lib -lssl -lcrypto"
+        fi
 
-            ngx_feature="OpenSSL library in /usr/local/"
-            ngx_feature_path="/usr/local/include"
+        ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
+
+        . auto/feature
+    fi
 
-            if [ $NGX_RPATH = YES ]; then
-                ngx_feature_libs="-R/usr/local/lib -L/usr/local/lib -lssl -lcrypto"
-            else
-                ngx_feature_libs="-L/usr/local/lib -lssl -lcrypto"
-            fi
+    if [ $ngx_found = no ]; then
+
+        # NetBSD port
 
-            ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
+        ngx_feature="OpenSSL library in /usr/pkg/"
+        ngx_feature_path="/usr/pkg/include"
 
-            . auto/feature
+        if [ $NGX_RPATH = YES ]; then
+            ngx_feature_libs="-R/usr/pkg/lib -L/usr/pkg/lib -lssl -lcrypto"
+        else
+            ngx_feature_libs="-L/usr/pkg/lib -lssl -lcrypto"
         fi
 
-        if [ $ngx_found = no ]; then
+        ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
+
+        . auto/feature
+    fi
+
+    if [ $ngx_found = no ]; then
+
+        # MacPorts
 
-            # NetBSD port
+        ngx_feature="OpenSSL library in /opt/local/"
+        ngx_feature_path="/opt/local/include"
+
+        if [ $NGX_RPATH = YES ]; then
+            ngx_feature_libs="-R/opt/local/lib -L/opt/local/lib -lssl -lcrypto"
+        else
+            ngx_feature_libs="-L/opt/local/lib -lssl -lcrypto"
+        fi
+
+        ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
 
-            ngx_feature="OpenSSL library in /usr/pkg/"
-            ngx_feature_path="/usr/pkg/include"
+        . auto/feature
+    fi
+
+    if [ $ngx_found = yes ]; then
+        have=NGX_SSL . auto/have
+        CORE_INCS="$CORE_INCS $ngx_feature_path"
+        CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
+        OPENSSL=YES
+
+        if [ $USE_OPENSSL_QUIC = YES ]; then
 
-            if [ $NGX_RPATH = YES ]; then
-                ngx_feature_libs="-R/usr/pkg/lib -L/usr/pkg/lib -lssl -lcrypto"
-            else
-                ngx_feature_libs="-L/usr/pkg/lib -lssl -lcrypto"
+            ngx_feature="OpenSSL QUIC support"
+            ngx_feature_name="NGX_QUIC"
+            ngx_feature_test="SSL_set_quic_method(NULL, NULL)"
+            . auto/feature
+
+            if [ $ngx_found = no ]; then
+                have=NGX_QUIC_OPENSSL_COMPAT . auto/have
+
+                ngx_feature="OpenSSL QUIC compatibility"
+                ngx_feature_test="SSL_CTX_add_custom_ext(NULL, 0, 0,
+                                             NULL, NULL, NULL, NULL, NULL)"
+                . auto/feature
             fi
 
-            ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
-
-            . auto/feature
-        fi
-
-        if [ $ngx_found = no ]; then
-
-            # MacPorts
-
-            ngx_feature="OpenSSL library in /opt/local/"
-            ngx_feature_path="/opt/local/include"
-
-            if [ $NGX_RPATH = YES ]; then
-                ngx_feature_libs="-R/opt/local/lib -L/opt/local/lib -lssl -lcrypto"
-            else
-                ngx_feature_libs="-L/opt/local/lib -lssl -lcrypto"
-            fi
-
-            ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
-
-            . auto/feature
-        fi
-
-        if [ $ngx_found = yes ]; then
-            have=NGX_SSL . auto/have
-            CORE_INCS="$CORE_INCS $ngx_feature_path"
-            CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
-            OPENSSL=YES
-
-            if [ $USE_OPENSSL_QUIC = YES ]; then
-
-                ngx_feature="OpenSSL QUIC support"
-                ngx_feature_name="NGX_QUIC"
-                ngx_feature_test="SSL_set_quic_method(NULL, NULL)"
-                . auto/feature
-
-                if [ $ngx_found = no ]; then
-                    have=NGX_QUIC_OPENSSL_COMPAT . auto/have
-
-                    ngx_feature="OpenSSL QUIC compatibility"
-                    ngx_feature_test="SSL_CTX_add_custom_ext(NULL, 0, 0,
-                                                 NULL, NULL, NULL, NULL, NULL)"
-                    . auto/feature
-                fi
-
-                if [ $ngx_found = no ]; then
+            if [ $ngx_found = no ]; then
 cat << END
 
 $0: error: certain modules require OpenSSL QUIC support.
@@ -153,8 +151,7 @@ QUIC support into the system, or build t
 statically from the source with nginx by using --with-openssl=<path> option.
 
 END
-                        exit 1
-                fi
+                exit 1
             fi
         fi
     fi
diff --git a/auto/lib/pcre/conf b/auto/lib/pcre/conf
--- a/auto/lib/pcre/conf
+++ b/auto/lib/pcre/conf
@@ -68,11 +68,9 @@ if [ $PCRE != NONE ]; then
 
 else
 
-    if [ "$NGX_PLATFORM" != win32 ]; then
-        PCRE=NO
-    fi
+    PCRE=NO
 
-    if [ $PCRE = NO -a $PCRE2 != DISABLED ]; then
+    if [ $PCRE2 != DISABLED ]; then
 
         ngx_feature="PCRE2 library"
         ngx_feature_name="NGX_PCRE2"
diff --git a/auto/lib/zlib/conf b/auto/lib/zlib/conf
--- a/auto/lib/zlib/conf
+++ b/auto/lib/zlib/conf
@@ -42,26 +42,24 @@ if [ $ZLIB != NONE ]; then
 
 else
 
-    if [ "$NGX_PLATFORM" != win32 ]; then
-        ZLIB=NO
+    ZLIB=NO
 
-        # FreeBSD, Solaris, Linux
+    # FreeBSD, Solaris, Linux
 
-        ngx_feature="zlib library"
-        ngx_feature_name="NGX_ZLIB"
-        ngx_feature_run=no
-        ngx_feature_incs="#include <zlib.h>"
-        ngx_feature_path=
-        ngx_feature_libs="-lz"
-        ngx_feature_test="z_stream z; deflate(&z, Z_NO_FLUSH)"
-        . auto/feature
+    ngx_feature="zlib library"
+    ngx_feature_name="NGX_ZLIB"
+    ngx_feature_run=no
+    ngx_feature_incs="#include <zlib.h>"
+    ngx_feature_path=
+    ngx_feature_libs="-lz"
+    ngx_feature_test="z_stream z; deflate(&z, Z_NO_FLUSH)"
+    . auto/feature
 
 
-        if [ $ngx_found = yes ]; then
-            CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
-            ZLIB=YES
-            ngx_found=no
-        fi
+    if [ $ngx_found = yes ]; then
+        CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
+        ZLIB=YES
+        ngx_found=no
     fi
 
     if [ $ZLIB != YES ]; then


From mdounin at mdounin.ru  Wed Aug  7 01:03:55 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:55 +0300
Subject: [PATCH 10 of 11] Win32: added modern MSVC versions
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <314be1eba450fd212bca.1722992635@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992341 -10800
#      Wed Aug 07 03:59:01 2024 +0300
# Node ID 314be1eba450fd212bca448a1cc52af58a2eca9f
# Parent  b40149d062cba9d047f21325ba769498e2c2386b
Win32: added modern MSVC versions.

diff --git a/auto/cc/msvc b/auto/cc/msvc
--- a/auto/cc/msvc
+++ b/auto/cc/msvc
@@ -9,6 +9,8 @@
 # MSVC 2008 Express Edition (9.0)         cl 15.00
 # MSVC 2010 (10.0)                        cl 16.00
 # MSVC 2015 (14.0)                        cl 19.00
+# MSVC 2017 (16.9)                        cl 19.16
+# MSVC 2022 (17.10.1)                     cl 19.40
 
 
 NGX_MSVC_VER=`$NGX_WINE $CC 2>&1 | grep 'C/C++.* [0-9][0-9]*\.[0-9]' 2>&1 \


From mdounin at mdounin.ru  Wed Aug  7 01:03:56 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:03:56 +0300
Subject: [PATCH 11 of 11] Updated PCRE2 used for win32 builds
In-Reply-To: <patchbomb.1722992625@vm-bsd.mdounin.ru>
References: <patchbomb.1722992625@vm-bsd.mdounin.ru>
Message-ID: <8149e6e3ea2aa3d7ef38.1722992636@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722992353 -10800
#      Wed Aug 07 03:59:13 2024 +0300
# Node ID 8149e6e3ea2aa3d7ef3861330e38a2f144e35c47
# Parent  314be1eba450fd212bca448a1cc52af58a2eca9f
Updated PCRE2 used for win32 builds.

Note that PCRE2 10.40 and newer versions require C99 support, as it now
uses "for (int i = 0; ...)" constructs[1], and thus cannot be compiled
with MSVC 2010 and older versions anymore.

[1] https://github.com/PCRE2Project/pcre2/issues/163

diff --git a/auto/lib/pcre/make b/auto/lib/pcre/make
--- a/auto/lib/pcre/make
+++ b/auto/lib/pcre/make
@@ -36,7 +36,8 @@ if [ $PCRE_LIBRARY = PCRE2 ]; then
                        pcre2_valid_utf.c \
                        pcre2_xclass.c"
 
-        ngx_pcre_test="pcre2_convert.c \
+        ngx_pcre_test="pcre2_chkdint.c \
+                       pcre2_convert.c \
                        pcre2_extuni.c \
                        pcre2_find_bracket.c \
                        pcre2_script_run.c \
diff --git a/misc/GNUmakefile b/misc/GNUmakefile
--- a/misc/GNUmakefile
+++ b/misc/GNUmakefile
@@ -8,7 +8,7 @@ CC =		cl
 OBJS =		objs.msvc8
 OPENSSL =	openssl-3.0.14
 ZLIB =		zlib-1.3.1
-PCRE =		pcre2-10.39
+PCRE =		pcre2-10.44
 
 
 release: export


From mdounin at mdounin.ru  Wed Aug  7 01:44:22 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Wed, 07 Aug 2024 04:44:22 +0300
Subject: [PATCH] Tests: better binary path handling on Windows
Message-ID: <73eca33514672f9c17ae.1722995062@1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1722994681 -10800
#      Wed Aug 07 04:38:01 2024 +0300
# Node ID 73eca33514672f9c17aeb47ae7bcdf06ac15f77d
# Parent  a8c4d48a4073e5ec6745e4bddd2d4a844af3c0b7
Tests: better binary path handling on Windows.

The ".exe" extension is no longer required, and testing is allowed if
it is omitted.

Additionally, forward slashes in the binary path are automatically replaced
with reverse slashes, since CMD cannot properly handle relative paths with
forward slashes, and such paths previously resulted in various issues,
including non-working $t->has() and $t->has_version().

In particular, with these changes the default binary path, which is
"../nginx/objs/nginx", works properly, and testing can be done without
any additional options.

diff -r a8c4d48a4073 -r 73eca3351467 lib/Test/Nginx.pm
--- a/lib/Test/Nginx.pm	Thu Jul 18 19:40:19 2024 +0300
+++ b/lib/Test/Nginx.pm	Wed Aug 07 04:38:01 2024 +0300
@@ -49,8 +49,10 @@ sub new {
 		or die "Can't create temp directory: $!\n";
 	$self->{_testdir} =~ s!\\!/!g if $^O eq 'MSWin32';
 
+	$NGINX =~ s!/!\\!g if $^O eq 'MSWin32';
+
 	Test::More::BAIL_OUT("no $NGINX binary found")
-		unless -x $NGINX;
+		unless -x $NGINX or ($^O eq 'MSWin32' and -x "$NGINX.exe");
 
 	return $self;
 }


From mdounin at mdounin.ru  Fri Aug  9 20:37:25 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Fri, 09 Aug 2024 23:37:25 +0300
Subject: [PATCH 1 of 5] Tests: removed usage of "cat" and "grep" in tests
Message-ID: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1723169931 -10800
#      Fri Aug 09 05:18:51 2024 +0300
# Node ID d329b05e20faf1fa7235d95657649f224e46edd4
# Parent  e9235c647f45bc6a333fccbbc0d4e8f6d0ea716a
Tests: removed usage of "cat" and "grep" in tests.

Both "cat" and "grep" might not be available on Windows.  Instead,
$t->read_file() is used, as it is already used in other places.  To
simplify checking logs as previously done with "grep", $t->grep_file()
helper function is introduced.

diff --git a/grpc_request_buffering.t b/grpc_request_buffering.t
--- a/grpc_request_buffering.t
+++ b/grpc_request_buffering.t
@@ -105,7 +105,7 @@ is(eval(join '+', map { $_->{length} } g
 is(eval(join '+', map { $_->{length} } grep { $_->{type} eq "DATA" } @$frames),
 	465, 'preserve_output - last body bytes');
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crits');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/h3_ssl_session_reuse.t b/h3_ssl_session_reuse.t
--- a/h3_ssl_session_reuse.t
+++ b/h3_ssl_session_reuse.t
@@ -151,7 +151,7 @@ is(test_reuse(8949), 0, 'cache off not r
 
 $t->stop();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm
--- a/lib/Test/Nginx.pm
+++ b/lib/Test/Nginx.pm
@@ -84,14 +84,12 @@ sub DESTROY {
 	}
 
 	if (Test::More->builder->expected_tests) {
-		my $errors = $self->read_file('error.log');
-		$errors = join "\n", $errors =~ /.+Sanitizer.+/gm;
+		my $errors = $self->grep_file('error.log', 'Sanitizer');
 		Test::More::is($errors, '', 'no sanitizer errors');
 	}
 
 	if (Test::More->builder->expected_tests && $ENV{TEST_NGINX_VALGRIND}) {
-		my $errors = $self->read_file('valgrind.log');
-		$errors = join "\n", $errors =~ /^==\d+== .+/gm;
+		my $errors = $self->grep_file('valgrind.log', /^==\d+== .+/m);
 		Test::More::is($errors, '', 'no valgrind errors');
 	}
 
@@ -633,6 +631,16 @@ sub read_file($) {
 	return $content;
 }
 
+sub grep_file($$) {
+	my ($self, $name, $regex) = @_;
+
+	my $lines = $self->read_file($name);
+
+	$regex = qr/.*\Q$regex\E.*/m if ref($regex) eq '';
+
+	return join "\n", $lines =~ /$regex/g;
+}
+
 sub write_file($$) {
 	my ($self, $name, $content) = @_;
 
diff --git a/memcached_fake.t b/memcached_fake.t
--- a/memcached_fake.t
+++ b/memcached_fake.t
@@ -69,7 +69,7 @@ like(http_get('/'), qr/SEE-THIS/, 'memca
 
 like(http_get('/ssi.html'), qr/SEE-THIS/, 'memcached ssi var');
 
-like(`grep -F '[error]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no errors');
+is($t->grep_file('error.log', '[error]'), '', 'no errors');
 
 ###############################################################################
 
diff --git a/post_action.t b/post_action.t
--- a/post_action.t
+++ b/post_action.t
@@ -76,6 +76,6 @@ unlike(http_get('/remote'), qr/HIDDEN/m,
 
 $t->stop();
 
-like(`cat ${\($t->testdir())}/access.log`, qr/post/, 'post action in logs');
+like($t->read_file('access.log'), qr/post/, 'post action in logs');
 
 ###############################################################################
diff --git a/proxy_cache_vary.t b/proxy_cache_vary.t
--- a/proxy_cache_vary.t
+++ b/proxy_cache_vary.t
@@ -293,7 +293,7 @@ like(get1('/cold?vary=x,y&xtra=1', 'x:2'
 
 $t->stop();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/proxy_keepalive.t b/proxy_keepalive.t
--- a/proxy_keepalive.t
+++ b/proxy_keepalive.t
@@ -208,7 +208,7 @@ like(http_get('/inmemory/closed2'), qr/2
 
 # check for errors, shouldn't be any
 
-like(`grep -F '[error]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no errors');
+is($t->grep_file('error.log', '[error]'), '', 'no errors');
 
 ###############################################################################
 
diff --git a/ssl.t b/ssl.t
--- a/ssl.t
+++ b/ssl.t
@@ -275,7 +275,7 @@ is(get_ssl_shutdown(8085), 1, 'ssl shutd
 like($t->read_file('ssl.log'), qr/^(TLS|SSL)v(\d|\.)+$/m,
 	'log ssl variable on lingering close');
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/ssl_ocsp.t b/ssl_ocsp.t
--- a/ssl_ocsp.t
+++ b/ssl_ocsp.t
@@ -409,7 +409,7 @@ like(get('root', port => 8447), qr/200 O
 
 # check for errors
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/ssl_session_reuse.t b/ssl_session_reuse.t
--- a/ssl_session_reuse.t
+++ b/ssl_session_reuse.t
@@ -195,7 +195,7 @@ is(test_reuse(8449), 0, 'cache off not r
 
 $t->stop();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/ssl_stapling.t b/ssl_stapling.t
--- a/ssl_stapling.t
+++ b/ssl_stapling.t
@@ -301,7 +301,7 @@ local $TODO = 'broken TLSv1.3 sigalgs in
 	&& !Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER")
 	&& test_tls13();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 }
 
diff --git a/stream_resolver.t b/stream_resolver.t
--- a/stream_resolver.t
+++ b/stream_resolver.t
@@ -107,7 +107,7 @@ ok(stream('127.0.0.1:' . port(8086))->re
 SKIP: {
 skip "relies on error log contents", 2 unless $ENV{TEST_NGINX_UNSAFE};
 
-my $log = `grep -F '[error]' ${\($t->testdir())}/error.log`;
+my $log = $t->grep_file('error.log', '[error]');
 like($log, qr/no port in upstream "a.example.com"/, 'log - no port');
 like($log, qr/nx.example.com could not be resolved/, 'log - not found');
 


From mdounin at mdounin.ru  Fri Aug  9 20:37:26 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Fri, 09 Aug 2024 23:37:26 +0300
Subject: [PATCH 2 of 5] Tests: fixed mail_oauth.t to run with CPU cache line
 size 32
In-Reply-To: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
References: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
Message-ID: <099c972fb42b7527d13c.1723235846@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1723169931 -10800
#      Fri Aug 09 05:18:51 2024 +0300
# Node ID 099c972fb42b7527d13c12765a47e9ae856bbe14
# Parent  d329b05e20faf1fa7235d95657649f224e46edd4
Tests: fixed mail_oauth.t to run with CPU cache line size 32.

diff --git a/mail_oauth.t b/mail_oauth.t
--- a/mail_oauth.t
+++ b/mail_oauth.t
@@ -65,6 +65,8 @@ mail {
 http {
     %%TEST_GLOBALS_HTTP%%
 
+    map_hash_bucket_size 64;
+
     map $http_auth_protocol $proxy_port {
 	imap %%PORT_8144%%;
 	pop3 %%PORT_8111%%;


From mdounin at mdounin.ru  Fri Aug  9 20:37:27 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Fri, 09 Aug 2024 23:37:27 +0300
Subject: [PATCH 3 of 5] Tests: removed remnants of NPN in tests
In-Reply-To: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
References: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
Message-ID: <d2d00eea7b3d5bcc39b5.1723235847@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1723169932 -10800
#      Fri Aug 09 05:18:52 2024 +0300
# Node ID d2d00eea7b3d5bcc39b52df2293481a073156a37
# Parent  099c972fb42b7527d13c12765a47e9ae856bbe14
Tests: removed remnants of NPN in tests.

NPN support was removed in nginx 1.21.4 (7934:61abb35bb8cf).

diff --git a/h2_ssl_proxy_cache.t b/h2_ssl_proxy_cache.t
--- a/h2_ssl_proxy_cache.t
+++ b/h2_ssl_proxy_cache.t
@@ -92,7 +92,7 @@ open OLDERR, ">&", \*STDERR; close STDER
 $t->run();
 open STDERR, ">&", \*OLDERR;
 
-plan(skip_all => 'no ALPN/NPN negotiation') unless defined getconn(port(8080));
+plan(skip_all => 'no ALPN negotiation') unless defined getconn(port(8080));
 $t->plan(1);
 
 ###############################################################################
@@ -129,15 +129,6 @@ sub getconn {
 			if $sock->alpn_selected();
 	};
 
-	return $s if defined $s;
-
-	eval {
-		my $sock = Test::Nginx::HTTP2::new_socket($port, SSL => 1,
-			npn => 'h2');
-		$s = Test::Nginx::HTTP2->new($port, socket => $sock)
-			if $sock->next_proto_negotiated();
-	};
-
 	return $s;
 }
 
diff --git a/h2_ssl_variables.t b/h2_ssl_variables.t
--- a/h2_ssl_variables.t
+++ b/h2_ssl_variables.t
@@ -24,7 +24,7 @@ select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
 my $t = Test::Nginx->new()->has(qw/http http_ssl http_v2 rewrite socket_ssl/)
-	->has_daemon('openssl')->plan(8);
+	->has_daemon('openssl')->plan(4);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
 
@@ -88,29 +88,13 @@ open STDERR, ">&", \*OLDERR;
 
 my ($s, $sid, $frames, $frame);
 
-my $has_npn = eval { Test::Nginx::HTTP2::new_socket(port(8080), SSL => 1,
-	npn => 'h2')->next_proto_negotiated() };
 my $has_alpn = eval { Test::Nginx::HTTP2::new_socket(port(8080), SSL => 1,
 	alpn => 'h2')->alpn_selected() };
 
-# SSL/TLS connection, NPN
-
 SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/h2' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
+skip 'OpenSSL ALPN support required', 4 unless $has_alpn;
 
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'h2', 'http variable - npn');
-
-}
-
-# SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# SSL/TLS connection
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/h2' });
@@ -119,26 +103,7 @@ skip 'OpenSSL ALPN support required', 1 
 ($frame) = grep { $_->{type} eq "DATA" } @$frames;
 is($frame->{data}, 'h2', 'http variable - alpn');
 
-}
-
-# $server_protocol - SSL/TLS connection, NPN
-
-SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/sp' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
-
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'HTTP/2.0', 'server_protocol variable - npn');
-
-}
-
-# $server_protocol - SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# $server_protocol
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/sp' });
@@ -147,26 +112,7 @@ skip 'OpenSSL ALPN support required', 1 
 ($frame) = grep { $_->{type} eq "DATA" } @$frames;
 is($frame->{data}, 'HTTP/2.0', 'server_protocol variable - alpn');
 
-}
-
-# $scheme - SSL/TLS connection, NPN
-
-SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/scheme' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
-
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'https', 'scheme variable - npn');
-
-}
-
-# $scheme - SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# $scheme
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/scheme' });
@@ -175,26 +121,7 @@ skip 'OpenSSL ALPN support required', 1 
 ($frame) = grep { $_->{type} eq "DATA" } @$frames;
 is($frame->{data}, 'https', 'scheme variable - alpn');
 
-}
-
-# $https - SSL/TLS connection, NPN
-
-SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/https' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
-
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'on', 'https variable - npn');
-
-}
-
-# $https - SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# $https
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/https' });
diff --git a/lib/Test/Nginx/HTTP2.pm b/lib/Test/Nginx/HTTP2.pm
--- a/lib/Test/Nginx/HTTP2.pm
+++ b/lib/Test/Nginx/HTTP2.pm
@@ -532,7 +532,6 @@ sub unpack_length {
 
 sub new_socket {
 	my ($port, %extra) = @_;
-	my $npn = $extra{'npn'};
 	my $alpn = $extra{'alpn'};
 	my $s;
 
@@ -550,7 +549,6 @@ sub new_socket {
 		IO::Socket::SSL->start_SSL($s,
 			SSL_version => 'SSLv23',
 			SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(),
-			SSL_npn_protocols => $npn ? [ $npn ] : undef,
 			SSL_alpn_protocols => $alpn ? [ $alpn ] : undef,
 			SSL_error_trap => sub { die $_[1] }
 		) if $extra{'SSL'};


From mdounin at mdounin.ru  Fri Aug  9 20:37:28 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Fri, 09 Aug 2024 23:37:28 +0300
Subject: [PATCH 4 of 5] Tests: removed remnants of "listen ... http2" usage
In-Reply-To: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
References: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
Message-ID: <6b3b31149551efb88fa8.1723235848@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1723170064 -10800
#      Fri Aug 09 05:21:04 2024 +0300
# Node ID 6b3b31149551efb88fa863901563932c19679db2
# Parent  d2d00eea7b3d5bcc39b52df2293481a073156a37
Tests: removed remnants of "listen ... http2" usage.

