[PATCH] nginx: Update to version 1.24.0

[Adolf Belka <adolf.belka@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 11874 bytes --]

- Update from version 1.22.1 to 1.24.0
- Update of rootfile not required
- Changelog (including some CVE's)
Changes with nginx 1.24.0                                        11 Apr 2023
    *) 1.24.x stable branch.
Changes with nginx 1.23.4                                        28 Mar 2023
    *) Change: now TLSv1.3 protocol is enabled by default.
    *) Change: now nginx issues a warning if protocol parameters of a
       listening socket are redefined.
    *) Change: now nginx closes connections with lingering if pipelining was
       used by the client.
    *) Feature: byte ranges support in the ngx_http_gzip_static_module.
    *) Bugfix: port ranges in the "listen" directive did not work; the bug
       had appeared in 1.23.3.
       Thanks to Valentin Bartenev.
    *) Bugfix: incorrect location might be chosen to process a request if a
       prefix location longer than 255 characters was used in the
       configuration.
    *) Bugfix: non-ASCII characters in file names on Windows were not
       supported by the ngx_http_autoindex_module, the ngx_http_dav_module,
       and the "include" directive.
    *) Change: the logging level of the "data length too long", "length too
       short", "bad legacy version", "no shared signature algorithms", "bad
       digest length", "missing sigalgs extension", "encrypted length too
       long", "bad length", "bad key update", "mixed handshake and non
       handshake data", "ccs received early", "data between ccs and
       finished", "packet length too long", "too many warn alerts", "record
       too small", and "got a fin before a ccs" SSL errors has been lowered
       from "crit" to "info".
    *) Bugfix: a socket leak might occur when using HTTP/2 and the
       "error_page" directive to redirect errors with code 400.
    *) Bugfix: messages about logging to syslog errors did not contain
       information that the errors happened while logging to syslog.
       Thanks to Safar Safarly.
    *) Workaround: "gzip filter failed to use preallocated memory" alerts
       appeared in logs when using zlib-ng.
    *) Bugfix: in the mail proxy server.
Changes with nginx 1.23.3                                        13 Dec 2022
    *) Bugfix: an error might occur when reading PROXY protocol version 2
       header with large number of TLVs.
    *) Bugfix: a segmentation fault might occur in a worker process if SSI
       was used to process subrequests created by other modules.
       Thanks to Ciel Zhao.
    *) Workaround: when a hostname used in the "listen" directive resolves
       to multiple addresses, nginx now ignores duplicates within these
       addresses.
    *) Bugfix: nginx might hog CPU during unbuffered proxying if SSL
       connections to backends were used.
Changes with nginx 1.23.2                                        19 Oct 2022
    *) Security: processing of a specially crafted mp4 file by the
       ngx_http_mp4_module might cause a worker process crash, worker
       process memory disclosure, or might have potential other impact
       (CVE-2022-41741, CVE-2022-41742).
    *) Feature: the "$proxy_protocol_tlv_..." variables.
    *) Feature: TLS session tickets encryption keys are now automatically
       rotated when using shared memory in the "ssl_session_cache"
       directive.
    *) Change: the logging level of the "bad record type" SSL errors has
       been lowered from "crit" to "info".
       Thanks to Murilo Andrade.
    *) Change: now when using shared memory in the "ssl_session_cache"
       directive the "could not allocate new session" errors are logged at
       the "warn" level instead of "alert" and not more often than once per
       second.
    *) Bugfix: nginx/Windows could not be built with OpenSSL 3.0.x.
    *) Bugfix: in logging of the PROXY protocol errors.
       Thanks to Sergey Brester.
    *) Workaround: shared memory from the "ssl_session_cache" directive was
       spent on sessions using TLS session tickets when using TLSv1.3 with
       OpenSSL.
    *) Workaround: timeout specified with the "ssl_session_timeout"
       directive did not work when using TLSv1.3 with OpenSSL or BoringSSL.
Changes with nginx 1.23.1                                        19 Jul 2022
    *) Feature: memory usage optimization in configurations with SSL
       proxying.
    *) Feature: looking up of IPv4 addresses while resolving now can be
       disabled with the "ipv4=off" parameter of the "resolver" directive.
    *) Change: the logging level of the "bad key share", "bad extension",
       "bad cipher", and "bad ecpoint" SSL errors has been lowered from
       "crit" to "info".
    *) Bugfix: while returning byte ranges nginx did not remove the
       "Content-Range" header line if it was present in the original backend
       response.
    *) Bugfix: a proxied response might be truncated during reconfiguration
       on Linux; the bug had appeared in 1.17.5.
Changes with nginx 1.23.0                                        21 Jun 2022
    *) Change in internal API: now header lines are represented as linked
       lists.
    *) Change: now nginx combines arbitrary header lines with identical
       names when sending to FastCGI, SCGI, and uwsgi backends, in the
       $r->header_in() method of the ngx_http_perl_module, and during lookup
       of the "$http_...", "$sent_http_...", "$sent_trailer_...",
       "$upstream_http_...", and "$upstream_trailer_..." variables.
