bugfix: applied nginx's official security fix for an issue in the range filter (CVE-2017-7529).

upgraded lua-resty-lock to 0.05.

upgraded ngx_lua to 0.10.8.

upgraded ngx_drizzle to 0.1.10.

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 2009-2015, by Yichun "agentzh" Zhang, CloudFlare Inc.
+Copyright (C) 2009-2015, by Yichun "agentzh" Zhang, OpenResty Inc.
 
 Copyright (C) 2009-2014, by Xiaozhe Wang (chaoslawful) <chaoslawful@gmail.com>.
 

README.markdown

@@ -88,7 +88,7 @@ Copyright & License
 
 The bundle itself is licensed under the 2-clause BSD license.
 
-Copyright (c) 2011-2016, Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, CloudFlare Inc.
+Copyright (c) 2011-2017, Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, OpenResty Inc.
 
 This module is licensed under the terms of the BSD license.
 

doc/LuaJIT-2.1/README.pod

@@ -65,7 +65,7 @@ programming language. Lua is a powerful, dynamic and light-weight
 programming language. It may be embedded or used as a general-purpose,
 stand-alone language.
 
-LuaJIT is Copyright E<copy> 2005-2016 Mike Pall, released under the
+LuaJIT is Copyright E<copy> 2005-2017 Mike Pall, released under the
 E<rchevron> MIT open source license.
 
 =head2 Compatibility
@@ -189,13 +189,13 @@ LuaJIT.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file luajit.html
 # 8082 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/contact.pod

@@ -60,24 +60,28 @@ LuaJIT
 
 =back
 
+If you want to report bugs, propose fixes or suggest enhancements,
+please use the GitHub issue tracker.
+
 Please send general questions to the E<rchevron> LuaJIT mailing list.
+
 You can also send any questions you have directly to me:
 
 Contact info in image
 
 =head2 Copyright
 
-All documentation is Copyright E<copy> 2005-2016 Mike Pall.
+All documentation is Copyright E<copy> 2005-2017 Mike Pall.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file contact.html
-# 2813 bytes of input
+# 2989 bytes of input
-#Wed Jun 29 13:18:14 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/ext_c_api.pod

@@ -163,14 +163,14 @@ note that this mechanism is not without overhead.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_c_api.html
 # 6042 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>
 # Deleting phrasal "code" element (`tt_18) because it has super-phrasal elements (`br_3) as children.

doc/LuaJIT-2.1/ext_ffi.pod

@@ -273,13 +273,13 @@ undue conversion penalties.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_ffi.html
 # 10336 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/ext_ffi_api.pod

@@ -488,14 +488,14 @@ itself still refers to a variable named C<i>.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_ffi_api.html
 # 21471 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>
 # Deleting phrasal "code" element (`tt_157) because it has super-phrasal elements (`br_3, `br_4) as children.

doc/LuaJIT-2.1/ext_ffi_semantics.pod

@@ -1375,13 +1375,13 @@ called via the FFI, if the call is compiled.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_ffi_semantics.html
 # 53847 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/ext_ffi_tutorial.pod

@@ -609,14 +609,14 @@ function scope is unnecessary.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_ffi_tutorial.html
 # 22557 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>
 # Deleting phrasal "code" element (`tt_100) because it has super-phrasal elements (`br_33, `br_34) as children.

doc/LuaJIT-2.1/ext_jit.pod

@@ -168,14 +168,14 @@ know more.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_jit.html
 # 5903 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>
 # Deleting phrasal "code" element (`tt_6) because it has super-phrasal elements (`br_2, `br_3) as children.

doc/LuaJIT-2.1/ext_profiler.pod

@@ -346,13 +346,13 @@ content immediately or copy it for later use.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file ext_profiler.html
 # 13135 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/extensions.pod

@@ -166,7 +166,8 @@ and cannot be loaded.
 
 Note: C<LJ_GC64> mode requires a different frame layout, which implies
 a different, incompatible bytecode format for ports that use this mode
-(e.g. ARM64). This may be rectified in the future.
+(e.g. ARM64 or MIPS64) or when explicitly enabled for x64. This may be
+rectified in the future.
 
 =head2 C<table.new(narray, nhash)> allocates a pre-sized table
 
@@ -275,6 +276,12 @@ functions.
 
