Merge pull request #4863 from aledbf/switch-nginx
Switch to nginx again
This commit is contained in:
Manuel Alejandro de Brito Fontes
GitHub
commit
eb3fd57bd2
12 changed files with 616 additions and 164 deletions
|
|
@ -13,7 +13,7 @@
|
|||
# limitations under the License.
|
||||
|
||||
# 0.0.0 shouldn't clobber any released builds
|
||||
TAG ?= 0.94
|
||||
TAG ?= 0.95
|
||||
REGISTRY ?= quay.io/kubernetes-ingress-controller
|
||||
ARCH ?= $(shell go env GOARCH)
|
||||
DOCKER ?= docker
|
||||
|
|
@ -26,15 +26,12 @@ ifeq ($(GOHOSTOS),darwin)
|
|||
SED_I=sed -i ''
|
||||
endif
|
||||
|
||||
QEMUVERSION=v4.1.0-1
|
||||
QEMUVERSION=v4.1.1-1
|
||||
|
||||
IMGNAME = nginx
|
||||
IMAGE = $(REGISTRY)/$(IMGNAME)
|
||||
MULTI_ARCH_IMG = $(IMAGE)-$(ARCH)
|
||||
|
||||
# Set default base image dynamically for each arch
|
||||
BASEIMAGE?=quay.io/kubernetes-ingress-controller/debian-base-$(ARCH):0.1
|
||||
|
||||
ifeq ($(ARCH),arm)
|
||||
QEMUARCH=arm
|
||||
endif
|
||||
|
|
@ -62,7 +59,6 @@ all-push: $(addprefix sub-push-,$(ALL_ARCH))
|
|||
container: .container-$(ARCH)
|
||||
.container-$(ARCH):
|
||||
cp -r ./rootfs/* $(TEMP_DIR)
|
||||
cd $(TEMP_DIR) && $(SED_I) 's|BASEIMAGE|$(BASEIMAGE)|g' Dockerfile
|
||||
cd $(TEMP_DIR) && $(SED_I) "s|ARCH|$(QEMUARCH)|g" Dockerfile
|
||||
|
||||
ifeq ($(ARCH),amd64)
|
||||
|
|
|
|||
|
|
@ -1,6 +1,4 @@
|
|||
OpenResty base image using [debian-base](https://quay.io/kubernetes-ingress-controller/debian-base-amd64)
|
||||
|
||||
OpenResty® is a dynamic web platform based on NGINX and LuaJIT.
|
||||
NGINX base image using [alpine](https://www.alpinelinux.org/)
|
||||
|
||||
This custom image contains:
|
||||
|
||||
|
|
@ -20,7 +18,7 @@ This image provides a default configuration file with no backend servers.
|
|||
_Using docker_
|
||||
|
||||
```console
|
||||
docker run -v /some/nginx.con:/etc/nginx/nginx.conf:ro quay.io/kubernetes-ingress-controller/nginx:0.90
|
||||
docker run -v /some/nginx.con:/etc/nginx/nginx.conf:ro quay.io/kubernetes-ingress-controller/nginx:0.95
|
||||
```
|
||||
|
||||
_Creating a replication controller_
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nginxsvc
|
||||
name: nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
|
|
@ -38,7 +38,7 @@ spec:
|
|||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: quay.io/kubernetes-ingress-controller/nginx:0.90
|
||||
image: quay.io/kubernetes-ingress-controller/nginx:0.95
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 443
|
||||
|
|
|
|||
|
|
@ -13,22 +13,62 @@
|
|||
# limitations under the License.
|
||||
|
||||
|
||||
FROM BASEIMAGE
|
||||
FROM alpine:3.11 as builder
|
||||
|
||||
CROSS_BUILD_COPY qemu-ARCH-static /usr/bin/
|
||||
|
||||
ENV PATH=$PATH:/usr/local/openresty/luajit/bin:/usr/local/openresty/nginx/sbin:/usr/local/openresty/bin
|
||||
|
||||
# Add LuaRocks paths
|
||||
# see https://github.com/openresty/docker-openresty/blob/de05cd72594498b83e3a97e2f632da6aa75ec01d/bionic/Dockerfile#L168
|
||||
ENV LUA_PATH="/usr/local/openresty/site/lualib/?.ljbc;/usr/local/openresty/site/lualib/?/init.ljbc;/usr/local/openresty/lualib/?.ljbc;/usr/local/openresty/lualib/?/init.ljbc;/usr/local/openresty/site/lualib/?.lua;/usr/local/openresty/site/lualib/?/init.lua;/usr/local/openresty/lualib/?.lua;/usr/local/openresty/lualib/?/init.lua;./?.lua;/usr/local/openresty/luajit/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/?/init.lua;/usr/local/openresty/luajit/share/lua/5.1/?.lua;/usr/local/openresty/luajit/share/lua/5.1/?/init.lua;/usr/local/lib/lua/?.lua"
|
||||
ENV LUA_CPATH="/usr/local/openresty/site/lualib/?.so;/usr/local/openresty/lualib/?.so;./?.so;/usr/local/lib/lua/5.1/?.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so;/usr/local/lib/lua/5.1/loadall.so;/usr/local/openresty/luajit/lib/lua/5.1/?.so"
|
||||
|
||||
COPY . /
|
||||
|
||||
RUN clean-install bash
|
||||
RUN apk add -U bash \
|
||||
&& /build.sh
|
||||
|
||||
RUN /build.sh
|
||||
# Use a multi-stage build
|
||||
FROM alpine:3.11
|
||||
|
||||
ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin
|
||||
|
||||
ENV LUA_PATH="/usr/local/share/luajit-2.1.0-beta3/?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/lib/lua/?.lua;;"
|
||||
ENV LUA_CPATH="/usr/local/lib/lua/?/?.so;/usr/local/lib/lua/?.so;;"
