Skip to content

Commit 5cd8aff

Browse files
chronolawchronolaw
committed
nginx 1.23.2
1 parent 18c8707 commit 5cd8aff

16 files changed

+856
-148
lines changed

‎nginx/CHANGES

+35
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,39 @@
11

2+
Changes with nginx 1.23.2 19 Oct 2022
3+
4+
*) Security: processing of a specially crafted mp4 file by the
5+
ngx_http_mp4_module might cause a worker process crash, worker
6+
process memory disclosure, or might have potential other impact
7+
(CVE-2022-41741, CVE-2022-41742).
8+
9+
*) Feature: the "$proxy_protocol_tlv_..." variables.
10+
11+
*) Feature: TLS session tickets encryption keys are now automatically
12+
rotated when using shared memory in the "ssl_session_cache"
13+
directive.
14+
15+
*) Change: the logging level of the "bad record type" SSL errors has
16+
been lowered from "crit" to "info".
17+
Thanks to Murilo Andrade.
18+
19+
*) Change: now when using shared memory in the "ssl_session_cache"
20+
directive the "could not allocate new session" errors are logged at
21+
the "warn" level instead of "alert" and not more often than once per
22+
second.
23+
24+
*) Bugfix: nginx/Windows could not be built with OpenSSL 3.0.x.
25+
26+
*) Bugfix: in logging of the PROXY protocol errors.
27+
Thanks to Sergey Brester.
28+
29+
*) Workaround: shared memory from the "ssl_session_cache" directive was
30+
spent on sessions using TLS session tickets when using TLSv1.3 with
31+
OpenSSL.
32+
33+
*) Workaround: timeout specified with the "ssl_session_timeout"
34+
directive did not work when using TLSv1.3 with OpenSSL or BoringSSL.
35+
36+
237
Changes with nginx 1.23.1 19 Jul 2022
338

439
*) Feature: memory usage optimization in configurations with SSL

‎nginx/CHANGES.ru

+35
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,39 @@
11

2+
Изменения в nginx 1.23.2 19.10.2022
3+
4+
*) Безопасность: обработка специально созданного mp4-файла модулем
5+
ngx_http_mp4_module могла приводить к падению рабочего процесса,
6+
отправке клиенту части содержимого памяти рабочего процесса, а также
7+
потенциально могла иметь другие последствия (CVE-2022-41741,
8+
CVE-2022-41742).
9+
10+
*) Добавление: переменные "$proxy_protocol_tlv_...".
11+
12+
*) Добавление: ключи шифрования TLS session tickets теперь автоматически
13+
меняются при использовании разделяемой памяти в ssl_session_cache.
14+
15+
*) Изменение: уровень логгирования ошибок SSL "bad record type" понижен
16+
с уровня crit до info.
17+
Спасибо Murilo Andrade.
18+
19+
*) Изменение: теперь при использовании разделяемой памяти в
20+
ssl_session_cache сообщения "could not allocate new session"
21+
логгируются на уровне warn вместо alert и не чаще одного раза в
22+
секунду.
23+
24+
*) Исправление: nginx/Windows не собирался с OpenSSL 3.0.x.
25+
26+
*) Исправление: в логгировании ошибок протокола PROXY.
27+
Спасибо Сергею Брестеру.
28+
29+
*) Изменение: при использовании TLSv1.3 с OpenSSL разделяемая память из
30+
ssl_session_cache расходовалась в том числе на сессии, использующие
31+
TLS session tickets.
32+
33+
*) Изменение: таймаут, заданный с помощью директивы ssl_session_timeout,
34+
не работал при использовании TLSv1.3 с OpenSSL или BoringSSL.
35+
36+
237
Изменения в nginx 1.23.1 19.07.2022
338

439
*) Добавление: оптимизация использования памяти в конфигурациях с

‎nginx/auto/lib/openssl/makefile.msvc

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
all:
77
cd $(OPENSSL)
88

9-
perl Configure VC-WIN32 no-shared \
9+
perl Configure VC-WIN32 no-shared no-threads \
1010
--prefix="%cd%/openssl" \
1111
--openssldir="%cd%/openssl/ssl" \
1212
$(OPENSSL_OPT)

