From 28cea613e4d327458cc715425cfa9ee399c68b11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Nov=C3=BD?= Date: Fri, 21 Aug 2020 14:14:23 +0200 Subject: [PATCH 001/267] d/p/CVE-2019-20372.patch: Drop, applied upstream. --- debian/changelog | 6 ++++++ debian/patches/CVE-2019-20372.patch | 26 -------------------------- debian/patches/series | 1 - 3 files changed, 6 insertions(+), 27 deletions(-) delete mode 100644 debian/patches/CVE-2019-20372.patch diff --git a/debian/changelog b/debian/changelog index 266e3ea..05a740b 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +nginx (1.18.0-7) UNRELEASED; urgency=medium + + * d/p/CVE-2019-20372.patch: Drop, applied upstream. + + -- Ondřej Nový Fri, 21 Aug 2020 14:14:13 +0200 + nginx (1.18.0-6) unstable; urgency=medium * Fix GCC-10 compatibility (Closes: #957605). diff --git a/debian/patches/CVE-2019-20372.patch b/debian/patches/CVE-2019-20372.patch deleted file mode 100644 index 741b0a9..0000000 --- a/debian/patches/CVE-2019-20372.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 8bffc01d084b4881e3eed2052c115b8f04268cb9 Mon Sep 17 00:00:00 2001 -From: Ruslan Ermilov -Date: Mon, 23 Dec 2019 15:45:46 +0300 -Subject: [PATCH] Discard request body when redirecting to a URL via - error_page. - -Reported by Bert JW Regeer and Francisco Oca Gonzalez. ---- - src/http/ngx_http_special_response.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/src/http/ngx_http_special_response.c -+++ b/src/http/ngx_http_special_response.c -@@ -629,6 +629,12 @@ - r->keepalive = 0; - } - -+ r->expect_tested = 1; -+ -+ if (ngx_http_discard_request_body(r) != NGX_OK) { -+ r->keepalive = 0; -+ } -+ - location = ngx_list_push(&r->headers_out.headers); - - if (location == NULL) { diff --git a/debian/patches/series b/debian/patches/series index b221db7..5b6b799 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,2 @@ 0002-Make-sure-signature-stays-the-same-in-all-nginx-buil.patch 0003-define_gnu_source-on-other-glibc-based-platforms.patch -CVE-2019-20372.patch From da49114fdc5bf958678fc432802408e05f4cb07b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Tue, 8 Oct 2019 22:48:47 +0200 Subject: [PATCH 002/267] Add arm64 and ppc64el to list of luajit platforms --- debian/control | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/control b/debian/control index fe24d3e..d55777f 100644 --- a/debian/control +++ b/debian/control @@ -10,8 +10,8 @@ Build-Depends: debhelper-compat (= 13), libgd-dev, libgeoip-dev, libhiredis-dev, - liblua5.1-0-dev [!i386 !amd64 !kfreebsd-i386 !armel !armhf !powerpc !powerpcspe !mips !mipsel], - libluajit-5.1-dev [i386 amd64 kfreebsd-i386 armel armhf powerpc powerpcspe mips mipsel], + liblua5.1-0-dev [!i386 !amd64 !kfreebsd-i386 !armel !armhf !powerpc !powerpcspe !mips !mipsel !arm64 !ppc64el], + libluajit-5.1-dev [i386 amd64 kfreebsd-i386 armel armhf powerpc powerpcspe mips mipsel arm64 ppc64el], libmaxminddb-dev, libmhash-dev, libpam0g-dev, From ecdfceccf1f12f440c0890056d145b27dbb3c1ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Nov=C3=BD?= Date: Tue, 15 Mar 2022 11:01:10 +0100 Subject: [PATCH 003/267] http-auth-pam: Upgrade to 1.5.3 --- debian/modules/control | 2 +- debian/modules/http-auth-pam/ChangeLog | 6 ++++++ debian/modules/http-auth-pam/VERSION | 2 +- debian/modules/http-auth-pam/config | 3 ++- 4 files changed, 10 insertions(+), 3 deletions(-) diff --git a/debian/modules/control b/debian/modules/control index e980b2f..86b6094 100644 --- a/debian/modules/control +++ b/debian/modules/control @@ -9,7 +9,7 @@ Version: 0.3.1 Module: http-auth-pam Homepage: https://github.com/sto/ngx_http_auth_pam_module -Version: 1.5.2 +Version: 1.5.3 Module: http-echo Homepage: https://github.com/agentzh/echo-nginx-module diff --git a/debian/modules/http-auth-pam/ChangeLog b/debian/modules/http-auth-pam/ChangeLog index 084c99a..5974d79 100644 --- a/debian/modules/http-auth-pam/ChangeLog +++ b/debian/modules/http-auth-pam/ChangeLog @@ -1,3 +1,9 @@ +2021-08-23 sto@mixinet.net + + * Version 1.5.3. + * Always load after ngx_http_access_module (patch provided by khimaros, see + https://github.com/sto/ngx_http_auth_pam_module/pull/26) + 2020-06-23 sto@mixinet.net * Version 1.5.2. diff --git a/debian/modules/http-auth-pam/VERSION b/debian/modules/http-auth-pam/VERSION index 4cda8f1..8af85be 100644 --- a/debian/modules/http-auth-pam/VERSION +++ b/debian/modules/http-auth-pam/VERSION @@ -1 +1 @@ -1.5.2 +1.5.3 diff --git a/debian/modules/http-auth-pam/config b/debian/modules/http-auth-pam/config index 2275262..6965eea 100644 --- a/debian/modules/http-auth-pam/config +++ b/debian/modules/http-auth-pam/config @@ -7,10 +7,11 @@ if test -n "$ngx_module_link"; then ngx_module_deps= ngx_module_srcs="$ngx_addon_dir/ngx_http_auth_pam_module.c" ngx_module_libs="-lpam" + ngx_module_order="$ngx_module_name ngx_http_access_module" . auto/module else HTTP_MODULES="$HTTP_MODULES ngx_http_auth_pam_module" NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_auth_pam_module.c" CORE_LIBS="$CORE_LIBS -lpam" -fi \ No newline at end of file +fi From 0b739c803e9b15111d84aae1d2fbf8b538960aa8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Nov=C3=BD?= Date: Tue, 15 Mar 2022 11:01:16 +0100 Subject: [PATCH 004/267] http-echo: Upgrade to 0.62 --- debian/modules/control | 2 +- debian/modules/http-echo/README.markdown | 7 +++- debian/modules/http-echo/config | 29 ++++++++-------- .../http-echo/src/ngx_http_echo_util.h | 2 +- debian/modules/http-echo/valgrind.suppress | 33 +++++++++++-------- 5 files changed, 43 insertions(+), 30 deletions(-) diff --git a/debian/modules/control b/debian/modules/control index 86b6094..83deeab 100644 --- a/debian/modules/control +++ b/debian/modules/control @@ -13,7 +13,7 @@ Version: 1.5.3 Module: http-echo Homepage: https://github.com/agentzh/echo-nginx-module -Version: v0.61 +Version: 0.62 Files-Excluded: .gitignore .gitattributes .travis.yml Module: http-geoip2 diff --git a/debian/modules/http-echo/README.markdown b/debian/modules/http-echo/README.markdown index 71ac080..02d4608 100644 --- a/debian/modules/http-echo/README.markdown +++ b/debian/modules/http-echo/README.markdown @@ -1606,6 +1606,11 @@ Compatibility The following versions of Nginx should work with this module: +* **1.16.x** +* **1.15.x** (last tested: 1.15.8) +* **1.14.x** +* **1.13.x** (last tested: 1.13.6) +* **1.12.x** * **1.11.x** (last tested: 1.11.2) * **1.10.x** * **1.9.x** (last tested: 1.9.15) @@ -1809,7 +1814,7 @@ This wiki page is also maintained by the author himself, and everybody is encour Copyright & License =================== -Copyright (c) 2009-2017, Yichun "agentzh" Zhang (章亦春) , OpenResty Inc. +Copyright (c) 2009-2018, Yichun "agentzh" Zhang (章亦春) , OpenResty Inc. This module is licensed under the terms of the BSD license. diff --git a/debian/modules/http-echo/config b/debian/modules/http-echo/config index 32b54bf..4bf0f00 100644 --- a/debian/modules/http-echo/config +++ b/debian/modules/http-echo/config @@ -30,21 +30,24 @@ ECHO_DEPS=" \ $ngx_addon_dir/src/ngx_http_echo_foreach.h \ " -# nginx won't have HTTP_POSTPONE_FILTER_MODULE & HTTP_POSTPONE_FILTER_SRCS -# defined since 1.9.11 -if test -z "$HTTP_POSTPONE_FILTER_MODULE"; then - HTTP_POSTPONE_FILTER_MODULE=ngx_http_postpone_filter_module - HTTP_POSTPONE_FILTER_SRCS=src/http/ngx_http_postpone_filter_module.c +# nginx 1.17.0+ unconditionally enables the postpone filter +if [ ! -z "$HTTP_POSTPONE" ]; then + # nginx won't have HTTP_POSTPONE_FILTER_MODULE & HTTP_POSTPONE_FILTER_SRCS + # defined since 1.9.11 + if [ -z "$HTTP_POSTPONE_FILTER_MODULE" ]; then + HTTP_POSTPONE_FILTER_MODULE=ngx_http_postpone_filter_module + HTTP_POSTPONE_FILTER_SRCS=src/http/ngx_http_postpone_filter_module.c + fi + + # This module depends upon the postpone filter being activated + if [ "$HTTP_POSTPONE" != YES ]; then + HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_POSTPONE_FILTER_MODULE" + HTTP_SRCS="$HTTP_SRCS $HTTP_POSTPONE_FILTER_SRCS" + HTTP_POSTPONE=YES + fi fi -# This module depends upon the postpone filter being activated -if [ $HTTP_POSTPONE != YES ]; then - HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_POSTPONE_FILTER_MODULE" - HTTP_SRCS="$HTTP_SRCS $HTTP_POSTPONE_FILTER_SRCS" - HTTP_POSTPONE=YES -fi - -if test -n "$ngx_module_link"; then +if [ -n "$ngx_module_link" ]; then ngx_module_type=HTTP_AUX_FILTER ngx_module_name=$ngx_addon_name ngx_module_incs= diff --git a/debian/modules/http-echo/src/ngx_http_echo_util.h b/debian/modules/http-echo/src/ngx_http_echo_util.h index 24b3e15..d620d09 100644 --- a/debian/modules/http-echo/src/ngx_http_echo_util.h +++ b/debian/modules/http-echo/src/ngx_http_echo_util.h @@ -11,7 +11,7 @@ #include "ngx_http_echo_module.h" -#define ngx_http_echo_strcmp_const(a, b) \ +#define ngx_http_echo_strcmp_const(a, b) \ ngx_strncmp(a, b, sizeof(b) - 1) diff --git a/debian/modules/http-echo/valgrind.suppress b/debian/modules/http-echo/valgrind.suppress index d4bfe63..975415e 100644 --- a/debian/modules/http-echo/valgrind.suppress +++ b/debian/modules/http-echo/valgrind.suppress @@ -1,17 +1,3 @@ -{ - - Memcheck:Addr4 - fun:lj_str_new - fun:lua_setfield - fun:ngx_http_lua_cache_store_code -} -{ - - Memcheck:Addr4 - fun:lj_str_new - fun:lua_getfield - fun:ngx_http_lua_cache_load_code -} { Memcheck:Param @@ -46,3 +32,22 @@ fun:ngx_single_process_cycle fun:main } +{ + + Memcheck:Leak + match-leak-kinds: definite + fun:malloc + fun:ngx_alloc + fun:ngx_set_environment + fun:ngx_single_process_cycle +} +{ + + Memcheck:Leak + match-leak-kinds: definite + fun:malloc + fun:ngx_alloc + fun:ngx_set_environment + fun:ngx_worker_process_init + fun:ngx_worker_process_cycle +} From e5cbfb9f4badbb07dcef050c5afdd54a567b9bab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Nov=C3=BD?= Date: Tue, 15 Mar 2022 11:01:27 +0100 Subject: [PATCH 005/267] nchan: Upgrade to 1.2.15 --- debian/modules/control | 2 +- debian/modules/nchan/README.md | 107 ++- debian/modules/nchan/changelog.txt | 36 + debian/modules/nchan/config | 16 +- debian/modules/nchan/src/nchan_commands.rb | 149 +++- .../modules/nchan/src/nchan_config_commands.c | 616 +++++++++++++- debian/modules/nchan/src/nchan_defs.h | 5 +- debian/modules/nchan/src/nchan_module.c | 158 ++++ debian/modules/nchan/src/nchan_module.h | 1 + debian/modules/nchan/src/nchan_setup.c | 185 ++++- debian/modules/nchan/src/nchan_types.h | 66 ++ debian/modules/nchan/src/nchan_variables.c | 44 + debian/modules/nchan/src/nchan_version.h | 2 +- .../nchan/src/store/memory/ipc-handlers.c | 1 - .../modules/nchan/src/store/memory/memstore.c | 105 ++- .../nchan/src/store/memory/store-private.h | 4 +- .../nchan/src/store/redis/hiredis/.gitignore | 2 + .../nchan/src/store/redis/hiredis/.travis.yml | 119 ++- .../src/store/redis/hiredis/CHANGELOG.md | 258 +++++- .../nchan/src/store/redis/hiredis/Makefile | 179 +++- .../nchan/src/store/redis/hiredis/README.md | 300 ++++++- .../src/store/redis/hiredis/adapters/ae.h | 127 --- .../src/store/redis/hiredis/adapters/libev.h | 147 ---- .../store/redis/hiredis/adapters/libevent.h | 108 --- .../src/store/redis/hiredis/adapters/libuv.h | 121 --- .../nchan/src/store/redis/hiredis/alloc.c | 86 ++ .../nchan/src/store/redis/hiredis/alloc.h | 91 ++ .../nchan/src/store/redis/hiredis/async.c | 406 ++++++--- .../nchan/src/store/redis/hiredis/async.h | 18 + .../src/store/redis/hiredis/async_private.h | 75 ++ .../nchan/src/store/redis/hiredis/dict.c | 41 +- .../store/redis/hiredis/examples/example-ae.c | 62 -- .../redis/hiredis/examples/example-libev.c | 52 -- .../redis/hiredis/examples/example-libevent.c | 53 -- .../redis/hiredis/examples/example-libuv.c | 53 -- .../store/redis/hiredis/examples/example.c | 78 -- .../nchan/src/store/redis/hiredis/fmacros.h | 17 +- .../nchan/src/store/redis/hiredis/hiredis.c | 513 ++++++++---- .../nchan/src/store/redis/hiredis/hiredis.h | 179 +++- .../src/store/redis/hiredis/hiredis_ssl.h | 127 +++ .../nchan/src/store/redis/hiredis/net.c | 324 ++++++-- .../nchan/src/store/redis/hiredis/net.h | 9 +- .../nchan/src/store/redis/hiredis/read.c | 392 +++++++-- .../nchan/src/store/redis/hiredis/read.h | 37 +- .../nchan/src/store/redis/hiredis/sds.c | 555 +++++++++---- .../nchan/src/store/redis/hiredis/sds.h | 207 ++++- .../nchan/src/store/redis/hiredis/sdsalloc.h | 44 + .../src/store/redis/hiredis/sockcompat.c | 248 ++++++ .../src/store/redis/hiredis/sockcompat.h | 92 +++ .../nchan/src/store/redis/hiredis/ssl.c | 526 ++++++++++++ .../nchan/src/store/redis/hiredis/test.c | 782 +++++++++++++++--- .../nchan/src/store/redis/hiredis/win32.h | 18 +- .../modules/nchan/src/store/redis/rdsstore.c | 201 ++++- .../get_subscriber_info_id.lua | 18 + .../request_subscriber_info.lua | 15 + .../src/store/redis/redis_lua_commands.c | 39 +- .../src/store/redis/redis_lua_commands.h | 15 +- .../src/store/redis/redis_nginx_adapter.c | 100 +-- .../src/store/redis/redis_nginx_adapter.h | 8 +- .../nchan/src/store/redis/redis_nodeset.c | 601 ++++++++++++-- .../nchan/src/store/redis/redis_nodeset.h | 71 +- .../redis/scripts/get_unique_request_id.lua | 1 + .../nchan/src/store/redis/store-private.h | 2 + debian/modules/nchan/src/store/redis/store.h | 1 + debian/modules/nchan/src/subscribers/common.c | 52 +- debian/modules/nchan/src/subscribers/common.h | 3 +- .../nchan/src/subscribers/http-raw-stream.c | 30 +- .../modules/nchan/src/subscribers/internal.c | 38 +- .../modules/nchan/src/subscribers/internal.h | 6 +- .../nchan/src/subscribers/longpoll-private.h | 6 +- .../modules/nchan/src/subscribers/longpoll.c | 42 +- .../nchan/src/subscribers/memstore_ipc.c | 3 +- .../nchan/src/subscribers/memstore_multi.c | 3 + .../nchan/src/subscribers/memstore_redis.c | 4 + .../modules/nchan/src/subscribers/websocket.c | 38 +- .../modules/nchan/src/util/nchan_channel_id.c | 36 + .../modules/nchan/src/util/nchan_channel_id.h | 2 + .../nchan/src/util/nchan_fake_request.c | 6 +- .../nchan/src/util/nchan_output_info.c | 21 +- debian/modules/nchan/src/util/nchan_util.c | 57 ++ debian/modules/nchan/src/util/nchan_util.h | 5 +- 81 files changed, 7374 insertions(+), 1993 deletions(-) delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/adapters/ae.h delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/adapters/libev.h delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/adapters/libevent.h delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/adapters/libuv.h create mode 100644 debian/modules/nchan/src/store/redis/hiredis/alloc.c create mode 100644 debian/modules/nchan/src/store/redis/hiredis/alloc.h create mode 100644 debian/modules/nchan/src/store/redis/hiredis/async_private.h delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/examples/example-ae.c delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/examples/example-libev.c delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/examples/example-libevent.c delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/examples/example-libuv.c delete mode 100644 debian/modules/nchan/src/store/redis/hiredis/examples/example.c create mode 100644 debian/modules/nchan/src/store/redis/hiredis/hiredis_ssl.h create mode 100644 debian/modules/nchan/src/store/redis/hiredis/sdsalloc.h create mode 100644 debian/modules/nchan/src/store/redis/hiredis/sockcompat.c create mode 100644 debian/modules/nchan/src/store/redis/hiredis/sockcompat.h create mode 100644 debian/modules/nchan/src/store/redis/hiredis/ssl.c create mode 100644 debian/modules/nchan/src/store/redis/redis-lua-scripts/get_subscriber_info_id.lua create mode 100644 debian/modules/nchan/src/store/redis/redis-lua-scripts/request_subscriber_info.lua create mode 100644 debian/modules/nchan/src/store/redis/scripts/get_unique_request_id.lua diff --git a/debian/modules/control b/debian/modules/control index 83deeab..2fe5622 100644 --- a/debian/modules/control +++ b/debian/modules/control @@ -38,7 +38,7 @@ Patch: Module: nchan Homepage: https://github.com/slact/nchan -Version: 1.2.7 +Version: 1.2.15 Files-Excluded: dev nchan_logo.png NchanSubscriber.js src/hiredis nchan Module: http-uploadprogress diff --git a/debian/modules/nchan/README.md b/debian/modules/nchan/README.md index 152396d..f1c2a4d 100644 --- a/debian/modules/nchan/README.md +++ b/debian/modules/nchan/README.md @@ -22,7 +22,7 @@ In a web browser, you can use Websocket or EventSource natively, or the [NchanSu ## Status and History -The latest Nchan release is 1.2.7 (March 17, 2020) ([changelog](https://nchan.io/changelog)). +The latest Nchan release is 1.2.15 (December 27, 2021) ([changelog](https://nchan.io/changelog)). The first iteration of Nchan was written in 2009-2010 as the [Nginx HTTP Push Module](https://pushmodule.slact.net), and was vastly refactored into its present state in 2014-2016. @@ -704,6 +704,14 @@ Redis Cluster connections are designed to be resilient and try to recover from e All Nchan servers sharing a Redis server or cluster should have their times synchronized (via ntpd or your favorite ntp daemon). Failure to do so may result in missed or duplicate messages. +#### Using Redis securely + +Redis servers can be connected to via TLS by using the [nchan_redis_ssl](#nchan_redis_ssl) config setting in an `upstream` block, or by using the `rediss://` schema for the server URLs. + +A password and optional username for the `AUTH` command can be set by the [nchan_redis_username](#nchan_redis_username) and [nchan_redis_password](#nchan_redis_password) config settings in an `upstream` block, or by using the `redis://:@hostname` server URL schema. + +Note that autodiscovered Redis nodes inherit their parent's SSL, username, and password settings. + #### Tweaks and Optimizations As of version 1.2.0, Nchan uses Redis slaves to load-balance PUBSUB traffic. By default, there is an equal chance that a channel's PUBSUB subscription will go to any master or slave. The [`nchan_redis_subscribe_weights`](#nchan_redis_subscribe_weights) setting is available to fine-tune this load-balancing. @@ -1003,16 +1011,25 @@ Nchan makes several variables usabled in the config file: - `$nchan_subscriber_type` For subscriber locations, this variable is set to the subscriber type (websocket, longpoll, etc.). +- `$nchan_channel_subscriber_last_seen` + For publisher locations, this variable is set to