|
||||
|
||||
COPY --from=builder /usr/local /usr/local
|
||||
COPY --from=builder /opt /opt
|
||||
COPY --from=builder /etc/nginx /etc/nginx
|
||||
|
||||
RUN apk add -U --no-cache \
|
||||
bash \
|
||||
openssl \
|
||||
pcre \
|
||||
zlib \
|
||||
geoip \
|
||||
curl ca-certificates \
|
||||
patch \
|
||||
yajl \
|
||||
lmdb \
|
||||
libxml2 \
|
||||
libmaxminddb \
|
||||
yaml-cpp \
|
||||
dumb-init \
|
||||
nano \
|
||||
tzdata \
|
||||
&& ln -s /usr/local/nginx/sbin/nginx /sbin/nginx \
|
||||
&& ln -s /usr/local/lib/mimalloc-1.2/libmimalloc.so /usr/local/lib/libmimalloc.so \
|
||||
&& addgroup -Sg 101 www-data \
|
||||
&& adduser -S -D -H -u 101 -h /usr/local/nginx \
|
||||
-s /sbin/nologin -G www-data -g www-data www-data \
|
||||
&& bash -eu -c ' \
|
||||
writeDirs=( \
|
||||
/var/log/nginx \
|
||||
/var/lib/nginx/body \
|
||||
/var/lib/nginx/fastcgi \
|
||||
/var/lib/nginx/proxy \
|
||||
/var/lib/nginx/scgi \
|
||||
/var/lib/nginx/uwsgi \
|
||||
/var/log/audit \
|
||||
); \
|
||||
for dir in "${writeDirs[@]}"; do \
|
||||
mkdir -p ${dir}; \
|
||||
chown -R www-data.www-data ${dir}; \
|
||||
done'
|
||||
|
||||
EXPOSE 80 443
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,10 @@ set -o pipefail
|
|||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
export OPENRESTY_VERSION=7508c1852265bd04fdb2dfd64989d4c490440f1a
|
||||
export NGINX_VERSION=1.17.7
|
||||
export NDK_VERSION=0.3.1rc1
|
||||
export SETMISC_VERSION=0.32
|
||||
export MORE_HEADERS_VERSION=0.33
|
||||
export NGINX_DIGEST_AUTH=cd8641886c873cf543255aeda20d23e4cd603d05
|
||||
export NGINX_SUBSTITUTIONS=bc58cb11844bc42735bbaef7085ea86ace46d05b
|
||||
export NGINX_OPENTRACING_VERSION=0.9.0
|
||||
|
|
@ -31,14 +34,20 @@ export JAEGER_VERSION=741b1af2805388e98dbfea449f40c6d6b19c13be
|
|||
export MSGPACK_VERSION=3.2.0
|
||||
export DATADOG_CPP_VERSION=1.1.1
|
||||
export MODSECURITY_VERSION=1.0.1
|
||||
export MODSECURITY_LIB_VERSION=3.0.3
|
||||
export MODSECURITY_LIB_VERSION=6624a18a4e7fd9881a7a9b435db3e481e8e986a5
|
||||
export OWASP_MODSECURITY_CRS_VERSION=3.2.0
|
||||
export LUA_NGX_VERSION=0.10.15
|
||||
export LUA_STREAM_NGX_VERSION=0.0.7
|
||||
export LUA_UPSTREAM_VERSION=0.07
|
||||
export LUA_BRIDGE_TRACER_VERSION=0.1.1
|
||||
export NGINX_INFLUXDB_VERSION=5b09391cb7b9a889687c0aa67964c06a2d933e8b
|
||||
export GEOIP2_VERSION=3.2
|
||||
export GEOIP2_VERSION=3.3
|
||||
export NGINX_AJP_VERSION=bf6cd93f2098b59260de8d494f0f4b1f11a84627
|
||||
export RESTY_LUAROCKS_VERSION=3.1.3
|
||||
export LUA_RESTY_BALANCER_VERSION=0.03
|
||||
export RESTY_LUAROCKS_VERSION=3.2.1
|
||||
export LUAJIT_VERSION=9d5750d28478abfdcaefdfdc408f87752a21e431
|
||||
export LUA_RESTY_BALANCER=0.03
|
||||
export LUA_RESTY_CORE=0.1.17
|
||||
export LUA_CJSON_VERSION=2.1.0.7
|
||||
|
||||
export BUILD_PATH=/tmp/build
|
||||
|
||||
|
|
@ -58,51 +67,47 @@ get_src()
|
|||
rm -rf "$f"
|
||||
}
|
||||
|
||||
apt-get update && apt-get dist-upgrade -y
|
||||
apk update
|
||||
apk upgrade
|
||||
|
||||
# install required packages to build
|
||||
clean-install \
|
||||
apk add \
|
||||
bash \
|
||||
build-essential \
|
||||
gcc \
|
||||
clang \
|
||||
libc-dev \
|
||||
make \
|
||||
automake \
|
||||
openssl-dev \
|
||||
pcre-dev \
|
||||
zlib-dev \
|
||||
linux-headers \
|
||||
libxslt-dev \
|
||||
gd-dev \
|
||||
geoip-dev \
|
||||
perl-dev \
|
||||
libedit-dev \
|
||||
mercurial \
|
||||
alpine-sdk \
|
||||
findutils \
|
||||
curl ca-certificates \
|
||||
libgeoip1 \
|
||||
libgeoip-dev \
|
||||
geoip-dev \
|
||||
patch \
|
||||
libpcre3 \
|
||||
libpcre3-dev \
|
||||
libssl-dev \
|
||||
zlib1g \
|
||||
zlib1g-dev \
|
||||
libaio1 \
|
||||
libaio-dev \
|
||||
openssl \
|
||||
libperl-dev \
|
||||
cmake \
|
||||
util-linux \
|
||||
lmdb-utils \
|
||||
lmdb-tools \
|
||||
wget \
|
||||
libcurl4-openssl-dev \
|
||||
libprotobuf-dev protobuf-compiler \
|
||||
libz-dev \
|
||||
procps \
|
||||
git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libtool dh-autoreconf libxml2 libpcre++-dev libxml2-dev \
|
||||
curl-dev \
|
||||
libprotobuf \
|
||||
git g++ pkgconf flex bison doxygen yajl-dev lmdb-dev libtool autoconf libxml2 pcre-dev libxml2-dev \
|
||||
python \
|
||||
libmaxminddb-dev \
|
||||