‎nginx/src/core/nginx.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
#define _NGINX_H_INCLUDED_
1010

1111

12-
#define nginx_version 1023001
13-
#define NGINX_VERSION "1.23.1"
12+
#define nginx_version 1023002
13+
#define NGINX_VERSION "1.23.2"
1414
#define NGINX_VER "nginx/" NGINX_VERSION
1515

1616
#ifdef NGX_BUILD

‎nginx/src/core/ngx_proxy_protocol.c

+194-4
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,15 @@
1313
#define NGX_PROXY_PROTOCOL_AF_INET6 2
1414

1515

16-
#define ngx_proxy_protocol_parse_uint16(p) ((p)[0] << 8 | (p)[1])
16+
#define ngx_proxy_protocol_parse_uint16(p) \
17+
( ((uint16_t) (p)[0] << 8) \
18+
+ ( (p)[1]) )
19+
20+
#define ngx_proxy_protocol_parse_uint32(p) \
21+
( ((uint32_t) (p)[0] << 24) \
22+
+ ( (p)[1] << 16) \
23+
+ ( (p)[2] << 8) \
24+
+ ( (p)[3]) )
1725

1826

1927
typedef struct {
@@ -40,12 +48,52 @@ typedef struct {
4048
} ngx_proxy_protocol_inet6_addrs_t;
4149

4250

51+
typedef struct {
52+
u_char type;
53+
u_char len[2];
54+
} ngx_proxy_protocol_tlv_t;
55+
56+
57+
typedef struct {
58+
u_char client;
59+
u_char verify[4];
60+
} ngx_proxy_protocol_tlv_ssl_t;
61+
62+
63+
typedef struct {
64+
ngx_str_t name;
65+
ngx_uint_t type;
66+
} ngx_proxy_protocol_tlv_entry_t;
67+
68+
4369
static u_char *ngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p,
4470
u_char *last, ngx_str_t *addr);
4571
static u_char *ngx_proxy_protocol_read_port(u_char *p, u_char *last,
4672
in_port_t *port, u_char sep);
4773
static u_char *ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf,
4874
u_char *last);
75+
static ngx_int_t ngx_proxy_protocol_lookup_tlv(ngx_connection_t *c,
76+
ngx_str_t *tlvs, ngx_uint_t type, ngx_str_t *value);
77+
78+
79+
static ngx_proxy_protocol_tlv_entry_t ngx_proxy_protocol_tlv_entries[] = {
80+
{ ngx_string("alpn"), 0x01 },
81+
{ ngx_string("authority"), 0x02 },
82+
{ ngx_string("unique_id"), 0x05 },
83+
{ ngx_string("ssl"), 0x20 },
84+
{ ngx_string("netns"), 0x30 },
85+
{ ngx_null_string, 0x00 }
86+
};
87+
88+
89+
static ngx_proxy_protocol_tlv_entry_t ngx_proxy_protocol_tlv_ssl_entries[] = {
90+
{ ngx_string("version"), 0x21 },
91+
{ ngx_string("cn"), 0x22 },
92+
{ ngx_string("cipher"), 0x23 },
93+
{ ngx_string("sig_alg"), 0x24 },
94+
{ ngx_string("key_alg"), 0x25 },
95+
{ ngx_null_string, 0x00 }
96+
};
4997

5098

5199
u_char *
@@ -139,8 +187,14 @@ ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
139187

140188
invalid:
141189

190+
for (p = buf; p < last; p++) {
191+
if (*p == CR || *p == LF) {
192+
break;
193+
}
194+
}
195+
142196
ngx_log_error(NGX_LOG_ERR, c->log, 0,
143-
"broken header: \"%*s\"", (size_t) (last - buf), buf);
197+
"broken header: \"%*s\"", (size_t) (p - buf), buf);
144198