 =item * C<debug.upvalueid()> and C<debug.upvaluejoin()>.
 
+=item * Lua/C API extensions: C<lua_upvalueid()> C<lua_upvaluejoin()>
+C<lua_loadx()> C<luaL_fileresult()> C<luaL_execresult()>
+C<luaL_loadfilex()> C<luaL_loadbufferx()> C<luaL_traceback()>
+C<luaL_setfuncs()> C<luaL_pushmodule()> C<luaL_newlibtable()>
+C<luaL_newlib()>
+
 =item * Command line option C<-E>.
 
 =item * Command line checks C<__tostring> for errors.
@@ -314,6 +321,10 @@ status.
 
 =item * Remove C<math.mod()>, C<string.gfind()>.
 
+=item * C<package.searchers>.
+
+=item * C<module()> returns the module table.
+
 =back
 
 Note: this provides only partial compatibility with Lua 5.2 at the
@@ -330,6 +341,16 @@ LuaJIT supports some extensions from Lua 5.3:
 =item * Unicode escape C<'\u{XX...}'> embeds the UTF-8 encoding in
 string literals.
 
+=item * The argument table C<arg> can be read (and modified) by
+C<LUA_INIT> and C<-e> chunks.
+
+=item * C<io.read()> and C<file:read()> accept formats with or without
+a leading C<*>.
+
+=item * C<table.move(a1, f, e, t [,a2])>.
+
+=item * C<coroutine.isyieldable()>.
+
 =back
 
 =head2 C++ Exception Interoperability
@@ -441,13 +462,13 @@ destructors.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file extensions.html
-# 16722 bytes of input
+# 17525 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/faq.pod

@@ -212,13 +212,13 @@ development of certain features, if they are important to you.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file faq.html
 # 7685 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/install.pod

@@ -185,6 +185,11 @@ MSVC or WinSDK.
 Please read the instructions given in these files, before changing any
 settings.
 
+LuaJIT on x64 currently uses 32 bit GC objects by default. C<LJ_GC64>
+mode may be explicitly enabled: add C<XCFLAGS=-DLUAJIT_ENABLE_GC64> to
+the make command or run C<msvcbuild gc64> for MSVC/WinSDK. Please check
+the note about the bytecode format differences, too.
+
 =head2 POSIX Systems (Linux, OSX, *BSD etc.)
 
 =head2 Prerequisites
@@ -491,14 +496,15 @@ Apple, not me. Or use Android. :-p
  ISDKP=$(xcrun --sdk iphoneos --show-sdk-path)
  ICC=$(xcrun --sdk iphoneos --find clang)
  ISDKF="-arch armv7 -isysroot $ISDKP"
- make HOST_CC="clang -m32 -arch i386" CROSS="$(dirname $ICC)/" \
+ make DEFAULT_CC=clang HOST_CC="clang -m32 -arch i386" \
-      TARGET_FLAGS="$ISDKF" TARGET_SYS=iOS
+      CROSS="$(dirname $ICC)/" TARGET_FLAGS="$ISDKF" TARGET_SYS=iOS
  
  # iOS/ARM64
  ISDKP=$(xcrun --sdk iphoneos --show-sdk-path)
  ICC=$(xcrun --sdk iphoneos --find clang)
  ISDKF="-arch arm64 -isysroot $ISDKP"
- make CROSS="$(dirname $ICC)/" TARGET_FLAGS="$ISDKF" TARGET_SYS=iOS
+ make DEFAULT_CC=clang CROSS="$(dirname $ICC)/" \
+      TARGET_FLAGS="$ISDKF" TARGET_SYS=iOS
 
 =head2 Cross-compiling for consoles
 
@@ -586,15 +592,11 @@ don't intend to load Lua/C modules at runtime.
 =back
 
 =item * If you're building a 64 bit application on OSX which links
-directly or indirectly against LuaJIT, you need to link your main
+directly or indirectly against LuaJIT which is not built for C<LJ_GC64>
-executable with these flags:
+mode, you need to link your main executable with these flags:
 