dumb-init \
|
||||
bc \
|
||||
unzip \
|
||||
nano \
|
||||
ssdeep \
|
||||
dos2unix mercurial \
|
||||
libyaml-cpp0.6 \
|
||||
|| exit 1
|
||||
|
||||
# https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1667178.html
|
||||
if [[ ${ARCH} == "armv7l" ]]; then
|
||||
echo "Fixing ca-certificates"
|
||||
touch /etc/ssl/certs/ca-certificates.crt
|
||||
c_rehash
|
||||
fi
|
||||
yaml-cpp
|
||||
|
||||
mkdir -p /etc/nginx
|
||||
|
||||
|
|
@ -126,8 +131,17 @@ mkdir --verbose -p "$BUILD_PATH"
|
|||
cd "$BUILD_PATH"
|
||||
|
||||
# download, verify and extract the source files
|
||||
get_src 221cfecadd0ed2902738757e7d8fb0bc41882840f07ea87112740b44f173722f \
|
||||
"https://github.com/openresty/openresty/archive/${OPENRESTY_VERSION}.tar.gz"
|
||||
get_src b62756842807e5693b794e5d0ae289bd8ae5b098e66538b2a91eb80f25c591ff \
|
||||
"https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz"
|
||||
|
||||
get_src 49f50d4cd62b166bc1aaf712febec5e028d9f187cedbc27a610dfd01bdde2d36 \
|
||||
"https://github.com/simpl/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz"
|
||||
|
||||
get_src f1ad2459c4ee6a61771aa84f77871f4bfe42943a4aa4c30c62ba3f981f52c201 \
|
||||
"https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz"
|
||||
|
||||
get_src a3dcbab117a9c103bc1ea5200fc00a7b7d2af97ff7fd525f16f8ac2632e30fbf \
|
||||
"https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz"
|
||||
|
||||
get_src fe683831f832aae4737de1e1026a4454017c2d5f98cb88b08c5411dc380062f8 \
|
||||
"https://github.com/atomx/nginx-http-auth-digest/archive/$NGINX_DIGEST_AUTH.tar.gz"
|
||||
|
|
@ -153,6 +167,18 @@ get_src db377619a07d538bdbf328272fdec3893e6f674bdf469b3b575f778866e3ace7 \
|
|||
get_src ff865a36bad5c72b8e7ebc4b7cf5f27a820fce4faff9c571c1791e3728355a39 \
|
||||
"https://github.com/msgpack/msgpack-c/archive/cpp-$MSGPACK_VERSION.tar.gz"
|
||||
|
||||
get_src 7d5f3439c8df56046d0564b5857fd8a30296ab1bd6df0f048aed7afb56a0a4c2 \
|
||||
"https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz"
|
||||
|
||||
get_src 99c47c75c159795c9faf76bbb9fa58e5a50b75286c86565ffcec8514b1c74bf9 \
|
||||
"https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz"
|
||||
|
||||
get_src 2a69815e4ae01aa8b170941a8e1a10b6f6a9aab699dee485d58f021dd933829a \
|
||||
"https://github.com/openresty/lua-upstream-nginx-module/archive/v$LUA_UPSTREAM_VERSION.tar.gz"
|
||||
|
||||
get_src 266ed1abb70a9806d97cb958537a44b67db6afb33d3b32292a2d68a2acedea75 \
|
||||
"https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz"
|
||||
|
||||
get_src 052fd37cd698e24ab73ee18fc3fa55acd1d43153c12a0e65b0fba0447de1117e \
|
||||
"https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz"
|
||||
|
||||
|
|
@ -162,17 +188,29 @@ get_src 6faab57557bd9cc9fc38208f6bc304c1c13cf048640779f98812cf1f9567e202 \
|
|||
get_src 1af5a5632dc8b00ae103d51b7bf225de3a7f0df82f5c6a401996c080106e600e \
|
||||
"https://github.com/influxdata/nginx-influxdb-module/archive/$NGINX_INFLUXDB_VERSION.tar.gz"
|
||||
|
||||
get_src 15bd1005228cf2c869a6f09e8c41a6aaa6846e4936c473106786ae8ac860fab7 \
|
||||
get_src 41378438c833e313a18869d0c4a72704b4835c30acaf7fd68013ab6732ff78a7 \
|
||||
"https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz"
|
||||
|
||||
get_src 5f629a50ba22347c441421091da70fdc2ac14586619934534e5a0f8a1390a950 \
|
||||
"https://github.com/yaoweibin/nginx_ajp_module/archive/$NGINX_AJP_VERSION.tar.gz"
|
||||
|
||||
get_src c573435f495aac159e34eaa0a3847172a2298eb6295fcdc35d565f9f9b990513 \
|
||||
get_src f27e20c9cdb3ffb991ccdb85796c36a0690566676f8e1a59b0d0ee6598907d04 \
|
||||
"https://luarocks.github.io/luarocks/releases/luarocks-${RESTY_LUAROCKS_VERSION}.tar.gz"
|
||||
|
||||
get_src 5d16e623d17d4f42cc64ea9cfb69ca960d313e12f5d828f785dd227cc483fcbd \
|
||||
"https://github.com/openresty/lua-resty-upload/archive/v0.10.tar.gz"
|
||||
|
||||
get_src 095615fe94e64615c4a27f4f4475b91c047cf8d10bc2dbde8d5ba6aa625fc5ab \
|
||||
"https://github.com/openresty/lua-resty-string/archive/v0.11.tar.gz"
|
||||
|
||||
get_src 82209d5a5d9545c6dde3db7857f84345db22162fdea9743d5e2b2094d8d407f8 \
|
||||
"https://github.com/openresty/lua-resty-balancer/archive/v${LUA_RESTY_BALANCER_VERSION}.tar.gz"
|
||||
"https://github.com/openresty/lua-resty-balancer/archive/v$LUA_RESTY_BALANCER.tar.gz"
