AIO support in nginx was originally developed against FreeBSD versions 4-6, where the sival_ptr field was named as sigval_ptr (seemingly by mistake[1]), which made nginx use the only name available then. The standard-complaint name was restored in 2005 (first appeared in FreeBSD 7.0, 2008), retaining compatibility with previous versions[2][3]. In DragonFly, similar changes were committed in 2009[4], with backward compatibility recently removed[5]. The change switches to the standard name, retaining compatibility with old FreeBSD versions. [1] https://svnweb.freebsd.org/changeset/base/48621 [2] https://svnweb.freebsd.org/changeset/base/152029 [3] https://svnweb.freebsd.org/changeset/base/174003 [4] https://gitweb.dragonflybsd.org/dragonfly.git/commit/3693401 [5] https://gitweb.dragonflybsd.org/dragonfly.git/commit/7875042
WSAPoll() is only available with Windows Vista and newer (and only available during compilation if _WIN32_WINNT >= 0x0600). To make sure the code works with Windows XP, we do not redefine _WIN32_WINNT, but instead load WSAPoll() dynamically if it is not available during compilation. Also, sockets are not guaranteed to be small integers on Windows. So an index array is used instead of NGX_USE_FD_EVENT to map events to connections.
Previous interface of ngx_open_dir() assumed that passed directory name has a room for NGX_DIR_MASK at the end (NGX_DIR_MASK_LEN bytes). While all direct users of ngx_dir_open() followed this interface, this also implied similar requirements for indirect uses - in particular, via ngx_walk_tree(). Currently none of ngx_walk_tree() uses provides appropriate space, and fixing this does not look like a right way to go. Instead, ngx_dir_open() interface was changed to not require any additional space and use appropriate allocations instead.
Previously, "%uA" was used, which corresponds to ngx_atomic_uint_t. Size of ngx_atomic_uint_t can be easily different from uint64_t, leading to undefined results.
The bug in question was fixed in glibc 2.3.2 and is no longer expected to manifest itself on real servers. On the other hand, the workaround causes compilation problems on various systems. Previously, we've already fixed the code to compile with musl libc (fd6fd02f6a4d), and now it is broken on Fedora 28 where glibc's crypt library was replaced by libxcrypt. So the workaround was removed.
No functional changes.
Previously, capset(2) was called with the 64-bit capabilities version _LINUX_CAPABILITY_VERSION_3. With this version Linux kernel expected two copies of struct __user_cap_data_struct, while only one was submitted. As a result, random stack memory was accessed and random capabilities were requested by the worker. This sometimes caused capset() errors. Now the 32-bit version _LINUX_CAPABILITY_VERSION_1 is used instead. This is OK since CAP_NET_RAW is a 32-bit capability (CAP_NET_RAW = 13).
Previously included file sys/capability.h mentioned in capset(2) man page, belongs to the libcap-dev package, which may not be installed on some Linux systems when compiling nginx. This prevented the capabilities feature from being detected and compiled on that systems. Now linux/capability.h system header is included instead. Since capset() declaration is located in sys/capability.h, now capset() syscall is defined explicitly in code using the SYS_capset constant, similarly to other Linux-specific features in nginx.
The capability is retained automatically in unprivileged worker processes after changing UID if transparent proxying is enabled at least once in nginx configuration. The feature is only available in Linux.