The only remaining test which uses "listen ... http2" is h2_http2.t
now, which is specifically to test that this form still works.

diff --git a/h2_ssl.t b/h2_ssl.t
--- a/h2_ssl.t
+++ b/h2_ssl.t
@@ -41,9 +41,11 @@ http {
     %%TEST_GLOBALS_HTTP%%
 
     server {
-        listen       127.0.0.1:8080 http2 ssl;
+        listen       127.0.0.1:8080 ssl;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -77,9 +79,7 @@ foreach my $name ('localhost') {
 $t->write_file('tbig.html',
 	join('', map { sprintf "XX%06dXX", $_ } (1 .. 500000)));
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 plan(skip_all => 'no ALPN negotiation') unless defined getconn();
 $t->plan(4);
diff --git a/h2_ssl_proxy_cache.t b/h2_ssl_proxy_cache.t
--- a/h2_ssl_proxy_cache.t
+++ b/h2_ssl_proxy_cache.t
@@ -42,9 +42,11 @@ http {
     proxy_cache_path   %%TESTDIR%%/cache  keys_zone=NAME:1m;
 
     server {
-        listen       127.0.0.1:8080 http2 ssl sndbuf=32k;
+        listen       127.0.0.1:8080 ssl sndbuf=32k;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -88,9 +90,7 @@ foreach my $name ('localhost') {
 $t->write_file('tbig.html',
 	join('', map { sprintf "XX%06dXX", $_ } (1 .. 500000)));
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 plan(skip_all => 'no ALPN negotiation') unless defined getconn(port(8080));
 $t->plan(1);
diff --git a/h2_ssl_proxy_protocol.t b/h2_ssl_proxy_protocol.t
--- a/h2_ssl_proxy_protocol.t
+++ b/h2_ssl_proxy_protocol.t
@@ -42,9 +42,11 @@ http {
     %%TEST_GLOBALS_HTTP%%
 
     server {
-        listen       127.0.0.1:8080 proxy_protocol http2 ssl;
+        listen       127.0.0.1:8080 proxy_protocol ssl;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -79,9 +81,7 @@ foreach my $name ('localhost') {
 
 $t->write_file('t.html', 'SEE-THIS');
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 ###############################################################################
 
diff --git a/h2_ssl_variables.t b/h2_ssl_variables.t
--- a/h2_ssl_variables.t
+++ b/h2_ssl_variables.t
@@ -39,9 +39,11 @@ http {
     %%TEST_GLOBALS_HTTP%%
 
     server {
-        listen       127.0.0.1:8080 http2 ssl;
+        listen       127.0.0.1:8080 ssl;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -80,9 +82,7 @@ foreach my $name ('localhost') {
 		or die "Can't create certificate for $name: $!\n";
 }
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 ###############################################################################
 


From mdounin at mdounin.ru  Fri Aug  9 20:37:29 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Fri, 09 Aug 2024 23:37:29 +0300
Subject: [PATCH 5 of 5] Tests: adjusted proxy_cache_use_stale.t cache validity
In-Reply-To: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
References: <d329b05e20faf1fa7235.1723235845@vm-bsd.mdounin.ru>
Message-ID: <15f538440a7734a57353.1723235849@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1723217845 -10800
#      Fri Aug 09 18:37:25 2024 +0300
# Node ID 15f538440a7734a57353054f2f2e33808f8a1174
# Parent  6b3b31149551efb88fa863901563932c19679db2
Tests: adjusted proxy_cache_use_stale.t cache validity.

At least the "s-w-r - updating stale" test sometimes fails on slow
hosts due to "stale-while-revalidate=4" being not enough, so the request
returns with the EXPIRED cache status instead of STALE.

Fix is to use larger "stale-while-revalidate=" times where it is not
significant.

diff --git a/proxy_cache_use_stale.t b/proxy_cache_use_stale.t
--- a/proxy_cache_use_stale.t
+++ b/proxy_cache_use_stale.t
@@ -163,9 +163,9 @@ like(http_get('/t2.html'), qr/HIT/, 's-w
 
 get('/tt.html', 'max-age=1, stale-if-error=3');
 get('/t3.html', 'max-age=1, stale-while-revalidate=2');
-get('/t4.html', 'max-age=1, stale-while-revalidate=3');
-get('/t5.html', 'max-age=1, stale-while-revalidate=3');
-get('/t6.html', 'max-age=1, stale-while-revalidate=4');
+get('/t4.html', 'max-age=1, stale-while-revalidate=10');
+get('/t5.html', 'max-age=1, stale-while-revalidate=10');
+get('/t6.html', 'max-age=1, stale-while-revalidate=10');
 get('/t7.html', 'max-age=1, stale-while-revalidate=10');
 http_get('/ssi.html');
 get('/updating/t.html', 'max-age=1');


From mdounin at mdounin.ru  Mon Aug 12 03:36:59 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:36:59 +0300
Subject: [nginx] Configure: added latest Sun C version.
Message-ID: <hg.d2b87352e5a7.1723433819.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/d2b87352e5a7
branches:  
changeset: 9308:d2b87352e5a7
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:21 2024 +0300
description:
Configure: added latest Sun C version.

diffstat:

 auto/cc/sunc |  1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diffs (11 lines):

diff --git a/auto/cc/sunc b/auto/cc/sunc
--- a/auto/cc/sunc
+++ b/auto/cc/sunc
@@ -12,6 +12,7 @@
 # Sun C 5.12 SunOS_i386 2011/11/16        Oracle Solaris Studio 12.3
 # Sun C 5.13 SunOS_i386 2014/10/20        Oracle Solaris Studio 12.4
 # Sun C 5.14 SunOS_i386 2016/05/31        Oracle Developer Studio 12.5
+# Sun C 5.15 SunOS_i386 2017/05/30        Oracle Developer Studio 12.6
 
 NGX_SUNC_VER=`$CC -V 2>&1 | grep 'Sun C' 2>&1 \
                           | sed -e 's/^.* Sun C \(.*\)/\1/'`

From mdounin at mdounin.ru  Mon Aug 12 03:36:59 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:36:59 +0300
Subject: [nginx] Configure: adjusted optimization level for Sun C.
Message-ID: <hg.92e14ce71b72.1723433819.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/92e14ce71b72
branches:  
changeset: 9309:92e14ce71b72
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:23 2024 +0300
description:
Configure: adjusted optimization level for Sun C.

With "-fast" (and with "-xbuiltin=%all -xO4"), Sun C miscompiles
ngx_http_script_add_copy_code(), which is inlined into
ngx_http_script_compile().  From the assembly code it looks like
the code uses uninitialized register when calculating new p value
after memcpy:

movq %r15,%rdi
call _memcpy
leaq (%r15,rbx),%rax
movq (%r12),%rbx
movb $0x0000000000000000,(%rax)

Note that %rax is set to (%r15 + %rbx), but %rbx is only set after
it is used.  As such, "*p = '\0'" tries to modify an unrelated memory
address, leading to a segmentation fault.

The issue was seen in tests which use null-terminated complex values:
proxy_ssl_certificate_vars.t, uwsgi_ssl_certificate_vars.t,
stream_proxy_ssl_certificate_vars.t.  Tested with Sun C compilers
from Sun Studio 12.3, 12.4, 12.5, and 12.6.

Restructuring code, such as splitting ngx_cpymem() with a separate
"p += value->len" increment, fixes things, but it is not clear if its
the only place where such miscompilation can happen.

Fix is to use "-fast -xO3".  Since IPO requires "-xO5", it is commented
out.

diffstat:

 auto/cc/sunc |  8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diffs (23 lines):

diff --git a/auto/cc/sunc b/auto/cc/sunc
--- a/auto/cc/sunc
+++ b/auto/cc/sunc
@@ -73,14 +73,16 @@ MODULE_LINK="-G"
 # 20736 == 0x5100, Sun Studio 12.1
 
 if [ "$ngx_sunc_ver" -ge 20736 ]; then
-    ngx_fast="-fast"
+    ngx_fast="-fast -xO3"
 
 else
     # older versions had problems with bit-fields
-    ngx_fast="-fast -xalias_level=any"
+    ngx_fast="-fast -xO3 -xalias_level=any"
 fi
 
-IPO=-xipo
+IPO=
+#IPO=-xipo
+
 CFLAGS="$CFLAGS $ngx_fast $IPO"
 CORE_LINK="$CORE_LINK $ngx_fast $IPO"
 

From mdounin at mdounin.ru  Mon Aug 12 03:37:04 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:04 +0300
Subject: [nginx] Core: changed ngx_buf_tag_t to uintptr_t.
Message-ID: <hg.ebebc1d68046.1723433824.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/ebebc1d68046
branches:  
changeset: 9310:ebebc1d68046
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:26 2024 +0300
description:
Core: changed ngx_buf_tag_t to uintptr_t.

There is no real difference, but "void *" as previously used results
in "ISO C forbids conversion of function pointer to object pointer type"
warnings with -Wpedantic when a function pointer is used as a tag.

Changing the type to uintptr_t makes the conversion always valid, since
any pointer type can be converted to an integer type.

diffstat:

 src/core/ngx_buf.h |  2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diffs (12 lines):

diff --git a/src/core/ngx_buf.h b/src/core/ngx_buf.h
--- a/src/core/ngx_buf.h
+++ b/src/core/ngx_buf.h
@@ -13,7 +13,7 @@
 #include <ngx_core.h>
 
 
-typedef void *            ngx_buf_tag_t;
+typedef uintptr_t         ngx_buf_tag_t;
 
 typedef struct ngx_buf_s  ngx_buf_t;
 

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Events: fixed warnings with -Wpedantic in epoll notify.
Message-ID: <hg.0ad3dde83947.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/0ad3dde83947
branches:  
changeset: 9311:0ad3dde83947
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:31 2024 +0300
description:
Events: fixed warnings with -Wpedantic in epoll notify.

Added casts through uintptr_t to suppress "ISO C forbids assignment
between function pointer and 'void *'" warnings as seen with -Wpedantic
in ngx_epoll_notify() and ngx_epoll_notify_handler().

Additionally, it resolves "assignment type mismatch" warnings as seen
with Sun Studio on Linux, "pointer to function... "=" pointer to void"
and "pointer to void "=" pointer to function...".

diffstat:

 src/event/modules/ngx_epoll_module.c |  4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diffs (21 lines):

diff --git a/src/event/modules/ngx_epoll_module.c b/src/event/modules/ngx_epoll_module.c
--- a/src/event/modules/ngx_epoll_module.c
+++ b/src/event/modules/ngx_epoll_module.c
@@ -452,7 +452,7 @@ ngx_epoll_notify_handler(ngx_event_t *ev
         }
     }
 
-    handler = ev->data;
+    handler = (ngx_event_handler_pt) (uintptr_t) ev->data;
     handler(ev);
 }
 
@@ -766,7 +766,7 @@ ngx_epoll_notify(ngx_event_handler_pt ha
 {
     static uint64_t inc = 1;
 
-    notify_event.data = handler;
+    notify_event.data = (void *) (uintptr_t) handler;
 
     if ((size_t) write(notify_fd, &inc, sizeof(uint64_t)) != sizeof(uint64_t)) {
         ngx_log_error(NGX_LOG_ALERT, notify_event.log, ngx_errno,

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Changed script length code casts to work with -Wpedantic.
Message-ID: <hg.098019656024.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/098019656024
branches:  
changeset: 9312:098019656024
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:38 2024 +0300
description:
Changed script length code casts to work with -Wpedantic.

Script length code casts though "void *", as introduced in
7271:9e25a5380a21 to silence -Wcast-function-type warnings, result
in "ISO C forbids conversion of function pointer to object pointer type"
warnings with -Wpedantic.  Fix is to cast though uintptr_t instead.

diffstat:

 src/http/modules/ngx_http_fastcgi_module.c |  4 ++--
 src/http/modules/ngx_http_grpc_module.c    |  2 +-
 src/http/modules/ngx_http_proxy_module.c   |  2 +-
 src/http/modules/ngx_http_scgi_module.c    |  4 ++--
 src/http/modules/ngx_http_uwsgi_module.c   |  4 ++--
 src/http/ngx_http_script.c                 |  8 ++++----
 src/stream/ngx_stream_script.c             |  8 ++++----
 7 files changed, 16 insertions(+), 16 deletions(-)

diffs (165 lines):

diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c
--- a/src/http/modules/ngx_http_fastcgi_module.c
+++ b/src/http/modules/ngx_http_fastcgi_module.c
@@ -3436,7 +3436,7 @@ ngx_http_fastcgi_init_params(ngx_conf_t 
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
@@ -3446,7 +3446,7 @@ ngx_http_fastcgi_init_params(ngx_conf_t 
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].skip_empty;
 
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
--- a/src/http/modules/ngx_http_grpc_module.c
+++ b/src/http/modules/ngx_http_grpc_module.c
@@ -4677,7 +4677,7 @@ ngx_http_grpc_init_headers(ngx_conf_t *c
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
--- a/src/http/modules/ngx_http_proxy_module.c
+++ b/src/http/modules/ngx_http_proxy_module.c
@@ -4047,7 +4047,7 @@ ngx_http_proxy_init_headers(ngx_conf_t *
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c
--- a/src/http/modules/ngx_http_scgi_module.c
+++ b/src/http/modules/ngx_http_scgi_module.c
@@ -1820,7 +1820,7 @@ ngx_http_scgi_init_params(ngx_conf_t *cf
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len + 1;
 
@@ -1830,7 +1830,7 @@ ngx_http_scgi_init_params(ngx_conf_t *cf
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].skip_empty;
 
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
--- a/src/http/modules/ngx_http_uwsgi_module.c
+++ b/src/http/modules/ngx_http_uwsgi_module.c
@@ -2118,7 +2118,7 @@ ngx_http_uwsgi_init_params(ngx_conf_t *c
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].key.len;
 
@@ -2128,7 +2128,7 @@ ngx_http_uwsgi_init_params(ngx_conf_t *c
             return NGX_ERROR;
         }
 
-        copy->code = (ngx_http_script_code_pt) (void *)
+        copy->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
         copy->len = src[i].skip_empty;
 
diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -822,7 +822,7 @@ ngx_http_script_add_copy_code(ngx_http_s
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                                  ngx_http_script_copy_len_code;
     code->len = len;
 
@@ -912,7 +912,7 @@ ngx_http_script_add_var_code(ngx_http_sc
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                              ngx_http_script_copy_var_len_code;
     code->index = (uintptr_t) index;
 
@@ -1308,7 +1308,7 @@ ngx_http_script_add_capture_code(ngx_htt
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                          ngx_http_script_copy_capture_len_code;
     code->n = 2 * n;
 
@@ -1423,7 +1423,7 @@ ngx_http_script_add_full_name_code(ngx_h
         return NGX_ERROR;
     }
 
-    code->code = (ngx_http_script_code_pt) (void *)
+    code->code = (ngx_http_script_code_pt) (uintptr_t)
                                             ngx_http_script_full_name_len_code;
     code->conf_prefix = sc->conf_prefix;
 
diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c
--- a/src/stream/ngx_stream_script.c
+++ b/src/stream/ngx_stream_script.c
@@ -686,7 +686,7 @@ ngx_stream_script_add_copy_code(ngx_stre
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                                ngx_stream_script_copy_len_code;
     code->len = len;
 
@@ -777,7 +777,7 @@ ngx_stream_script_add_var_code(ngx_strea
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                            ngx_stream_script_copy_var_len_code;
     code->index = (uintptr_t) index;
 
@@ -867,7 +867,7 @@ ngx_stream_script_add_capture_code(ngx_s
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                        ngx_stream_script_copy_capture_len_code;
     code->n = 2 * n;
 
@@ -959,7 +959,7 @@ ngx_stream_script_add_full_name_code(ngx
         return NGX_ERROR;
     }
 
-    code->code = (ngx_stream_script_code_pt) (void *)
+    code->code = (ngx_stream_script_code_pt) (uintptr_t)
                                           ngx_stream_script_full_name_len_code;
     code->conf_prefix = sc->conf_prefix;
 

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Win32: building with Clang.
Message-ID: <hg.7c350e517168.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/7c350e517168
branches:  
changeset: 9313:7c350e517168
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:49 2024 +0300
description:
Win32: building with Clang.

diffstat:

 auto/os/win32 |  2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diffs (12 lines):

diff --git a/auto/os/win32 b/auto/os/win32
--- a/auto/os/win32
+++ b/auto/os/win32
@@ -18,7 +18,7 @@ ngx_binext=".exe"
 
 case "$NGX_CC_NAME" in
 
-    gcc)
+    gcc | clang)
         CORE_LIBS="$CORE_LIBS -ladvapi32 -lws2_32"
         MAIN_LINK="$MAIN_LINK -Wl,--export-all-symbols"
         MAIN_LINK="$MAIN_LINK -Wl,--out-implib=$NGX_OBJS/libnginx.a"

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Win32: improved MinGW/MinGW-w64 GCC checks.
Message-ID: <hg.32a5186a2705.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/32a5186a2705
branches:  
changeset: 9314:32a5186a2705
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:56:59 2024 +0300
description:
Win32: improved MinGW/MinGW-w64 GCC checks.

Previously, __GNUC__ was checked, which is now replaced with __MINGW32__
checks.  The difference is that __MINGW32__ is defined when using MinGW
(or MinGW-w64) header files regardless of the compiler being used.  And,
more importantly, it is not defined when Clang is being used (which
pretends to be GCC by default) with Windows SDK header files.

With this change, it is now possible to compile nginx with native Clang
on Windows.  This current requires --with-ld-opt="-lkernel32 -luser32"
though, since native Clang on Windows uses MSVC linker, which does
not link kernel32.lib and user32.lib automatically.

diffstat:

 src/os/win32/ngx_atomic.h       |  2 +-
 src/os/win32/ngx_win32_config.h |  6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diffs (42 lines):

diff --git a/src/os/win32/ngx_atomic.h b/src/os/win32/ngx_atomic.h
--- a/src/os/win32/ngx_atomic.h
+++ b/src/os/win32/ngx_atomic.h
@@ -21,7 +21,7 @@ typedef volatile ngx_atomic_uint_t  ngx_
 #define NGX_ATOMIC_T_LEN            (sizeof("-2147483648") - 1)
 
 
-#if defined( __WATCOMC__ ) || defined( __BORLANDC__ ) || defined(__GNUC__)    \
+#if defined( __WATCOMC__ ) || defined( __BORLANDC__ ) || defined(__MINGW32__) \
     || ( _MSC_VER >= 1300 )
 
 /* the new SDK headers */
diff --git a/src/os/win32/ngx_win32_config.h b/src/os/win32/ngx_win32_config.h
--- a/src/os/win32/ngx_win32_config.h
+++ b/src/os/win32/ngx_win32_config.h
@@ -47,7 +47,7 @@
 /* GCC MinGW-w64 supports _FILE_OFFSET_BITS */
 #define _FILE_OFFSET_BITS 64
 
-#elif defined __GNUC__
+#elif defined __MINGW32__
 
 /* GCC MinGW's stdio.h includes sys/types.h */
 #define _OFF_T_
@@ -58,7 +58,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdarg.h>
-#ifdef __GNUC__
+#ifdef __MINGW32__
 #include <stdint.h>
 #endif
 #include <ctype.h>
@@ -198,7 +198,7 @@ typedef unsigned int        ino_t;
 #endif
 
 
-#ifndef __GNUC__
+#ifndef __MINGW32__
 #ifdef _WIN64
 typedef __int64             ssize_t;
 #else

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Support for Clang with "-fgnuc-version=0".
Message-ID: <hg.d286426eab1a.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/d286426eab1a
branches:  
changeset: 9315:d286426eab1a
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:58:30 2024 +0300
description:
Support for Clang with "-fgnuc-version=0".

Previously, the code assumed that Clang pretends to be GCC and defines
the __GNUC__ macro, which might not be the case if the "-fgnuc-version=0"
flag is used.  Fix is to explicitly check for __clang__ as well.