|
||||
|
||||
get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \
|
||||
"https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz"
|
||||
|
||||
get_src 59d2f18ecadba48be61061004c8664eaed1111a3372cd2567cb24c5a47eb41fe \
|
||||
"https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz"
|
||||
|
||||
# improve compilation times
|
||||
CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0))
|
||||
|
|
@ -180,25 +218,19 @@ CORES=$(($(grep -c ^processor /proc/cpuinfo) - 0))
|
|||
export MAKEFLAGS=-j${CORES}
|
||||
export CTEST_BUILD_FLAGS=${MAKEFLAGS}
|
||||
export HUNTER_JOBS_NUMBER=${CORES}
|
||||
export HUNTER_KEEP_PACKAGE_SOURCES=false
|
||||
export HUNTER_USE_CACHE_SERVERS=true
|
||||
|
||||
if [[ ${ARCH} == "armv7l" ]]; then
|
||||
export PCRE_DIR=/usr/lib/arm-linux-gnueabihf
|
||||
fi
|
||||
# Install luajit from openresty fork
|
||||
export LUAJIT_LIB=/usr/local/lib
|
||||
export LUA_LIB_DIR="$LUAJIT_LIB/lua"
|
||||
export LUAJIT_INC=/usr/local/include/luajit-2.1
|
||||
|
||||
if [[ ${ARCH} == "x86_64" ]]; then
|
||||
export PCRE_DIR=/usr/lib/x86_64-linux-gnu
|
||||
fi
|
||||
|
||||
if [[ ${ARCH} == "aarch64" ]]; then
|
||||
export PCRE_DIR=/usr/lib/aarch64-linux-gnu
|
||||
fi
|
||||
cd "$BUILD_PATH/luajit2-$LUAJIT_VERSION"
|
||||
make CCDEBUG=-g
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH"
|
||||
|
||||
export PATH=$PATH:/usr/local/openresty/luajit
|
||||
|
||||
# install openresty-gdb-utils
|
||||
cd /
|
||||
git clone --depth=1 https://github.com/openresty/openresty-gdb-utils.git
|
||||
|
|
@ -316,14 +348,31 @@ cd ngx_brotli
|
|||
git submodule init
|
||||
git submodule update
|
||||
|
||||
cd "$BUILD_PATH"
|
||||
git clone https://github.com/ssdeep-project/ssdeep
|
||||
cd ssdeep/
|
||||
|
||||
./bootstrap
|
||||
./configure
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
# build modsecurity library
|
||||
cd "$BUILD_PATH"
|
||||
git clone -b v$MODSECURITY_LIB_VERSION https://github.com/SpiderLabs/ModSecurity
|
||||
git clone https://github.com/SpiderLabs/ModSecurity
|
||||
cd ModSecurity/
|
||||
git checkout $MODSECURITY_LIB_VERSION
|
||||
git submodule init
|
||||
git submodule update
|
||||
|
||||
sh build.sh
|
||||
./configure --disable-doxygen-doc --disable-examples --disable-dependency-tracking
|
||||
|
||||
./configure \
|
||||
--disable-doxygen-doc \
|
||||
--disable-doxygen-html \
|
||||
--disable-examples
|
||||
|
||||
make
|
||||
make install
|
||||
|
||||
|
|
@ -381,7 +430,13 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTE
|
|||
" > /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf
|
||||
|
||||
# build nginx
|
||||
cd "$BUILD_PATH/openresty-$OPENRESTY_VERSION"
|
||||
cd "$BUILD_PATH/nginx-$NGINX_VERSION"
|
||||
|
||||
# apply nginx patches
|
||||
for PATCH in `ls /patches`;do
|
||||
echo "Patch: $PATCH"
|
||||
patch -p1 < /patches/$PATCH
|
||||
done
|
||||
|
||||
WITH_FLAGS="--with-debug \
|
||||
--with-compat \
|
||||
|
|
@ -401,10 +456,7 @@ WITH_FLAGS="--with-debug \
|
|||
--with-stream_ssl_preread_module \
|
||||
--with-threads \
|
||||
--with-http_secure_link_module \
|
||||
--with-http_gunzip_module \
|
||||
--with-md5-asm \
|
||||
--with-sha1-asm \
|
||||
-j${CORES} "
|
||||
--with-http_gunzip_module"
|
||||
|
||||
# "Combining -flto with -g is currently experimental and expected to produce unexpected results."
|
||||
# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html
|
||||
|
|
@ -434,8 +486,14 @@ if [[ ${ARCH} == "x86_64" ]]; then
|
|||
CC_OPT+=' -m64 -mtune=native'
|
||||
fi
|
||||
|
||||
WITH_MODULES="--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
|
||||
WITH_MODULES="--add-module=$BUILD_PATH/ngx_devel_kit-$NDK_VERSION \
|
||||
--add-module=$BUILD_PATH/set-misc-nginx-module-$SETMISC_VERSION \
|
||||
--add-module=$BUILD_PATH/headers-more-nginx-module-$MORE_HEADERS_VERSION \
|
||||
--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \
|
||||
--add-module=$BUILD_PATH/ngx_http_substitutions_filter_module-$NGINX_SUBSTITUTIONS \
|
||||
--add-module=$BUILD_PATH/lua-nginx-module-$LUA_NGX_VERSION \
|
||||
--add-module=$BUILD_PATH/stream-lua-nginx-module-$LUA_STREAM_NGX_VERSION \
|
||||
--add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \
|
||||