145199
return NULL;
146200
}
@@ -412,11 +466,147 @@ ngx_proxy_protocol_v2_read(ngx_connection_t *c, u_char *buf, u_char *last)
412466
&pp->src_addr, pp->src_port, &pp->dst_addr, pp->dst_port);
413467

414468
if (buf < end) {
415-
ngx_log_debug1(NGX_LOG_DEBUG_CORE, c->log, 0,
416-
"PROXY protocol v2 %z bytes of tlv ignored", end - buf);
469+
pp->tlvs.data = ngx_pnalloc(c->pool, end - buf);
470+
if (pp->tlvs.data == NULL) {
471+
return NULL;
472+
}
473+
474+
ngx_memcpy(pp->tlvs.data, buf, end - buf);
475+
pp->tlvs.len = end - buf;
417476
}
418477

419478
c->proxy_protocol = pp;
420479

421480
return end;
422481
}
482+
483+
484+
ngx_int_t
485+
ngx_proxy_protocol_get_tlv(ngx_connection_t *c, ngx_str_t *name,
486+
ngx_str_t *value)
487+
{
488+
u_char *p;
489+
size_t n;
490+
uint32_t verify;
491+
ngx_str_t ssl, *tlvs;
492+
ngx_int_t rc, type;
493+
ngx_proxy_protocol_tlv_ssl_t *tlv_ssl;
494+
ngx_proxy_protocol_tlv_entry_t *te;
495+
496+
if (c->proxy_protocol == NULL) {
497+
return NGX_DECLINED;
498+
}
499+
500+
ngx_log_debug1(NGX_LOG_DEBUG_CORE, c->log, 0,
501+
"PROXY protocol v2 get tlv \"%V\"", name);
502+
503+
te = ngx_proxy_protocol_tlv_entries;
504+
tlvs = &c->proxy_protocol->tlvs;
505+
506+
p = name->data;
507+
n = name->len;
508+
509+
if (n >= 4 && p[0] == 's' && p[1] == 's' && p[2] == 'l' && p[3] == '_') {
510+
511+
rc = ngx_proxy_protocol_lookup_tlv(c, tlvs, 0x20, &ssl);
512+
if (rc != NGX_OK) {
513+
return rc;
514+
}
515+
516+
if (ssl.len < sizeof(ngx_proxy_protocol_tlv_ssl_t)) {
517+
return NGX_ERROR;
518+
}
519+
520+
p += 4;
521+
n -= 4;
522+
523+
if (n == 6 && ngx_strncmp(p, "verify", 6) == 0) {
524+
525+
tlv_ssl = (ngx_proxy_protocol_tlv_ssl_t *) ssl.data;
526+
verify = ngx_proxy_protocol_parse_uint32(tlv_ssl->verify);
527+
528+
value->data = ngx_pnalloc(c->pool, NGX_INT32_LEN);
529+
if (value->data == NULL) {
530+
return NGX_ERROR;
531+
}
532+
533+
value->len = ngx_sprintf(value->data, "%uD", verify)
534+
- value->data;
535+
return NGX_OK;
536+
}
537+
538+
ssl.data += sizeof(ngx_proxy_protocol_tlv_ssl_t);
539+
ssl.len -= sizeof(ngx_proxy_protocol_tlv_ssl_t);
540+
541+
te = ngx_proxy_protocol_tlv_ssl_entries;
542+
tlvs = &ssl;
543+
}
544+
545+
if (n >= 2 && p[0] == '0' && p[1] == 'x') {
546+
547+
type = ngx_hextoi(p + 2, n - 2);
548+
if (type == NGX_ERROR) {
549+
ngx_log_error(NGX_LOG_ERR, c->log, 0,
550+
"invalid PROXY protocol TLV \"%V\"", name);
551+
return NGX_ERROR;
552+
}
553+
554+
return ngx_proxy_protocol_lookup_tlv(c, tlvs, type, value);
555+
}
556+
557+
for ( /* void */ ; te->type; te++) {
558+
if (te->name.len == n && ngx_strncmp(te->name.data, p, n) == 0) {
559+
return ngx_proxy_protocol_lookup_tlv(c, tlvs, te->type, value);
560+
}
561+
}
562+
563+
ngx_log_error(NGX_LOG_ERR, c->log, 0,
564+
"unknown PROXY protocol TLV \"%V\"", name);
565+
566+
return NGX_DECLINED;
567+
}
568+
569+
570+
static ngx_int_t
571+
ngx_proxy_protocol_lookup_tlv(ngx_connection_t *c, ngx_str_t *tlvs,
572+
ngx_uint_t type, ngx_str_t *value)
573+
{
574+
u_char *p;
575+
size_t n, len;
576+
ngx_proxy_protocol_tlv_t *tlv;
577+
578+
ngx_log_debug1(NGX_LOG_DEBUG_CORE, c->log, 0,
579+
"PROXY protocol v2 lookup tlv:%02xi", type);
580+
581+
p = tlvs->data;
582+
n = tlvs->len;
583+
584+
while (n) {
585+
if (n < sizeof(ngx_proxy_protocol_tlv_t)) {
586+
ngx_log_error(NGX_LOG_ERR, c->log, 0, "broken PROXY protocol TLV");
587+
return NGX_ERROR;
588+
}
589+
590+
tlv = (ngx_proxy_protocol_tlv_t *) p;
591+
len = ngx_proxy_protocol_parse_uint16(tlv->len);
592+
593+
p += sizeof(ngx_proxy_protocol_tlv_t);
594+
n -= sizeof(ngx_proxy_protocol_tlv_t);
595+
596+
if (n < len) {
597+
ngx_log_error(NGX_LOG_ERR, c->log, 0, "broken PROXY protocol TLV");
598+
return NGX_ERROR;
599+
}
600+
601+
if (tlv->type == type) {
602+
value->data = p;
603+
value->len = len;
604+
return NGX_OK;
605+
}
606+
607+
p += len;
608+
n -= len;
609+
}
610+
611+
return NGX_DECLINED;
612+
}

