Skip to content

Commit 952f714

Browse files
PDowneyPDowney
authored
Updates
1 parent afb1229 commit 952f714

7 files changed

Lines changed: 65 additions & 592 deletions

File tree

‎.github/workflows/software-version-check.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -259,27 +259,27 @@ jobs:
259259
echo "::warning::Failed to fetch NGINX Cache Purge Module version, keeping current version"
260260
fi
261261
262-
# NGINX Dynamic TLS Records Patch
263-
echo "::debug::Fetching NGINX Dynamic TLS Records Patch SHA..."
264-
LATEST_NGINX_DYN_TLS_PATCH_SHA=$(curl -sL https://github.com/kn007/patch/raw/master/nginx_dynamic_tls_records.patch | sha256sum | awk '{print $1}')
265-
echo "::debug::Fetched patch SHA: '$LATEST_NGINX_DYN_TLS_PATCH_SHA'"
262+
# NGINX Dynamic TLS Records Patch - Track repository commits
263+
echo "::debug::Fetching NGINX Dynamic TLS Records Patch latest commit..."
264+
LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA=$(curl -sL https://api.github.com/repos/nginx-modules/ngx_http_tls_dyn_size/commits/master | jq -r '.sha')
265+
echo "::debug::Fetched commit SHA: '$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA'"
266266
267-
CURRENT_NGINX_DYN_TLS_PATCH_SHA=$(get_current_version "NGINX_DYN_TLS_PATCH_SHA")
267+
CURRENT_NGINX_DYN_TLS_PATCH_COMMIT_SHA=$(get_current_version "NGINX_DYN_TLS_PATCH_COMMIT_SHA")
268268
269-
if [[ "$CURRENT_NGINX_DYN_TLS_PATCH_SHA" != "$LATEST_NGINX_DYN_TLS_PATCH_SHA" ]]; then
270-
sed -i "s/^NGINX_DYN_TLS_PATCH_SHA=\"[^\"]*\"/NGINX_DYN_TLS_PATCH_SHA=\"$LATEST_NGINX_DYN_TLS_PATCH_SHA\"/" enginescript-variables.txt
269+
if [[ -n "$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA" && "$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA" != "null" && "$CURRENT_NGINX_DYN_TLS_PATCH_COMMIT_SHA" != "$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA" ]]; then
270+
sed -i "s/^NGINX_DYN_TLS_PATCH_COMMIT_SHA=\"[^\"]*\"/NGINX_DYN_TLS_PATCH_COMMIT_SHA=\"$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA\"/" enginescript-variables.txt
271271
SOFTWARE_VERSIONS_CHANGED=true
272-
echo "::notice::NGINX_DYN_TLS_PATCH_SHA update detected: $CURRENT_NGINX_DYN_TLS_PATCH_SHA -> $LATEST_NGINX_DYN_TLS_PATCH_SHA"
272+
echo "::notice::NGINX_DYN_TLS_PATCH_COMMIT_SHA update detected: $CURRENT_NGINX_DYN_TLS_PATCH_COMMIT_SHA -> $LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA"
273273
274274
# Add to changelog
275275
if [[ -z "$CHANGELOG_CONTENT" ]]; then
276-
CHANGELOG_CONTENT="| NGINX_DYN_TLS_PATCH | ${CURRENT_NGINX_DYN_TLS_PATCH_SHA:0:12}... | **${LATEST_NGINX_DYN_TLS_PATCH_SHA:0:12}...** |"
276+
CHANGELOG_CONTENT="| NGINX_DYN_TLS_PATCH | ${CURRENT_NGINX_DYN_TLS_PATCH_COMMIT_SHA:0:7} | **${LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA:0:7}** |"
277277
else
278-
CHANGELOG_CONTENT="${CHANGELOG_CONTENT}\n| NGINX_DYN_TLS_PATCH | ${CURRENT_NGINX_DYN_TLS_PATCH_SHA:0:12}... | **${LATEST_NGINX_DYN_TLS_PATCH_SHA:0:12}...** |"
278+
CHANGELOG_CONTENT="${CHANGELOG_CONTENT}\n| NGINX_DYN_TLS_PATCH | ${CURRENT_NGINX_DYN_TLS_PATCH_COMMIT_SHA:0:7} | **${LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA:0:7}** |"
279279
fi
280280
else
281-
if [[ -z "$LATEST_NGINX_DYN_TLS_PATCH_SHA" ]]; then
282-
echo "::warning::Failed to fetch NGINX Dynamic TLS Records Patch, keeping current SHA"
281+
if [[ -z "$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA" || "$LATEST_NGINX_DYN_TLS_PATCH_COMMIT_SHA" == "null" ]]; then
282+
echo "::warning::Failed to fetch NGINX Dynamic TLS Records Patch commit SHA, keeping current SHA"
283283
fi
284284
fi
285285