--add-module=$BUILD_PATH/nginx-influxdb-module-$NGINX_INFLUXDB_VERSION \
|
||||
--add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \
|
||||
--add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \
|
||||
|
|
@ -443,11 +501,19 @@ WITH_MODULES="--add-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH
|
|||
--add-module=$BUILD_PATH/nginx_ajp_module-${NGINX_AJP_VERSION} \
|
||||
--add-module=$BUILD_PATH/ngx_brotli"
|
||||
|
||||
make
|
||||
|
||||
cd openresty-1.17.4.1rc0
|
||||
|
||||
./configure \
|
||||
--prefix=/usr/local/nginx \
|
||||
--conf-path=/etc/nginx/nginx.conf \
|
||||
--modules-path=/etc/nginx/modules \
|
||||
--http-log-path=/var/log/nginx/access.log \
|
||||
--error-log-path=/var/log/nginx/error.log \
|
||||
--lock-path=/var/lock/nginx.lock \
|
||||
--pid-path=/run/nginx.pid \
|
||||
--http-client-body-temp-path=/var/lib/nginx/body \
|
||||
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
|
||||
--http-proxy-temp-path=/var/lib/nginx/proxy \
|
||||
--http-scgi-temp-path=/var/lib/nginx/scgi \
|
||||
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
|
||||
${WITH_FLAGS} \
|
||||
--without-mail_pop3_module \
|
||||
--without-mail_smtp_module \
|
||||
|
|
@ -460,39 +526,49 @@ cd openresty-1.17.4.1rc0
|
|||
--group=www-data \
|
||||
${WITH_MODULES}
|
||||
|
||||
make || exit 1
|
||||
make install || exit 1
|
||||
make
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/luarocks-${RESTY_LUAROCKS_VERSION}"
|
||||
./configure \
|
||||
--prefix=/usr/local/openresty/luajit \
|
||||
--with-lua=/usr/local/openresty/luajit \
|
||||
--lua-suffix=jit-2.1.0-beta3 \
|
||||
--with-lua-include=/usr/local/openresty/luajit/include/luajit-2.1
|
||||
--with-lua-include=/usr/local/include/luajit-2.1
|
||||
|
||||
make || exit 1
|
||||
make install || exit 1
|
||||
make
|
||||
make install
|
||||
|
||||
export PATH=$PATH:/usr/local/openresty/luajit/bin
|
||||
|
||||
cd /usr/local/openresty
|
||||
|
||||
# build and install lua-resty-waf with dependencies
|
||||
export LUA_LIB_DIR=/usr/local/openresty/lualib
|
||||
export LUA_INCLUDE_DIR=/tmp/build/openresty-$OPENRESTY_VERSION/openresty-1.17.4.1rc0/build/luajit-root/usr/local/openresty/luajit/include/luajit-2.1
|
||||
export LUA_INCLUDE_DIR=/usr/local/include/luajit-2.1
|
||||
|
||||
ln -s $LUA_INCLUDE_DIR /usr/include/lua5.1
|
||||
|
||||
if [[ ${ARCH} != "armv7l" ]]; then
|
||||
luarocks install lrexlib-pcre 2.7.2-1 PCRE_LIBDIR=${PCRE_DIR}
|
||||
luarocks install lrexlib-pcre 2.7.2-1
|
||||
fi
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-core-$LUA_RESTY_CORE"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER"
|
||||
make all
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-cjson-$LUA_CJSON_VERSION"
|
||||
make all
|
||||
make install
|
||||
|
||||
luarocks install lua-resty-iputils 0.3.0-1
|
||||
luarocks install lua-resty-cookie 0.1.0-1
|
||||
luarocks install lua-resty-lrucache 0.09-2
|
||||
luarocks install lua-resty-lock 0.08-0
|
||||
luarocks install lua-resty-dns 0.21-1
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-balancer-$LUA_RESTY_BALANCER_VERSION"
|
||||
# required for OCSP verification
|
||||
luarocks install lua-resty-http
|
||||
|
||||
make
|
||||
cd "$BUILD_PATH/lua-resty-upload-0.10"
|
||||
make install
|
||||
|
||||
cd "$BUILD_PATH/lua-resty-string-0.11"
|
||||
make install
|
||||
|
||||
# build Lua bridge tracer
|
||||
|
|
@ -513,76 +589,25 @@ cmake ../..
|
|||
make
|
||||
make install
|
||||
|
||||
echo "Cleaning..."
|
||||
|
||||
cd /
|
||||
|
||||
apt-mark unmarkauto \
|
||||
bash \
|
||||
curl ca-certificates \
|
||||
libgeoip1 \
|
||||
libpcre3 \
|
||||
zlib1g \
|
||||
libaio1 \
|
||||
geoip-bin \
|
||||
libyajl2 liblmdb0 libxml2 libpcre++ \
|
||||
gzip \
|
||||
openssl \
|
||||
libyaml-cpp0.6
|
||||
|
||||
apt-get remove -y --purge \
|
||||
build-essential \
|
||||
libgeoip-dev \
|
||||
libpcre3-dev \
|
||||
libssl-dev \
|
||||
zlib1g-dev \
|
||||
libaio-dev \
|
||||
linux-libc-dev \
|
||||
cmake \
|
||||
wget \
|
||||
patch \
|
||||
protobuf-compiler \
|
||||
python \
|
||||
xz-utils \
|
||||
bc \
|
||||
sensible-utils \
|
||||
git g++ pkgconf flex bison doxygen libyajl-dev liblmdb-dev libgeoip-dev libtool dh-autoreconf libpcre++-dev libxml2-dev