  -pagezero_size 10000 -image_base 100000000
 
-Also, it's recommended to C<rebase> all (self-compiled) shared
-libraries which are loaded at runtime on OSX/x64 (e.g. C extension
-modules for Lua). See: C<man rebase>
-
 =back
 
 Additional hints for initializing LuaJIT using the C API functions:
@@ -683,14 +685,14 @@ package maintainer), anyway.
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file install.html
-# 25008 bytes of input
+# 25250 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>
 # Deleting phrasal "a" element (`a_34) because it has super-phrasal elements (`br_16) as children.

doc/LuaJIT-2.1/running.pod

@@ -409,13 +409,13 @@ Max. total size of all machine code areas in KBytes
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file running.html
 # 13720 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/LuaJIT-2.1/status.pod

@@ -87,17 +87,27 @@ are not handled correctly. The error may fall through an on-trace
 C<pcall> or it may be passed on to the function set with C<lua_atpanic>
 on x64. This issue will be fixed with the new garbage collector.
 
+=item * LuaJIT on 64 bit systems provides a B<limited range> of 47 bits
+for the B<legacy C<lightuserdata>> data type. This is only relevant on
+x64 systems which use the negative part of the virtual address space in
+user mode, e.g. Solaris/x64, and on ARM64 systems configured with a 48
+bit or 52 bit VA. Avoid using C<lightuserdata> to hold pointers that
+may point outside of that range, e.g. variables on the stack. In
+general, avoid this data type for new code and replace it with (much
+more performant) FFI bindings. FFI cdata pointers can address the full
+64 bit range.
+
 =back
 
 ----
 
-Copyright E<copy> 2005-2016 Mike Pall E<middot> Contact
+Copyright E<copy> 2005-2017 Mike Pall E<middot> Contact
 
 =cut
 
 #Pod::HTML2Pod conversion notes:
 #From file status.html
-# 3334 bytes of input
+# 3931 bytes of input
-#Wed Jun 29 13:18:15 2016 agentzh
+#Sat Apr  8 14:31:44 2017 agentzh
 # No a_name switch not specified, so will not try to render <a name='...'>
 # No a_href switch not specified, so will not try to render <a href='...'>

doc/README-win32.md

@@ -6,9 +6,9 @@ README-win32 - README for the Windows 32-bit build of OpenResty
 Description
 ===========
 
-The binary distributions of OpenResty can be downloaded from the following web page:
+The official binary Win32 distribution of OpenResty can be downloaded from the following web page:
 
-https://openresty.org/#Download
+https://openresty.org/en/download.html
 
 To start the NGINX server of the nginx server of the Win32 binary distribution of OpenResty:
 
