Latest update - 7316

src/core/ngx_connection.c

@@ -96,7 +96,7 @@ ngx_create_listening(ngx_conf_t *cf, struct sockaddr *sockaddr,
 
 
 ngx_int_t
-ngx_clone_listening(ngx_conf_t *cf, ngx_listening_t *ls)
+ngx_clone_listening(ngx_cycle_t *cycle, ngx_listening_t *ls)
 {
 #if (NGX_HAVE_REUSEPORT)
 
@@ -104,20 +104,19 @@ ngx_clone_listening(ngx_conf_t *cf, ngx_listening_t *ls)
     ngx_core_conf_t  *ccf;
     ngx_listening_t   ols;
 
-    if (!ls->reuseport) {
+    if (!ls->reuseport || ls->worker != 0) {
         return NGX_OK;
     }
 
     ols = *ls;
 
-    ccf = (ngx_core_conf_t *) ngx_get_conf(cf->cycle->conf_ctx,
+    ccf = (ngx_core_conf_t *) ngx_get_conf(cycle->conf_ctx, ngx_core_module);
-                                           ngx_core_module);
 
     for (n = 1; n < ccf->worker_processes; n++) {
 
         /* create a socket for each worker process */
 
-        ls = ngx_array_push(&cf->cycle->listening);
+        ls = ngx_array_push(&cycle->listening);
         if (ls == NULL) {
             return NGX_ERROR;
         }

src/core/ngx_connection.h

@@ -210,7 +210,7 @@ struct ngx_connection_s {
 
 ngx_listening_t *ngx_create_listening(ngx_conf_t *cf, struct sockaddr *sockaddr,
     socklen_t socklen);
-ngx_int_t ngx_clone_listening(ngx_conf_t *cf, ngx_listening_t *ls);
+ngx_int_t ngx_clone_listening(ngx_cycle_t *cycle, ngx_listening_t *ls);
 ngx_int_t ngx_set_inherited_sockets(ngx_cycle_t *cycle);
 ngx_int_t ngx_open_listening_sockets(ngx_cycle_t *cycle);
 void ngx_configure_listening_sockets(ngx_cycle_t *cycle);

src/event/ngx_event.c

@@ -410,12 +410,52 @@ ngx_handle_write_event(ngx_event_t *wev, size_t lowat)
 static char *
 ngx_event_init_conf(ngx_cycle_t *cycle, void *conf)
 {
+#if (NGX_HAVE_REUSEPORT)
+    ngx_uint_t        i;
+    ngx_listening_t  *ls;
+#endif
+
     if (ngx_get_conf(cycle->conf_ctx, ngx_events_module) == NULL) {
         ngx_log_error(NGX_LOG_EMERG, cycle->log, 0,
                       "no \"events\" section in configuration");
         return NGX_CONF_ERROR;
     }
 
+    if (cycle->connection_n < cycle->listening.nelts + 1) {
+
+        /*
+         * there should be at least one connection for each listening
+         * socket, plus an additional connection for channel
+         */
+
+        ngx_log_error(NGX_LOG_EMERG, cycle->log, 0,
+                      "%ui worker_connections are not enough "
+                      "for %ui listening sockets",
+                      cycle->connection_n, cycle->listening.nelts);
+
+        return NGX_CONF_ERROR;
+    }
+
+#if (NGX_HAVE_REUSEPORT)
+
+    ls = cycle->listening.elts;
+    for (i = 0; i < cycle->listening.nelts; i++) {
+
+        if (!ls[i].reuseport || ls[i].worker != 0) {
+            continue;
+        }
+
+        if (ngx_clone_listening(cycle, &ls[i]) != NGX_OK) {
+            return NGX_CONF_ERROR;
+        }
+
+        /* cloning may change cycle->listening.elts */
+
+        ls = cycle->listening.elts;
+    }
+
+#endif
+
     return NGX_CONF_OK;
 }
 

src/http/ngx_http.c

@@ -1685,10 +1685,6 @@ ngx_http_init_listening(ngx_conf_t *cf, ngx_http_conf_port_t *port)
             break;
         }
 
-        if (ngx_clone_listening(cf, ls) != NGX_OK) {
-            return NGX_ERROR;
-        }
-
         addr++;
         last--;
     }

src/stream/ngx_stream.c

@@ -538,10 +538,6 @@ ngx_stream_optimize_servers(ngx_conf_t *cf, ngx_array_t *ports)
                 break;
             }
 