|
||||
|
||||
apt-get autoremove -y
|
||||
|
||||
# Remove configuration files left after the package removal.
|
||||
# To see such packages run: apt list | grep residual
|
||||
dpkg -l | grep '^rc' | awk '{print $2}' | xargs apt-get purge --yes
|
||||
|
||||
rm -rf "$BUILD_PATH"
|
||||
rm -Rf /usr/share/man /usr/share/doc
|
||||
rm -rf /tmp/* /var/tmp/*
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
rm -rf /var/cache/apt/archives/*
|
||||
rm -rf /usr/local/modsecurity/bin
|
||||
rm -rf /usr/local/modsecurity/include
|
||||
rm -rf /usr/local/modsecurity/lib/libmodsecurity.a
|
||||
|
||||
rm -rf /root/.cache
|
||||
|
||||
rm -rf /etc/nginx/owasp-modsecurity-crs/.git
|
||||
rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
|
||||
|
||||
rm -rf $HOME/.hunter
|
||||
|
||||
rm -rf $LUA_INCLUDE_DIR /usr/include/lua5.1
|
||||
|
||||
# update image permissions
|
||||
writeDirs=( \
|
||||
/etc/nginx \
|
||||
/usr/local/openresty/nginx \
|
||||
/usr/local/nginx \
|
||||
/opt/modsecurity/var/log \
|
||||
/opt/modsecurity/var/upload \
|
||||
/opt/modsecurity/var/audit \
|
||||
/var/log/audit \
|
||||
/var/log/nginx \
|
||||
);
|
||||
|
||||
addgroup -Sg 101 www-data
|
||||
adduser -S -D -H -u 101 -h /usr/local/nginx -s /sbin/nologin -G www-data -g www-data www-data
|
||||
|
||||
for dir in "${writeDirs[@]}"; do
|
||||
mkdir -p ${dir};
|
||||
chown -R www-data.www-data ${dir};
|
||||
done
|
||||
|
||||
rm -rf /etc/nginx/owasp-modsecurity-crs/.git
|
||||
rm -rf /etc/nginx/owasp-modsecurity-crs/util/regression-tests
|
||||
rm -rf /usr/local/modsecurity/lib/libmodsecurity.a
|
||||
|
|
|
|||
|
|
@ -0,0 +1,72 @@
|
|||
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
|
||||
index f8d5707d..6efe0047 100644
|
||||
--- a/src/http/ngx_http_upstream.c
|
||||
+++ b/src/http/ngx_http_upstream.c
|
||||
@@ -1515,6 +1515,11 @@ ngx_http_upstream_connect(ngx_http_request_t *r, ngx_http_upstream_t *u)
|
||||
return;
|
||||
}
|
||||
|
||||
+ if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
|
||||
+ ngx_http_upstream_finalize_request(r, u, rc);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
u->state->peer = u->peer.name;
|
||||
|
||||
if (rc == NGX_BUSY) {
|
||||
diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
|
||||
index 3e714e5b..dfbb25e0 100644
|
||||
--- a/src/http/ngx_http_upstream.h
|
||||
+++ b/src/http/ngx_http_upstream.h
|
||||
@@ -427,4 +427,9 @@ extern ngx_conf_bitmask_t ngx_http_upstream_cache_method_mask[];
|
||||
extern ngx_conf_bitmask_t ngx_http_upstream_ignore_headers_masks[];
|
||||
|
||||
|
||||
+#ifndef HAVE_BALANCER_STATUS_CODE_PATCH
|
||||
+#define HAVE_BALANCER_STATUS_CODE_PATCH
|
||||
+#endif
|
||||
+
|
||||
+
|
||||
#endif /* _NGX_HTTP_UPSTREAM_H_INCLUDED_ */
|
||||
diff --git a/src/stream/ngx_stream.h b/src/stream/ngx_stream.h
|
||||
index 09d24593..d8b4b584 100644
|
||||
--- a/src/stream/ngx_stream.h
|
||||
+++ b/src/stream/ngx_stream.h
|
||||
@@ -27,6 +27,7 @@ typedef struct ngx_stream_session_s ngx_stream_session_t;
|
||||
|
||||
|
||||
#define NGX_STREAM_OK 200
|
||||
+#define NGX_STREAM_SPECIAL_RESPONSE 300
|
||||
#define NGX_STREAM_BAD_REQUEST 400
|
||||
#define NGX_STREAM_FORBIDDEN 403
|
||||
#define NGX_STREAM_INTERNAL_SERVER_ERROR 500
|
||||
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
|
||||
index 818d7329..329dcdc6 100644
|
||||
--- a/src/stream/ngx_stream_proxy_module.c
|
||||
+++ b/src/stream/ngx_stream_proxy_module.c
|
||||
@@ -691,6 +691,11 @@ ngx_stream_proxy_connect(ngx_stream_session_t *s)
|
||||
return;
|
||||
}
|
||||
|
||||
+ if (rc >= NGX_STREAM_SPECIAL_RESPONSE) {
|
||||
+ ngx_stream_proxy_finalize(s, rc);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
u->state->peer = u->peer.name;
|
||||
|
||||
if (rc == NGX_BUSY) {
|
||||
diff --git a/src/stream/ngx_stream_upstream.h b/src/stream/ngx_stream_upstream.h
|
||||
index 73947f46..21bc0ad7 100644
|
||||
--- a/src/stream/ngx_stream_upstream.h
|
||||
+++ b/src/stream/ngx_stream_upstream.h
|
||||
@@ -151,4 +151,9 @@ ngx_stream_upstream_srv_conf_t *ngx_stream_upstream_add(ngx_conf_t *cf,
|
||||
extern ngx_module_t ngx_stream_upstream_module;
|
||||
|
||||
|
||||
+#ifndef HAVE_BALANCER_STATUS_CODE_PATCH
|
||||
+#define HAVE_BALANCER_STATUS_CODE_PATCH
|
||||
+#endif
|
||||
+
|
||||
+
|
||||
#endif /* _NGX_STREAM_UPSTREAM_H_INCLUDED_ */
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
--- nginx-1.17.4/src/core/ngx_log.h 2013-10-08 05:07:14.000000000 -0700
|
||||
+++ nginx-1.17.4-patched/src/core/ngx_log.h 2013-12-05 20:35:35.996236720 -0800
|
||||
@@ -64,7 +64,9 @@ struct ngx_log_s {
|
||||
};
|
||||
|
||||
|
||||
-#define NGX_MAX_ERROR_STR 2048
|
||||
+#ifndef NGX_MAX_ERROR_STR
|
||||
+#define NGX_MAX_ERROR_STR 4096
|
||||
+#endif
|
||||
|
||||
|
||||
/*********************************/
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
diff --git a/src/core/ngx_connection.c b/src/core/ngx_connection.c
|
||||
--- a/src/core/ngx_connection.c
|
||||
+++ b/src/core/ngx_connection.c
|
||||
@@ -1118,6 +1118,12 @@ ngx_close_listening_sockets(ngx_cycle_t *cycle)
|
||||
ls = cycle->listening.elts;