@@ -126,7 +126,7 @@ MinGW gcc 4.8.1, MSYS perl, MSYS bash, MSYS make, and etc. Basically, it is curr
 ```bash
 PCRE=pcre-8.39
 ZLIB=zlib-1.2.8
-OPENSSL=openssl-1.0.2h
+OPENSSL=openssl-1.0.2j
 
 mkdir -p objs/lib || exit 1
 cd objs/lib || exit 1
@@ -137,7 +137,7 @@ tar -xf ../../../$PCRE.tar.gz || exit 1
 cd ../..
 
 cd objs/lib/$OPENSSL || exit 1
-patch -p1 < ../../../patches/$OPENSSL-sess_set_get_cb_yield.patch || exit 1
+patch -p1 < ../../../patches/openssl-1.0.2h-sess_set_get_cb_yield.patch || exit 1
 cd ../../..
 
 ./configure \
@@ -195,14 +195,14 @@ installing the build toolchain.
 Author
 ======
 
-Yichun "agentzh" Zhang <agentzh@gmail.com>, CloudFlare Inc.
+Yichun "agentzh" Zhang <agentzh@gmail.com>, OpenResty Inc.
 
 Copyright & License
 ===================
 
 This module is licensed under the BSD license.
 
-Copyright (C) 2015-2016, by Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, CloudFlare Inc.
+Copyright (C) 2015-2016, by Yichun "agentzh" Zhang (章亦春) <agentzh@gmail.com>, OpenResty Inc.
 
 All rights reserved.
 

html/index.html

@@ -16,7 +16,7 @@
 working. Further configuration is required.</p>
 
 <p>For online documentation and support please refer to
-<a href="https://openresty.org/">openresty.org</a>.<br/>
+<a href="https://openresty.org/">openresty.org</a>.<br/></p>
 
 <p><em>Thank you for flying OpenResty.</em></p>
 </body>

patches/nginx-1.11.2-safe_resolver_ipv6_option.patch

@@ -0,0 +1,55 @@
+# HG changeset patch
+# User Thibault Charbonnier <thibaultcha@fastmail.com>
+# Date 1481847421 28800
+#      Thu Dec 15 16:17:01 2016 -0800
+# Node ID 8bf038fe006fd8ae253d6b41fc6cf109a8912d3e
+# Parent  a3dc657f4e9530623683e6b85bd7492662e4dc47
+Resolver: ignore ipv6=off resolver option when no ipv6 support
+
+Makes the resolver directive more robust: we only error out when ipv6
+resolution is desired but not supported (ipv6=on).
+
+use case 1: some configurations are sometimes re-used between builds with and
+without ipv6 support. This patch avoids the need to remove the "ipv6=off" flag.
+
+use case 2: currently, some tools rely on the --with-ipv6 configure option from
+"nginx -V" to determine if ipv6 resolution should be disabled in some cases.
+With this option disappearing in Nginx 1.11.5, this patch would allow such tools
+to assume "ipv6=off" to be safe regardless of ipv6 support in the current
+build.
+
+diff -r a3dc657f4e95 -r 8bf038fe006f src/core/ngx_resolver.c
+--- a/src/core/ngx_resolver.c	Thu Dec 15 21:44:34 2016 +0300
++++ b/src/core/ngx_resolver.c	Thu Dec 15 16:17:01 2016 -0800
+@@ -224,14 +224,22 @@
+             continue;
+         }
+ 
+-#if (NGX_HAVE_INET6)
+         if (ngx_strncmp(names[i].data, "ipv6=", 5) == 0) {
+ 
+             if (ngx_strcmp(&names[i].data[5], "on") == 0) {
++#if (NGX_HAVE_INET6)
+                 r->ipv6 = 1;
++#else
++                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
++                                   "no ipv6 support but \"%V\" in resolver",
++                                   &names[i]);
++                return NULL;
++#endif
+ 
+             } else if (ngx_strcmp(&names[i].data[5], "off") == 0) {
++#if (NGX_HAVE_INET6)
+                 r->ipv6 = 0;
++#endif
+ 
+             } else {
+                 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+@@ -241,7 +249,6 @@
+ 
+             continue;
+         }
+-#endif
+ 
+         ngx_memzero(&u, sizeof(ngx_url_t));