    *) Bugfix: if there were multiple "Vary" header lines in the backend
       response, nginx only used the last of them when caching.
    *) Bugfix: if there were multiple "WWW-Authenticate" header lines in the
       backend response and errors with code 401 were intercepted or the
       "auth_request" directive was used, nginx only sent the first of the
       header lines to the client.
    *) Change: the logging level of the "application data after close
       notify" SSL errors has been lowered from "crit" to "info".
    *) Bugfix: connections might hang if nginx was built on Linux 2.6.17 or
       newer, but was used on systems without EPOLLRDHUP support, notably
       with epoll emulation layers; the bug had appeared in 1.17.5.
       Thanks to Marcus Ball.
    *) Bugfix: nginx did not cache the response if the "Expires" response
       header line disabled caching, but following "Cache-Control" header
       line enabled caching.
Changes with nginx 1.21.6                                        25 Jan 2022
    *) Bugfix: when using EPOLLEXCLUSIVE on Linux client connections were
       unevenly distributed among worker processes.
    *) Bugfix: nginx returned the "Connection: keep-alive" header line in
       responses during graceful shutdown of old worker processes.
    *) Bugfix: in the "ssl_session_ticket_key" when using TLSv1.3.
Changes with nginx 1.21.5                                        28 Dec 2021
    *) Change: now nginx is built with the PCRE2 library by default.
    *) Change: now nginx always uses sendfile(SF_NODISKIO) on FreeBSD.
    *) Feature: support for sendfile(SF_NOCACHE) on FreeBSD.
    *) Feature: the $ssl_curve variable.
    *) Bugfix: connections might hang when using HTTP/2 without SSL with the
       "sendfile" and "aio" directives.
Changes with nginx 1.21.4                                        02 Nov 2021
    *) Change: support for NPN instead of ALPN to establish HTTP/2
       connections has been removed.
    *) Change: now nginx rejects SSL connections if ALPN is used by the
       client, but no supported protocols can be negotiated.
    *) Change: the default value of the "sendfile_max_chunk" directive was
       changed to 2 megabytes.
    *) Feature: the "proxy_half_close" directive in the stream module.
    *) Feature: the "ssl_alpn" directive in the stream module.
    *) Feature: the $ssl_alpn_protocol variable.
    *) Feature: support for SSL_sendfile() when using OpenSSL 3.0.
    *) Feature: the "mp4_start_key_frame" directive in the
       ngx_http_mp4_module.
       Thanks to Tracey Jaquith.
    *) Bugfix: in the $content_length variable when using chunked transfer
       encoding.
    *) Bugfix: after receiving a response with incorrect length from a
       proxied backend nginx might nevertheless cache the connection.
       Thanks to Awdhesh Mathpal.
    *) Bugfix: invalid headers from backends were logged at the "info" level
       instead of "error"; the bug had appeared in 1.21.1.
    *) Bugfix: requests might hang when using HTTP/2 and the "aio_write"
       directive.
Changes with nginx 1.21.3                                        07 Sep 2021
    *) Change: optimization of client request body reading when using
       HTTP/2.
    *) Bugfix: in request body filters internal API when using HTTP/2 and
       buffering of the data being processed.
Changes with nginx 1.21.2                                        31 Aug 2021
    *) Change: now nginx rejects HTTP/1.0 requests with the
       "Transfer-Encoding" header line.
    *) Change: export ciphers are no longer supported.
    *) Feature: OpenSSL 3.0 compatibility.
    *) Feature: the "Auth-SSL-Protocol" and "Auth-SSL-Cipher" header lines
       are now passed to the mail proxy authentication server.
       Thanks to Rob Mueller.
    *) Feature: request body filters API now permits buffering of the data
       being processed.
    *) Bugfix: backend SSL connections in the stream module might hang after
       an SSL handshake.
    *) Bugfix: the security level, which is available in OpenSSL 1.1.0 or
       newer, did not affect loading of the server certificates when set
       with "@SECLEVEL=N" in the "ssl_ciphers" directive.
    *) Bugfix: SSL connections with gRPC backends might hang if select,
       poll, or /dev/poll methods were used.
    *) Bugfix: when using HTTP/2 client request body was always written to
       disk if the "Content-Length" header line was not present in the
       request.

Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
 lfs/nginx | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lfs/nginx b/lfs/nginx
index ef13eefb4..ef314a177 100644
--- a/lfs/nginx
+++ b/lfs/nginx
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2020  IPFire Team  <info(a)ipfire.org>                     #
+# Copyright (C) 2007-2023  IPFire Team  <info(a)ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -25,15 +25,15 @@
 include Config
 
 SUMMARY    = A HTTP server and IMAP/POP3 proxy server
-VER        = 1.22.1
+VER        = 1.24.0
 
 THISAPP    = nginx-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
 DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
-PROG	   = nginx
-PAK_VER	   = 14
+PROG	    = nginx
+PAK_VER    = 15
 
 DEPS       =
 
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 253cd4c53ed0e6d3da8ca0f0ab3b2c46f6c7222c4f6fedd05302dd05efee31869d25a33947cca3ca526899cbdfcea96754be34e15643ebd77da24175319edb46
+$(DL_FILE)_BLAKE2 = 7f671c57666dec822bff72fcf0e4eec35ecf981b8f1e489827f9bbbf9179036f61c9fdc7e497c076ccaeb35b9ba3dfe7684e4fc91ee9cae52601f68859bb034d
 
 install : $(TARGET)
 
-- 
2.40.1