the timestamp for the last connected subscriber. + +- `$nchan_channel_subscriber_count` + For publisher locations, this variable is set to the number of subscribers in the published channel. + +- `$nchan_channel_message_count` + For publisher locations, this variable is set to the number of messages buffered in the published channel. + - `$nchan_publisher_type` For publisher locations, this variable is set to the subscriber type (http or websocket). -- `$nchan_prev_message_id`, `$nchan_message_id` +- `$nchan_prev_message_id`, `$nchan_message_id` The current and previous (if applicable) message id for publisher request or subscriber response. -- `$nchan_channel_event` +- `$nchan_channel_event` For channel events, this is the event name. Useful when configuring `nchan_channel_event_string`. -- `$nchan_version` +- `$nchan_version` Current Nchan version. Available since 1.1.5. Additionally, `nchan_stub_status` data is also exposed as variables. These are available only when `nchan_stub_status` is enabled on at least one location: @@ -1180,7 +1197,18 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a arguments: 1 default: `\n` context: server, location, if - > Message separator string for the http-raw-stream subscriber. Automatically terminated with a newline character. + > Message separator string for the http-raw-stream subscriber. Automatically terminated with a newline character if not explicitly set to an empty string. + +- **nchan_subscriber_info** + arguments: 0 + context: location + > A subscriber location for debugging the state of subscribers on a given channel. The subscribers of the channel specified by `nchan_channel_id` evaluate `nchan_subscriber_info_string` and send it back to the requested on this location. This is useful to see where subscribers are in an Nchan cluster, as well as debugging subscriber connection issues. + +- **nchan_subscriber_info_string** + arguments: 1 + default: `$nchan_subscriber_type $remote_addr:$remote_port $http_user_agent $server_name $request_uri $pid` + context: server, location + > this string is evaluated by each subscriber on a given channel and sent to the requester of a `nchan_subscriber_info` location - **nchan_subscriber_last_message_id** arguments: 1 - 5 @@ -1327,12 +1355,23 @@ Additionally, `nchan_stub_status` data is also exposed as variables. These are a legacy name: push_message_timeout > Publisher configuration setting the length of time a message may be queued before it is considered expired. If you do not want messages to expire, set this to 0. Note that messages always expire from oldest to newest, so an older message may prevent a newer one with a shorter timeout from expiring. An Nginx variable can also be used to set the timeout dynamically. +- **nchan_redis_cluster_check_interval** + arguments: 1 + default: `5s` + context: http, server, upstream, location + > Send a CLUSTER INFO command to each connected Redis node to see if the cluster config epoch has changed. Sent only when in Cluster mode and if any other command that may result in a MOVE error has not been sent in the configured time. + - **nchan_redis_connect_timeout** arguments: 1 default: `600ms` context: upstream > Redis server connection timeout. +- **nchan_redis_discovered_ip_range_blacklist** `` + arguments: 1 - 7 + context: upstream + > do not attempt to connect to **autodiscovered** nodes with IPs in the specified ranges. Useful for blacklisting private network ranges for clusters and Redis slaves. NOTE that this blacklist applies only to autodiscovered nodes, and not ones specified in the upstream block + - **nchan_redis_idle_channel_cache_timeout** `