Nginx Nginx 1.21.5 Released

Yup sure does. Did a quick private test with 1.21.5 + pcre2 v10.39 and will be a while for proper public release given other nginx modules from third parties depend on pcre too i.e. ngx_brotli & nginx lua module = more testing

In the meantime, pcre v8.45 like normal will work fine with Nginx 1.21.5+

 

So according to Maxim at Nginx, one of the main motivations for adding PCRE2 support in Nginx is that PCRE is essentially gone/EOL without security updates it seems https://forum.nginx.org/read.php?29,281263,292622#msg-292622

 

Yeah true.

Yeah Nginx folks have been resistant to add PCRE2 support as you can see even from age of the thread starter date at https://forum.nginx.org/read.php?29,281263,281263#msg-281263 - September 2018.

So far, ngx brotli is fine with PCRE2, but nginx lua module needs updates for PCRE2 module do not support with PCRE2 on nginx 1.21.5 · Issue #1984 · openresty/lua-nginx-module so that would be holding Centmin Mod Nginx 1.21.5+ and PCRE2 support if folks using nginx lua module. But nginx lua module is optional and not enabled by default in Centmin Mod 123.09beta01, so without nginx lua module, Nginx 1.21.5 + PCRE2 does work from initial test

PCRE2 shared library /usr/local/nginx-dep/lib/libpcre2-8.so.0 in Nginx binary built

Code (Text):

ldd $(which nginx)
        linux-vdso.so.1 =>  (0x00007fff55db4000)
        libpcre2-8.so.0 => /usr/local/nginx-dep/lib/libpcre2-8.so.0 (0x00007f91506a0000)
        libjemalloc.so.1 => /lib64/libjemalloc.so.1 (0x00007f91502db000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f91500d7000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f914febb000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f914fc84000)
        libGeoIP.so.1 => /lib64/libGeoIP.so.1 (0x00007f914fa52000)
        libatomic_ops.so.1 => /usr/local/lib/libatomic_ops.so.1 (0x00007f914f850000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f914f482000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f915050f000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007f914f27f000)

 

Sounds like they did have private in house PCRE2 test/patches planned just not rolled out in production

Maxims stated this back in October 2021 - so a few months. Generally, Nginx folks release quite stable stuff - so fingers crossed. And yes Openresty folks do good stuff - a lot of their Nginx modules are baked into Centmin Mod Nginx either by default or as optionally enabled modules i.e. Nginx Lua.

 

Currently, Nginx 1.21.5+ with PCRE2 isn't compatible with optional Nginx Lua and ModSecurity Nginx modules as at Dec 31, 2021. So probably will be a while before Centmin Mod Nginx switches from PCRE v8.45 to PCRE2 v10.x.

Both Nginx Lua and ModSecurity Nginx modules are disabled by default unless you specifically enable them via persistent config set variables in /etc/centminmod/custom_config.inc.

Nginx Lua PCRE2 Incompatibilty

Centmin Mod optionally enabled Nginx Lua module from OpenResty manages to get to end of centmin.sh menu option 4 Nginx compile run, but the resulting Nginx binary has an error and is unable to start the Nginx server with error on Nginx config check

Code (Text):

nginx -t
nginx: [emerg] dlopen() "/usr/local/nginx/modules/ngx_http_lua_module.so" failed (/usr/local/nginx/modules/ngx_http_lua_module.so: undefined symbol: pcre_malloc) in /usr/local/nginx/conf/dynamic-modules.conf:9
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

Nginx restart error

Code (Text):

ngxrestart
Restarting nginx (via systemctl):  Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details.
                                                           [FAILED]

and journatlctl log for Nginx shows the same error message as above Nginx config check