In practice, with this change ngx_cpuinfo() is now available on Linux
with "-fgnuc-version=0".

diffstat:

 src/core/ngx_cpuinfo.c              |  3 ++-
 src/event/modules/ngx_iocp_module.c |  2 +-
 src/os/unix/ngx_atomic.h            |  6 +++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diffs (55 lines):

diff --git a/src/core/ngx_cpuinfo.c b/src/core/ngx_cpuinfo.c
--- a/src/core/ngx_cpuinfo.c
+++ b/src/core/ngx_cpuinfo.c
@@ -9,7 +9,8 @@
 #include <ngx_core.h>
 
 
-#if (( __i386__ || __amd64__ ) && ( __GNUC__ || __INTEL_COMPILER ))
+#if (( __i386__ || __amd64__ )                                                \
+    && ( __GNUC__ || __clang__ || __INTEL_COMPILER ))
 
 
 static ngx_inline void ngx_cpuid(uint32_t i, uint32_t *buf);
diff --git a/src/event/modules/ngx_iocp_module.c b/src/event/modules/ngx_iocp_module.c
--- a/src/event/modules/ngx_iocp_module.c
+++ b/src/event/modules/ngx_iocp_module.c
@@ -172,7 +172,7 @@ ngx_iocp_timer(void *data)
 #endif
     }
 
-#if defined(__WATCOMC__) || defined(__GNUC__)
+#if defined(__WATCOMC__) || defined(__GNUC__) || defined(__clang__)
     return 0;
 #endif
 }
diff --git a/src/os/unix/ngx_atomic.h b/src/os/unix/ngx_atomic.h
--- a/src/os/unix/ngx_atomic.h
+++ b/src/os/unix/ngx_atomic.h
@@ -153,7 +153,7 @@ ngx_cpu_pause(void);
 #define ngx_memory_barrier()        __asm (".volatile"); __asm (".nonvolatile")
 
 
-#else /* ( __GNUC__ || __INTEL_COMPILER ) */
+#else /* ( __GNUC__ || __clang__ || __INTEL_COMPILER ) */
 
 #define NGX_HAVE_ATOMIC_OPS  1
 
@@ -194,7 +194,7 @@ ngx_cpu_pause(void);
 #define ngx_memory_barrier()        __asm (".volatile"); __asm (".nonvolatile")
 
 
-#else /* ( __GNUC__ || __INTEL_COMPILER ) */
+#else /* ( __GNUC__ || __clang__ || __INTEL_COMPILER ) */
 
 #define NGX_HAVE_ATOMIC_OPS  1
 
@@ -229,7 +229,7 @@ typedef volatile ngx_atomic_uint_t  ngx_
 #include "ngx_sunpro_atomic_sparc64.h"
 
 
-#else /* ( __GNUC__ || __INTEL_COMPILER ) */
+#else /* ( __GNUC__ || __clang__ || __INTEL_COMPILER ) */
 
 #define NGX_HAVE_ATOMIC_OPS  1
 

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Win32: checking for system PCRE, zlib, and OpenSSL libs.
Message-ID: <hg.b40149d062cb.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/b40149d062cb
branches:  
changeset: 9316:b40149d062cb
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:58:50 2024 +0300
description:
Win32: checking for system PCRE, zlib, and OpenSSL libs.

Checking for system libs on Windows is beneficial when compiling in
MSYS2 environments with GCC or Clang, as most libraries are readily
available.

diffstat:

 auto/lib/openssl/conf |  153 ++++++++++++++++++++++++-------------------------
 auto/lib/pcre/conf    |    6 +-
 auto/lib/zlib/conf    |   30 ++++-----
 3 files changed, 91 insertions(+), 98 deletions(-)

diffs (245 lines):

diff --git a/auto/lib/openssl/conf b/auto/lib/openssl/conf
--- a/auto/lib/openssl/conf
+++ b/auto/lib/openssl/conf
@@ -55,96 +55,94 @@ if [ $OPENSSL != NONE ]; then
 
 else
 
-    if [ "$NGX_PLATFORM" != win32 ]; then
-
-        OPENSSL=NO
+    OPENSSL=NO
 
-        ngx_feature="OpenSSL library"
-        ngx_feature_name="NGX_OPENSSL"
-        ngx_feature_run=no
-        ngx_feature_incs="#include <openssl/ssl.h>"
-        ngx_feature_path=
-        ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL $NGX_LIBPTHREAD"
-        ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
-        . auto/feature
+    ngx_feature="OpenSSL library"
+    ngx_feature_name="NGX_OPENSSL"
+    ngx_feature_run=no
+    ngx_feature_incs="#include <openssl/ssl.h>"
+    ngx_feature_path=
+    ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL $NGX_LIBPTHREAD"
+    ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+    . auto/feature
 
-        if [ $ngx_found = no ]; then
+    if [ $ngx_found = no ]; then
+
+        # FreeBSD port
+
+        ngx_feature="OpenSSL library in /usr/local/"
+        ngx_feature_path="/usr/local/include"
 
-            # FreeBSD port
+        if [ $NGX_RPATH = YES ]; then
+            ngx_feature_libs="-R/usr/local/lib -L/usr/local/lib -lssl -lcrypto"
+        else
+            ngx_feature_libs="-L/usr/local/lib -lssl -lcrypto"
+        fi
 
-            ngx_feature="OpenSSL library in /usr/local/"
-            ngx_feature_path="/usr/local/include"
+        ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
+
+        . auto/feature
+    fi
 
-            if [ $NGX_RPATH = YES ]; then
-                ngx_feature_libs="-R/usr/local/lib -L/usr/local/lib -lssl -lcrypto"
-            else
-                ngx_feature_libs="-L/usr/local/lib -lssl -lcrypto"
-            fi
+    if [ $ngx_found = no ]; then
+
+        # NetBSD port
 
-            ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
+        ngx_feature="OpenSSL library in /usr/pkg/"
+        ngx_feature_path="/usr/pkg/include"
 
-            . auto/feature
+        if [ $NGX_RPATH = YES ]; then
+            ngx_feature_libs="-R/usr/pkg/lib -L/usr/pkg/lib -lssl -lcrypto"
+        else
+            ngx_feature_libs="-L/usr/pkg/lib -lssl -lcrypto"
         fi
 
-        if [ $ngx_found = no ]; then
+        ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
+
+        . auto/feature
+    fi
+
+    if [ $ngx_found = no ]; then
+
+        # MacPorts
 
-            # NetBSD port
+        ngx_feature="OpenSSL library in /opt/local/"
+        ngx_feature_path="/opt/local/include"
+
+        if [ $NGX_RPATH = YES ]; then
+            ngx_feature_libs="-R/opt/local/lib -L/opt/local/lib -lssl -lcrypto"
+        else
+            ngx_feature_libs="-L/opt/local/lib -lssl -lcrypto"
+        fi
+
+        ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
 
-            ngx_feature="OpenSSL library in /usr/pkg/"
-            ngx_feature_path="/usr/pkg/include"
+        . auto/feature
+    fi
+
+    if [ $ngx_found = yes ]; then
+        have=NGX_SSL . auto/have
+        CORE_INCS="$CORE_INCS $ngx_feature_path"
+        CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
+        OPENSSL=YES
+
+        if [ $USE_OPENSSL_QUIC = YES ]; then
 
-            if [ $NGX_RPATH = YES ]; then
-                ngx_feature_libs="-R/usr/pkg/lib -L/usr/pkg/lib -lssl -lcrypto"
-            else
-                ngx_feature_libs="-L/usr/pkg/lib -lssl -lcrypto"
+            ngx_feature="OpenSSL QUIC support"
+            ngx_feature_name="NGX_QUIC"
+            ngx_feature_test="SSL_set_quic_method(NULL, NULL)"
+            . auto/feature
+
+            if [ $ngx_found = no ]; then
+                have=NGX_QUIC_OPENSSL_COMPAT . auto/have
+
+                ngx_feature="OpenSSL QUIC compatibility"
+                ngx_feature_test="SSL_CTX_add_custom_ext(NULL, 0, 0,
+                                             NULL, NULL, NULL, NULL, NULL)"
+                . auto/feature
             fi
 
-            ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
-
-            . auto/feature
-        fi
-
-        if [ $ngx_found = no ]; then
-
-            # MacPorts
-
-            ngx_feature="OpenSSL library in /opt/local/"
-            ngx_feature_path="/opt/local/include"
-
-            if [ $NGX_RPATH = YES ]; then
-                ngx_feature_libs="-R/opt/local/lib -L/opt/local/lib -lssl -lcrypto"
-            else
-                ngx_feature_libs="-L/opt/local/lib -lssl -lcrypto"
-            fi
-
-            ngx_feature_libs="$ngx_feature_libs $NGX_LIBDL $NGX_LIBPTHREAD"
-
-            . auto/feature
-        fi
-
-        if [ $ngx_found = yes ]; then
-            have=NGX_SSL . auto/have
-            CORE_INCS="$CORE_INCS $ngx_feature_path"
-            CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
-            OPENSSL=YES
-
-            if [ $USE_OPENSSL_QUIC = YES ]; then
-
-                ngx_feature="OpenSSL QUIC support"
-                ngx_feature_name="NGX_QUIC"
-                ngx_feature_test="SSL_set_quic_method(NULL, NULL)"
-                . auto/feature
-
-                if [ $ngx_found = no ]; then
-                    have=NGX_QUIC_OPENSSL_COMPAT . auto/have
-
-                    ngx_feature="OpenSSL QUIC compatibility"
-                    ngx_feature_test="SSL_CTX_add_custom_ext(NULL, 0, 0,
-                                                 NULL, NULL, NULL, NULL, NULL)"
-                    . auto/feature
-                fi
-
-                if [ $ngx_found = no ]; then
+            if [ $ngx_found = no ]; then
 cat << END
 
 $0: error: certain modules require OpenSSL QUIC support.
@@ -153,8 +151,7 @@ QUIC support into the system, or build t
 statically from the source with nginx by using --with-openssl=<path> option.
 
 END
-                        exit 1
-                fi
+                exit 1
             fi
         fi
     fi
diff --git a/auto/lib/pcre/conf b/auto/lib/pcre/conf
--- a/auto/lib/pcre/conf
+++ b/auto/lib/pcre/conf
@@ -68,11 +68,9 @@ if [ $PCRE != NONE ]; then
 
 else
 
-    if [ "$NGX_PLATFORM" != win32 ]; then
-        PCRE=NO
-    fi
+    PCRE=NO
 
-    if [ $PCRE = NO -a $PCRE2 != DISABLED ]; then
+    if [ $PCRE2 != DISABLED ]; then
 
         ngx_feature="PCRE2 library"
         ngx_feature_name="NGX_PCRE2"
diff --git a/auto/lib/zlib/conf b/auto/lib/zlib/conf
--- a/auto/lib/zlib/conf
+++ b/auto/lib/zlib/conf
@@ -42,26 +42,24 @@ if [ $ZLIB != NONE ]; then
 
 else
 
-    if [ "$NGX_PLATFORM" != win32 ]; then
-        ZLIB=NO
+    ZLIB=NO
 
-        # FreeBSD, Solaris, Linux
+    # FreeBSD, Solaris, Linux
 
-        ngx_feature="zlib library"
-        ngx_feature_name="NGX_ZLIB"
-        ngx_feature_run=no
-        ngx_feature_incs="#include <zlib.h>"
-        ngx_feature_path=
-        ngx_feature_libs="-lz"
-        ngx_feature_test="z_stream z; deflate(&z, Z_NO_FLUSH)"
-        . auto/feature
+    ngx_feature="zlib library"
+    ngx_feature_name="NGX_ZLIB"
+    ngx_feature_run=no
+    ngx_feature_incs="#include <zlib.h>"
+    ngx_feature_path=
+    ngx_feature_libs="-lz"
+    ngx_feature_test="z_stream z; deflate(&z, Z_NO_FLUSH)"
+    . auto/feature
 
 
-        if [ $ngx_found = yes ]; then
-            CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
-            ZLIB=YES
-            ngx_found=no
-        fi
+    if [ $ngx_found = yes ]; then
+        CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
+        ZLIB=YES
+        ngx_found=no
     fi
 
     if [ $ZLIB != YES ]; then

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Win32: added modern MSVC versions.
Message-ID: <hg.314be1eba450.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/314be1eba450
branches:  
changeset: 9317:314be1eba450
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:59:01 2024 +0300
description:
Win32: added modern MSVC versions.

diffstat:

 auto/cc/msvc |  2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diffs (12 lines):

diff --git a/auto/cc/msvc b/auto/cc/msvc
--- a/auto/cc/msvc
+++ b/auto/cc/msvc
@@ -9,6 +9,8 @@
 # MSVC 2008 Express Edition (9.0)         cl 15.00
 # MSVC 2010 (10.0)                        cl 16.00
 # MSVC 2015 (14.0)                        cl 19.00
+# MSVC 2017 (16.9)                        cl 19.16
+# MSVC 2022 (17.10.1)                     cl 19.40
 
 
 NGX_MSVC_VER=`$NGX_WINE $CC 2>&1 | grep 'C/C++.* [0-9][0-9]*\.[0-9]' 2>&1 \

From mdounin at mdounin.ru  Mon Aug 12 03:37:05 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:05 +0300
Subject: [nginx] Updated PCRE2 used for win32 builds.
Message-ID: <hg.8149e6e3ea2a.1723433825.-3675280147348374716@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/8149e6e3ea2a
branches:  
changeset: 9318:8149e6e3ea2a
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Wed Aug 07 03:59:13 2024 +0300
description:
Updated PCRE2 used for win32 builds.

Note that PCRE2 10.40 and newer versions require C99 support, as it now
uses "for (int i = 0; ...)" constructs[1], and thus cannot be compiled
with MSVC 2010 and older versions anymore.

[1] https://github.com/PCRE2Project/pcre2/issues/163

diffstat:

 auto/lib/pcre/make |  3 ++-
 misc/GNUmakefile   |  2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diffs (25 lines):

diff --git a/auto/lib/pcre/make b/auto/lib/pcre/make
--- a/auto/lib/pcre/make
+++ b/auto/lib/pcre/make
@@ -36,7 +36,8 @@ if [ $PCRE_LIBRARY = PCRE2 ]; then
                        pcre2_valid_utf.c \
                        pcre2_xclass.c"
 
-        ngx_pcre_test="pcre2_convert.c \
+        ngx_pcre_test="pcre2_chkdint.c \
+                       pcre2_convert.c \
                        pcre2_extuni.c \
                        pcre2_find_bracket.c \
                        pcre2_script_run.c \
diff --git a/misc/GNUmakefile b/misc/GNUmakefile
--- a/misc/GNUmakefile
+++ b/misc/GNUmakefile
@@ -8,7 +8,7 @@ CC =		cl
 OBJS =		objs.msvc8
 OPENSSL =	openssl-3.0.14
 ZLIB =		zlib-1.3.1
-PCRE =		pcre2-10.39
+PCRE =		pcre2-10.44
 
 
 release: export

From mdounin at mdounin.ru  Mon Aug 12 03:37:27 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:27 +0300
Subject: [nginx-tests] Tests: fixed proxy_cache_age.t with older Perl ver...
Message-ID: <hg.d715aff0b61d.1723433847.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/d715aff0b61d
branches:  
changeset: 1992:d715aff0b61d
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Thu Aug 01 10:35:39 2024 +0300
description:
Tests: fixed proxy_cache_age.t with older Perl versions.

The test used regular expressions with "{,n}" quantifier with empty
lower bound, which is only available starting with Perl 5.34.0.  Further,
it used variable-length look-behind assertions, which are only available
starting with Perl 5.30.0 and emit experimental warning till Perl 5.36.0.

Fix is to rewrite regular expressions in question using "(?>pattern)"
instead (an independent subexpression), which is available since at least
Perl 5.005.

diffstat:

 proxy_cache_age.t |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (18 lines):

diff --git a/proxy_cache_age.t b/proxy_cache_age.t
--- a/proxy_cache_age.t
+++ b/proxy_cache_age.t
@@ -123,11 +123,11 @@ like(get('/ignore/noage'), qr/HIT/, 'noa
 
 sleep(2);
 
-like(http_get('/fresh'), qr/(?<!Age:.{,200})Age: 9[1-5](?!.*Age:)/ms,
+like(http_get('/fresh'), qr/^(?>.*?Age:) 9[1-5](?!.*Age:)/s,
 	'cached age updated');
-like(http_get('/stale'), qr/(?<!Age:.{,200})Age: 110(?!.*Age:)/ms,
+like(http_get('/stale'), qr/^(?>.*?Age:) 110(?!.*Age:)/s,
 	'not cached age preserved');
-like(http_get('/noage'), qr/(?<!Age:.{,200})Age: [1-5](?!.*Age:)/ms,
+like(http_get('/noage'), qr/^(?>.*?Age:) [1-5](?!.*Age:)/s,
 	'noage age added');
 
 like(http_get('/revalidate'), qr/REVALIDATED(?!.*Age:)/ms,

From mdounin at mdounin.ru  Mon Aug 12 03:37:27 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:27 +0300
Subject: [nginx-tests] Tests: fixed prerequisites for regular expressions...
Message-ID: <hg.6b1222de8286.1723433847.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/6b1222de8286
branches:  
changeset: 1993:6b1222de8286
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Thu Aug 01 10:37:20 2024 +0300
description:
Tests: fixed prerequisites for regular expressions in maps.

Regular expressions in maps are only recognized when nginx is compiled
with the PCRE library.  The simplest way to make sure it is the case
is to require the rewrite module, which cannot be compiled in without
the PCRE library.

diffstat:

 proxy_protocol2_tlv.t        |  2 +-
 stream_map.t                 |  2 +-
 stream_proxy_protocol2_tlv.t |  3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diffs (37 lines):

diff --git a/proxy_protocol2_tlv.t b/proxy_protocol2_tlv.t
--- a/proxy_protocol2_tlv.t
+++ b/proxy_protocol2_tlv.t
@@ -23,7 +23,7 @@ use Test::Nginx;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/http map/)->plan(14)
+my $t = Test::Nginx->new()->has(qw/http map rewrite/)->plan(14)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%
diff --git a/stream_map.t b/stream_map.t
--- a/stream_map.t
+++ b/stream_map.t
@@ -23,7 +23,7 @@ use Test::Nginx::Stream qw/ stream /;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/stream stream_return stream_map/)
+my $t = Test::Nginx->new()->has(qw/stream stream_return stream_map rewrite/)
 	->has(qw/http rewrite/);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
diff --git a/stream_proxy_protocol2_tlv.t b/stream_proxy_protocol2_tlv.t
--- a/stream_proxy_protocol2_tlv.t
+++ b/stream_proxy_protocol2_tlv.t
@@ -24,7 +24,8 @@ use Test::Nginx::Stream qw/ stream /;
 select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
-my $t = Test::Nginx->new()->has(qw/stream stream_return map/)->plan(14)
+my $t = Test::Nginx->new()
+	->has(qw/stream stream_return stream_map rewrite/)->plan(14)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%

From mdounin at mdounin.ru  Mon Aug 12 03:37:27 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:27 +0300
Subject: [nginx-tests] Tests: better binary path handling on Windows.
Message-ID: <hg.e9235c647f45.1723433847.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/e9235c647f45
branches:  
changeset: 1994:e9235c647f45
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 09 05:18:51 2024 +0300
description:
Tests: better binary path handling on Windows.

The ".exe" extension is no longer required, and testing is allowed if
it is omitted.

Additionally, forward slashes in the binary path are automatically replaced
with reverse slashes, since CMD cannot properly handle relative paths with
forward slashes, and such paths previously resulted in various issues,
including non-working $t->has() and $t->has_version().

In particular, with these changes the default binary path, which is
"../nginx/objs/nginx", works properly, and testing can be done without
any additional options.

diffstat:

 lib/Test/Nginx.pm |  4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diffs (15 lines):

diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm
--- a/lib/Test/Nginx.pm
+++ b/lib/Test/Nginx.pm
@@ -49,8 +49,10 @@ sub new {
 		or die "Can't create temp directory: $!\n";
 	$self->{_testdir} =~ s!\\!/!g if $^O eq 'MSWin32';
 
+	$NGINX =~ s!/!\\!g if $^O eq 'MSWin32';
+
 	Test::More::BAIL_OUT("no $NGINX binary found")
-		unless -x $NGINX;
+		unless -x $NGINX or ($^O eq 'MSWin32' and -x "$NGINX.exe");
 
 	return $self;
 }

From mdounin at mdounin.ru  Mon Aug 12 03:37:27 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:27 +0300
Subject: [nginx-tests] Tests: removed usage of "cat" and "grep" in tests.
Message-ID: <hg.d329b05e20fa.1723433847.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/d329b05e20fa
branches:  
changeset: 1995:d329b05e20fa
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 09 05:18:51 2024 +0300
description:
Tests: removed usage of "cat" and "grep" in tests.

