Adding upstream version 1.52.0.upstream/1.52.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

9 files changed, 394 insertions, 0 deletions

diff --git a/contrib/.gitignore b/contrib/.gitignore
new file mode 100644
index 0000000..85acde3
--- /dev/null
+++ b/contrib/.gitignore
@@ -0,0 +1,3 @@
+nghttpx-init
+nghttpx.service
+nghttpx-upstart.conf
diff --git a/contrib/CMakeLists.txt b/contrib/CMakeLists.txt
new file mode 100644
index 0000000..f598f7b
--- /dev/null
+++ b/contrib/CMakeLists.txt
@@ -0,0 +1,12 @@
+set(CONFIGFILES
+  nghttpx-init
+  nghttpx.service
+  nghttpx-upstart.conf
+)
+
+# Note that the execute permissions of nghttpx-init is preserved
+foreach(name IN LISTS CONFIGFILES)
+  configure_file("${name}.in" "${name}" @ONLY)
+endforeach()
+
+# set(EXTRA_DIST ${CONFIGFILES} nghttpx-logrotate tlsticketupdate.go)
diff --git a/contrib/Makefile.am b/contrib/Makefile.am
new file mode 100644
index 0000000..5a02e2f
--- /dev/null
+++ b/contrib/Makefile.am
@@ -0,0 +1,51 @@
+# nghttp2 - HTTP/2 C Library
+
+# Copyright (c) 2014 Tatsuhiro Tsujikawa
+
+# Permission is hereby granted, free of charge, to any person obtaining
+# a copy of this software and associated documentation files (the
+# "Software"), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish,
+# distribute, sublicense, and/or sell copies of the Software, and to
+# permit persons to whom the Software is furnished to do so, subject to
+# the following conditions:
+
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+configfiles = nghttpx-init nghttpx.service nghttpx-upstart.conf
+
+EXTRA_DIST = \
+	CMakeLists.txt \
+	$(configfiles:%=%.in) \
+	nghttpx-logrotate \
+	tlsticketupdate.go
+
+edit = sed -e 's|@bindir[@]|$(bindir)|g'
+
+nghttpx-init: $(srcdir)/nghttpx-init.in
+	rm -f $@ $@.tmp
+	$(edit) $< > $@.tmp
+	chmod +x $@.tmp
+	mv $@.tmp $@
+
+nghttpx.service: $(srcdir)/nghttpx.service.in
+	$(edit) $< > $@
+
+nghttpx-upstart.conf: $(srcdir)/nghttpx-upstart.conf.in
+	$(edit) $< > $@
+
+$(configfiles): Makefile
+
+all-local: $(configfiles)
+
+clean-local:
+	-rm -f nghttpx-init.tmp $(configfiles)
diff --git a/contrib/nghttpx-init.in b/contrib/nghttpx-init.in
new file mode 100755
index 0000000..2b3c76e
--- /dev/null
+++ b/contrib/nghttpx-init.in
@@ -0,0 +1,164 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          nghttpx
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: nghttpx initscript
+# Description:       nghttpx initscript
+### END INIT INFO
+
+# Author: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
+#
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin
+DESC="HTTP/2 reverse proxy"
+NAME=nghttpx
+# Depending on the configuration, binary may be located under @sbindir@
+DAEMON=@bindir@/$NAME
+PIDFILE=/var/run/$NAME.pid
+DAEMON_ARGS="--conf /etc/nghttpx/nghttpx.conf --pid-file=$PIDFILE --daemon"
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
+		$DAEMON_ARGS \
+		|| return 2
+	# Add code here, if necessary, that waits for the process to be ready
+	# to handle requests from services started subsequently which depend
+	# on this one.  As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	#start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+	#[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+	;;
+  upgrade)
+	log_daemon_msg "Upgrading $DESC" "$NAME"
+	oldpid=`pidofproc -p $PIDFILE $NAME`
+	case "$?" in
+		0)
+			log_progress_msg "Sending SIGUSR2 to $oldpid..."
+			kill -USR2 $oldpid
+			log_progress_msg "Waiting for new binary..."
+			for i in 1 2 3 4 5 ; do
+				sleep 1
+				newpid=`pidofproc -p $PIDFILE $NAME`
+				if [ "$newpid" != "$oldpid" ] ; then
+					break
+				fi
+			done
+			if [ "$newpid" != "$oldpid" ] ; then
+				log_progress_msg "Sending SIGQUIT to $oldpid..."
