@@ -1,20 +1,17 @@

-

-# HG changeset patch

-# User Ruslan Ermilov <ru@nginx.com>

-# Date 1541510975 -10800

-# Node ID 1c6b6163c03945bcc65c252cc42b0af18744c085

-# Parent  fdc19a3289c1138bfe49ddbde310778ddc495729

 HTTP/2: flood detection.

 Fixed uncontrolled memory growth in case peer is flooding us with

 some frames (e.g., SETTINGS and PING) and doesn't read data.  Fix

 is to limit the number of allocated control frames.

-

-diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c

-index 2c62190..b9943c9 100644

-+++ b/src/http/v2/ngx_http_v2.c

-@@ -635,6 +635,7 @@ ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c)

+author	Ruslan Ermilov <ru@nginx.com>

+date	Tue, 06 Nov 2018 16:29:35 +0300 (2 months ago)

+parents	fdc19a3289c1

+children	9200b41db765

+files	src/http/v2/ngx_http_v2.c src/http/v2/ngx_http_v2.h

+diffstat	2 files changed, 12 insertions(+), 1 deletions(-) [+]

+--- a/src/http/v2/ngx_http_v2.c	Tue Nov 06 16:29:18 2018 +0300

+@@ -664,6 +664,7 @@

      h2c->pool = NULL;

      h2c->free_frames = NULL;

@@ -22,7 +19,7 @@ index 2c62190..b9943c9 100644

      h2c->free_fake_connections = NULL;

  #if (NGX_HTTP_SSL)

-@@ -2678,7 +2679,7 @@ ngx_http_v2_get_frame(ngx_http_v2_connection_t *h2c, size_t length,

+@@ -2895,7 +2896,7 @@

          frame->blocked = 0;

@@ -31,7 +28,7 @@ index 2c62190..b9943c9 100644

          pool = h2c->pool ? h2c->pool : h2c->connection->pool;

          frame = ngx_pcalloc(pool, sizeof(ngx_http_v2_out_frame_t));

-@@ -2702,6 +2703,15 @@ ngx_http_v2_get_frame(ngx_http_v2_connection_t *h2c, size_t length,

+@@ -2919,6 +2920,15 @@

          frame->last = frame->first;

          frame->handler = ngx_http_v2_frame_handler;

@@ -47,15 +44,13 @@ index 2c62190..b9943c9 100644

      }

  #if (NGX_DEBUG)

-diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h

-index 42e0eb1..11f774a 100644

-+++ b/src/http/v2/ngx_http_v2.h

-@@ -115,6 +115,7 @@ struct ngx_http_v2_connection_s {

+--- a/src/http/v2/ngx_http_v2.h	Tue Nov 06 16:29:18 2018 +0300

+@@ -120,6 +120,7 @@

      ngx_http_connection_t           *http_connection;

      ngx_uint_t                       processing;

 +    ngx_uint_t                       frames;

-     size_t                           send_window;

-     size_t                           recv_window;

+     ngx_uint_t                       pushing;

+     ngx_uint_t                       concurrent_pushes;

@@ -1,9 +1,3 @@

-

-# HG changeset patch

-# User Ruslan Ermilov <ru@nginx.com>

-# Date 1541510989 -10800

-# Node ID 9200b41db765fbd6709765ba2d218e78ad8e9860

-# Parent  1c6b6163c03945bcc65c252cc42b0af18744c085

 HTTP/2: limit the number of idle state switches.

 An attack that continuously switches HTTP/2 connection between

@@ -17,21 +11,21 @@ This limits possible CPU usage in one connection, and also

 imposes a limit on the maximum lifetime of a connection.

 Initially reported by Gal Goldshtein from F5 Networks.

-

-diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c

-index b9943c9..83f9c4a 100644

-+++ b/src/http/v2/ngx_http_v2.c

-@@ -4237,12 +4237,19 @@ ngx_http_v2_idle_handler(ngx_event_t *rev)

+author	Ruslan Ermilov <ru@nginx.com>

+date	Tue, 06 Nov 2018 16:29:49 +0300 (2 months ago)

+parents	1c6b6163c039

+children	6afba58cd5a3

+files	src/http/v2/ngx_http_v2.c src/http/v2/ngx_http_v2.h

+diffstat	2 files changed, 11 insertions(+), 3 deletions(-) [+]

+--- a/src/http/v2/ngx_http_v2.c	Tue Nov 06 16:29:35 2018 +0300

+@@ -4481,12 +4481,19 @@

  #endif

--    c->destroyed = 0;

--    ngx_reusable_connection(c, 0);

--

-     h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,

-                                          ngx_http_v2_module);

- 

++    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,

++                                         ngx_http_v2_module);

++

 +    if (h2c->idle++ > 10 * h2scf->max_requests) {

 +        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,

 +                      "http2 flood detected");

@@ -39,21 +33,22 @@ index b9943c9..83f9c4a 100644

 +        return;

 +    }

 +

-+    c->destroyed = 0;

-+    ngx_reusable_connection(c, 0);

-+

+     c->destroyed = 0;

+     ngx_reusable_connection(c, 0);

+ 

+-    h2scf = ngx_http_get_module_srv_conf(h2c->http_connection->conf_ctx,

+-                                         ngx_http_v2_module);

+-

      h2c->pool = ngx_create_pool(h2scf->pool_size, h2c->connection->log);

      if (h2c->pool == NULL) {

          ngx_http_v2_finalize_connection(h2c, NGX_HTTP_V2_INTERNAL_ERROR);

-diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h

-index 11f774a..83dbea3 100644

-+++ b/src/http/v2/ngx_http_v2.h

-@@ -116,6 +116,7 @@ struct ngx_http_v2_connection_s {

+--- a/src/http/v2/ngx_http_v2.h	Tue Nov 06 16:29:35 2018 +0300

+@@ -121,6 +121,7 @@

      ngx_uint_t                       processing;

      ngx_uint_t                       frames;

 +    ngx_uint_t                       idle;

-     size_t                           send_window;

-     size_t                           recv_window;

+     ngx_uint_t                       pushing;

+     ngx_uint_t                       concurrent_pushes;

@@ -1,14 +1,14 @@

 Summary:        High-performance HTTP server and reverse proxy

 Name:           nginx

-Version:        1.13.8

-Release:        7%{?dist}

+Version:        1.13.10

+Release:        1%{?dist}

 License:        BSD-2-Clause

 URL:            http://nginx.org/download/nginx-%{version}.tar.gz

 Group:          Applications/System

 Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        %{name}-%{version}.tar.gz

-%define sha1    nginx=a1f9348c9c46f449a0b549d0519dd34191d30cee

+%define sha1    nginx=1cb3cff21370aa71cc0f127ff26759f78bc08168

 Source1:        nginx.service

 Source2:        nginx-njs-0.2.1.tar.gz

 %define sha1    nginx-njs=fd8c3f2d219f175be958796e3beaa17f3b465126

@@ -77,6 +77,8 @@ install -p -m 0644 %{SOURCE1} %{buildroot}/usr/lib/systemd/system/nginx.service

 %dir %{_var}/log/nginx

 %changelog

+*   Mon Jan 28 2019 Keerthana K <keerthanak@vmware.com> 1.13.10-1

+-   Update to version 1.13.10

 *   Thu Jan 17 2019 Keerthana K <keerthanak@vmware.com> 1.13.8-7

 -   Adding http v2 module support.

 *   Mon Dec 17 2018 Ankit Jain <ankitja@vmware.com> 1.13.8-6