Both "cat" and "grep" might not be available on Windows.  Instead,
$t->read_file() is used, as it is already used in other places.  To
simplify checking logs as previously done with "grep", $t->grep_file()
helper function is introduced.

diffstat:

 grpc_request_buffering.t |   2 +-
 h3_ssl_session_reuse.t   |   2 +-
 lib/Test/Nginx.pm        |  16 ++++++++++++----
 memcached_fake.t         |   2 +-
 post_action.t            |   2 +-
 proxy_cache_vary.t       |   2 +-
 proxy_keepalive.t        |   2 +-
 ssl.t                    |   2 +-
 ssl_ocsp.t               |   2 +-
 ssl_session_reuse.t      |   2 +-
 ssl_stapling.t           |   2 +-
 stream_resolver.t        |   2 +-
 12 files changed, 23 insertions(+), 15 deletions(-)

diffs (168 lines):

diff --git a/grpc_request_buffering.t b/grpc_request_buffering.t
--- a/grpc_request_buffering.t
+++ b/grpc_request_buffering.t
@@ -105,7 +105,7 @@ is(eval(join '+', map { $_->{length} } g
 is(eval(join '+', map { $_->{length} } grep { $_->{type} eq "DATA" } @$frames),
 	465, 'preserve_output - last body bytes');
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crits');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/h3_ssl_session_reuse.t b/h3_ssl_session_reuse.t
--- a/h3_ssl_session_reuse.t
+++ b/h3_ssl_session_reuse.t
@@ -151,7 +151,7 @@ is(test_reuse(8949), 0, 'cache off not r
 
 $t->stop();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/lib/Test/Nginx.pm b/lib/Test/Nginx.pm
--- a/lib/Test/Nginx.pm
+++ b/lib/Test/Nginx.pm
@@ -84,14 +84,12 @@ sub DESTROY {
 	}
 
 	if (Test::More->builder->expected_tests) {
-		my $errors = $self->read_file('error.log');
-		$errors = join "\n", $errors =~ /.+Sanitizer.+/gm;
+		my $errors = $self->grep_file('error.log', 'Sanitizer');
 		Test::More::is($errors, '', 'no sanitizer errors');
 	}
 
 	if (Test::More->builder->expected_tests && $ENV{TEST_NGINX_VALGRIND}) {
-		my $errors = $self->read_file('valgrind.log');
-		$errors = join "\n", $errors =~ /^==\d+== .+/gm;
+		my $errors = $self->grep_file('valgrind.log', /^==\d+== .+/m);
 		Test::More::is($errors, '', 'no valgrind errors');
 	}
 
@@ -633,6 +631,16 @@ sub read_file($) {
 	return $content;
 }
 
+sub grep_file($$) {
+	my ($self, $name, $regex) = @_;
+
+	my $lines = $self->read_file($name);
+
+	$regex = qr/.*\Q$regex\E.*/m if ref($regex) eq '';
+
+	return join "\n", $lines =~ /$regex/g;
+}
+
 sub write_file($$) {
 	my ($self, $name, $content) = @_;
 
diff --git a/memcached_fake.t b/memcached_fake.t
--- a/memcached_fake.t
+++ b/memcached_fake.t
@@ -69,7 +69,7 @@ like(http_get('/'), qr/SEE-THIS/, 'memca
 
 like(http_get('/ssi.html'), qr/SEE-THIS/, 'memcached ssi var');
 
-like(`grep -F '[error]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no errors');
+is($t->grep_file('error.log', '[error]'), '', 'no errors');
 
 ###############################################################################
 
diff --git a/post_action.t b/post_action.t
--- a/post_action.t
+++ b/post_action.t
@@ -76,6 +76,6 @@ unlike(http_get('/remote'), qr/HIDDEN/m,
 
 $t->stop();
 
-like(`cat ${\($t->testdir())}/access.log`, qr/post/, 'post action in logs');
+like($t->read_file('access.log'), qr/post/, 'post action in logs');
 
 ###############################################################################
diff --git a/proxy_cache_vary.t b/proxy_cache_vary.t
--- a/proxy_cache_vary.t
+++ b/proxy_cache_vary.t
@@ -293,7 +293,7 @@ like(get1('/cold?vary=x,y&xtra=1', 'x:2'
 
 $t->stop();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/proxy_keepalive.t b/proxy_keepalive.t
--- a/proxy_keepalive.t
+++ b/proxy_keepalive.t
@@ -208,7 +208,7 @@ like(http_get('/inmemory/closed2'), qr/2
 
 # check for errors, shouldn't be any
 
-like(`grep -F '[error]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no errors');
+is($t->grep_file('error.log', '[error]'), '', 'no errors');
 
 ###############################################################################
 
diff --git a/ssl.t b/ssl.t
--- a/ssl.t
+++ b/ssl.t
@@ -275,7 +275,7 @@ is(get_ssl_shutdown(8085), 1, 'ssl shutd
 like($t->read_file('ssl.log'), qr/^(TLS|SSL)v(\d|\.)+$/m,
 	'log ssl variable on lingering close');
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/ssl_ocsp.t b/ssl_ocsp.t
--- a/ssl_ocsp.t
+++ b/ssl_ocsp.t
@@ -409,7 +409,7 @@ like(get('root', port => 8447), qr/200 O
 
 # check for errors
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/ssl_session_reuse.t b/ssl_session_reuse.t
--- a/ssl_session_reuse.t
+++ b/ssl_session_reuse.t
@@ -195,7 +195,7 @@ is(test_reuse(8449), 0, 'cache off not r
 
 $t->stop();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 ###############################################################################
 
diff --git a/ssl_stapling.t b/ssl_stapling.t
--- a/ssl_stapling.t
+++ b/ssl_stapling.t
@@ -301,7 +301,7 @@ local $TODO = 'broken TLSv1.3 sigalgs in
 	&& !Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER")
 	&& test_tls13();
 
-like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
+is($t->grep_file('error.log', '[crit]'), '', 'no crit');
 
 }
 
diff --git a/stream_resolver.t b/stream_resolver.t
--- a/stream_resolver.t
+++ b/stream_resolver.t
@@ -107,7 +107,7 @@ ok(stream('127.0.0.1:' . port(8086))->re
 SKIP: {
 skip "relies on error log contents", 2 unless $ENV{TEST_NGINX_UNSAFE};
 
-my $log = `grep -F '[error]' ${\($t->testdir())}/error.log`;
+my $log = $t->grep_file('error.log', '[error]');
 like($log, qr/no port in upstream "a.example.com"/, 'log - no port');
 like($log, qr/nx.example.com could not be resolved/, 'log - not found');
 

From mdounin at mdounin.ru  Mon Aug 12 03:37:27 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:27 +0300
Subject: [nginx-tests] Tests: fixed mail_oauth.t to run with CPU cache li...
Message-ID: <hg.099c972fb42b.1723433847.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/099c972fb42b
branches:  
changeset: 1996:099c972fb42b
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 09 05:18:51 2024 +0300
description:
Tests: fixed mail_oauth.t to run with CPU cache line size 32.

diffstat:

 mail_oauth.t |  2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diffs (12 lines):

diff --git a/mail_oauth.t b/mail_oauth.t
--- a/mail_oauth.t
+++ b/mail_oauth.t
@@ -65,6 +65,8 @@ mail {
 http {
     %%TEST_GLOBALS_HTTP%%
 
+    map_hash_bucket_size 64;
+
     map $http_auth_protocol $proxy_port {
 	imap %%PORT_8144%%;
 	pop3 %%PORT_8111%%;

From mdounin at mdounin.ru  Mon Aug 12 03:37:28 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:28 +0300
Subject: [nginx-tests] Tests: removed remnants of NPN in tests.
Message-ID: <hg.d2d00eea7b3d.1723433848.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/d2d00eea7b3d
branches:  
changeset: 1997:d2d00eea7b3d
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 09 05:18:52 2024 +0300
description:
Tests: removed remnants of NPN in tests.

NPN support was removed in nginx 1.21.4 (7934:61abb35bb8cf).

diffstat:

 h2_ssl_proxy_cache.t    |  11 +-----
 h2_ssl_variables.t      |  85 +++---------------------------------------------
 lib/Test/Nginx/HTTP2.pm |   2 -
 3 files changed, 7 insertions(+), 91 deletions(-)

diffs (175 lines):

diff --git a/h2_ssl_proxy_cache.t b/h2_ssl_proxy_cache.t
--- a/h2_ssl_proxy_cache.t
+++ b/h2_ssl_proxy_cache.t
@@ -92,7 +92,7 @@ open OLDERR, ">&", \*STDERR; close STDER
 $t->run();
 open STDERR, ">&", \*OLDERR;
 
-plan(skip_all => 'no ALPN/NPN negotiation') unless defined getconn(port(8080));
+plan(skip_all => 'no ALPN negotiation') unless defined getconn(port(8080));
 $t->plan(1);
 
 ###############################################################################
@@ -129,15 +129,6 @@ sub getconn {
 			if $sock->alpn_selected();
 	};
 
-	return $s if defined $s;
-
-	eval {
-		my $sock = Test::Nginx::HTTP2::new_socket($port, SSL => 1,
-			npn => 'h2');
-		$s = Test::Nginx::HTTP2->new($port, socket => $sock)
-			if $sock->next_proto_negotiated();
-	};
-
 	return $s;
 }
 
diff --git a/h2_ssl_variables.t b/h2_ssl_variables.t
--- a/h2_ssl_variables.t
+++ b/h2_ssl_variables.t
@@ -24,7 +24,7 @@ select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
 my $t = Test::Nginx->new()->has(qw/http http_ssl http_v2 rewrite socket_ssl/)
-	->has_daemon('openssl')->plan(8);
+	->has_daemon('openssl')->plan(4);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
 
@@ -88,29 +88,13 @@ open STDERR, ">&", \*OLDERR;
 
 my ($s, $sid, $frames, $frame);
 
-my $has_npn = eval { Test::Nginx::HTTP2::new_socket(port(8080), SSL => 1,
-	npn => 'h2')->next_proto_negotiated() };
 my $has_alpn = eval { Test::Nginx::HTTP2::new_socket(port(8080), SSL => 1,
 	alpn => 'h2')->alpn_selected() };
 
-# SSL/TLS connection, NPN
-
 SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/h2' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
+skip 'OpenSSL ALPN support required', 4 unless $has_alpn;
 
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'h2', 'http variable - npn');
-
-}
-
-# SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# SSL/TLS connection
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/h2' });
@@ -119,26 +103,7 @@ skip 'OpenSSL ALPN support required', 1 
 ($frame) = grep { $_->{type} eq "DATA" } @$frames;
 is($frame->{data}, 'h2', 'http variable - alpn');
 
-}
-
-# $server_protocol - SSL/TLS connection, NPN
-
-SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/sp' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
-
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'HTTP/2.0', 'server_protocol variable - npn');
-
-}
-
-# $server_protocol - SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# $server_protocol
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/sp' });
@@ -147,26 +112,7 @@ skip 'OpenSSL ALPN support required', 1 
 ($frame) = grep { $_->{type} eq "DATA" } @$frames;
 is($frame->{data}, 'HTTP/2.0', 'server_protocol variable - alpn');
 
-}
-
-# $scheme - SSL/TLS connection, NPN
-
-SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/scheme' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
-
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'https', 'scheme variable - npn');
-
-}
-
-# $scheme - SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# $scheme
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/scheme' });
@@ -175,26 +121,7 @@ skip 'OpenSSL ALPN support required', 1 
 ($frame) = grep { $_->{type} eq "DATA" } @$frames;
 is($frame->{data}, 'https', 'scheme variable - alpn');
 
-}
-
-# $https - SSL/TLS connection, NPN
-
-SKIP: {
-skip 'OpenSSL NPN support required', 1 unless $has_npn;
-
-$s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, npn => 'h2');
-$sid = $s->new_stream({ path => '/https' });
-$frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
-
-($frame) = grep { $_->{type} eq "DATA" } @$frames;
-is($frame->{data}, 'on', 'https variable - npn');
-
-}
-
-# $https - SSL/TLS connection, ALPN
-
-SKIP: {
-skip 'OpenSSL ALPN support required', 1 unless $has_alpn;
+# $https
 
 $s = Test::Nginx::HTTP2->new(port(8080), SSL => 1, alpn => 'h2');
 $sid = $s->new_stream({ path => '/https' });
diff --git a/lib/Test/Nginx/HTTP2.pm b/lib/Test/Nginx/HTTP2.pm
--- a/lib/Test/Nginx/HTTP2.pm
+++ b/lib/Test/Nginx/HTTP2.pm
@@ -532,7 +532,6 @@ sub unpack_length {
 
 sub new_socket {
 	my ($port, %extra) = @_;
-	my $npn = $extra{'npn'};
 	my $alpn = $extra{'alpn'};
 	my $s;
 
@@ -550,7 +549,6 @@ sub new_socket {
 		IO::Socket::SSL->start_SSL($s,
 			SSL_version => 'SSLv23',
 			SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(),
-			SSL_npn_protocols => $npn ? [ $npn ] : undef,
 			SSL_alpn_protocols => $alpn ? [ $alpn ] : undef,
 			SSL_error_trap => sub { die $_[1] }
 		) if $extra{'SSL'};

From mdounin at mdounin.ru  Mon Aug 12 03:37:28 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:28 +0300
Subject: [nginx-tests] Tests: removed remnants of "listen ... http2" usage.
Message-ID: <hg.6b3b31149551.1723433848.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/6b3b31149551
branches:  
changeset: 1998:6b3b31149551
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 09 05:21:04 2024 +0300
description:
Tests: removed remnants of "listen ... http2" usage.

The only remaining test which uses "listen ... http2" is h2_http2.t
now, which is specifically to test that this form still works.

diffstat:

 h2_ssl.t                |  6 +++---
 h2_ssl_proxy_cache.t    |  6 +++---
 h2_ssl_proxy_protocol.t |  6 +++---
 h2_ssl_variables.t      |  6 +++---
 4 files changed, 12 insertions(+), 12 deletions(-)

diffs (104 lines):

diff --git a/h2_ssl.t b/h2_ssl.t
--- a/h2_ssl.t
+++ b/h2_ssl.t
@@ -41,9 +41,11 @@ http {
     %%TEST_GLOBALS_HTTP%%
 
     server {
-        listen       127.0.0.1:8080 http2 ssl;
+        listen       127.0.0.1:8080 ssl;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -77,9 +79,7 @@ foreach my $name ('localhost') {
 $t->write_file('tbig.html',
 	join('', map { sprintf "XX%06dXX", $_ } (1 .. 500000)));
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 plan(skip_all => 'no ALPN negotiation') unless defined getconn();
 $t->plan(4);
diff --git a/h2_ssl_proxy_cache.t b/h2_ssl_proxy_cache.t
--- a/h2_ssl_proxy_cache.t
+++ b/h2_ssl_proxy_cache.t
@@ -42,9 +42,11 @@ http {
     proxy_cache_path   %%TESTDIR%%/cache  keys_zone=NAME:1m;
 
     server {
-        listen       127.0.0.1:8080 http2 ssl sndbuf=32k;
+        listen       127.0.0.1:8080 ssl sndbuf=32k;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -88,9 +90,7 @@ foreach my $name ('localhost') {
 $t->write_file('tbig.html',
 	join('', map { sprintf "XX%06dXX", $_ } (1 .. 500000)));
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 plan(skip_all => 'no ALPN negotiation') unless defined getconn(port(8080));
 $t->plan(1);
diff --git a/h2_ssl_proxy_protocol.t b/h2_ssl_proxy_protocol.t
--- a/h2_ssl_proxy_protocol.t
+++ b/h2_ssl_proxy_protocol.t
@@ -42,9 +42,11 @@ http {
     %%TEST_GLOBALS_HTTP%%
 
     server {
-        listen       127.0.0.1:8080 proxy_protocol http2 ssl;
+        listen       127.0.0.1:8080 proxy_protocol ssl;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -79,9 +81,7 @@ foreach my $name ('localhost') {
 
 $t->write_file('t.html', 'SEE-THIS');
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 ###############################################################################
 
diff --git a/h2_ssl_variables.t b/h2_ssl_variables.t
--- a/h2_ssl_variables.t
+++ b/h2_ssl_variables.t
@@ -39,9 +39,11 @@ http {
     %%TEST_GLOBALS_HTTP%%
 
     server {
-        listen       127.0.0.1:8080 http2 ssl;
+        listen       127.0.0.1:8080 ssl;
         server_name  localhost;
 
+        http2 on;
+
         ssl_certificate_key localhost.key;
         ssl_certificate localhost.crt;
 
@@ -80,9 +82,7 @@ foreach my $name ('localhost') {
 		or die "Can't create certificate for $name: $!\n";
 }
 
-open OLDERR, ">&", \*STDERR; close STDERR;
 $t->run();
-open STDERR, ">&", \*OLDERR;
 
 ###############################################################################
 

From mdounin at mdounin.ru  Mon Aug 12 03:37:28 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 06:37:28 +0300
Subject: [nginx-tests] Tests: adjusted proxy_cache_use_stale.t cache vali...
Message-ID: <hg.15f538440a77.1723433848.-555673838107394535@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-tests/rev/15f538440a77
branches:  
changeset: 1999:15f538440a77
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Fri Aug 09 18:37:25 2024 +0300
description:
Tests: adjusted proxy_cache_use_stale.t cache validity.

At least the "s-w-r - updating stale" test sometimes fails on slow
hosts due to "stale-while-revalidate=4" being not enough, so the request
returns with the EXPIRED cache status instead of STALE.

Fix is to use larger "stale-while-revalidate=" times where it is not
significant.

diffstat:

 proxy_cache_use_stale.t |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (16 lines):

diff --git a/proxy_cache_use_stale.t b/proxy_cache_use_stale.t
--- a/proxy_cache_use_stale.t
+++ b/proxy_cache_use_stale.t
@@ -163,9 +163,9 @@ like(http_get('/t2.html'), qr/HIT/, 's-w
 
 get('/tt.html', 'max-age=1, stale-if-error=3');
 get('/t3.html', 'max-age=1, stale-while-revalidate=2');
-get('/t4.html', 'max-age=1, stale-while-revalidate=3');
-get('/t5.html', 'max-age=1, stale-while-revalidate=3');
-get('/t6.html', 'max-age=1, stale-while-revalidate=4');
+get('/t4.html', 'max-age=1, stale-while-revalidate=10');
+get('/t5.html', 'max-age=1, stale-while-revalidate=10');
+get('/t6.html', 'max-age=1, stale-while-revalidate=10');
 get('/t7.html', 'max-age=1, stale-while-revalidate=10');
 http_get('/ssi.html');
 get('/updating/t.html', 'max-age=1');

From mdounin at mdounin.ru  Mon Aug 12 04:48:46 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Mon, 12 Aug 2024 07:48:46 +0300
Subject: [PATCH] Removed $upstream_queue_time, missed in 3043:9eadb98ec770
Message-ID: <a52c1f1493bf940a2e03.1723438126@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1723438004 -10800
#      Mon Aug 12 07:46:44 2024 +0300
# Node ID a52c1f1493bf940a2e039f566587c9a5e7e2bb68
# Parent  ca4c8ac67c0ebb9d3c09f295b667d452ac709ede
Removed $upstream_queue_time, missed in 3043:9eadb98ec770.

diff --git a/xml/en/docs/http/ngx_http_upstream_module.xml b/xml/en/docs/http/ngx_http_upstream_module.xml
--- a/xml/en/docs/http/ngx_http_upstream_module.xml
+++ b/xml/en/docs/http/ngx_http_upstream_module.xml
@@ -10,7 +10,7 @@
 <module name="Module ngx_http_upstream_module"
         link="/en/docs/http/ngx_http_upstream_module.html"
         lang="en"
-        rev="91">
+        rev="92">
 
 <section id="summary">
 
@@ -637,16 +637,6 @@ as for the variables that start with the
 Only the header fields from the response of the last server are saved.
 </tag-desc>
 
-<tag-name id="var_upstream_queue_time"><var>$upstream_queue_time</var></tag-name>
-<tag-desc>
-keeps time the request spent in the upstream <link id="queue">queue</link>
-(1.13.9);
-the time is kept in seconds with millisecond resolution.
-Times of several responses
-are separated by commas and colons like addresses in the
-<link id="var_upstream_addr">$upstream_addr</link> variable.
-</tag-desc>
-
 <tag-name id="var_upstream_response_length"><var>$upstream_response_length</var>
 </tag-name>
 <tag-desc>
diff --git a/xml/ru/docs/http/ngx_http_upstream_module.xml b/xml/ru/docs/http/ngx_http_upstream_module.xml
--- a/xml/ru/docs/http/ngx_http_upstream_module.xml
+++ b/xml/ru/docs/http/ngx_http_upstream_module.xml
@@ -10,7 +10,7 @@
 <module name="?????? ngx_http_upstream_module"
         link="/ru/docs/http/ngx_http_upstream_module.html"
         lang="ru"
-        rev="91">
+        rev="92">
 
 <section id="summary">
 
@@ -646,16 +646,6 @@ server {
 ?????????? ???????.
 </tag-desc>
 
-<tag-name id="var_upstream_queue_time"><var>$upstream_queue_time</var></tag-name>
-<tag-desc>
-?????? ?????, ??????????? ???????? ? <link id="queue">???????</link>
-(1.13.9);
-????? ???????? ? ???????? ? ????????? ?? ???????????.
-??????? ?????????? ???????
-??????????? ???????? ? ??????????? ??????? ??????? ? ??????????
-<link id="var_upstream_addr">$upstream_addr</link>.
-</tag-desc>
-
 <tag-name id="var_upstream_response_length"><var>$upstream_response_length</var>
 </tag-name>
 <tag-desc>

From mdounin at mdounin.ru  Tue Aug 13 01:00:56 2024
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Tue, 13 Aug 2024 04:00:56 +0300
Subject: freenginx-1.27.3 changes draft
Message-ID: <ZrqwSFtmHdCsqDg_@mdounin.ru>

Hello!

Below are changes draft for freenginx 1.27.3.
Comments are welcome.


Changes with freenginx 1.27.3                                    13 Aug 2024

    *) Change: now the "Age" backend response header line is taken into
       account when caching.
       Thanks to Hiroaki Nakamura.

    *) Feature: the $upstream_cache_age variable.

    *) Change: during graceful shutdown of old worker processes keepalive
       connections are now closed only after timeout specified with the
       "lingering_timeout" directive expires.

    *) Feature: improvements in building on Windows.


????????? ? freenginx 1.27.3                                      13.08.2024

    *) ?????????: ?????? ??? ??????????? ??????????? ?????? "Age" ?????????
       ?????? ???????.
       ??????? Hiroaki Nakamura.

    *) ??????????: ?????????? $upstream_cache_age.

    *) ?????????: ??? ??????? ?????????? ?????? ??????? ?????????
       keepalive-?????????? ?????? ??????????? ?????? ????? ?????????
       ????????, ????????? ?????????? lingering_timeout.

    *) ??????????: ????????? ? ?????? ?? Windows.


-- 
Maxim Dounin
http://mdounin.ru/

From anthony.doeraene.dev at gmail.com  Tue Aug 13 09:37:02 2024
From: anthony.doeraene.dev at gmail.com (=?iso-8859-1?q?Anthony_Doeraene?=)
Date: Tue, 13 Aug 2024 11:37:02 +0200
Subject: [PATCH 0 of 4] Add Multipath TCP (MPTCP) support
Message-ID: <patchbomb.1723541822@localhost.localdomain>

Add Multipath TCP (MPTCP) support

Multipath TCP (MPTCP), standardized in RFC8684 [1], is a TCP extension
that enables a TCP connection to use different paths.

Multipath TCP has been used for several use cases. On smartphones, MPTCP
enables seamless handovers between cellular and Wi-Fi networks while
preserving Established connections. This use-case is what pushed Apple
to use MPTCP since 2013 in multiple applications [2]. On dual-stack
hosts, Multipath TCP enables the TCP connection to automatically use the
best performing path, either IPv4 or IPv6. If one path fails, MPTCP
automatically uses the other path.

The benefit from MPTCP, both the client and the server have to support
it. Multipath TCP is a backward-compatible TCP extension that is enabled
by default on recent Linux distributions (Debian, Ubuntu, Redhat, ...).
Multipath TCP is included in the Linux kernel since version 5.6 [3].
To use it on Linux, an application must explicitly enable it when
creating the socket. No need to change anything else in the application.

Even if MPTCP is supported by different OS, only Linux supports the
`IPPROTO_MPTCP` protocol, which is why this feature is currently
limited to Linux only.

This is a new version of the series sent by Maxime Dourov a few
months ago. He was no longer able to continue to look at that. I
hope I applied all comment sent by Maxim Dounin in [4].