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,16 @@ Changes are organized by date, with the most recent changes listed first.
1818

1919
- **Static Files Cache Control**: Enhanced cache control headers for static assets
2020
- **Plugin Installation Options**: Added granular control over WordPress plugin installation
21+
- **INSTALL_ENGINESCRIPT_PLUGINS**: New option to control EngineScript custom plugins (Simple WP Optimizer, Simple Site Exporter)
22+
- **INSTALL_EXTRA_WP_PLUGINS**: New option to control optional recommended plugins (action-scheduler, app-for-cf, autodescription, etc.)
23+
- **Core Plugins Always Installed**: Essential plugins (nginx-helper, redis-cache, flush-opcache, mariadb-health-checks) remain mandatory
24+
- **Enhanced Flexibility**: Allows customization while maintaining critical functionality
25+
26+
### 🔄 NGINX PATCH SOURCE UPDATE
27+
28+
- **Dynamic TLS Records Patch Source**: Updated to use nginx-modules/ngx_http_tls_dyn_size repository
29+
- **New Source**: Changed from `https://github.com/kn007/patch` to `https://github.com/nginx-modules/ngx_http_tls_dyn_size`
30+
- **Documentation**: Updated README.md and patch file comments to reflect the correct upstream source
2131

2232
## 2025-10-02
2333

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ Once configured, your uptime monitoring data will automatically appear in the ad
225225
|NGINX MAINLINE|1.29.1|<https://nginx.org/en/download.html>|
226226
|NGINX CACHE PURGE|2.5.3|<https://github.com/nginx-modules/ngx_cache_purge>|
227227
|NGINX HEADERS MORE|0.39|<https://github.com/openresty/headers-more-nginx-module>|
228-
|NGINX PATCH: Dynamic TLS Records||<https://github.com/kn007/patch>|
228+
|NGINX PATCH: Dynamic TLS Records||<https://github.com/nginx-modules/ngx_http_tls_dyn_size>|
229229
|OPENSSL|3.5.2|<https://www.openssl.org/source/>|
230230
|PCRE2|10.46|<https://github.com/PCRE2Project/pcre2/releases>|
231231
|ZLIB-Cloudflare||<https://github.com/cloudflare/zlib>|

‎enginescript-variables.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
# Software Versions
99
LIBURING_VER="2.12"
1010
MARIADB_VER="11.8.3"
11-
NGINX_DYN_TLS_PATCH_SHA="1eeff69434585b2417e5d5c49e0479c8b22b205192f60b638a5b6c589152c40b"
11+
NGINX_DYN_TLS_PATCH_COMMIT_SHA="1eeff69434585b2417e5d5c49e0479c8b22b205192f60b638a5b6c589152c40b"
1212
NGINX_HEADER_VER="0.39"
1313
NGINX_PURGE_VER="2.5.3"
1414
NGINX_VER="1.29.1"

patches/nginx/nginx.patch renamed to patches/nginx/nginx_dyn_tls.patch

Lines changed: 40 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,22 @@ In case the connection idles for a given amount of time (1s,
2222
ssl_dyn_rec_timeout), the process repeats itself (i.e. begin sending small
2323
records again).
2424