Code (Text):

journalctl -u nginx --no-pager | sed -e "s|$HOSTNAME|hostname|g"| tail -7

Dec 30 23:48:38 hostname systemd[1]: Starting SYSV: Nginx is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3 proxy server...
Dec 30 23:48:38 hostname nginx[4223]: Starting nginx: nginx: [emerg] dlopen() "/usr/local/nginx/modules/ngx_http_lua_module.so" failed (/usr/local/nginx/modules/ngx_http_lua_module.so: undefined symbol: pcre_malloc) in /usr/local/nginx/conf/dynamic-modules.conf:9
Dec 30 23:48:38 hostname nginx[4223]: [FAILED]
Dec 30 23:48:38 hostname systemd[1]: nginx.service: control process exited, code=exited status=1
Dec 30 23:48:38 hostname systemd[1]: Failed to start SYSV: Nginx is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3 proxy server.
Dec 30 23:48:38 hostname systemd[1]: Unit nginx.service entered failed state.
Dec 30 23:48:38 hostname systemd[1]: nginx.service failed.

ModSecurity PCRE2 Incompatibility

Centmin Mod optionally enabled ModSecurity Nginx module compiles (with NGINX_MODSECURITY='y') of Nginx 1.21.5 with PCRE2 enabled will result in errors like below during Nginx make stage.

Code (Text):

-L/usr/local/nginx-dep/lib -Wl,-E -L/usr/local/zlib-cf/lib -L/usr/local/nginx-dep/lib -lpcre2-8 -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/nginx-dep/lib:/usr/local/zlib-cf/lib:/usr/local/nginx-dep/lib -flto=8 -fuse-ld=gold \
-shared
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c: In function ‘ngx_http_modsecurity_pcre_malloc_init’:
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c:78:9: error: ‘pcre_malloc’ undeclared (first use in this function); did you mean ‘old_pcre_malloc’?
   78 |     if (pcre_malloc != ngx_http_modsec_pcre_malloc) {
      |         ^~~~~~~~~~~
      |         old_pcre_malloc
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c:78:9: note: each undeclared identifier is reported only once for each function it appears in
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c:82:25: error: ‘pcre_free’ undeclared (first use in this function); did you mean ‘old_pcre_free’?
   82 |         old_pcre_free = pcre_free;
      |                         ^~~~~~~~~
      |                         old_pcre_free
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c: In function ‘ngx_http_modsecurity_pcre_malloc_done’:
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c:102:9: error: ‘pcre_malloc’ undeclared (first use in this function); did you mean ‘old_pcre_malloc’?
  102 |         pcre_malloc = old_pcre_malloc;
      |         ^~~~~~~~~~~
      |         old_pcre_malloc
../ModSecurity-nginx/src/ngx_http_modsecurity_module.c:103:9: error: ‘pcre_free’ undeclared (first use in this function); did you mean ‘old_pcre_free’?
  103 |         pcre_free = old_pcre_free;
      |         ^~~~~~~~~
      |         old_pcre_free
make[1]: *** [objs/addon/src/ngx_http_modsecurity_module.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make[1]: Leaving directory `/svr-setup/nginx-1.21.5'
make: *** [build] Error 2

 

If folks want to help test Nginx 1.21.5 and new PCRE2 support in Centmin Mod 123.09beta01, I've posted a dedicated thread outlining the 2 step process for beta testing Centmin Mod Nginx PCRE2 support at https://community.centminmod.com/threads/centmin-mod-nginx-1-21-5-pcre2-beta-testing.22326/

 

Interesting doing more research. It seems Nginx PCRE2 library is less tolerant of regular expression errors than PCRE https://serverfault.com/questions/1...ows-in-index-html-after-updating-to-nginx-1-2

These gotchas will be interesting

 

cheers https://community.centminmod.com/threads/nginx-announce-nginx-1-21-6.22394/

 

Centmin Mod Nginx auto falls back to PCRE if Lua Nginx module is enabled even if PCRE2 is enabled. But looks like some folks are switching back to PCRE default from PCRE2 due to Lua Nginx module compatibility. Intel's Clear Linux Nginx builds have switched back to PCRE defaults because of this Switch back to legacy PCRE for now · clearlinux-pkgs/nginx-mainline@1021eb1