ChangeLog:
    - v2:
      - Patch 1: 
        - no seamless fallback to the default protocol

      - Patch 2: 
        - Rename flag to multipath instead of mptcp as suggested.
        - Replace the check to include the multipath flag to use #ifdef
          IPPROTO_MPTCP, instead of #if NGX_LINUX, allowing any platform
          supporting MPTCP to enable this option
        - Delete redefinition of IPPROTO_MPTCP if not defined

      - Patch 3: 
        - Rename flag to multipath instead of mptcp as suggested.
        - Add missing check #ifdef IPPROTO_MPTCP, to ensure that MPTCP
          is supported
        - Delete redefinition of IPPROTO_MPTCP if not defined

      - Patch 4: 
        - Rename flag to multipath instead of mptcp as suggested.
        - Replace the check to include the multipath flag to use #ifdef
          IPPROTO_MPTCP, instead of #if NGX_LINUX, allowing any platform
          supporting MPTCP to enable this option
        - Delete redefinition of IPPROTO_MPTCP if not defined

Co-developed-by: Maxime Dourov <mux99 at live.be>

Link: https://www.rfc-editor.org/rfc/rfc8684.html [1]
Link: https://www.tessares.net/apples-mptcp-story-so-far/ [2]
Link: https://www.mptcp.dev [3]
Link: https://freenginx.org/pipermail/nginx-devel/2024-May/000300.html [4]


From anthony.doeraene.dev at gmail.com  Tue Aug 13 09:37:03 2024
From: anthony.doeraene.dev at gmail.com (=?iso-8859-1?q?Anthony_Doeraene?=)
Date: Tue, 13 Aug 2024 11:37:03 +0200
Subject: [PATCH 1 of 4] Core: added socket protocol
In-Reply-To: <patchbomb.1723541822@localhost.localdomain>
References: <patchbomb.1723541822@localhost.localdomain>
Message-ID: <b72362042b52f378e18f.1723541823@localhost.localdomain>

# HG changeset patch
# User Anthony Doeraene <anthony.doeraene.dev at gmail.com>
# Date 1723531815 -7200
#      Tue Aug 13 08:50:15 2024 +0200
# Node ID b72362042b52f378e18ff6d01ec533e447331214
# Parent  8149e6e3ea2aa3d7ef3861330e38a2f144e35c47
Core: added socket protocol

Multipath TCP (MPTCP), standardized in RFC8684 [1], is a TCP extension
that enables a TCP connection to use different paths.

Multipath TCP has been used for several use cases. On smartphones, MPTCP
enables seamless handovers between cellular and Wi-Fi networks while
preserving Established connections. This use-case is what pushed Apple
to use MPTCP since 2013 in multiple applications [2]. On dual-stack
hosts, Multipath TCP enables the TCP connection to automatically use the
best performing path, either IPv4 or IPv6. If one path fails, MPTCP
automatically uses the other path.

The benefit from MPTCP, both the client and the server have to support
it. Multipath TCP is a backward-compatible TCP extension that is enabled
by default on recent Linux distributions (Debian, Ubuntu, Redhat, ...).
Multipath TCP is included in the Linux kernel since version 5.6 [3].
To use it on Linux, an application must explicitly enable it when
creating the socket. No need to change anything else in the application.

Even if MPTCP is supported by different OS, only Linux supports the
`IPPROTO_MPTCP` protocol, which is why this feature is currently
limited to Linux only.

This patch updates the creation of listening sockets to use a new field
of the `ngx_listening_s` structure. The `protocol` field can be used in
conjunction with the `type` to specify the protocol to be used.

Modules will then be able to specify a different protocol, e.g.
IPPROTO_MPTCP.

Co-developed-by: Maxime Dourov <mux99 at live.be>

Link: https://www.rfc-editor.org/rfc/rfc8684.html [1]
Link: https://www.tessares.net/apples-mptcp-story-so-far/ [2]
Link: https://www.mptcp.dev [3]

diff -r 8149e6e3ea2a -r b72362042b52 src/core/ngx_connection.c
--- a/src/core/ngx_connection.c	Wed Aug 07 03:59:13 2024 +0300
+++ b/src/core/ngx_connection.c	Tue Aug 13 08:50:15 2024 +0200
@@ -487,7 +487,8 @@
                 continue;
             }
 
-            s = ngx_socket(ls[i].sockaddr->sa_family, ls[i].type, 0);
+            s = ngx_socket(ls[i].sockaddr->sa_family, ls[i].type,
+                           ls[i].protocol);
 
             if (s == (ngx_socket_t) -1) {
                 ngx_log_error(NGX_LOG_EMERG, log, ngx_socket_errno,
diff -r 8149e6e3ea2a -r b72362042b52 src/core/ngx_connection.h
--- a/src/core/ngx_connection.h	Wed Aug 07 03:59:13 2024 +0300
+++ b/src/core/ngx_connection.h	Tue Aug 13 08:50:15 2024 +0200
@@ -24,6 +24,7 @@
     ngx_str_t           addr_text;
 
     int                 type;
+    int                 protocol;
 
     int                 backlog;
     int                 rcvbuf;


From anthony.doeraene.dev at gmail.com  Tue Aug 13 09:37:04 2024
From: anthony.doeraene.dev at gmail.com (=?iso-8859-1?q?Anthony_Doeraene?=)
Date: Tue, 13 Aug 2024 11:37:04 +0200
Subject: [PATCH 2 of 4] HTTP: added MPTCP support
In-Reply-To: <patchbomb.1723541822@localhost.localdomain>
References: <patchbomb.1723541822@localhost.localdomain>
Message-ID: <d5b3c722c6796f5b1638.1723541824@localhost.localdomain>

# HG changeset patch
# User Anthony Doeraene <anthony.doeraene.dev at gmail.com>
# Date 1723532143 -7200
#      Tue Aug 13 08:55:43 2024 +0200
# Node ID d5b3c722c6796f5b163821b9a8402457420ade4a
# Parent  b72362042b52f378e18ff6d01ec533e447331214
HTTP: added MPTCP support.

Multipath TCP (MPTCP), standardized in RFC8684 [1], is a TCP extension
that enables a TCP connection to use different paths.

Multipath TCP has been used for several use cases. On smartphones, MPTCP
enables seamless handovers between cellular and Wi-Fi networks while
preserving Established connections. This use-case is what pushed Apple
to use MPTCP since 2013 in multiple applications [2]. On dual-stack
hosts, Multipath TCP enables the TCP connection to automatically use the
best performing path, either IPv4 or IPv6. If one path fails, MPTCP
automatically uses the other path.

The benefit from MPTCP, both the client and the server have to support
it. Multipath TCP is a backward-compatible TCP extension that is enabled
by default on recent Linux distributions (Debian, Ubuntu, Redhat, ...).
Multipath TCP is included in the Linux kernel since version 5.6 [3].
To use it on Linux, an application must explicitly enable it when
creating the socket. No need to change anything else in the application.

Even if MPTCP is supported by different OS, only Linux supports the
`IPPROTO_MPTCP` protocol, which is why this feature is currently
limited to Linux only.

This patch adds a new parameter 'multipath' to the 'listen' directive
in the HTTP module. This new parameter is only compatible with TCP if
IPPROTO_MPTCP is defined, not with QUIC so far.

Co-developed-by: Maxime Dourov <mux99 at live.be>

Link: https://www.rfc-editor.org/rfc/rfc8684.html [1]
Link: https://www.tessares.net/apples-mptcp-story-so-far/ [2]
Link: https://www.mptcp.dev [3]

diff -r b72362042b52 -r d5b3c722c679 contrib/vim/syntax/nginx.vim
--- a/contrib/vim/syntax/nginx.vim	Tue Aug 13 08:50:15 2024 +0200
+++ b/contrib/vim/syntax/nginx.vim	Tue Aug 13 08:55:43 2024 +0200
@@ -65,7 +65,7 @@
     \ contained
     \ nextgroup=@ngxListenParams skipwhite skipempty
 syn keyword ngxListenOptions contained
-    \ default_server ssl quic proxy_protocol
+    \ default_server ssl quic proxy_protocol multipath
     \ setfib fastopen backlog rcvbuf sndbuf accept_filter deferred bind
     \ ipv6only reuseport so_keepalive
     \ nextgroup=@ngxListenParams skipwhite skipempty
diff -r b72362042b52 -r d5b3c722c679 src/http/ngx_http.c
--- a/src/http/ngx_http.c	Tue Aug 13 08:50:15 2024 +0200
+++ b/src/http/ngx_http.c	Tue Aug 13 08:55:43 2024 +0200
@@ -1845,6 +1845,7 @@
 #endif
 
     ls->type = addr->opt.type;
+    ls->protocol = addr->opt.protocol;
     ls->backlog = addr->opt.backlog;
     ls->rcvbuf = addr->opt.rcvbuf;
     ls->sndbuf = addr->opt.sndbuf;
diff -r b72362042b52 -r d5b3c722c679 src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c	Tue Aug 13 08:50:15 2024 +0200
+++ b/src/http/ngx_http_core_module.c	Tue Aug 13 08:55:43 2024 +0200
@@ -4062,6 +4062,13 @@
         }
 #endif
 
+#ifdef IPPROTO_MPTCP
+        if (ngx_strcmp(value[n].data, "multipath") == 0) {
+            lsopt.protocol = IPPROTO_MPTCP;
+            continue;
+        }
+#endif
+
         if (ngx_strncmp(value[n].data, "backlog=", 8) == 0) {
             lsopt.backlog = ngx_atoi(value[n].data + 8, value[n].len - 8);
             lsopt.set = 1;
@@ -4351,6 +4358,12 @@
         }
 #endif
 
+#ifdef IPPROTO_MPTCP
+        if (lsopt.protocol == IPPROTO_MPTCP) {
+             return "\"multipath\" parameter is incompatible with \"quic\"";
+        }
+#endif
+
 #if (NGX_HTTP_V2)
         if (lsopt.http2) {
             return "\"http2\" parameter is incompatible with \"quic\"";
diff -r b72362042b52 -r d5b3c722c679 src/http/ngx_http_core_module.h
--- a/src/http/ngx_http_core_module.h	Tue Aug 13 08:50:15 2024 +0200
+++ b/src/http/ngx_http_core_module.h	Tue Aug 13 08:55:43 2024 +0200
@@ -88,6 +88,7 @@
     int                        rcvbuf;
     int                        sndbuf;
     int                        type;
+    int                        protocol;
 #if (NGX_HAVE_SETFIB)
     int                        setfib;
 #endif


From anthony.doeraene.dev at gmail.com  Tue Aug 13 09:37:05 2024
From: anthony.doeraene.dev at gmail.com (=?iso-8859-1?q?Anthony_Doeraene?=)
Date: Tue, 13 Aug 2024 11:37:05 +0200
Subject: [PATCH 3 of 4] Mail: added MPTCP support
In-Reply-To: <patchbomb.1723541822@localhost.localdomain>
References: <patchbomb.1723541822@localhost.localdomain>
Message-ID: <19780d9b772a8b7192c2.1723541825@localhost.localdomain>

# HG changeset patch
# User Anthony Doeraene <anthony.doeraene.dev at gmail.com>
# Date 1723532381 -7200
#      Tue Aug 13 08:59:41 2024 +0200
# Node ID 19780d9b772a8b7192c20fc0fe7890dd381f0cce
# Parent  d5b3c722c6796f5b163821b9a8402457420ade4a
Mail: added MPTCP support.

Multipath TCP (MPTCP), standardized in RFC8684 [1], is a TCP extension
that enables a TCP connection to use different paths.

Multipath TCP has been used for several use cases. On smartphones, MPTCP
enables seamless handovers between cellular and Wi-Fi networks while
preserving Established connections. This use-case is what pushed Apple
to use MPTCP since 2013 in multiple applications [2]. On dual-stack
hosts, Multipath TCP enables the TCP connection to automatically use the
best performing path, either IPv4 or IPv6. If one path fails, MPTCP
automatically uses the other path.

The benefit from MPTCP, both the client and the server have to support
it. Multipath TCP is a backward-compatible TCP extension that is enabled
by default on recent Linux distributions (Debian, Ubuntu, Redhat, ...).
Multipath TCP is included in the Linux kernel since version 5.6 [3].
To use it on Linux, an application must explicitly enable it when
creating the socket. No need to change anything else in the application.

Even if MPTCP is supported by different OS, only Linux supports the
`IPPROTO_MPTCP` protocol, which is why this feature is currently
limited to Linux only.

This patch adds a new parameter 'multipath' to the 'listen' directive
in the Mail module.

Co-developed-by: Maxime Dourov <mux99 at live.be>

Link: https://www.rfc-editor.org/rfc/rfc8684.html [1]
Link: https://www.tessares.net/apples-mptcp-story-so-far/ [2]
Link: https://www.mptcp.dev [3]

diff -r d5b3c722c679 -r 19780d9b772a src/mail/ngx_mail.c
--- a/src/mail/ngx_mail.c	Tue Aug 13 08:55:43 2024 +0200
+++ b/src/mail/ngx_mail.c	Tue Aug 13 08:59:41 2024 +0200
@@ -332,6 +332,7 @@
             ls->log.data = &ls->addr_text;
             ls->log.handler = ngx_accept_log_error;
 
+            ls->protocol = addr[i].opt.protocol;
             ls->backlog = addr[i].opt.backlog;
             ls->rcvbuf = addr[i].opt.rcvbuf;
             ls->sndbuf = addr[i].opt.sndbuf;
diff -r d5b3c722c679 -r 19780d9b772a src/mail/ngx_mail.h
--- a/src/mail/ngx_mail.h	Tue Aug 13 08:55:43 2024 +0200
+++ b/src/mail/ngx_mail.h	Tue Aug 13 08:59:41 2024 +0200
@@ -47,6 +47,7 @@
     int                     tcp_keepintvl;
     int                     tcp_keepcnt;
 #endif
+    int                     protocol;
     int                     backlog;
     int                     rcvbuf;
     int                     sndbuf;
diff -r d5b3c722c679 -r 19780d9b772a src/mail/ngx_mail_core_module.c
--- a/src/mail/ngx_mail_core_module.c	Tue Aug 13 08:55:43 2024 +0200
+++ b/src/mail/ngx_mail_core_module.c	Tue Aug 13 08:59:41 2024 +0200
@@ -477,6 +477,13 @@
 #endif
         }
 
+#ifdef IPPROTO_MPTCP
+        if (ngx_strcmp(value[i].data, "multipath") == 0) {
+            ls->protocol = IPPROTO_MPTCP;
+            continue;
+        }
+#endif
+
         if (ngx_strncmp(value[i].data, "so_keepalive=", 13) == 0) {
 
             if (ngx_strcmp(&value[i].data[13], "on") == 0) {


From anthony.doeraene.dev at gmail.com  Tue Aug 13 09:37:06 2024
From: anthony.doeraene.dev at gmail.com (=?iso-8859-1?q?Anthony_Doeraene?=)
Date: Tue, 13 Aug 2024 11:37:06 +0200
Subject: [PATCH 4 of 4] Stream: added MPTCP support
In-Reply-To: <patchbomb.1723541822@localhost.localdomain>
References: <patchbomb.1723541822@localhost.localdomain>
Message-ID: <3bc05b0a87ba68fc4364.1723541826@localhost.localdomain>

# HG changeset patch
# User Anthony Doeraene <anthony.doeraene.dev at gmail.com>
# Date 1723532563 -7200
#      Tue Aug 13 09:02:43 2024 +0200
# Node ID 3bc05b0a87ba68fc436444294f7ec1529a13c10e
# Parent  19780d9b772a8b7192c20fc0fe7890dd381f0cce
Stream: added MPTCP support.

Multipath TCP (MPTCP), standardized in RFC8684 [1], is a TCP extension
that enables a TCP connection to use different paths.

Multipath TCP has been used for several use cases. On smartphones, MPTCP
enables seamless handovers between cellular and Wi-Fi networks while
preserving Established connections. This use-case is what pushed Apple
to use MPTCP since 2013 in multiple applications [2]. On dual-stack
hosts, Multipath TCP enables the TCP connection to automatically use the
best performing path, either IPv4 or IPv6. If one path fails, MPTCP
automatically uses the other path.

The benefit from MPTCP, both the client and the server have to support
it. Multipath TCP is a backward-compatible TCP extension that is enabled
by default on recent Linux distributions (Debian, Ubuntu, Redhat, ...).
Multipath TCP is included in the Linux kernel since version 5.6 [3].
To use it on Linux, an application must explicitly enable it when
creating the socket. No need to change anything else in the application.

Even if MPTCP is supported by different OS, only Linux supports the
`IPPROTO_MPTCP` protocol, which is why this feature is currently
limited to Linux only.

This patch adds a new parameter 'multipath' to the 'listen' directive
in the Stream module. This new parameter is only compatible with TCP if
IPPROTO_MPTCP is defined, not with QUIC so far.

Co-developed-by: Maxime Dourov <mux99 at live.be>

Link: https://www.rfc-editor.org/rfc/rfc8684.html [1]
Link: https://www.tessares.net/apples-mptcp-story-so-far/ [2]
Link: https://www.mptcp.dev [3]

diff -r 19780d9b772a -r 3bc05b0a87ba src/stream/ngx_stream.c
--- a/src/stream/ngx_stream.c	Tue Aug 13 08:59:41 2024 +0200
+++ b/src/stream/ngx_stream.c	Tue Aug 13 09:02:43 2024 +0200
@@ -486,6 +486,7 @@
             ls->handler = ngx_stream_init_connection;
             ls->pool_size = 256;
             ls->type = addr[i].opt.type;
+            ls->protocol = addr[i].opt.protocol;
 
             cscf = addr->opt.ctx->srv_conf[ngx_stream_core_module.ctx_index];
 
diff -r 19780d9b772a -r 3bc05b0a87ba src/stream/ngx_stream.h
--- a/src/stream/ngx_stream.h	Tue Aug 13 08:59:41 2024 +0200
+++ b/src/stream/ngx_stream.h	Tue Aug 13 09:02:43 2024 +0200
@@ -69,6 +69,7 @@
     int                            fastopen;
 #endif
     int                            type;
+    int                            protocol;
 } ngx_stream_listen_t;
 
 
diff -r 19780d9b772a -r 3bc05b0a87ba src/stream/ngx_stream_core_module.c
--- a/src/stream/ngx_stream_core_module.c	Tue Aug 13 08:59:41 2024 +0200
+++ b/src/stream/ngx_stream_core_module.c	Tue Aug 13 09:02:43 2024 +0200
@@ -654,6 +654,13 @@
         }
 #endif
 
+#ifdef IPPROTO_MPTCP
+        if (ngx_strcmp(value[i].data, "multipath") == 0) {
+            ls->protocol = IPPROTO_MPTCP;
+            continue;
+        }
+#endif
+
         if (ngx_strncmp(value[i].data, "backlog=", 8) == 0) {
             ls->backlog = ngx_atoi(value[i].data + 8, value[i].len - 8);
             ls->bind = 1;
@@ -886,6 +893,12 @@
 #endif
     }
 
+#ifdef IPPROTO_MPTCP
+        if (ls->protocol == IPPROTO_MPTCP) {
+             return "\"multipath\" parameter is incompatible with \"udp\"";
+        }
+#endif
+
     for (n = 0; n < u.naddrs; n++) {
 
         for (i = 0; i < n; i++) {


From mdounin at mdounin.ru  Tue Aug 13 14:48:12 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Tue, 13 Aug 2024 17:48:12 +0300
Subject: [nginx] freenginx-1.27.3-RELEASE
Message-ID: <hg.665f7a7675cf.1723560492.-5113970985393975657@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/665f7a7675cf
branches:  
changeset: 9319:665f7a7675cf
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Tue Aug 13 17:26:32 2024 +0300
description:
freenginx-1.27.3-RELEASE

diffstat:

 docs/xml/nginx/changes.xml |  49 ++++++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 49 insertions(+), 0 deletions(-)

diffs (59 lines):

diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml
--- a/docs/xml/nginx/changes.xml
+++ b/docs/xml/nginx/changes.xml
@@ -7,6 +7,55 @@
 <section title="freenginx">
 
 
+<changes ver="1.27.3" date="2024-08-13">
+
+<change type="change">
+<para lang="ru">
+?????? ??? ??????????? ???????????
+?????? "Age" ????????? ?????? ???????.<br/>
+??????? Hiroaki Nakamura.
+</para>
+<para lang="en">
+now the "Age" backend response header line
+is taken into account when caching.<br/>
+Thanks to Hiroaki Nakamura.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+?????????? $upstream_cache_age.
+</para>
+<para lang="en">
+the $upstream_cache_age variable.
+</para>
+</change>
+
+<change type="change">
+<para lang="ru">
+??? ??????? ?????????? ?????? ??????? ?????????
+keepalive-?????????? ?????? ???????????
+?????? ????? ????????? ????????, ????????? ?????????? lingering_timeout.
+</para>
+<para lang="en">
+during graceful shutdown of old worker processes
+keepalive connections are now closed
+only after timeout specified with the "lingering_timeout" directive expires.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+????????? ? ?????? ?? Windows.
+</para>
+<para lang="en">
+improvements in building on Windows.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.27.2" date="2024-07-09">
 
 <change type="feature">

From mdounin at mdounin.ru  Tue Aug 13 14:48:13 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Tue, 13 Aug 2024 17:48:13 +0300
Subject: [nginx] release-1.27.3 tag
Message-ID: <hg.cf73b65983c2.1723560493.-5113970985393975657@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/cf73b65983c2
branches:  
changeset: 9320:cf73b65983c2
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Tue Aug 13 17:26:33 2024 +0300
description:
release-1.27.3 tag

diffstat:

 .hgtags |  1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diffs (8 lines):

diff --git a/.hgtags b/.hgtags
--- a/.hgtags
+++ b/.hgtags
@@ -481,3 +481,4 @@ 2956b59565c91baa79d13d6411f2404614c0134e
 8c4e2b7de093d357b2f462399d6d395b899ffe76 release-1.27.0
 ee3eb2b9705f0c913a1bf4b9fe74def31411e8bf release-1.27.1
 91d77cc29d3336b1df25fe42d6c5ad4ca24b72b9 release-1.27.2
+665f7a7675cf4620c5d05cbcabdf72e6afe18b80 release-1.27.3

From mdounin at mdounin.ru  Tue Aug 13 14:48:30 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Tue, 13 Aug 2024 17:48:30 +0300
Subject: [nginx-site] Removed $upstream_queue_time, missed in 3043:9eadb9...
Message-ID: <hg.a52c1f1493bf.1723560510.-6865902460462981495@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-site/rev/a52c1f1493bf
branches:  
changeset: 3093:a52c1f1493bf
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Mon Aug 12 07:46:44 2024 +0300
description:
Removed $upstream_queue_time, missed in 3043:9eadb98ec770.

diffstat:

 xml/en/docs/http/ngx_http_upstream_module.xml |  12 +-----------
 xml/ru/docs/http/ngx_http_upstream_module.xml |  12 +-----------
 2 files changed, 2 insertions(+), 22 deletions(-)

diffs (58 lines):

diff --git a/xml/en/docs/http/ngx_http_upstream_module.xml b/xml/en/docs/http/ngx_http_upstream_module.xml
--- a/xml/en/docs/http/ngx_http_upstream_module.xml
+++ b/xml/en/docs/http/ngx_http_upstream_module.xml
@@ -10,7 +10,7 @@
 <module name="Module ngx_http_upstream_module"
         link="/en/docs/http/ngx_http_upstream_module.html"
         lang="en"
-        rev="91">
+        rev="92">
 