+ 

patches/patch.2017.ranges.txt

@@ -0,0 +1,14 @@
+diffsrc/http/modules/ngx_http_range_filter_module.c b/src/http/modules/ngx_http_range_filter_module.c
+--- src/http/modules/ngx_http_range_filter_module.c
++++ src/http/modules/ngx_http_range_filter_module.c
+@@ -377,6 +377,10 @@ ngx_http_range_parse(ngx_http_request_t 
+             range->start = start;
+             range->end = end;
+ 
++            if (size > NGX_MAX_OFF_T_VALUE - (end - start)) {
++                return NGX_HTTP_RANGE_NOT_SATISFIABLE;
++            }
++
+             size += end - start;
+ 
+             if (ranges-- == 0) {

util/build-win32.sh

@@ -1,8 +1,12 @@
 #!/bin/bash
 
-PCRE=pcre-8.39
+PCRE=pcre-8.40
-ZLIB=zlib-1.2.8
+ZLIB=zlib-1.2.11
-OPENSSL=openssl-1.0.2j
+OPENSSL=openssl-1.0.2k
+
+# wget https://www.openssl.org/source/openssl-1.0.2k.tar.gz
+# wget http://zlib.net/zlib-1.2.11.tar.gz
+# wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.40.tar.gz
 
 rm -rf objs || exit 1
 mkdir -p objs/lib || exit 1

util/configure

@@ -5,6 +5,7 @@ use strict;
 use warnings;
 
 use File::Spec;
+use File::Temp qw( tempfile tmpnam );
 
 sub shell ($@);
 sub env ($$);
@@ -121,6 +122,7 @@ my $with_resty_mods_regex;
 }
 
 my $prefix = '/usr/local/openresty';
+my $ngx_sbin;
 my %resty_opts;
 my $dry_run;
 my @ngx_rpaths;
@@ -166,13 +168,13 @@ for my $opt (@ARGV) {
         }
 
     } elsif ($opt eq '--without-lua51') {
-        undef $resty_opts{lua};
+        die "ERROR: --without-lua51 is no longer supported.\n";
 
     } elsif ($opt eq '--with-lua51') {
-        $resty_opts{lua} = 1;
+        die "ERROR: --with-lua51 is no longer supported.\n";
 
     } elsif ($opt =~ /^--with-lua51=(.*)/) {
-        $resty_opts{lua_path} = $1;
+        die "ERROR: --with-lua51=PATH is no longer supported.\n";
 
     } elsif ($opt eq '--without-http_rewrite_module') {
         warn "WARNING: ngx_devel_kit is automatically disabled ",
@@ -304,6 +306,10 @@ for my $opt (@ARGV) {
         $path = File::Spec->rel2abs($path);
         push @ngx_opts, "--with-$lib=$path";
 
+    } elsif ($opt =~ /^--sbin-path=(.*)/) {
+        $ngx_sbin = $1;
+        push @ngx_opts, $opt;
+
     } elsif ($opt =~ /^--\w.*/) {
         push @ngx_opts, $opt;
 
@@ -354,7 +360,10 @@ push @make_install_cmds,
     . " \$(DESTDIR)$prefix/site/manifest";
 
 if ($platform ne 'msys') {
-    push @make_install_cmds, "ln -sf $ngx_prefix/sbin/nginx \$(DESTDIR)$prefix/bin/openresty";
+    if (!$ngx_sbin) {
+        $ngx_sbin = "$ngx_prefix/sbin/nginx";
+    }
+    push @make_install_cmds, "ln -sf $ngx_sbin \$(DESTDIR)$prefix/bin/openresty";
 }
 
 cd '../..'; # to the root
@@ -617,6 +626,28 @@ _END_
             $luajit_xcflags .= " -DLUAJIT_ENABLE_LUA52COMPAT";
         }
 
+        {
+            # check -msse4.2
+            my ($out, $cfile) = tempfile("resty-config-XXXXXX",
+                                         SUFFIX => '.c', TMPDIR => 1,
+                                         UNLINK => 1);
+
+            print $out "int main(void) { return 0; }";
+            close $out;
+
+            my $ofile = tmpnam();
+            my $comp = ($cc || 'cc');
+
+            if (system("$comp -o $ofile -msse4.2 -c $cfile") == 0 && -s $ofile) {
+                print "INFO: found -msse4.2 in $comp.\n";
+                $luajit_xcflags .= " -msse4.2";
+                unlink $ofile;
+
+            } else {