|
||||
for (i = 0; i < cycle->listening.nelts; i++) {
|
||||
|
||||
+#if (NGX_HAVE_REUSEPORT)
|
||||
+ if (ls[i].fd == (ngx_socket_t) -1) {
|
||||
+ continue;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
c = ls[i].connection;
|
||||
|
||||
if (c) {
|
||||
diff --git a/src/event/ngx_event.c b/src/event/ngx_event.c
|
||||
--- a/src/event/ngx_event.c
|
||||
+++ b/src/event/ngx_event.c
|
||||
@@ -775,6 +775,18 @@ ngx_event_process_init(ngx_cycle_t *cycle)
|
||||
|
||||
#if (NGX_HAVE_REUSEPORT)
|
||||
if (ls[i].reuseport && ls[i].worker != ngx_worker) {
|
||||
+ ngx_log_debug2(NGX_LOG_DEBUG_CORE, cycle->log, 0,
|
||||
+ "closing unused fd:%d listening on %V",
|
||||
+ ls[i].fd, &ls[i].addr_text);
|
||||
+
|
||||
+ if (ngx_close_socket(ls[i].fd) == -1) {
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_socket_errno,
|
||||
+ ngx_close_socket_n " %V failed",
|
||||
+ &ls[i].addr_text);
|
||||
+ }
|
||||
+
|
||||
+ ls[i].fd = (ngx_socket_t) -1;
|
||||
+
|
||||
continue;
|
||||
}
|
||||
#endif
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
|
||||
index 1710ea81..b379da9c 100644
|
||||
--- a/src/os/unix/ngx_process_cycle.c
|
||||
+++ b/src/os/unix/ngx_process_cycle.c
|
||||
@@ -304,11 +304,26 @@ ngx_single_process_cycle(ngx_cycle_t *cycle)
|
||||
}
|
||||
|
||||
for ( ;; ) {
|
||||
+ if (ngx_exiting) {
|
||||
+ if (ngx_event_no_timers_left() == NGX_OK) {
|
||||
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");
|
||||
+
|
||||
+ for (i = 0; cycle->modules[i]; i++) {
|
||||
+ if (cycle->modules[i]->exit_process) {
|
||||
+ cycle->modules[i]->exit_process(cycle);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ ngx_master_process_exit(cycle);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
ngx_log_debug0(NGX_LOG_DEBUG_EVENT, cycle->log, 0, "worker cycle");
|
||||
|
||||
ngx_process_events_and_timers(cycle);
|
||||
|
||||
- if (ngx_terminate || ngx_quit) {
|
||||
+ if (ngx_terminate) {
|
||||
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "exiting");
|
||||
|
||||
for (i = 0; cycle->modules[i]; i++) {
|
||||
if (cycle->modules[i]->exit_process) {
|
||||
@@ -319,6 +334,20 @@ ngx_single_process_cycle(ngx_cycle_t *cycle)
|
||||
ngx_master_process_exit(cycle);
|
||||
}
|
||||
|
||||
+ if (ngx_quit) {
|
||||
+ ngx_quit = 0;
|
||||
+ ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0,
|
||||
+ "gracefully shutting down");
|
||||
+ ngx_setproctitle("process is shutting down");
|
||||
+
|
||||
+ if (!ngx_exiting) {
|
||||
+ ngx_exiting = 1;
|
||||
+ ngx_set_shutdown_timer(cycle);
|
||||
+ ngx_close_listening_sockets(cycle);
|
||||
+ ngx_close_idle_connections(cycle);
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
if (ngx_reconfigure) {
|
||||
ngx_reconfigure = 0;
|
||||
ngx_log_error(NGX_LOG_NOTICE, cycle->log, 0, "reconfiguring");
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
# HG changeset patch
|
||||
# User Yichun Zhang <agentzh@openresty.org>
|
||||
# Date 1451762084 28800
|
||||
# Sat Jan 02 11:14:44 2016 -0800
|
||||
# Node ID 449f0461859c16e95bdb18e8be6b94401545d3dd
|
||||
# Parent 78b4e10b4367b31367aad3c83c9c3acdd42397c4
|
||||
SSL: handled SSL_CTX_set_cert_cb() callback yielding.
|
||||
|
||||
OpenSSL 1.0.2+ introduces SSL_CTX_set_cert_cb() to allow custom
|
||||
callbacks to serve the SSL certificiates and private keys dynamically
|
||||
and lazily. The callbacks may yield for nonblocking I/O or sleeping.
|
||||
Here we added support for such usage in NGINX 3rd-party modules
|
||||
(like ngx_lua) in NGINX's event handlers for downstream SSL
|
||||
connections.
|
||||
|
||||
diff -r 78b4e10b4367 -r 449f0461859c src/event/ngx_event_openssl.c
|
||||
--- a/src/event/ngx_event_openssl.c Thu Dec 17 16:39:15 2015 +0300
|
||||
+++ b/src/event/ngx_event_openssl.c Sat Jan 02 11:14:44 2016 -0800
|
||||
@@ -1445,6 +1445,23 @@ ngx_ssl_handshake(ngx_connection_t *c)
|
||||
return NGX_AGAIN;
|
||||
}
|
||||
|
||||
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L
|
||||
+ if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
|
||||
+ c->read->handler = ngx_ssl_handshake_handler;
|
||||
+ c->write->handler = ngx_ssl_handshake_handler;
|
||||
+
|
||||
+ if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_AGAIN;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
|
||||
|
||||
c->ssl->no_wait_shutdown = 1;
|
||||
@@ -1558,6 +1575,21 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
|
||||
return NGX_AGAIN;
|
||||
}
|
||||
|
||||
+ if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
|
||||
+ c->read->handler = ngx_ssl_handshake_handler;
|
||||
+ c->write->handler = ngx_ssl_handshake_handler;
|
||||
+
|
||||
+ if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_AGAIN;
|
||||
+ }
|
||||
+
|
||||
err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
|
||||
|
||||
c->ssl->no_wait_shutdown = 1;
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -1446,7 +1446,12 @@ ngx_ssl_handshake(ngx_connection_t *c)
|
||||
}
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x10002000L
|
||||
- if (sslerr == SSL_ERROR_WANT_X509_LOOKUP) {
|