 <section id="summary">
 
@@ -637,16 +637,6 @@ as for the variables that start with the
 Only the header fields from the response of the last server are saved.
 </tag-desc>
 
-<tag-name id="var_upstream_queue_time"><var>$upstream_queue_time</var></tag-name>
-<tag-desc>
-keeps time the request spent in the upstream <link id="queue">queue</link>
-(1.13.9);
-the time is kept in seconds with millisecond resolution.
-Times of several responses
-are separated by commas and colons like addresses in the
-<link id="var_upstream_addr">$upstream_addr</link> variable.
-</tag-desc>
-
 <tag-name id="var_upstream_response_length"><var>$upstream_response_length</var>
 </tag-name>
 <tag-desc>
diff --git a/xml/ru/docs/http/ngx_http_upstream_module.xml b/xml/ru/docs/http/ngx_http_upstream_module.xml
--- a/xml/ru/docs/http/ngx_http_upstream_module.xml
+++ b/xml/ru/docs/http/ngx_http_upstream_module.xml
@@ -10,7 +10,7 @@
 <module name="?????? ngx_http_upstream_module"
         link="/ru/docs/http/ngx_http_upstream_module.html"
         lang="ru"
-        rev="91">
+        rev="92">
 
 <section id="summary">
 
@@ -646,16 +646,6 @@ server {
 ?????????? ???????.
 </tag-desc>
 
-<tag-name id="var_upstream_queue_time"><var>$upstream_queue_time</var></tag-name>
-<tag-desc>
-?????? ?????, ??????????? ???????? ? <link id="queue">???????</link>
-(1.13.9);
-????? ???????? ? ???????? ? ????????? ?? ???????????.
-??????? ?????????? ???????
-??????????? ???????? ? ??????????? ??????? ??????? ? ??????????
-<link id="var_upstream_addr">$upstream_addr</link>.
-</tag-desc>
-
 <tag-name id="var_upstream_response_length"><var>$upstream_response_length</var>
 </tag-name>
 <tag-desc>

From mdounin at mdounin.ru  Tue Aug 13 14:48:30 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Tue, 13 Aug 2024 17:48:30 +0300
Subject: [nginx-site] freenginx-1.27.3
Message-ID: <hg.f7e9bd7de0f9.1723560510.-6865902460462981495@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx-site/rev/f7e9bd7de0f9
branches:  
changeset: 3094:f7e9bd7de0f9
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Tue Aug 13 17:45:23 2024 +0300
description:
freenginx-1.27.3

diffstat:

 text/en/CHANGES    |  15 +++++++++++++++
 text/ru/CHANGES.ru |  15 +++++++++++++++
 xml/index.xml      |  13 +++++++++++++
 xml/versions.xml   |   1 +
 4 files changed, 44 insertions(+), 0 deletions(-)

diffs (80 lines):

diff --git a/text/en/CHANGES b/text/en/CHANGES
--- a/text/en/CHANGES
+++ b/text/en/CHANGES
@@ -1,4 +1,19 @@
 
+Changes with freenginx 1.27.3                                    13 Aug 2024
+
+    *) Change: now the "Age" backend response header line is taken into
+       account when caching.
+       Thanks to Hiroaki Nakamura.
+
+    *) Feature: the $upstream_cache_age variable.
+
+    *) Change: during graceful shutdown of old worker processes keepalive
+       connections are now closed only after timeout specified with the
+       "lingering_timeout" directive expires.
+
+    *) Feature: improvements in building on Windows.
+
+
 Changes with freenginx 1.27.2                                    09 Jul 2024
 
     *) Feature: now maximum error logging rate can be limited with the
diff --git a/text/ru/CHANGES.ru b/text/ru/CHANGES.ru
--- a/text/ru/CHANGES.ru
+++ b/text/ru/CHANGES.ru
@@ -1,4 +1,19 @@
 
+????????? ? freenginx 1.27.3                                      13.08.2024
+
+    *) ?????????: ?????? ??? ??????????? ??????????? ?????? "Age" ?????????
+       ?????? ???????.
+       ??????? Hiroaki Nakamura.
+
+    *) ??????????: ?????????? $upstream_cache_age.
+
+    *) ?????????: ??? ??????? ?????????? ?????? ??????? ?????????
+       keepalive-?????????? ?????? ??????????? ?????? ????? ?????????
+       ????????, ????????? ?????????? lingering_timeout.
+
+    *) ??????????: ????????? ? ?????? ?? Windows.
+
+
 ????????? ? freenginx 1.27.2                                      09.07.2024
 
     *) ??????????: ?????? ???????????? ??????? ????????????? ?????? ?????
diff --git a/xml/index.xml b/xml/index.xml
--- a/xml/index.xml
+++ b/xml/index.xml
@@ -8,6 +8,19 @@
 
 <news name="freenginx news" link="/" lang="en">
 
+<event date="2024-08-13">
+<para>
+<link doc="en/download.xml">freenginx-1.27.3</link>
+mainline version has been released,
+featuring
+improved handling of keepalive connections during graceful shutdown
+of old worker processes
+and
+<link doc="en/docs/http/ngx_http_proxy_module.xml" id="proxy_cache_valid">Age
+header</link> support in cache.
+</para>
+</event>
+
 <event date="2024-07-09">
 <para>
 <link doc="en/download.xml">freenginx-1.27.2</link>
diff --git a/xml/versions.xml b/xml/versions.xml
--- a/xml/versions.xml
+++ b/xml/versions.xml
@@ -9,6 +9,7 @@
 
 <download tag="mainline" changes="">
 
+<item ver="1.27.3" name="freenginx" />
 <item ver="1.27.2" name="freenginx" />
 <item ver="1.27.1" name="freenginx" />
 <item ver="1.27.0" name="freenginx" />

From mdounin at mdounin.ru  Tue Aug 20 02:18:03 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Tue, 20 Aug 2024 05:18:03 +0300
Subject: [PATCH] Mp4: added and updated sanity checks for "end" handling
Message-ID: <05355032b45dad2b2420.1724120283@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724120272 -10800
#      Tue Aug 20 05:17:52 2024 +0300
# Node ID 05355032b45dad2b2420592bb7dc77c0b05d1f4b
# Parent  cf73b65983c2d093f5b6651f8b45b9973a68e9f5
Mp4: added and updated sanity checks for "end" handling.

When handling incorrect data in ngx_http_mp4_crop_stsc_data(),
trak->end_chunk_samples might end up being arbitrary large, leading
to reading before the buffer in ngx_http_mp4_update_stsz_atom().  Fix
is to check that trak->end_chunk_samples corresponds to a memory within
the stsz atom data.  For consistency, trak->start_chunk_samples
is checked similarly.

Similarly, trak->end_chunk might end up being smaller than trak->start_chunk,
leading to reading memory after the buffer in ngx_http_mp4_update_stco_atom()
and ngx_http_mp4_update_co64_atom().  Corresponding checks are updated
to explicitly test (trak->end_chunk - trak->start_chunk) instead of just
checking trak->end_chunk and assuming it is larger than trak->start_chunk.

This is generally in line with existing checks of
(trak->end_sample - trak->start_sample) in ngx_http_mp4_update_stsz_atom(),
where trak->end_sample might also become smaller than trak->start_sample
when handling incorrect data in ngx_http_mp4_crop_stts_data().

diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -3419,6 +3419,13 @@ ngx_http_mp4_update_stsz_atom(ngx_http_m
         data->pos += trak->start_sample * sizeof(uint32_t);
         end = (uint32_t *) data->pos;
 
+        if (trak->start_chunk_samples > trak->start_sample) {
+            ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                          "too many mp4 start chunk samples in \"%s\"",
+                          mp4->file.name.data);
+            return NGX_ERROR;
+        }
+
         for (pos = end - trak->start_chunk_samples; pos < end; pos++) {
             trak->start_chunk_samples_size += ngx_mp4_get_32value(pos);
         }
@@ -3446,6 +3453,13 @@ ngx_http_mp4_update_stsz_atom(ngx_http_m
             data->last = data->pos + entries * sizeof(uint32_t);
             end = (uint32_t *) data->last;
 
+            if (trak->end_chunk_samples > entries) {
+                ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                              "too many mp4 end chunk samples in \"%s\"",
+                              mp4->file.name.data);
+                return NGX_ERROR;
+            }
+
             for (pos = end - trak->end_chunk_samples; pos < end; pos++) {
                 trak->end_chunk_samples_size += ngx_mp4_get_32value(pos);
             }
@@ -3612,7 +3626,9 @@ ngx_http_mp4_update_stco_atom(ngx_http_m
 
     if (mp4->length) {
 
-        if (trak->end_chunk > trak->chunks) {
+        if (trak->end_chunk - trak->start_chunk
+            > trak->chunks - trak->start_chunk)
+        {
             ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
                           "end time is out mp4 stco chunks in \"%s\"",
                           mp4->file.name.data);
@@ -3825,8 +3841,10 @@ ngx_http_mp4_update_co64_atom(ngx_http_m
 
     if (mp4->length) {
 
-        if (trak->end_chunk > trak->chunks) {
-            ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+        if (trak->end_chunk - trak->start_chunk
+            > trak->chunks - trak->start_chunk)
+        {
+            ngx_log_error(NGX_LOG_ALERT, mp4->file.log, 0,
                           "end time is out mp4 co64 chunks in \"%s\"",
                           mp4->file.name.data);
             return NGX_ERROR;


From barry.allard at gmail.com  Fri Aug 23 04:19:58 2024
From: barry.allard at gmail.com (=?iso-8859-1?q?skull-squadron?=)
Date: Thu, 22 Aug 2024 23:19:58 -0500
Subject: [PATCH] MP4 32-bit chunk size buffer overrun fix per the corporatists
 (CVE-2024-7347 2024-08-14)
Message-ID: <045b92ed3e5a79153363.1724386798@vahalla>

# HG changeset patch
# User skull-squadron <barry.allard at gmail.com>
# Date 1724385465 18000
#      Thu Aug 22 22:57:45 2024 -0500
# Node ID 045b92ed3e5a79153363cdae44278eb149fee6c2
# Parent  cf73b65983c2d093f5b6651f8b45b9973a68e9f5
MP4 32-bit chunk size buffer overrun fix per the corporatists (CVE-2024-7347 2024-08-14)

diff -r cf73b65983c2 -r 045b92ed3e5a src/http/modules/ngx_http_mp4_module.c
--- a/src/http/modules/ngx_http_mp4_module.c	Tue Aug 13 17:26:33 2024 +0300
+++ b/src/http/modules/ngx_http_mp4_module.c	Thu Aug 22 22:57:45 2024 -0500
@@ -3099,7 +3099,8 @@
 ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
     ngx_http_mp4_trak_t *trak, ngx_uint_t start)
 {
-    uint32_t               start_sample, chunk, samples, id, next_chunk, n,
+    uint64_t               n;
+    uint32_t               start_sample, chunk, samples, id, next_chunk,
                            prev_samples;
     ngx_buf_t             *data, *buf;
     ngx_uint_t             entries, target_chunk, chunk_samples;
@@ -3155,12 +3156,19 @@
 
         next_chunk = ngx_mp4_get_32value(entry->chunk);
 
+        if (next_chunk < chunk) {
+            ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                          "unordered mp4 stsc chunks in \"%s\"",
+                          mp4->file.name.data);
+            return NGX_ERROR;
+        }
+
         ngx_log_debug5(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
                        "sample:%uD, chunk:%uD, chunks:%uD, "
                        "samples:%uD, id:%uD",
                        start_sample, chunk, next_chunk - chunk, samples, id);
 
-        n = (next_chunk - chunk) * samples;
+        n = (uint64_t) (next_chunk - chunk) * samples;
 
         if (start_sample < n) {
             goto found;
@@ -3182,7 +3190,7 @@
                    "sample:%uD, chunk:%uD, chunks:%uD, samples:%uD",
                    start_sample, chunk, next_chunk - chunk, samples);
 
-    n = (next_chunk - chunk) * samples;
+    n = (uint64_t) (next_chunk - chunk) * samples;
 
     if (start_sample > n) {
         ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,


From mdounin at mdounin.ru  Fri Aug 23 23:49:03 2024
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Sat, 24 Aug 2024 02:49:03 +0300
Subject: [PATCH] MP4 32-bit chunk size buffer overrun fix per the
 corporatists (CVE-2024-7347 2024-08-14)
In-Reply-To: <045b92ed3e5a79153363.1724386798@vahalla>
References: <045b92ed3e5a79153363.1724386798@vahalla>
Message-ID: <Zskf77LwqEWHSjTO@mdounin.ru>

Hello!

On Thu, Aug 22, 2024 at 11:19:58PM -0500, skull-squadron wrote:

> # HG changeset patch
> # User skull-squadron <barry.allard at gmail.com>
> # Date 1724385465 18000
> #      Thu Aug 22 22:57:45 2024 -0500
> # Node ID 045b92ed3e5a79153363cdae44278eb149fee6c2
> # Parent  cf73b65983c2d093f5b6651f8b45b9973a68e9f5
> MP4 32-bit chunk size buffer overrun fix per the corporatists (CVE-2024-7347 2024-08-14)

[...]

I've recently posted a better patch, see here:

https://freenginx.org/pipermail/nginx-devel/2024-August/000474.html

Please take a look if it works for you.

As for the changes committed into F5 NGINX and the CVE assigned, 
here are some thoughts, in no particular order:

- There are two clearly distinct issues here.  If at all, CVE 
  numbers should be assigned to both of them.

- The real issues happen elsewhere.  And, following existing array 
  access sanity checks, it might be a better idea to actually 
  check the array element is within the array just before access, 
  and avoid any assumptions about mp4-derived data.  That is what 
  the patch referenced above does.

- While adding sanity checks in stsc atom handling might be 
  beneficial, they shouldn't be relied upon.  And there are other 
  similar places to consider, such as potential overflows during 
  stts atom handling, which can result in arbitrary 
  trak->start_sample and trak->end_sample values.  Similarly, there 
  are other data issues to consider as well, such as chunks with 
  zero samples per chunk in stsc atoms.

Hope this helps.


-- 
Maxim Dounin
http://mdounin.ru/

From barry.allard at gmail.com  Sat Aug 24 08:42:16 2024
From: barry.allard at gmail.com (Barry Allard)
Date: Sat, 24 Aug 2024 03:42:16 -0500
Subject: [PATCH] MP4 32-bit chunk size buffer overrun fix per the
 corporatists (CVE-2024-7347 2024-08-14)
In-Reply-To: <Zskf77LwqEWHSjTO@mdounin.ru>
References: <045b92ed3e5a79153363.1724386798@vahalla>
 <Zskf77LwqEWHSjTO@mdounin.ru>
Message-ID: <CABny8OCFq4jEn=QU92gty06FeMJM3De9YOtrUEHOUOjrzaTwFw@mail.gmail.com>

LGTM. Sanity testing untrusted input seems a deeper improvement than
just increasing the width of `n`.

It probably could use refactoring of absolute vs. relative position
variable names to increase semantic clarity, but naming things is
hard.

Thanks for your diligent maintenance.

From mdounin at mdounin.ru  Sun Aug 25 03:45:45 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sun, 25 Aug 2024 06:45:45 +0300
Subject: [nginx] Version bump.
Message-ID: <hg.bfbcfaec4c06.1724557545.6879067546762496480@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/bfbcfaec4c06
branches:  
changeset: 9321:bfbcfaec4c06
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sun Aug 25 06:35:30 2024 +0300
description:
Version bump.

diffstat:

 src/core/nginx.h |  4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diffs (14 lines):

diff --git a/src/core/nginx.h b/src/core/nginx.h
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -9,8 +9,8 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define nginx_version      1027003
-#define NGINX_VERSION      "1.27.3"
+#define nginx_version      1027004
+#define NGINX_VERSION      "1.27.4"
 
 #define NGINX_NAME         "freenginx"
 #define NGINX_VER          NGINX_NAME "/" NGINX_VERSION

From mdounin at mdounin.ru  Sun Aug 25 03:45:45 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sun, 25 Aug 2024 06:45:45 +0300
Subject: [nginx] Mp4: added and updated sanity checks for "end" handling.
Message-ID: <hg.d6f75dd66761.1724557545.6879067546762496480@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/d6f75dd66761
branches:  
changeset: 9322:d6f75dd66761
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sun Aug 25 06:35:40 2024 +0300
description:
Mp4: added and updated sanity checks for "end" handling.

When handling incorrect data in ngx_http_mp4_crop_stsc_data(),
trak->end_chunk_samples might end up being arbitrary large, leading
to reading before the buffer in ngx_http_mp4_update_stsz_atom().  Fix
is to check that trak->end_chunk_samples corresponds to a memory within
the stsz atom data.  For consistency, trak->start_chunk_samples
is checked similarly.

Similarly, trak->end_chunk might end up being smaller than trak->start_chunk,
leading to reading memory after the buffer in ngx_http_mp4_update_stco_atom()
and ngx_http_mp4_update_co64_atom().  Corresponding checks are updated
to explicitly test (trak->end_chunk - trak->start_chunk) instead of just
checking trak->end_chunk and assuming it is larger than trak->start_chunk.

This is generally in line with existing checks of
(trak->end_sample - trak->start_sample) in ngx_http_mp4_update_stsz_atom(),
where trak->end_sample might also become smaller than trak->start_sample
when handling incorrect data in ngx_http_mp4_crop_stts_data().

diffstat:

 src/http/modules/ngx_http_mp4_module.c |  24 +++++++++++++++++++++---
 1 files changed, 21 insertions(+), 3 deletions(-)

diffs (55 lines):

diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -3419,6 +3419,13 @@ ngx_http_mp4_update_stsz_atom(ngx_http_m
         data->pos += trak->start_sample * sizeof(uint32_t);
         end = (uint32_t *) data->pos;
 
+        if (trak->start_chunk_samples > trak->start_sample) {
+            ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                          "too many mp4 start chunk samples in \"%s\"",
+                          mp4->file.name.data);
+            return NGX_ERROR;
+        }
+
         for (pos = end - trak->start_chunk_samples; pos < end; pos++) {
             trak->start_chunk_samples_size += ngx_mp4_get_32value(pos);
         }
@@ -3446,6 +3453,13 @@ ngx_http_mp4_update_stsz_atom(ngx_http_m
             data->last = data->pos + entries * sizeof(uint32_t);
             end = (uint32_t *) data->last;
 
+            if (trak->end_chunk_samples > entries) {
+                ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                              "too many mp4 end chunk samples in \"%s\"",
+                              mp4->file.name.data);
+                return NGX_ERROR;
+            }
+
             for (pos = end - trak->end_chunk_samples; pos < end; pos++) {
                 trak->end_chunk_samples_size += ngx_mp4_get_32value(pos);
             }
@@ -3612,7 +3626,9 @@ ngx_http_mp4_update_stco_atom(ngx_http_m
 
     if (mp4->length) {
 
-        if (trak->end_chunk > trak->chunks) {
+        if (trak->end_chunk - trak->start_chunk
+            > trak->chunks - trak->start_chunk)
+        {
             ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
                           "end time is out mp4 stco chunks in \"%s\"",
                           mp4->file.name.data);
@@ -3825,8 +3841,10 @@ ngx_http_mp4_update_co64_atom(ngx_http_m
 
     if (mp4->length) {
 
-        if (trak->end_chunk > trak->chunks) {
-            ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+        if (trak->end_chunk - trak->start_chunk
+            > trak->chunks - trak->start_chunk)
+        {
+            ngx_log_error(NGX_LOG_ALERT, mp4->file.log, 0,
                           "end time is out mp4 co64 chunks in \"%s\"",
                           mp4->file.name.data);
             return NGX_ERROR;

From mdounin at mdounin.ru  Sun Aug 25 03:46:21 2024
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Sun, 25 Aug 2024 06:46:21 +0300
Subject: [PATCH] MP4 32-bit chunk size buffer overrun fix per the
 corporatists (CVE-2024-7347 2024-08-14)
In-Reply-To: <CABny8OCFq4jEn=QU92gty06FeMJM3De9YOtrUEHOUOjrzaTwFw@mail.gmail.com>
References: <045b92ed3e5a79153363.1724386798@vahalla>
 <Zskf77LwqEWHSjTO@mdounin.ru>
 <CABny8OCFq4jEn=QU92gty06FeMJM3De9YOtrUEHOUOjrzaTwFw@mail.gmail.com>
Message-ID: <ZsqpDXAo1lBydf86@mdounin.ru>

Hello!

On Sat, Aug 24, 2024 at 03:42:16AM -0500, Barry Allard wrote:

> LGTM. Sanity testing untrusted input seems a deeper improvement than
> just increasing the width of `n`.
> 
> It probably could use refactoring of absolute vs. relative position
> variable names to increase semantic clarity, but naming things is
> hard.
> 
> Thanks for your diligent maintenance.

Thanks for looking, committed.

-- 
Maxim Dounin
http://mdounin.ru/

From mdounin at mdounin.ru  Mon Aug 26 04:04:06 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Mon, 26 Aug 2024 07:04:06 +0300
Subject: [PATCH 1 of 2] SSL: removed OPENSSL_NO_SHA256 support
Message-ID: <2cf47b5869fe0261835a.1724645046@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724634078 -10800
#      Mon Aug 26 04:01:18 2024 +0300
# Node ID 2cf47b5869fe0261835a2f5a0afa5d8f3ae941f8
# Parent  d6f75dd66761c10d4bfb257ae70a212411b6a69b
SSL: removed OPENSSL_NO_SHA256 support.

In OpenSSL itself, support for builds without SHA256 was removed in
OpenSSL 1.1.0 and was already broken at that time (see
https://github.com/openssl/openssl/commit/474e469bbd for details).
In BoringSSL, support for OPENSSL_NO_SHA256 was removed in 2014.
In LibreSSL as of 3.9.2, some support it still present, but broken.

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4553,11 +4553,7 @@ ngx_ssl_ticket_key_callback(ngx_ssl_conn
         return -1;
     }
 
-#ifdef OPENSSL_NO_SHA256
-    digest = EVP_sha1();
-#else
     digest = EVP_sha256();
-#endif
 
     keys = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_ticket_keys_index);
     if (keys == NULL) {


From mdounin at mdounin.ru  Mon Aug 26 04:04:07 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Mon, 26 Aug 2024 07:04:07 +0300
Subject: [PATCH 2 of 2] SSL: added SHA-256 fingerprints
In-Reply-To: <2cf47b5869fe0261835a.1724645046@vm-bsd.mdounin.ru>
References: <2cf47b5869fe0261835a.1724645046@vm-bsd.mdounin.ru>
Message-ID: <d97a6d0b1a421a601c75.1724645047@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724634081 -10800
#      Mon Aug 26 04:01:21 2024 +0300
# Node ID d97a6d0b1a421a601c756738e68cc607de530755
# Parent  2cf47b5869fe0261835a2f5a0afa5d8f3ae941f8
SSL: added SHA-256 fingerprints.