-            if (ngx_clone_listening(cf, ls) != NGX_OK) {
-                return NGX_CONF_ERROR;
-            }
-
             addr++;
             last--;
         }

src/stream/ngx_stream_ssl_preread_module.c

@@ -21,6 +21,7 @@ typedef struct {
     u_char         *pos;
     u_char         *dst;
     u_char          buf[4];
+    u_char          version[2];
     ngx_str_t       host;
     ngx_str_t       alpn;
     ngx_log_t      *log;
@@ -32,6 +33,8 @@ typedef struct {
 static ngx_int_t ngx_stream_ssl_preread_handler(ngx_stream_session_t *s);
 static ngx_int_t ngx_stream_ssl_preread_parse_record(
     ngx_stream_ssl_preread_ctx_t *ctx, u_char *pos, u_char *last);
+static ngx_int_t ngx_stream_ssl_preread_protocol_variable(
+    ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data);
 static ngx_int_t ngx_stream_ssl_preread_server_name_variable(
     ngx_stream_session_t *s, ngx_stream_variable_value_t *v, uintptr_t data);
 static ngx_int_t ngx_stream_ssl_preread_alpn_protocols_variable(
@@ -86,6 +89,9 @@ ngx_module_t  ngx_stream_ssl_preread_module = {
 
 static ngx_stream_variable_t  ngx_stream_ssl_preread_vars[] = {
 
+    { ngx_string("ssl_preread_protocol"), NULL,
+      ngx_stream_ssl_preread_protocol_variable, 0, 0, 0 },
+
     { ngx_string("ssl_preread_server_name"), NULL,
       ngx_stream_ssl_preread_server_name_variable, 0, 0, 0 },
 
@@ -196,7 +202,8 @@ ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
     enum {
         sw_start = 0,
         sw_header,          /* handshake msg_type, length */
-        sw_head_tail,       /* version, random */
+        sw_version,         /* client_version */
+        sw_random,          /* random */
         sw_sid_len,         /* session_id length */
         sw_sid,             /* session_id */
         sw_cs_len,          /* cipher_suites length */
@@ -210,7 +217,8 @@ ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
         sw_sni_host,        /* SNI host_name */
         sw_alpn_len,        /* ALPN length */
         sw_alpn_proto_len,  /* ALPN protocol_name length */
-        sw_alpn_proto_data  /* ALPN protocol_name */
+        sw_alpn_proto_data, /* ALPN protocol_name */
+        sw_supver_len       /* supported_versions length */
     } state;
 
     ngx_log_debug2(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
@@ -254,13 +262,19 @@ ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
                 return NGX_DECLINED;
             }
 
-            state = sw_head_tail;
+            state = sw_version;
-            dst = NULL;
+            dst = ctx->version;
-            size = 34;
+            size = 2;
             left = (p[1] << 16) + (p[2] << 8) + p[3];
             break;
 
-        case sw_head_tail:
+        case sw_version:
+            state = sw_random;
+            dst = NULL;
+            size = 32;
+            break;
+
+        case sw_random:
             state = sw_sid_len;
             dst = p;
             size = 1;
@@ -334,6 +348,14 @@ ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
                 break;
             }
 
+            if (p[0] == 0 && p[1] == 43) {
+                /* supported_versions extension */
+                state = sw_supver_len;
+                dst = p;
+                size = 1;
+                break;
+            }
+
             state = sw_ext;
             dst = NULL;
             size = (p[2] << 8) + p[3];
@@ -434,6 +456,19 @@ ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
             dst = NULL;
             size = 0;
             break;
+
+        case sw_supver_len:
+            ngx_log_debug0(NGX_LOG_DEBUG_STREAM, ctx->log, 0,
+                           "ssl preread: supported_versions");
+
+            /* set TLSv1.3 */
+            ctx->version[0] = 3;
+            ctx->version[1] = 4;
+
+            state = sw_ext;
+            dst = NULL;
+            size = p[0];
+            break;
         }
 
         if (left < size) {
@@ -453,6 +488,58 @@ ngx_stream_ssl_preread_parse_record(ngx_stream_ssl_preread_ctx_t *ctx,
 }
 
 
+static ngx_int_t
+ngx_stream_ssl_preread_protocol_variable(ngx_stream_session_t *s,
+    ngx_variable_value_t *v, uintptr_t data)
+{
+    ngx_str_t                      version;
+    ngx_stream_ssl_preread_ctx_t  *ctx;
+
+    ctx = ngx_stream_get_module_ctx(s, ngx_stream_ssl_preread_module);
+
+    if (ctx == NULL) {
+        v->not_found = 1;
+        return NGX_OK;
+    }
+
+    /* SSL_get_version() format */
+
+    ngx_str_null(&version);
+
+    switch (ctx->version[0]) {
+    case 2:
+        ngx_str_set(&version, "SSLv2");
+        break;
+    case 3:
+        switch (ctx->version[1]) {
+        case 0:
+            ngx_str_set(&version, "SSLv3");
+            break;
+        case 1:
+            ngx_str_set(&version, "TLSv1");
+            break;
+        case 2:
+            ngx_str_set(&version, "TLSv1.1");
+            break;
+        case 3:
+            ngx_str_set(&version, "TLSv1.2");
+            break;
+        case 4:
+            ngx_str_set(&version, "TLSv1.3");
+            break;
+        }
+    }
+
+    v->valid = 1;
+    v->no_cacheable = 0;
+    v->not_found = 0;
+    v->len = version.len;
+    v->data = version.data;
+
+    return NGX_OK;
+}
+
+
 static ngx_int_t
 ngx_stream_ssl_preread_server_name_variable(ngx_stream_session_t *s,
     ngx_variable_value_t *v, uintptr_t data)