||||
+ if (sslerr == SSL_ERROR_WANT_X509_LOOKUP
|
||||
+# ifdef SSL_ERROR_PENDING_SESSION
|
||||
+ || sslerr == SSL_ERROR_PENDING_SESSION
|
||||
+# endif
|
||||
+ )
|
||||
+ {
|
||||
c->read->handler = ngx_ssl_handshake_handler;
|
||||
c->write->handler = ngx_ssl_handshake_handler;
|
||||
|
||||
@@ -1575,6 +1580,23 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
|
||||
return NGX_AGAIN;
|
||||
}
|
||||
|
||||
+#ifdef SSL_ERROR_PENDING_SESSION
|
||||
+ if (sslerr == SSL_ERROR_PENDING_SESSION) {
|
||||
+ c->read->handler = ngx_ssl_handshake_handler;
|
||||
+ c->write->handler = ngx_ssl_handshake_handler;
|
||||
+
|
||||
+ if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_AGAIN;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
|
||||
|
||||
c->ssl->no_wait_shutdown = 1;
|
||||
|
|
@ -0,0 +1,112 @@
|
|||
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
|
||||
index 69019417..2265d8f7 100644
|
||||
--- a/src/http/ngx_http_upstream.c
|
||||
+++ b/src/http/ngx_http_upstream.c
|
||||
@@ -509,12 +509,19 @@ void
|
||||
ngx_http_upstream_init(ngx_http_request_t *r)
|
||||
{
|
||||
ngx_connection_t *c;
|
||||
+ ngx_http_upstream_t *u;
|
||||
|
||||
c = r->connection;
|
||||
|
||||
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
|
||||
"http init upstream, client timer: %d", c->read->timer_set);
|
||||
|
||||
+ u = r->upstream;
|
||||
+
|
||||
+ u->connect_timeout = u->conf->connect_timeout;
|
||||
+ u->send_timeout = u->conf->send_timeout;
|
||||
+ u->read_timeout = u->conf->read_timeout;
|
||||
+
|
||||
#if (NGX_HTTP_V2)
|
||||
if (r->stream) {
|
||||
ngx_http_upstream_init_request(r);
|
||||
@@ -1626,7 +1633,7 @@ ngx_http_upstream_connect(ngx_http_request_t *r, ngx_http_upstream_t *u)
|
||||
u->request_body_blocked = 0;
|
||||
|
||||
if (rc == NGX_AGAIN) {
|
||||
- ngx_add_timer(c->write, u->conf->connect_timeout);
|
||||
+ ngx_add_timer(c->write, u->connect_timeout);
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -1704,7 +1711,7 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
|
||||
if (rc == NGX_AGAIN) {
|
||||
|
||||
if (!c->write->timer_set) {
|
||||
- ngx_add_timer(c->write, u->conf->connect_timeout);
|
||||
+ ngx_add_timer(c->write, u->connect_timeout);
|
||||
}
|
||||
|
||||
c->ssl->handler = ngx_http_upstream_ssl_handshake_handler;
|
||||
@@ -2022,7 +2029,7 @@ ngx_http_upstream_send_request(ngx_http_request_t *r, ngx_http_upstream_t *u,
|
||||
|
||||
if (rc == NGX_AGAIN) {
|
||||
if (!c->write->ready || u->request_body_blocked) {
|
||||
- ngx_add_timer(c->write, u->conf->send_timeout);
|
||||
+ ngx_add_timer(c->write, u->send_timeout);
|
||||
|
||||
} else if (c->write->timer_set) {
|
||||
ngx_del_timer(c->write);
|
||||
@@ -2084,7 +2091,7 @@ ngx_http_upstream_send_request(ngx_http_request_t *r, ngx_http_upstream_t *u,
|
||||
return;
|
||||
}
|
||||
|
||||
- ngx_add_timer(c->read, u->conf->read_timeout);
|
||||
+ ngx_add_timer(c->read, u->read_timeout);
|
||||
|
||||
if (c->read->ready) {
|
||||
ngx_http_upstream_process_header(r, u);
|
||||
@@ -3213,7 +3220,7 @@ ngx_http_upstream_send_response(ngx_http_request_t *r, ngx_http_upstream_t *u)
|
||||
p->cyclic_temp_file = 0;
|
||||
}
|
||||
|
||||
- p->read_timeout = u->conf->read_timeout;
|
||||
+ p->read_timeout = u->read_timeout;
|
||||
p->send_timeout = clcf->send_timeout;
|
||||
p->send_lowat = clcf->send_lowat;
|
||||
|
||||
@@ -3458,7 +3465,7 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
|
||||
}
|
||||
|
||||
if (upstream->write->active && !upstream->write->ready) {
|
||||
- ngx_add_timer(upstream->write, u->conf->send_timeout);
|
||||
+ ngx_add_timer(upstream->write, u->send_timeout);
|
||||
|
||||
} else if (upstream->write->timer_set) {
|
||||
ngx_del_timer(upstream->write);
|
||||
@@ -3470,7 +3477,7 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
|
||||
}
|
||||
|
||||
if (upstream->read->active && !upstream->read->ready) {
|
||||
- ngx_add_timer(upstream->read, u->conf->read_timeout);
|
||||
+ ngx_add_timer(upstream->read, u->read_timeout);
|
||||
|
||||
} else if (upstream->read->timer_set) {
|
||||
ngx_del_timer(upstream->read);
|
||||
@@ -3664,7 +3671,7 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r,
|
||||
}
|
||||
|
||||
if (upstream->read->active && !upstream->read->ready) {
|
||||
- ngx_add_timer(upstream->read, u->conf->read_timeout);
|
||||
+ ngx_add_timer(upstream->read, u->read_timeout);
|
||||
|
||||
} else if (upstream->read->timer_set) {
|
||||
ngx_del_timer(upstream->read);
|
||||
diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
|
||||
index c2f4dc0b..b9eef118 100644
|
||||
--- a/src/http/ngx_http_upstream.h
|
||||
+++ b/src/http/ngx_http_upstream.h
|
||||
@@ -333,6 +333,11 @@ struct ngx_http_upstream_s {
|
||||
ngx_array_t *caches;
|
||||
#endif
|
||||
|
||||
+#define HAVE_NGX_UPSTREAM_TIMEOUT_FIELDS 1
|
||||
+ ngx_msec_t connect_timeout;
|
||||
+ ngx_msec_t send_timeout;
|
||||
+ ngx_msec_t read_timeout;
|
||||
+
|
||||
ngx_http_upstream_headers_in_t headers_in;
|
||||
|
||||
ngx_http_upstream_resolved_t *resolved;
|
||||
Loading…
Reference in a new issue