In http and stream modules, the $ssl_client_fingerprint_sha256 variable
now provides client certificate SHA-256 fingerprint, in addition to the
$ssl_client_fingerprint variable with SHA-1 fingerprint.

In mail proxy, the "Auth-SSL-Fingerprint-SHA256" header was added.

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -5749,6 +5749,42 @@ ngx_ssl_get_fingerprint(ngx_connection_t
 
 
 ngx_int_t
+ngx_ssl_get_fingerprint_sha256(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s)
+{
+    X509          *cert;
+    unsigned int   len;
+    u_char         buf[EVP_MAX_MD_SIZE];
+
+    s->len = 0;
+
+    cert = SSL_get_peer_certificate(c->ssl->connection);
+    if (cert == NULL) {
+        return NGX_OK;
+    }
+
+    if (!X509_digest(cert, EVP_sha256(), buf, &len)) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_digest() failed");
+        X509_free(cert);
+        return NGX_ERROR;
+    }
+
+    s->len = 2 * len;
+    s->data = ngx_pnalloc(pool, 2 * len);
+    if (s->data == NULL) {
+        X509_free(cert);
+        return NGX_ERROR;
+    }
+
+    ngx_hex_dump(s->data, buf, len);
+
+    X509_free(cert);
+
+    return NGX_OK;
+}
+
+
+ngx_int_t
 ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 {
     X509        *cert;
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -299,6 +299,8 @@ ngx_int_t ngx_ssl_get_serial_number(ngx_
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_fingerprint(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
+ngx_int_t ngx_ssl_get_fingerprint_sha256(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s);
 ngx_int_t ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_client_v_start(ngx_connection_t *c, ngx_pool_t *pool,
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -387,6 +387,9 @@ static ngx_http_variable_t  ngx_http_ssl
     { ngx_string("ssl_client_fingerprint"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_fingerprint, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_client_fingerprint_sha256"), NULL, ngx_http_ssl_variable,
+      (uintptr_t) ngx_ssl_get_fingerprint_sha256, NGX_HTTP_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c
--- a/src/mail/ngx_mail_auth_http_module.c
+++ b/src/mail/ngx_mail_auth_http_module.c
@@ -1213,7 +1213,8 @@ ngx_mail_auth_http_create_request(ngx_ma
     ngx_connection_t          *c;
 #if (NGX_MAIL_SSL)
     ngx_str_t                  protocol, cipher, verify, subject, issuer,
-                               serial, fingerprint, raw_cert, cert;
+                               serial, fingerprint, fingerprint2, raw_cert,
+                               cert;
     ngx_mail_ssl_conf_t       *sslcf;
 #endif
     ngx_mail_core_srv_conf_t  *cscf;
@@ -1275,6 +1276,10 @@ ngx_mail_auth_http_create_request(ngx_ma
             return NULL;
         }
 
+        if (ngx_ssl_get_fingerprint_sha256(c, pool, &fingerprint2) != NGX_OK) {
+            return NULL;
+        }
+
         if (ahcf->pass_client_cert) {
 
             /* certificate itself, if configured */
@@ -1297,6 +1302,7 @@ ngx_mail_auth_http_create_request(ngx_ma
         ngx_str_null(&issuer);
         ngx_str_null(&serial);
         ngx_str_null(&fingerprint);
+        ngx_str_null(&fingerprint2);
         ngx_str_null(&cert);
     }
 
@@ -1360,6 +1366,8 @@ ngx_mail_auth_http_create_request(ngx_ma
                      + sizeof(CRLF) - 1
                + sizeof("Auth-SSL-Fingerprint: ") - 1 + fingerprint.len
                      + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Fingerprint-SHA256: ") - 1 + fingerprint2.len
+                     + sizeof(CRLF) - 1
                + sizeof("Auth-SSL-Cert: ") - 1 + cert.len
                      + sizeof(CRLF) - 1;
     }
@@ -1520,6 +1528,13 @@ ngx_mail_auth_http_create_request(ngx_ma
             *b->last++ = CR; *b->last++ = LF;
         }
 
+        if (fingerprint2.len) {
+            b->last = ngx_cpymem(b->last, "Auth-SSL-Fingerprint-SHA256: ",
+                                 sizeof("Auth-SSL-Fingerprint-SHA256: ") - 1);
+            b->last = ngx_copy(b->last, fingerprint2.data, fingerprint2.len);
+            *b->last++ = CR; *b->last++ = LF;
+        }
+
         if (cert.len) {
             b->last = ngx_cpymem(b->last, "Auth-SSL-Cert: ",
                                  sizeof("Auth-SSL-Cert: ") - 1);
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
--- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c
@@ -310,6 +310,10 @@ static ngx_stream_variable_t  ngx_stream
     { ngx_string("ssl_client_fingerprint"), NULL, ngx_stream_ssl_variable,
       (uintptr_t) ngx_ssl_get_fingerprint, NGX_STREAM_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_client_fingerprint_sha256"), NULL,
+      ngx_stream_ssl_variable, (uintptr_t) ngx_ssl_get_fingerprint_sha256,
+      NGX_STREAM_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_client_verify"), NULL, ngx_stream_ssl_variable,
       (uintptr_t) ngx_ssl_get_client_verify, NGX_STREAM_VAR_CHANGEABLE, 0 },
 


From mdounin at mdounin.ru  Mon Aug 26 04:04:54 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Mon, 26 Aug 2024 07:04:54 +0300
Subject: [PATCH] Usage of ngx_explicit_memzero() in internal md5 and sha1
Message-ID: <ba7ab7de66704ef8d13e.1724645094@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724645076 -10800
#      Mon Aug 26 07:04:36 2024 +0300
# Node ID ba7ab7de66704ef8d13e7841a50e0e9f945fed5f
# Parent  d97a6d0b1a421a601c756738e68cc607de530755
Usage of ngx_explicit_memzero() in internal md5 and sha1.

The goal of the context cleanup in ngx_md5_final() and ngx_sha1_final()
is to clear potentially sensitive data, so ngx_explicit_memzero() is
appropriate.

diff --git a/src/core/ngx_md5.c b/src/core/ngx_md5.c
--- a/src/core/ngx_md5.c
+++ b/src/core/ngx_md5.c
@@ -107,7 +107,7 @@ ngx_md5_final(u_char result[16], ngx_md5
     result[14] = (u_char) (ctx->d >> 16);
     result[15] = (u_char) (ctx->d >> 24);
 
-    ngx_memzero(ctx, sizeof(*ctx));
+    ngx_explicit_memzero(ctx, sizeof(*ctx));
 }
 
 
diff --git a/src/core/ngx_sha1.c b/src/core/ngx_sha1.c
--- a/src/core/ngx_sha1.c
+++ b/src/core/ngx_sha1.c
@@ -113,7 +113,7 @@ ngx_sha1_final(u_char result[20], ngx_sh
     result[18] = (u_char) (ctx->e >> 8);
     result[19] = (u_char) ctx->e;
 
-    ngx_memzero(ctx, sizeof(*ctx));
+    ngx_explicit_memzero(ctx, sizeof(*ctx));
 }
 
 


From jiri.setnicka at cdn77.com  Mon Aug 26 10:14:48 2024
From: jiri.setnicka at cdn77.com (=?UTF-8?B?SmnFmcOtIFNldG5pxI1rYQ==?=)
Date: Mon, 26 Aug 2024 12:14:48 +0200
Subject: [nginx] Request body: body is now cleared on errors.
In-Reply-To: <hg.81082b5521dd.1714233407.-8139659618229015162@ns3.mdounin.ru>
References: <hg.81082b5521dd.1714233407.-8139659618229015162@ns3.mdounin.ru>
Message-ID: <e4ebaf1a-a6b2-4b54-8f9c-9f219565fc0a@cdn77.com>

Hello,

I believe that I encountered segfault caused by this change:
> details:   http://freenginx.org/hg/nginx/rev/81082b5521dd
> branches:
> changeset: 9259:81082b5521dd
> user:      Maxim Dounin <mdounin at mdounin.ru>
> date:      Sat Apr 27 18:21:38 2024 +0300
> description:
> Request body: body is now cleared on errors.
>
> Previously, after errors the request body was left in a potentially
> inconsistent state, with r->headers_in.content_length_n which might be
> larger than buffers actually stored in r->request_body->bufs (or not
> set at all, in case of HTTP/2 and HTTP/3).  This can cause issues if
> the request body is subsequently used during error_page handling, such
> as when proxying.
>
> Fix is to clear r->request_body->bufs if this happens, and set
> r->headers_in.content_length_n to 0, much like it happens when
> ngx_http_discard_request_body() is called when returning 413 from
> ngx_http_core_find_config_phase() for requests with Content-Length.
>
> ...
>
> diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
> --- a/src/http/ngx_http_request_body.c
> +++ b/src/http/ngx_http_request_body.c
> @@ -228,6 +228,11 @@ done:
>       }
>   
>       if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
> +
> +        r->lingering_close = 1;
> +        r->headers_in.content_length_n = 0;
> +        r->request_body->bufs = NULL;
> +
>           r->main->count--;
>           r->read_event_handler = ngx_http_block_reading;
>       }

The r->request_body may not be set here. It could happen at the top of 
the ngx_http_read_client_request_body function, when either 
ngx_http_test_expect or ngx_pcalloc fails and the goto done is executed 
before setting r->request_body.

I encountered this with clients that sends Expect: 100-continue but 
immediately closes the connection.

The fix should be straightforward, just to check for existence of the 
r->request_body.

Sincerely
Ji?? Setni?ka


From mdounin at mdounin.ru  Mon Aug 26 15:45:18 2024
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Mon, 26 Aug 2024 18:45:18 +0300
Subject: [nginx] Request body: body is now cleared on errors.
In-Reply-To: <e4ebaf1a-a6b2-4b54-8f9c-9f219565fc0a@cdn77.com>
References: <hg.81082b5521dd.1714233407.-8139659618229015162@ns3.mdounin.ru>
 <e4ebaf1a-a6b2-4b54-8f9c-9f219565fc0a@cdn77.com>
Message-ID: <ZsyjDrnFlU0TVhVl@mdounin.ru>

Hello!

On Mon, Aug 26, 2024 at 12:14:48PM +0200, Ji?? Setni?ka via nginx-devel wrote:

> Hello,
> 
> I believe that I encountered segfault caused by this change:
> > details:   http://freenginx.org/hg/nginx/rev/81082b5521dd
> > branches:
> > changeset: 9259:81082b5521dd
> > user:      Maxim Dounin <mdounin at mdounin.ru>
> > date:      Sat Apr 27 18:21:38 2024 +0300
> > description:
> > Request body: body is now cleared on errors.
> > 
> > Previously, after errors the request body was left in a potentially
> > inconsistent state, with r->headers_in.content_length_n which might be
> > larger than buffers actually stored in r->request_body->bufs (or not
> > set at all, in case of HTTP/2 and HTTP/3).  This can cause issues if
> > the request body is subsequently used during error_page handling, such
> > as when proxying.
> > 
> > Fix is to clear r->request_body->bufs if this happens, and set
> > r->headers_in.content_length_n to 0, much like it happens when
> > ngx_http_discard_request_body() is called when returning 413 from
> > ngx_http_core_find_config_phase() for requests with Content-Length.
> > 
> > ...
> > 
> > diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
> > --- a/src/http/ngx_http_request_body.c
> > +++ b/src/http/ngx_http_request_body.c
> > @@ -228,6 +228,11 @@ done:
> >       }
> >       if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
> > +
> > +        r->lingering_close = 1;
> > +        r->headers_in.content_length_n = 0;
> > +        r->request_body->bufs = NULL;
> > +
> >           r->main->count--;
> >           r->read_event_handler = ngx_http_block_reading;
> >       }
> 
> The r->request_body may not be set here. It could happen at the top of the
> ngx_http_read_client_request_body function, when either ngx_http_test_expect
> or ngx_pcalloc fails and the goto done is executed before setting
> r->request_body.
> 
> I encountered this with clients that sends Expect: 100-continue but
> immediately closes the connection.
> 
> The fix should be straightforward, just to check for existence of the
> r->request_body.

Thanks for reporting this.

Indeed, clearly there is a bug (and I'm able to reproduce it with 
"Expect: 100-continue").

Here is a fix:

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724686663 -10800
#      Mon Aug 26 18:37:43 2024 +0300
# Node ID a507fb4679a4578077d301c723855b5a6e54d4eb
# Parent  d6f75dd66761c10d4bfb257ae70a212411b6a69b
Request body: fixed segfault on early errors.

The r->request_body might not be initialized on error handling in
ngx_http_read_client_request_body(), notably if ngx_http_test_expect()
or ngx_pcalloc() fail.  After introduction of request body clearing
in 9259:81082b5521dd (1.27.0), this caused segmentation fault due to
NULL pointer dereference when clearing r->request_body->bufs.

Fix is to explicitly check if r->request_body is available before
clearing r->request_body->bufs.

Reported by Ji?? Setni?ka,
http://freenginx.org/pipermail/nginx-devel/2024-August/000484.html

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -245,7 +245,10 @@ done:
 
         r->lingering_close = 1;
         r->discard_body = 1;
-        r->request_body->bufs = NULL;
+
+        if (r->request_body) {
+            r->request_body->bufs = NULL;
+        }
 
         r->main->count--;
         r->read_event_handler = ngx_http_block_reading;

-- 
Maxim Dounin
http://mdounin.ru/

From andrea at pappacoda.it  Tue Aug 27 12:08:31 2024
From: andrea at pappacoda.it (Andrea Pappacoda)
Date: Tue, 27 Aug 2024 14:08:31 +0200
Subject: [PATCH] Add markdown to mime.types
In-Reply-To: <YUDW/0Q9mJBBLgfV@mdounin.ru>
Message-ID: <D3QOKOOURSVL.1VWMIPT6R60ZN@pappacoda.it>

Hi all!

This is in reply to a relatively old patch adding "text/markdown" to 
mime.types.

On Tue, 14 Sep 2021 20:08:15 +0300, Maxim Dounin wrote:
>Hello!
>
>On Thu, Sep 09, 2021 at 10:35:32PM -0400, Abe Massry wrote:
>
>> # HG changeset patch
>> # User Abe Massry <a at abemassry.com>
>> # Date 1631238770 14400
>> #      Thu Sep 09 21:52:50 2021 -0400
>> # Branch update-mime-types
>> # Node ID 95a61e228bc19f6b9917671dfd2e6ff52e3e0294
>> # Parent  a525013b82967148e6e4b7e0eadd23e288001816
>> Add markdown to mime.types
>>
>> In the chromimum browser a warning is displayed if a markdown
>> mime type does not appear in the list of mime types on the server.
>> The browser attempts to download the file but gives a warning
>> saying that this type of file is usually displayed in the
>> browser.
>>
>> Files with a mime type of markdown and a file extension of `.md`
>> should be displayed as plain text in the browser and this
>> change adds that to the default mime types that will ship with
>> nginx.
>>
>> diff -r a525013b8296 -r 95a61e228bc1 conf/mime.types
>> --- a/conf/mime.types	Tue Sep 07 18:21:03 2021 +0300
>> +++ b/conf/mime.types	Thu Sep 09 21:52:50 2021 -0400
>> @@ -9,6 +9,7 @@
>>      application/atom+xml                             atom;
>>      application/rss+xml                              rss;
>>
>> +    text/markdown                                    md;
>>      text/mathml                                      mml;
>>      text/plain                                       txt;
>>      text/vnd.sun.j2me.app-descriptor                 jad;
>>
>
>A side note: the "text/markdown" specification says that the charset 
>attribute is required, and this is not something nginx provides unless 
>the charset module is explicitly used.
>
>(see RFC 7763 and/or 
>https://www.iana.org/assignments/media-types/text/markdown)

While it is true that the IANA assignment says that the charset 
attribute is required, it does so because of RFC 6838. This RFC, in 
fact, specifies that *all* text/* MIME types "MUST" specify the charset, 
unless that information is already present in the file format itself, 
like required by XML.

Hence, in a way, (free)nginx is already going against RFC 6838 whenever 
sending any text/* MIME type, but it cannot really do in any other way- 
only the user can know the actual charset of a given file.

So in my opinion the markdown MIME type should be added, and it is up to 
the user to comply with RFC 6838. Maybe it'd make sense to mention that 
in the mime.types file.

What do you think?

Please CC me as I'm not subscribed to this list. Thanks!

Bye :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 256 bytes
Desc: not available
URL: <http://freenginx.org/pipermail/nginx-devel/attachments/20240827/7c83163f/attachment.sig>

From mdounin at mdounin.ru  Wed Aug 28 01:24:25 2024
From: mdounin at mdounin.ru (Maxim Dounin)
Date: Wed, 28 Aug 2024 04:24:25 +0300
Subject: [PATCH] Add markdown to mime.types
In-Reply-To: <D3QOKOOURSVL.1VWMIPT6R60ZN@pappacoda.it>
References: <YUDW/0Q9mJBBLgfV@mdounin.ru>
 <D3QOKOOURSVL.1VWMIPT6R60ZN@pappacoda.it>
Message-ID: <Zs58SaGhdquse9DG@mdounin.ru>

Hello!

On Tue, Aug 27, 2024 at 02:08:31PM +0200, Andrea Pappacoda wrote:

> Hi all!
> 
> This is in reply to a relatively old patch adding "text/markdown" to
> mime.types.
> 
> On Tue, 14 Sep 2021 20:08:15 +0300, Maxim Dounin wrote:
> > Hello!
> > 
> > On Thu, Sep 09, 2021 at 10:35:32PM -0400, Abe Massry wrote:
> > 
> > > # HG changeset patch
> > > # User Abe Massry <a at abemassry.com>
> > > # Date 1631238770 14400
> > > #      Thu Sep 09 21:52:50 2021 -0400
> > > # Branch update-mime-types
> > > # Node ID 95a61e228bc19f6b9917671dfd2e6ff52e3e0294
> > > # Parent  a525013b82967148e6e4b7e0eadd23e288001816
> > > Add markdown to mime.types
> > > 
> > > In the chromimum browser a warning is displayed if a markdown
> > > mime type does not appear in the list of mime types on the server.
> > > The browser attempts to download the file but gives a warning
> > > saying that this type of file is usually displayed in the
> > > browser.
> > > 
> > > Files with a mime type of markdown and a file extension of `.md`
> > > should be displayed as plain text in the browser and this
> > > change adds that to the default mime types that will ship with
> > > nginx.
> > > 
> > > diff -r a525013b8296 -r 95a61e228bc1 conf/mime.types
> > > --- a/conf/mime.types	Tue Sep 07 18:21:03 2021 +0300
> > > +++ b/conf/mime.types	Thu Sep 09 21:52:50 2021 -0400
> > > @@ -9,6 +9,7 @@
> > >      application/atom+xml                             atom;
> > >      application/rss+xml                              rss;
> > > 
> > > +    text/markdown                                    md;
> > >      text/mathml                                      mml;
> > >      text/plain                                       txt;
> > >      text/vnd.sun.j2me.app-descriptor                 jad;
> > > 
> > 
> > A side note: the "text/markdown" specification says that the charset
> > attribute is required, and this is not something nginx provides unless
> > the charset module is explicitly used.
> > 
> > (see RFC 7763 and/or
> > https://www.iana.org/assignments/media-types/text/markdown)
> 
> While it is true that the IANA assignment says that the charset
> attribute is required, it does so because of RFC 6838. This RFC, in
> fact, specifies that *all* text/* MIME types "MUST" specify the charset,
> unless that information is already present in the file format itself,
> like required by XML.

RFC 6838 says:

:    If a "charset" parameter is specified, it SHOULD be a required
:    parameter, eliminating the options of specifying a default value.  If
:    there is a strong reason for the parameter to be optional despite
:    this advice, each subtype MAY specify its own default value, or
:    alternatively, it MAY specify that there is no default value.
:    Finally, the "UTF-8" charset [RFC3629] SHOULD be selected as the
:    default.  See [RFC6657] for additional information on the use of
:    "charset" parameters in conjunction with subtypes of text.
:
:    Regardless of what approach is chosen, all new text/* registrations
:    MUST clearly specify how the charset is determined; relying on the
:    US-ASCII default defined in Section 4.1.2 of [RFC2046] is no longer
:    permitted.  If explanatory text is needed, this SHOULD be placed in
:    the additional information section of the registration.

That is, registrations "MUST clearly specify how the charset is 
determined", but the "charset" parameter is not a required 
parameter unless defined as such by a particular registration.

Further, these are requirements for new registrations.  Existing 
registrations already either define charset handling explicitly or 
rely on the US-ASCII default mentioned in the quote.

This is explained with more details in RFC 6657, which says:

:    Regardless of what approach is chosen, all new "text/*" registrations
:    MUST clearly specify how the charset is determined; relying on the
:    default defined in Section 4.1.2 of [RFC2046] is no longer permitted.
:    However, existing "text/*" registrations that fail to specify how the
:    charset is determined still default to US-ASCII.

And in particular about text/plain:

:    The default "charset" parameter value for "text/plain" is unchanged
:    from [RFC2046] and remains as "US-ASCII".

> Hence, in a way, (free)nginx is already going against RFC 6838 whenever
> sending any text/* MIME type, but it cannot really do in any other way-
> only the user can know the actual charset of a given file.

I don't think this conclusion is correct, see above.  More 
specifically, in freenginx mime.types there are the following 
text/* types:

    text/html
    text/css
    text/xml
    text/mathml
    text/plain
    text/vnd.sun.j2me.app-descriptor
    text/vnd.wap.wml
    text/x-component

None of these types define "charset" as a required parameter.

OTOH, I agree that required charset parameter is something that 
cannot be reasonably provided by a server unless explicitly 
configured.  And the basic question is how to handle such 
requirements.  Possible options include:

- avoiding such types,

- ignoring the requirement,

- introducing some way to provide server-specific default value 
  for such types.

Given that .md files are not really used when building sites, 
avoiding the type might be the simplest option, and that's what 
implicitly happens now.
 
> So in my opinion the markdown MIME type should be added, and it is up to
> the user to comply with RFC 6838. Maybe it'd make sense to mention that
> in the mime.types file.

Just ignoring the requirement might also be an option - I don't 
see any issues with existing browsers.  Still, this would be an 
obvious RFC 7763 violation in the common case, which might fight 
back at some point.

Also, the remaining question is whether text/markdown needs to be 
added at all.  It does not seem to be meaningfully used when 
building sites, not in Apache mime.types, and currently I'm not 
able to reproduce the warning claimed in the above commit log with 
Chromium.