‎nginx/src/core/ngx_proxy_protocol.h

+3
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,16 @@ struct ngx_proxy_protocol_s {
2121
ngx_str_t dst_addr;
2222
in_port_t src_port;
2323
in_port_t dst_port;
24+
ngx_str_t tlvs;
2425
};
2526

2627

2728
u_char *ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf,
2829
u_char *last);
2930
u_char *ngx_proxy_protocol_write(ngx_connection_t *c, u_char *buf,
3031
u_char *last);
32+
ngx_int_t ngx_proxy_protocol_get_tlv(ngx_connection_t *c, ngx_str_t *name,
33+
ngx_str_t *value);
3134

3235

3336
#endif /* _NGX_PROXY_PROTOCOL_H_INCLUDED_ */

‎nginx/src/event/modules/ngx_iocp_module.c

+3-4
Original file line numberDiff line numberDiff line change
@@ -231,9 +231,8 @@ ngx_iocp_del_connection(ngx_connection_t *c, ngx_uint_t flags)
231231
}
232232

233233

234-
static
235-
ngx_int_t ngx_iocp_process_events(ngx_cycle_t *cycle, ngx_msec_t timer,
236-
ngx_uint_t flags)
234+
static ngx_int_t
235+
ngx_iocp_process_events(ngx_cycle_t *cycle, ngx_msec_t timer, ngx_uint_t flags)
237236
{
238237
int rc;
239238
u_int key;
@@ -356,7 +355,7 @@ ngx_iocp_create_conf(ngx_cycle_t *cycle)
356355

357356
cf = ngx_palloc(cycle->pool, sizeof(ngx_iocp_conf_t));
358357
if (cf == NULL) {
359-
return NGX_CONF_ERROR;
358+
return NULL;
360359
}
361360

362361
cf->threads = NGX_CONF_UNSET;

0 commit comments

Comments
 (0)