+                print "WARNING: -msse4.2 not supported in $comp.\n";
+            }
+        }
+
         if ($opts->{debug}) {
             $luajit_xcflags .= " -DLUA_USE_APICHECK -DLUA_USE_ASSERT";
             $luajit_xcflags =~ s/^ +//;
@@ -1115,10 +1146,6 @@ _EOC_
   --without-lua_resty_lrucache       disable the lua-resty-lrucache library
   --without-lua_resty_core           disable the lua-resty-core library
 
-  --with-lua51                       enable and build the bundled standard Lua 5.1 interpreter
-  --without-lua51                    disable the bundled standard Lua 5.1 interpreter
-  --with-lua51=DIR                   specify the external installation of Lua 5.1 by DIR
-
   --with-luajit                      enable and build the bundled LuaJIT 2.1 (the default)
   --with-luajit=DIR                  use the external LuaJIT 2.1 installation specified by DIR
   --with-luajit-xcflags=FLAGS        Specify extra C compiler flags for LuaJIT 2.1

util/dist-check

@@ -33,14 +33,8 @@ if ($^O eq 'freebsd' || $^O eq 'solaris') {
 
 my $cfg_opts = "";
 
-if ($opts{l}) {
+$lua = 'LuaJIT';
-    $lua = 'Lua';
+#$cfg_opts .= " --with-luajit";
-    $cfg_opts .= " --with-lua51";
-
-} else {
-    $lua = 'LuaJIT';
-    #$cfg_opts .= " --with-luajit";
-}
 
 if ($^O eq 'solaris') {
     $cfg_opts .= " --with-cc=gcc";
@@ -68,7 +62,7 @@ sub write_config_file ($) {
 
 write_config_file "/tmp/nginx.conf";
 
-warn "=== Without FFI ===\n";
+warn "\n=== Without FFI ===\n";
 $prefix = "/usr/local/openresty-noffi";
 cleanup();
 unless ($opts{f}) {
@@ -86,7 +80,7 @@ sh "curl -si localhost/cjson|grep 'json.safe: '";
 sh qq{$prefix/bin/resty -e 'ngx.say("Hello World!")'|grep 'Hello World'};
 sh "sudo $prefix/nginx/sbin/nginx -sstop";
 
-warn "=== --with-stream ===\n";
+warn "\n=== --with-stream ===\n";
 $prefix = "/usr/local/openresty-stream";
 cleanup();
 unless ($opts{f}) {
@@ -105,7 +99,7 @@ sh "curl -si localhost/cjson|grep 'json.safe: '";
 sh qq{$prefix/bin/resty -e 'ngx.say("Hello World!")'|grep 'Hello World'};
 sh "sudo $prefix/nginx/sbin/nginx -sstop";
 
-warn "=== --with-stream + dtrace static probes ===\n";
+warn "\n=== --with-stream + dtrace static probes ===\n";
 $prefix = "/usr/local/openresty-stream-usdt";
 cleanup();
 unless ($opts{f}) {
@@ -125,7 +119,7 @@ sh "curl -si localhost/cjson|grep 'json.safe: '";
 sh qq{$prefix/bin/resty -e 'ngx.say("Hello World!")'|grep 'Hello World'};
 sh "sudo $prefix/nginx/sbin/nginx -sstop";
 
-warn "=== Without Gzip/SSL/PCRE ===\n";
+warn "\n=== Without Gzip/SSL/PCRE ===\n";
 $prefix = "/usr/local/openresty-nogzip";
 cleanup();
 unless ($opts{f}) {

util/mirror-tarballs

@@ -34,6 +34,13 @@ cd nginx-$ver || exit 1
 
 # patch the patch
 
+answer=`$root/util/ver-ge "$main_ver" 1.13.3`
+if [ "$answer" = "N" ]; then
+    echo "$info_txt applying the patch for nginx security advisory (CVE-2017-7529)"
+    patch -p0 < $root/patches/patch.2017.ranges.txt || exit 1
+    echo
+fi
+
 answer=`$root/util/ver-ge "$main_ver" 1.5.12`
 if [ "$answer" = "N" ]; then
     echo "$info_txt applying the patch for nginx security advisory (CVE-2014-0133)"
@@ -333,6 +340,10 @@ echo "$info_txt applying the upstream_timeout_fields patch for nginx"
 patch -p1 < $root/patches/nginx-$main_ver-upstream_timeout_fields.patch || exit 1
 echo
 
+echo "$info_txt applying the safe_resolver_ipv6_option patch for nginx"
+patch -p1 < $root/patches/nginx-$main_ver-safe_resolver_ipv6_option.patch || exit 1