Still, I tend to think it should, and probably with both ".md" and 
".markdown" extensions, as Markdown is becoming more and more popular.

Also, it probably worth adding to the default charset_types list 
as well, thus making it easier to add the "charset" attribute as 
required by RFC 7763.

Here is a patch:

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724807989 -10800
#      Wed Aug 28 04:19:49 2024 +0300
# Node ID 1729a20708cff738afa5cc32e77b2b50a4b5d91d
# Parent  d6f75dd66761c10d4bfb257ae70a212411b6a69b
MIME: added text/markdown type.

Added text/markdown type for the ".md" and ".markdown" extensions
(https://www.iana.org/assignments/media-types/text/markdown).

Additionally, text/markdown is added to the default charset_types list
of the charset module, making it easier to provide the "charset"
parameter, which is defined as REQUIRED for text/markdown.

Prodded by Andrea Pappacoda,
http://freenginx.org/pipermail/nginx-devel/2024-August/000486.html

diff --git a/conf/mime.types b/conf/mime.types
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -9,6 +9,7 @@ types {
     application/atom+xml                             atom;
     application/rss+xml                              rss;
 
+    text/markdown                                    md markdown;
     text/mathml                                      mml;
     text/plain                                       txt;
     text/vnd.sun.j2me.app-descriptor                 jad;
diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -127,6 +127,7 @@ static ngx_str_t  ngx_http_charset_defau
     ngx_string("text/html"),
     ngx_string("text/xml"),
     ngx_string("text/plain"),
+    ngx_string("text/markdown"),
     ngx_string("text/vnd.wap.wml"),
     ngx_string("application/javascript"),
     ngx_string("application/rss+xml"),



-- 
Maxim Dounin
http://mdounin.ru/

From mdounin at mdounin.ru  Thu Aug 29 02:20:00 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Thu, 29 Aug 2024 05:20:00 +0300
Subject: [PATCH 1 of 2] MIME: updated type for js files to text/javascript
Message-ID: <b5c5efc97ed0ad41be39.1724898000@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724897092 -10800
#      Thu Aug 29 05:04:52 2024 +0300
# Node ID b5c5efc97ed0ad41be39018cbabe9abc31cb164d
# Parent  1729a20708cff738afa5cc32e77b2b50a4b5d91d
MIME: updated type for js files to text/javascript.

RFC 9239 changed recommended media type to text/javascript, and made
application/javascript deprecated.

According to httparchive.org data, as of 2023-01-01 javascript files
are returned with the following types (type, total pages using the type,
total requests with the type):

application/javascript,11686643,218376911
text/javascript,9623206,76111177
application/x-javascript,4874976,28554156

The same data as of 2024-01-01:

application/javascript,10563307,205156998
text/javascript,8429652,78523734
application/x-javascript,4197414,26277166

And as of 2024-08-01:

application/javascript,10945376,216622264
text/javascript,8802358,102680806
application/x-javascript,4278134,28726895

This corresponds to text/javascript being used in 23.5%, 25.3%, and
29.5% of responses.  That is, it is slowly gaining popularity.  Still,
application/javascript remains more popular for now.

With this change, js files are now returned with the text/javascript
type.  Similarly, autoindex in jsonp format now also uses text/javascript.

Additionally, text/javascript is added to the default charset_types list
of the charset module.  Since application/javascript is still more popular
than text/javascript, application/javascript is also preserved in the
default list for now.

diff --git a/conf/mime.types b/conf/mime.types
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -2,10 +2,10 @@
 types {
     text/html                                        html htm shtml;
     text/css                                         css;
+    text/javascript                                  js;
     text/xml                                         xml;
     image/gif                                        gif;
     image/jpeg                                       jpeg jpg;
-    application/javascript                           js;
     application/atom+xml                             atom;
     application/rss+xml                              rss;
 
diff --git a/src/http/modules/ngx_http_autoindex_module.c b/src/http/modules/ngx_http_autoindex_module.c
--- a/src/http/modules/ngx_http_autoindex_module.c
+++ b/src/http/modules/ngx_http_autoindex_module.c
@@ -264,7 +264,7 @@ ngx_http_autoindex_handler(ngx_http_requ
         break;
 
     case NGX_HTTP_AUTOINDEX_JSONP:
-        ngx_str_set(&r->headers_out.content_type, "application/javascript");
+        ngx_str_set(&r->headers_out.content_type, "text/javascript");
         break;
 
     case NGX_HTTP_AUTOINDEX_XML:
diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -126,6 +126,7 @@ static ngx_int_t ngx_http_charset_postco
 static ngx_str_t  ngx_http_charset_default_types[] = {
     ngx_string("text/html"),
     ngx_string("text/xml"),
+    ngx_string("text/javascript"),
     ngx_string("text/plain"),
     ngx_string("text/markdown"),
     ngx_string("text/vnd.wap.wml"),


From mdounin at mdounin.ru  Thu Aug 29 02:20:01 2024
From: mdounin at mdounin.ru (=?utf-8?q?Maxim_Dounin?=)
Date: Thu, 29 Aug 2024 05:20:01 +0300
Subject: [PATCH 2 of 2] MIME: added mjs extension to text/javascript
In-Reply-To: <b5c5efc97ed0ad41be39.1724898000@vm-bsd.mdounin.ru>
References: <b5c5efc97ed0ad41be39.1724898000@vm-bsd.mdounin.ru>
Message-ID: <03d08e0b6e84d9306b4d.1724898001@vm-bsd.mdounin.ru>

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1724897367 -10800
#      Thu Aug 29 05:09:27 2024 +0300
# Node ID 03d08e0b6e84d9306b4dfce4124e13dea42f3639
# Parent  b5c5efc97ed0ad41be39018cbabe9abc31cb164d
MIME: added mjs extension to text/javascript.

diff --git a/conf/mime.types b/conf/mime.types
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -2,7 +2,7 @@
 types {
     text/html                                        html htm shtml;
     text/css                                         css;
-    text/javascript                                  js;
+    text/javascript                                  js mjs;
     text/xml                                         xml;
     image/gif                                        gif;
     image/jpeg                                       jpeg jpg;


From mdounin at mdounin.ru  Sat Aug 31 00:54:18 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 03:54:18 +0300
Subject: [nginx] SSL: removed OPENSSL_NO_SHA256 support.
Message-ID: <hg.8ebb4e488aa4.1725065658.-2200967563296178459@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/8ebb4e488aa4
branches:  
changeset: 9323:8ebb4e488aa4
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 00:30:39 2024 +0300
description:
SSL: removed OPENSSL_NO_SHA256 support.

In OpenSSL itself, support for builds without SHA256 was removed in
OpenSSL 1.1.0 and was already broken at that time (see
https://github.com/openssl/openssl/commit/474e469bbd for details).
In BoringSSL, support for OPENSSL_NO_SHA256 was removed in 2014.
In LibreSSL as of 3.9.2, some support it still present, but broken.

diffstat:

 src/event/ngx_event_openssl.c |  4 ----
 1 files changed, 0 insertions(+), 4 deletions(-)

diffs (15 lines):

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4553,11 +4553,7 @@ ngx_ssl_ticket_key_callback(ngx_ssl_conn
         return -1;
     }
 
-#ifdef OPENSSL_NO_SHA256
-    digest = EVP_sha1();
-#else
     digest = EVP_sha256();
-#endif
 
     keys = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_ticket_keys_index);
     if (keys == NULL) {

From mdounin at mdounin.ru  Sat Aug 31 00:54:18 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 03:54:18 +0300
Subject: [nginx] SSL: added SHA-256 fingerprints.
Message-ID: <hg.03cdd806c0f2.1725065658.-2200967563296178459@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/03cdd806c0f2
branches:  
changeset: 9324:03cdd806c0f2
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 00:30:42 2024 +0300
description:
SSL: added SHA-256 fingerprints.

In http and stream modules, the $ssl_client_fingerprint_sha256 variable
now provides client certificate SHA-256 fingerprint, in addition to the
$ssl_client_fingerprint variable with SHA-1 fingerprint.

In mail proxy, the "Auth-SSL-Fingerprint-SHA256" header was added.

diffstat:

 src/event/ngx_event_openssl.c          |  36 ++++++++++++++++++++++++++++++++++
 src/event/ngx_event_openssl.h          |   2 +
 src/http/modules/ngx_http_ssl_module.c |   3 ++
 src/mail/ngx_mail_auth_http_module.c   |  17 +++++++++++++++-
 src/stream/ngx_stream_ssl_module.c     |   4 +++
 5 files changed, 61 insertions(+), 1 deletions(-)

diffs (140 lines):

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -5749,6 +5749,42 @@ ngx_ssl_get_fingerprint(ngx_connection_t
 
 
 ngx_int_t
+ngx_ssl_get_fingerprint_sha256(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s)
+{
+    X509          *cert;
+    unsigned int   len;
+    u_char         buf[EVP_MAX_MD_SIZE];
+
+    s->len = 0;
+
+    cert = SSL_get_peer_certificate(c->ssl->connection);
+    if (cert == NULL) {
+        return NGX_OK;
+    }
+
+    if (!X509_digest(cert, EVP_sha256(), buf, &len)) {
+        ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "X509_digest() failed");
+        X509_free(cert);
+        return NGX_ERROR;
+    }
+
+    s->len = 2 * len;
+    s->data = ngx_pnalloc(pool, 2 * len);
+    if (s->data == NULL) {
+        X509_free(cert);
+        return NGX_ERROR;
+    }
+
+    ngx_hex_dump(s->data, buf, len);
+
+    X509_free(cert);
+
+    return NGX_OK;
+}
+
+
+ngx_int_t
 ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
 {
     X509        *cert;
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -299,6 +299,8 @@ ngx_int_t ngx_ssl_get_serial_number(ngx_
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_fingerprint(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
+ngx_int_t ngx_ssl_get_fingerprint_sha256(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s);
 ngx_int_t ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_client_v_start(ngx_connection_t *c, ngx_pool_t *pool,
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -387,6 +387,9 @@ static ngx_http_variable_t  ngx_http_ssl
     { ngx_string("ssl_client_fingerprint"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_fingerprint, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_client_fingerprint_sha256"), NULL, ngx_http_ssl_variable,
+      (uintptr_t) ngx_ssl_get_fingerprint_sha256, NGX_HTTP_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c
--- a/src/mail/ngx_mail_auth_http_module.c
+++ b/src/mail/ngx_mail_auth_http_module.c
@@ -1213,7 +1213,8 @@ ngx_mail_auth_http_create_request(ngx_ma
     ngx_connection_t          *c;
 #if (NGX_MAIL_SSL)
     ngx_str_t                  protocol, cipher, verify, subject, issuer,
-                               serial, fingerprint, raw_cert, cert;
+                               serial, fingerprint, fingerprint2, raw_cert,
+                               cert;
     ngx_mail_ssl_conf_t       *sslcf;
 #endif
     ngx_mail_core_srv_conf_t  *cscf;
@@ -1275,6 +1276,10 @@ ngx_mail_auth_http_create_request(ngx_ma
             return NULL;
         }
 
+        if (ngx_ssl_get_fingerprint_sha256(c, pool, &fingerprint2) != NGX_OK) {
+            return NULL;
+        }
+
         if (ahcf->pass_client_cert) {
 
             /* certificate itself, if configured */
@@ -1297,6 +1302,7 @@ ngx_mail_auth_http_create_request(ngx_ma
         ngx_str_null(&issuer);
         ngx_str_null(&serial);
         ngx_str_null(&fingerprint);
+        ngx_str_null(&fingerprint2);
         ngx_str_null(&cert);
     }
 
@@ -1360,6 +1366,8 @@ ngx_mail_auth_http_create_request(ngx_ma
                      + sizeof(CRLF) - 1
                + sizeof("Auth-SSL-Fingerprint: ") - 1 + fingerprint.len
                      + sizeof(CRLF) - 1
+               + sizeof("Auth-SSL-Fingerprint-SHA256: ") - 1 + fingerprint2.len
+                     + sizeof(CRLF) - 1
                + sizeof("Auth-SSL-Cert: ") - 1 + cert.len
                      + sizeof(CRLF) - 1;
     }
@@ -1520,6 +1528,13 @@ ngx_mail_auth_http_create_request(ngx_ma
             *b->last++ = CR; *b->last++ = LF;
         }
 
+        if (fingerprint2.len) {
+            b->last = ngx_cpymem(b->last, "Auth-SSL-Fingerprint-SHA256: ",
+                                 sizeof("Auth-SSL-Fingerprint-SHA256: ") - 1);
+            b->last = ngx_copy(b->last, fingerprint2.data, fingerprint2.len);
+            *b->last++ = CR; *b->last++ = LF;
+        }
+
         if (cert.len) {
             b->last = ngx_cpymem(b->last, "Auth-SSL-Cert: ",
                                  sizeof("Auth-SSL-Cert: ") - 1);
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
--- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c
@@ -310,6 +310,10 @@ static ngx_stream_variable_t  ngx_stream
     { ngx_string("ssl_client_fingerprint"), NULL, ngx_stream_ssl_variable,
       (uintptr_t) ngx_ssl_get_fingerprint, NGX_STREAM_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_client_fingerprint_sha256"), NULL,
+      ngx_stream_ssl_variable, (uintptr_t) ngx_ssl_get_fingerprint_sha256,
+      NGX_STREAM_VAR_CHANGEABLE, 0 },
+
     { ngx_string("ssl_client_verify"), NULL, ngx_stream_ssl_variable,
       (uintptr_t) ngx_ssl_get_client_verify, NGX_STREAM_VAR_CHANGEABLE, 0 },
 

From mdounin at mdounin.ru  Sat Aug 31 00:54:19 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 03:54:19 +0300
Subject: [nginx] Usage of ngx_explicit_memzero() in internal md5 and sha1.
Message-ID: <hg.0086f8da5d8d.1725065659.-2200967563296178459@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/0086f8da5d8d
branches:  
changeset: 9325:0086f8da5d8d
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 00:30:44 2024 +0300
description:
Usage of ngx_explicit_memzero() in internal md5 and sha1.

The goal of the context cleanup in ngx_md5_final() and ngx_sha1_final()
is to clear potentially sensitive data, so ngx_explicit_memzero() is
appropriate.

diffstat:

 src/core/ngx_md5.c  |  2 +-
 src/core/ngx_sha1.c |  2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diffs (24 lines):

diff --git a/src/core/ngx_md5.c b/src/core/ngx_md5.c
--- a/src/core/ngx_md5.c
+++ b/src/core/ngx_md5.c
@@ -107,7 +107,7 @@ ngx_md5_final(u_char result[16], ngx_md5
     result[14] = (u_char) (ctx->d >> 16);
     result[15] = (u_char) (ctx->d >> 24);
 
-    ngx_memzero(ctx, sizeof(*ctx));
+    ngx_explicit_memzero(ctx, sizeof(*ctx));
 }
 
 
diff --git a/src/core/ngx_sha1.c b/src/core/ngx_sha1.c
--- a/src/core/ngx_sha1.c
+++ b/src/core/ngx_sha1.c
@@ -113,7 +113,7 @@ ngx_sha1_final(u_char result[20], ngx_sh
     result[18] = (u_char) (ctx->e >> 8);
     result[19] = (u_char) ctx->e;
 
-    ngx_memzero(ctx, sizeof(*ctx));
+    ngx_explicit_memzero(ctx, sizeof(*ctx));
 }
 
 

From mdounin at mdounin.ru  Sat Aug 31 02:33:11 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 05:33:11 +0300
Subject: [nginx] Request body: fixed segfault on early errors.
Message-ID: <hg.75794cb1f5ea.1725071591.-4581860829708017130@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/75794cb1f5ea
branches:  
changeset: 9326:75794cb1f5ea
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 03:55:10 2024 +0300
description:
Request body: fixed segfault on early errors.

The r->request_body might not be initialized on error handling in
ngx_http_read_client_request_body(), notably if ngx_http_test_expect()
or ngx_pcalloc() fail.  After introduction of request body clearing
in 9259:81082b5521dd (1.27.0), this caused segmentation fault due to
NULL pointer dereference when clearing r->request_body->bufs.

Fix is to explicitly check if r->request_body is available before
clearing r->request_body->bufs.

Reported by Ji?? Setni?ka,
http://freenginx.org/pipermail/nginx-devel/2024-August/000484.html

diffstat:

 src/http/ngx_http_request_body.c |  5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diffs (15 lines):

diff --git a/src/http/ngx_http_request_body.c b/src/http/ngx_http_request_body.c
--- a/src/http/ngx_http_request_body.c
+++ b/src/http/ngx_http_request_body.c
@@ -245,7 +245,10 @@ done:
 
         r->lingering_close = 1;
         r->discard_body = 1;
-        r->request_body->bufs = NULL;
+
+        if (r->request_body) {
+            r->request_body->bufs = NULL;
+        }
 
         r->main->count--;
         r->read_event_handler = ngx_http_block_reading;

From mdounin at mdounin.ru  Sat Aug 31 02:42:20 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 05:42:20 +0300
Subject: [nginx] MIME: added text/markdown type.
Message-ID: <hg.707736510a90.1725072140.1186740533437155051@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/707736510a90
branches:  
changeset: 9327:707736510a90
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 05:40:00 2024 +0300
description:
MIME: added text/markdown type.

Added text/markdown type for the ".md" and ".markdown" extensions
(https://www.iana.org/assignments/media-types/text/markdown).

Additionally, text/markdown is added to the default charset_types list
of the charset module, making it easier to provide the "charset"
parameter, which is defined as REQUIRED for text/markdown.

Prodded by Andrea Pappacoda,
http://freenginx.org/pipermail/nginx-devel/2024-August/000486.html

diffstat:

 conf/mime.types                                   |  1 +
 src/http/modules/ngx_http_charset_filter_module.c |  1 +
 2 files changed, 2 insertions(+), 0 deletions(-)

diffs (22 lines):

diff --git a/conf/mime.types b/conf/mime.types
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -9,6 +9,7 @@ types {
     application/atom+xml                             atom;
     application/rss+xml                              rss;
 
+    text/markdown                                    md markdown;
     text/mathml                                      mml;
     text/plain                                       txt;
     text/vnd.sun.j2me.app-descriptor                 jad;
diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -127,6 +127,7 @@ static ngx_str_t  ngx_http_charset_defau
     ngx_string("text/html"),
     ngx_string("text/xml"),
     ngx_string("text/plain"),
+    ngx_string("text/markdown"),
     ngx_string("text/vnd.wap.wml"),
     ngx_string("application/javascript"),
     ngx_string("application/rss+xml"),

From mdounin at mdounin.ru  Sat Aug 31 02:42:20 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 05:42:20 +0300
Subject: [nginx] MIME: updated type for js files to text/javascript.
Message-ID: <hg.48f30a3add51.1725072140.1186740533437155051@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/48f30a3add51
branches:  
changeset: 9328:48f30a3add51
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 05:40:06 2024 +0300
description:
MIME: updated type for js files to text/javascript.

RFC 9239 changed recommended media type to text/javascript, and made
application/javascript deprecated.

According to httparchive.org data, as of 2023-01-01 javascript files
are returned with the following types (type, total pages using the type,
total requests with the type):

application/javascript,11686643,218376911
text/javascript,9623206,76111177
application/x-javascript,4874976,28554156

The same data as of 2024-01-01:

application/javascript,10563307,205156998
text/javascript,8429652,78523734
application/x-javascript,4197414,26277166

And as of 2024-08-01:

application/javascript,10945376,216622264
text/javascript,8802358,102680806
application/x-javascript,4278134,28726895

This corresponds to text/javascript being used in 23.5%, 25.3%, and
29.5% of responses.  That is, it is slowly gaining popularity.  Still,
application/javascript remains more popular for now.

With this change, js files are now returned with the text/javascript
type.  Similarly, autoindex in jsonp format now also uses text/javascript.

Additionally, text/javascript is added to the default charset_types list
of the charset module.  Since application/javascript is still more popular
than text/javascript, application/javascript is also preserved in the
default list for now.

diffstat:

 conf/mime.types                                   |  2 +-
 src/http/modules/ngx_http_autoindex_module.c      |  2 +-
 src/http/modules/ngx_http_charset_filter_module.c |  1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

diffs (38 lines):

diff --git a/conf/mime.types b/conf/mime.types
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -2,10 +2,10 @@
 types {
     text/html                                        html htm shtml;
     text/css                                         css;
+    text/javascript                                  js;
     text/xml                                         xml;
     image/gif                                        gif;
     image/jpeg                                       jpeg jpg;
-    application/javascript                           js;
     application/atom+xml                             atom;
     application/rss+xml                              rss;
 
diff --git a/src/http/modules/ngx_http_autoindex_module.c b/src/http/modules/ngx_http_autoindex_module.c
--- a/src/http/modules/ngx_http_autoindex_module.c
+++ b/src/http/modules/ngx_http_autoindex_module.c
@@ -264,7 +264,7 @@ ngx_http_autoindex_handler(ngx_http_requ
         break;
 
     case NGX_HTTP_AUTOINDEX_JSONP:
-        ngx_str_set(&r->headers_out.content_type, "application/javascript");
+        ngx_str_set(&r->headers_out.content_type, "text/javascript");
         break;
 
     case NGX_HTTP_AUTOINDEX_XML:
diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -126,6 +126,7 @@ static ngx_int_t ngx_http_charset_postco
 static ngx_str_t  ngx_http_charset_default_types[] = {
     ngx_string("text/html"),
     ngx_string("text/xml"),
+    ngx_string("text/javascript"),
     ngx_string("text/plain"),
     ngx_string("text/markdown"),
     ngx_string("text/vnd.wap.wml"),

From mdounin at mdounin.ru  Sat Aug 31 02:42:21 2024
From: mdounin at mdounin.ru (=?iso-8859-1?q?Maxim_Dounin?=)
Date: Sat, 31 Aug 2024 05:42:21 +0300
Subject: [nginx] MIME: added mjs extension to text/javascript.
Message-ID: <hg.eebab9268326.1725072141.1186740533437155051@ns3.mdounin.ru>

details:   http://freenginx.org/hg/nginx/rev/eebab9268326
branches:  
changeset: 9329:eebab9268326
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Aug 31 05:40:14 2024 +0300
description:
MIME: added mjs extension to text/javascript.

diffstat:

 conf/mime.types |  2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diffs (12 lines):

diff --git a/conf/mime.types b/conf/mime.types
--- a/conf/mime.types
+++ b/conf/mime.types
@@ -2,7 +2,7 @@
 types {
     text/html                                        html htm shtml;
     text/css                                         css;
-    text/javascript                                  js;
+    text/javascript                                  js mjs;
     text/xml                                         xml;
     image/gif                                        gif;
     image/jpeg                                       jpeg jpg;