+				kill -QUIT $oldpid
+				log_end_msg 0
+			else
+				log_progress_msg "New binary failed to start"
+				log_end_msg 1
+			fi
+			;;
+		*)
+			log_progress_msg "pidofproc() failed"
+			log_end_msg 1
+		;;
+	esac
+	;;
+  restart|force-reload)
+	#
+	# If the "reload" option is implemented then remove the
+	# 'force-reload' alias
+	#
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+	  	# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload|upgrade}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/contrib/nghttpx-logrotate b/contrib/nghttpx-logrotate
new file mode 100644
index 0000000..c715ced
--- /dev/null
+++ b/contrib/nghttpx-logrotate
@@ -0,0 +1,11 @@
+/var/log/nghttpx/*.log {
+  weekly
+  rotate 52
+  missingok
+  compress
+  delaycompress
+  notifempty
+  postrotate
+    [ -s /var/run/nghttpx.pid ] && kill -USR1 `cat /var/run/nghttpx.pid` 2> /dev/null || true
+  endscript
+}
diff --git a/contrib/nghttpx-upstart.conf.in b/contrib/nghttpx-upstart.conf.in
new file mode 100644
index 0000000..0b79916
--- /dev/null
+++ b/contrib/nghttpx-upstart.conf.in
@@ -0,0 +1,8 @@
+# vim: ft=upstart:
+
+description "HTTP/2 reverse proxy"
+
+start on runlevel [2]
+stop on runlevel [016]
+
+exec @bindir@/nghttpx
diff --git a/contrib/nghttpx.service.in b/contrib/nghttpx.service.in
new file mode 100644
index 0000000..06fb736
--- /dev/null
+++ b/contrib/nghttpx.service.in
@@ -0,0 +1,17 @@
+[Unit]
+Description=HTTP/2 proxy
+Documentation=man:nghttpx
+After=network.target
+
+[Service]
+Type=notify
+ExecStart=@bindir@/nghttpx --conf=/etc/nghttpx/nghttpx.conf
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillSignal=SIGQUIT
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=full
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
diff --git a/contrib/tlsticketupdate.go b/contrib/tlsticketupdate.go
new file mode 100644
index 0000000..ff3d759
--- /dev/null
+++ b/contrib/tlsticketupdate.go
@@ -0,0 +1,112 @@
+//
+// nghttp2 - HTTP/2 C Library
+//
+// Copyright (c) 2015 Tatsuhiro Tsujikawa
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+package main
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/binary"
+	"flag"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/bradfitz/gomemcache/memcache"
+)
+
+func makeKey(len int) []byte {
+	b := make([]byte, len)
+	if _, err := rand.Read(b); err != nil {
+		log.Fatalf("rand.Read: %v", err)
+	}
+	return b
+}
+
+func main() {
+	var host = flag.String("host", "127.0.0.1", "memcached host")
+	var port = flag.Int("port", 11211, "memcached port")
+	var cipher = flag.String("cipher", "aes-128-cbc", "cipher for TLS ticket encryption")
+	var interval = flag.Int("interval", 3600, "interval to update TLS ticket keys")
+
+	flag.Parse()
+
+	var keylen int
+	switch *cipher {
+	case "aes-128-cbc":
+		keylen = 48
+	case "aes-256-cbc":
+		keylen = 80
+	default:
+		log.Fatalf("cipher: unknown cipher %v", cipher)
+	}
+
+	mc := memcache.New(fmt.Sprintf("%v:%v", *host, *port))
+
+	keys := [][]byte{
+		makeKey(keylen), // current encryption key
+		makeKey(keylen), // next encryption key; now decryption only
+	}
+
+	for {
+		buf := new(bytes.Buffer)
+		if err := binary.Write(buf, binary.BigEndian, uint32(1)); err != nil {
+			log.Fatalf("failed to write version: %v", err)
+		}
+
+		for _, key := range keys {
+			if err := binary.Write(buf, binary.BigEndian, uint16(keylen)); err != nil {
+				log.Fatalf("failed to write length: %v", err)
+			}
+			if _, err := buf.Write(key); err != nil {
+				log.Fatalf("buf.Write: %v", err)
+			}
+		}
+
+		mc.Set(&memcache.Item{
+			Key:        "nghttpx:tls-ticket-key",
+			Value:      buf.Bytes(),
+			Expiration: int32((*interval) + 300),
+		})
+
+		<-time.After(time.Duration(*interval) * time.Second)
+
+		// rotate keys.  the last key is now encryption key.
+		// generate new key and append it to the last, so that
+		// we can at least decrypt TLS ticket encrypted by new
+		// key on the host which does not get new key yet.
+		// keep at most past 11 keys as decryption only key
+		n := len(keys) + 1
+		if n > 13 {
+			n = 13
+		}
+		newKeys := make([][]byte, n)
+		newKeys[0] = keys[len(keys)-1]
+		copy(newKeys[1:], keys[0:n-2])
+		newKeys[n-1] = makeKey(keylen)
+
+		keys = newKeys
+	}
+
+}
diff --git a/contrib/usr.sbin.nghttpx b/contrib/usr.sbin.nghttpx
new file mode 100644
index 0000000..891ff52
--- /dev/null
+++ b/contrib/usr.sbin.nghttpx
@@ -0,0 +1,16 @@
+#include <tunables/global>
+
+/usr/sbin/nghttpx {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/openssl>
+
+  capability setgid,
+  capability setuid,
+
+  /usr/sbin/nghttpx rmix,      # allow to run itself
+  /etc/nghttpx/nghttpx.conf r, # allow to read the config file
+  /etc/ssl/** r,               # give access to ssl keys
+
+  /{,var/}run/nghttpx.pid lw,  # allow to store a pid file
+}