+echo
+
 cp $root/html/index.html docs/html/ || exit 1
 cp $root/html/50x.html docs/html/ || exit 1
 
@@ -396,14 +407,14 @@ mv openresty-headers-more-nginx-module-* headers-more-nginx-module-$ver || exit
 
 #################################
 
-ver=0.1.9
+ver=0.1.10
 $root/util/get-tarball "https://github.com/openresty/drizzle-nginx-module/tarball/v$ver" -O drizzle-nginx-module-$ver.tar.gz || exit 1
 tar -xzf drizzle-nginx-module-$ver.tar.gz || exit 1
 mv openresty-drizzle-nginx-module-* drizzle-nginx-module-$ver || exit 1
 
 #################################
 
-ver=0.10.7
+ver=0.10.8
 $root/util/get-tarball "https://github.com/openresty/lua-nginx-module/tarball/v$ver" -O lua-nginx-module-$ver.tar.gz || exit 1
 tar -xzf lua-nginx-module-$ver.tar.gz || exit 1
 mv openresty-lua-nginx-module-* ngx_lua-$ver || exit 1
@@ -424,7 +435,7 @@ mv openresty-array-var-nginx-module-* array-var-nginx-module-$ver || exit 1
 
 #################################
 
-ver=0.17
+ver=0.18
 $root/util/get-tarball "https://github.com/openresty/memc-nginx-module/tarball/v$ver" -O memc-nginx-module-$ver.tar.gz || exit 1
 tar -xzf memc-nginx-module-$ver.tar.gz || exit 1
 mv openresty-memc-nginx-module-* memc-nginx-module-$ver || exit 1
@@ -498,14 +509,14 @@ mv FRiCKLE-ngx_coolkit-* ngx_coolkit-$ver || exit 1
 
 #################################
 
-ver=0.13
+ver=0.14
 $root/util/get-tarball "https://github.com/openresty/redis2-nginx-module/tarball/v$ver" -O redis2-nginx-module-$ver.tar.gz || exit 1
 tar -xzf redis2-nginx-module-$ver.tar.gz || exit 1
 mv openresty-redis2-nginx-module-* redis2-nginx-module-$ver || exit 1
 
 #################################
 
-ver=0.16
+ver=0.17
 $root/util/get-tarball "https://github.com/openresty/resty-cli/tarball/v$ver" -O resty-cli-$ver.tar.gz || exit 1
 tar -xzf resty-cli-$ver.tar.gz || exit 1
 mv openresty-resty-cli-* resty-cli-$ver || exit 1
@@ -513,16 +524,16 @@ resty_cli=resty-cli-$ver
 
 #################################
 
-ver=0.0.2
+ver=0.0.3
 $root/util/get-tarball "https://github.com/openresty/opm/tarball/v$ver" -O opm-$ver.tar.gz || exit 1
 tar -xzf opm-$ver.tar.gz || exit 1
 mv openresty-opm-* opm-$ver || exit 1
 
 #################################
 
-ver=5.1.5
+#ver=5.1.5
-$root/util/get-tarball "http://www.lua.org/ftp/lua-$ver.tar.gz" -O "lua-$ver.tar.gz" || exit 1
+#$root/util/get-tarball "http://www.lua.org/ftp/lua-$ver.tar.gz" -O "lua-$ver.tar.gz" || exit 1
-tar -xzf lua-$ver.tar.gz || exit 1
+#tar -xzf lua-$ver.tar.gz || exit 1
 
 #$root/util/get-tarball "http://agentzh.org/misc/nginx/patch-lua-$ver-4" -O "patch-lua-$ver-4" || exit 1
 
@@ -532,21 +543,21 @@ tar -xzf lua-$ver.tar.gz || exit 1
 
 #rm "patch-lua-$ver-4" || exit 1
 
-echo "$info_txt applying the makefile_install_fix patch for lua $ver"
+#echo "$info_txt applying the makefile_install_fix patch for lua $ver"
-patch -p0 < $root/patches/lua-$ver-makefile_install_fix.patch || exit 1
+#patch -p0 < $root/patches/lua-$ver-makefile_install_fix.patch || exit 1
-echo
+#echo
 
-echo "$info_txt applying the disable_lua50_compat patch for lua $ver"
+#echo "$info_txt applying the disable_lua50_compat patch for lua $ver"
-patch -p0 < $root/patches/lua-$ver-disable_lua50_compat.patch || exit 1
+#patch -p0 < $root/patches/lua-$ver-disable_lua50_compat.patch || exit 1
-echo
+#echo
 
-echo "$info_txt applying the enable_debug_info patch for lua $ver"