25+
Upstream source:
26+
https://github.com/nginx-modules/ngx_http_tls_dyn_size/blob/master/nginx__dynamic_tls_records_1.29.2+.patch
2527

26-
diff --color -uNr a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
27-
--- a/src/event/ngx_event_openssl.c 2025-04-16 20:01:11.000000000 +0800
28-
+++ b/src/event/ngx_event_openssl.c 2025-04-17 02:43:15.616511714 +0800
29-
@@ -1620,6 +1620,7 @@
28+
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
29+
index 2b1d107df..88ae40ecc 100644
30+
--- a/src/event/ngx_event_openssl.c
31+
+++ b/src/event/ngx_event_openssl.c
32+
@@ -1594,6 +1594,7 @@ ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
3033

3134
sc->buffer = ((flags & NGX_SSL_BUFFER) != 0);
3235
sc->buffer_size = ssl->buffer_size;
3336
+ sc->dyn_rec = ssl->dyn_rec;
3437

3538
sc->session_ctx = ssl->ctx;
3639

37-
@@ -2591,6 +2592,41 @@
40+
@@ -2565,6 +2566,41 @@ ngx_ssl_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
3841

3942
for ( ;; ) {
4043

@@ -76,7 +79,7 @@ diff --color -uNr a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.
7679
while (in && buf->last < buf->end && send < limit) {
7780
if (in->buf->last_buf || in->buf->flush) {
7881
flush = 1;
79-
@@ -2730,6 +2766,9 @@
82+
@@ -2704,6 +2740,9 @@ ngx_ssl_write(ngx_connection_t *c, u_char *data, size_t size)
8083

8184
if (n > 0) {
8285

@@ -86,10 +89,11 @@ diff --color -uNr a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.
8689
if (c->ssl->saved_read_handler) {
8790

8891
c->read->handler = c->ssl->saved_read_handler;
89-
diff --color -uNr a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
90-
--- a/src/event/ngx_event_openssl.h 2025-04-16 20:01:11.000000000 +0800
91-
+++ b/src/event/ngx_event_openssl.h 2025-04-17 02:44:10.578945187 +0800
92-
@@ -86,6 +86,14 @@
92+
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
93+
index 6d171229c..246413fbb 100644
94+
--- a/src/event/ngx_event_openssl.h
95+
+++ b/src/event/ngx_event_openssl.h
96+
@@ -86,10 +86,19 @@
9397
typedef struct ngx_ssl_ocsp_s ngx_ssl_ocsp_t;
9498

9599

@@ -104,27 +108,23 @@ diff --color -uNr a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.
104108
struct ngx_ssl_s {
105109
SSL_CTX *ctx;
106110
ngx_log_t *log;
107-
@@ -95,6 +103,8 @@
108-
109-
ngx_rbtree_t staple_rbtree;
110-
ngx_rbtree_node_t staple_sentinel;
111-
+
111+
size_t buffer_size;
112112
+ ngx_ssl_dyn_rec_t dyn_rec;
113-
};
114113

114+
ngx_array_t certs;
115115

116-
@@ -133,6 +143,10 @@
117-
unsigned in_ocsp:1;
116+
@@ -133,6 +142,10 @@ struct ngx_ssl_connection_s {
118117
unsigned early_preread:1;
119118
unsigned write_blocked:1;
119+
unsigned sni_accepted:1;
120120
+
121121
+ ngx_ssl_dyn_rec_t dyn_rec;
122122
+ ngx_msec_t dyn_rec_last_write;
123123
+ ngx_uint_t dyn_rec_records_sent;
124124
};
125125

126126

127-
@@ -142,7 +156,7 @@
127+
@@ -142,7 +155,7 @@ struct ngx_ssl_connection_s {
128128
#define NGX_SSL_DFLT_BUILTIN_SCACHE -5
129129

130130

@@ -133,10 +133,11 @@ diff --color -uNr a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.
133133