+#echo "$info_txt applying the enable_debug_info patch for lua $ver"
-patch -p0 < $root/patches/lua-$ver-enable_debug_info.patch || exit 1
+#patch -p0 < $root/patches/lua-$ver-enable_debug_info.patch || exit 1
-echo
+#echo
 
 #################################
 
-ver=2.1-20161104
+ver=2.1-20170405
 $root/util/get-tarball "https://github.com/openresty/luajit2/archive/v$ver.tar.gz" -O "LuaJIT-$ver.tar.gz" || exit 1
 tar -xzf LuaJIT-$ver.tar.gz || exit 1
 mv luajit2-* LuaJIT-$ver || exit 1
@@ -567,7 +578,7 @@ cd .. || exit 1
 
 #################################
 
-ver=2.1.0.4
+ver=2.1.0.5
 $root/util/get-tarball "https://github.com/openresty/lua-cjson/archive/$ver.tar.gz" -O "lua-cjson-$ver.tar.gz" || exit 1
 tar -xzf lua-cjson-$ver.tar.gz || exit 1
 #cd lua-cjson-$ver || exit 1
@@ -578,10 +589,10 @@ tar -xzf lua-cjson-$ver.tar.gz || exit 1
 
 #################################
 
-ver=0.12
+ver=0.13
-$root/util/get-tarball "https://github.com/openresty/lua-redis-parser/tarball/v$ver" -O "lua-redis-parser-$ver.tar.gz" || exit 1
+$root/util/get-tarball "https://github.com/openresty/lua-redis-parser/archive/v$ver.tar.gz" -O "lua-redis-parser-$ver.tar.gz" || exit 1
 tar -xzf lua-redis-parser-$ver.tar.gz || exit 1
-mv openresty-lua-redis-parser-* lua-redis-parser-$ver || exit 1
+#mv lua-redis-parser-* lua-redis-parser-$ver || exit 1
 #cd lua-redis-parser-$ver || exit 1
 #patch -p1 < $root/patches/lua_cjson-$ver-array_detection_fix.patch || exit 1
 #sed 's/\$(DESTDIR)\//$(DESTDIR)/g' Makefile > mk || exit 1
@@ -638,7 +649,7 @@ mv openresty-lua-resty-redis-* lua-resty-redis-$ver || exit 1
 
 #################################
 
-ver=0.17
+ver=0.19
 $root/util/get-tarball "https://github.com/openresty/lua-resty-mysql/tarball/v$ver" -O "lua-resty-mysql-$ver.tar.gz" || exit 1
 tar -xzf lua-resty-mysql-$ver.tar.gz || exit 1
 mv openresty-lua-resty-mysql-* lua-resty-mysql-$ver || exit 1
@@ -650,7 +661,7 @@ cd ..
 
 #################################
 
-ver=0.01
+ver=0.03
 $root/util/get-tarball "https://github.com/openresty/lua-resty-limit-traffic/tarball/v$ver" -O "lua-resty-limit-traffic-$ver.tar.gz" || exit 1
 tar -xzf lua-resty-limit-traffic-$ver.tar.gz || exit 1
 mv openresty-lua-resty-limit-traffic-* lua-resty-limit-traffic-$ver || exit 1
@@ -698,7 +709,7 @@ cd ..
 
 #################################
 
-ver=0.04
+ver=0.06
 $root/util/get-tarball "https://github.com/openresty/lua-resty-lock/tarball/v$ver" -O "lua-resty-lock-$ver.tar.gz" || exit 1
 tar -xzf lua-resty-lock-$ver.tar.gz || exit 1
 mv openresty-lua-resty-lock-* lua-resty-lock-$ver || exit 1
@@ -710,7 +721,7 @@ cd ..
 
 #################################
 
-ver=0.04
+ver=0.06
 $root/util/get-tarball "https://github.com/openresty/lua-resty-lrucache/tarball/v$ver" -O "lua-resty-lrucache-$ver.tar.gz" || exit 1
 tar -xzf lua-resty-lrucache-$ver.tar.gz || exit 1
 mv openresty-lua-resty-lrucache-* lua-resty-lrucache-$ver || exit 1
@@ -722,7 +733,7 @@ cd ..
 
 #################################
 
-ver=0.1.9
+ver=0.1.11
 $root/util/get-tarball "https://github.com/openresty/lua-resty-core/tarball/v$ver" -O "lua-resty-core-$ver.tar.gz" || exit 1
 tar -xzf lua-resty-core-$ver.tar.gz || exit 1
 mv openresty-lua-resty-core-* lua-resty-core-$ver || exit 1

util/ver

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 main_ver=1.11.2
-minor_ver=2
+minor_ver=4
 version=$main_ver.$minor_ver
 echo $version