134134
typedef struct ngx_ssl_sess_id_s ngx_ssl_sess_id_t;
135135

136-
diff --color -uNr a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
137-
--- a/src/http/modules/ngx_http_ssl_module.c 2025-04-16 20:01:11.000000000 +0800
138-
+++ b/src/http/modules/ngx_http_ssl_module.c 2025-04-17 02:43:15.618511766 +0800
139-
@@ -299,6 +299,41 @@
136+
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
137+
index abc8d49ab..3a614ab9c 100644
138+
--- a/src/http/modules/ngx_http_ssl_module.c
139+
+++ b/src/http/modules/ngx_http_ssl_module.c
140+
@@ -290,6 +290,41 @@ static ngx_command_t ngx_http_ssl_commands[] = {
140141
offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
141142
NULL },
142143

@@ -178,7 +179,7 @@ diff --color -uNr a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ng
178179
ngx_null_command
179180
};
180181

181-
@@ -639,6 +674,11 @@
182+
@@ -629,6 +664,11 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
182183
sscf->ocsp_cache_zone = NGX_CONF_UNSET_PTR;
183184
sscf->stapling = NGX_CONF_UNSET;
184185
sscf->stapling_verify = NGX_CONF_UNSET;
@@ -190,11 +191,11 @@ diff --color -uNr a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ng
190191

191192
return sscf;
192193
}
193-
@@ -705,6 +745,20 @@
194+
@@ -694,6 +734,20 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
194195
ngx_conf_merge_str_value(conf->stapling_responder,
195196
prev->stapling_responder, "");
196197

197-
+ ngx_conf_merge_value(conf->dyn_rec_enable, prev->dyn_rec_enable, 0);
198+
+ ngx_conf_merge_value(conf->dyn_rec_enable, prev->dyn_rec_enable, 0);
198199
+ ngx_conf_merge_msec_value(conf->dyn_rec_timeout, prev->dyn_rec_timeout,
199200
+ 1000);
200201
+ /* Default sizes for the dynamic record sizes are defined to fit maximal
@@ -211,9 +212,9 @@ diff --color -uNr a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ng
211212
conf->ssl.log = cf->log;
212213

213214
if (conf->certificates) {
214-
@@ -905,6 +959,28 @@
215-
return NGX_CONF_ERROR;
216-
}
215+
@@ -709,6 +763,28 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
216+
return NGX_CONF_ERROR;
217+
}
217218

218219
+ if (conf->dyn_rec_enable) {
219220
+ conf->ssl.dyn_rec.timeout = conf->dyn_rec_timeout;
@@ -237,13 +238,14 @@ diff --color -uNr a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ng
237238
+ conf->ssl.dyn_rec.timeout = 0;
238239
+ }
239240
+
240-
return NGX_CONF_OK;
241-
}
242-
243-
diff --color -uNr a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h
244-
--- a/src/http/modules/ngx_http_ssl_module.h 2025-04-16 20:01:11.000000000 +0800
245-
+++ b/src/http/modules/ngx_http_ssl_module.h 2025-04-17 02:43:15.618511766 +0800
246-
@@ -64,6 +64,12 @@
241+
} else if (!conf->reject_handshake) {
242+
return NGX_CONF_OK;
243+
}
244+
diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h
245+
index c69c8ffd2..1d7e63e2b 100644
246+
--- a/src/http/modules/ngx_http_ssl_module.h
247+
+++ b/src/http/modules/ngx_http_ssl_module.h
248+
@@ -62,6 +62,12 @@ typedef struct {
247249
ngx_flag_t stapling_verify;
248250
ngx_str_t stapling_file;
249251
ngx_str_t stapling_responder;
@@ -254,3 +256,5 @@ diff --color -uNr a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ng
254256
+ size_t dyn_rec_size_hi;
255257
+ ngx_uint_t dyn_rec_threshold;
256258
} ngx_http_ssl_srv_conf_t;
259+
260+

0 commit comments

Comments
 (0)