Bug 12736 - Nginx - update to stable release v1.4.5
Summary: Nginx - update to stable release v1.4.5
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: has_procedure MGA4-64-OK MGA4-32-OK a...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-02-11 23:40 CET by Sam Bailey
Modified: 2014-02-13 21:11 CET (History)
5 users (show)

See Also:
Source RPM: nginx-1.4.5-1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description Sam Bailey 2014-02-11 23:40:41 CET
New stable release available for nginx, version 1.4.5 (mga4 current is 1.4.4).

Change Notes: http://nginx.org/en/CHANGES-1.4

    *) Bugfix: the $ssl_session_id variable contained full session
       serialized instead of just a session id.
       Thanks to Ivan RistiÄ.

    *) Bugfix: client connections might be immediately closed if deferred
       accept was used; the bug had appeared in 1.3.15.

    *) Bugfix: alerts "zero size buf in output" might appear in logs while
       proxying; the bug had appeared in 1.3.9.

    *) Bugfix: a segmentation fault might occur in a worker process if the
       ngx_http_spdy_module was used.

    *) Bugfix: proxied WebSocket connections might hang right after
       handshake if the select, poll, or /dev/poll methods were used.

    *) Bugfix: a timeout might occur while reading client request body in an
       SSL connection using chunked transfer encoding.

    *) Bugfix: memory leak in nginx/Windows.


Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2014-02-11 23:41:49 CET
Hi Sam, I noticed you're building this update.  I just wanted to point out to please build any updates in Cauldron *before* stable releases.  Thanks.
Comment 2 Sam Bailey 2014-02-11 23:45:54 CET
I have uploaded a patched/updated package for Mageia 4.

You can test this by installing/upgrading the nginx package from updates_testing and validating access via a browser to http://localhost/.

I've tested upgrading on x86_64 successfully.

Updated packages in core/updates_testing:
========================
nginx-1.4.5-1.mga4

Source RPMs: 
nginx-1.4.5-1.mga4.src.rpm

Status: NEW => ASSIGNED

Comment 3 Sam Bailey 2014-02-11 23:47:15 CET
Thanks David,

I'm about to upload to cauldron v1.5.10. Just hit go on this one first. I'll do them in the opposite order in future.
Comment 4 David Walser 2014-02-11 23:57:01 CET
Cool.  Don't forget to assign the bug to qa-bugs@ml.mageia.org when it's ready for testing and release.
Comment 5 Sam Bailey 2014-02-11 23:58:29 CET
Thanks again David. Assigned now.

Assignee: sam => qa-bugs

Comment 6 Samuel Verschelde 2014-02-12 00:16:07 CET
Please write an advisory too, saying what's the problem and why we are updating. We could use also some basic step to test that the package works.

CC: (none) => stormi

Comment 7 Sam Bailey 2014-02-12 00:25:34 CET
Not sure how best to write an advisory. Bugfix release only (not security fixes).

The relevant bugfixes for mga4 are:

    *) Bugfix: the $ssl_session_id variable contained full session
       serialized instead of just a session id.
       Thanks to Ivan RistiÄ.

    *) Bugfix: client connections might be immediately closed if deferred
       accept was used; the bug had appeared in 1.3.15.

    *) Bugfix: alerts "zero size buf in output" might appear in logs while
       proxying; the bug had appeared in 1.3.9.

    *) Bugfix: a segmentation fault might occur in a worker process if the
       ngx_http_spdy_module was used.

    *) Bugfix: proxied WebSocket connections might hang right after
       handshake if the select, poll, or /dev/poll methods were used.

    *) Bugfix: a timeout might occur while reading client request body in an
       SSL connection using chunked transfer encoding.

All are usefull fixes but the SSL, WebSocket and spdy modules fixes are the highlights.

Steps to test upgrading:
1. Install the current nginx-1.4.4.mga4 package.
2. Starts autotmatically
3. Go to http://localhost/ in a browser - should show the "Welcome to nginx 1.4.4 on Mageia!" page
4. Install the updated nginx-1.4.5.mga4 package.
5. Service will be automatically reload.
6. Go the http://localhost/ in a browser - should now show the "Welcome to nginx 1.4.5 on Mageia!" page.
7. Success
Comment 8 Sam Bailey 2014-02-12 01:24:17 CET
Suggested advisory:
========================

Updated nginx package to latest stable v1.4.5 to fix
several bugs, particulary in SSL, SPDY and WebSocket proxying.

References:
http://nginx.org/en/CHANGES-1.4
Comment 9 David Remy 2014-02-12 04:48:50 CET
Tested on MGA4-64 and based on suggested verification it is working as expected. For completness I did need to start the nginx service. I am unable to test SSL, WebSockets and Spdy specifically though I don't see any errors within logs when starting nginx.

CC: (none) => dpremy
Whiteboard: (none) => MGA4-64-OK

Samuel Verschelde 2014-02-12 09:52:01 CET

Whiteboard: MGA4-64-OK => MGA4-64-OK has_procedure

Comment 10 David Walser 2014-02-12 21:43:21 CET
Testing complete on Mageia 4 i586.  This can be validated once the advisory is uploaded.

Whiteboard: MGA4-64-OK has_procedure => has_procedure MGA4-64-OK MGA4-32-OK

Comment 11 Rémi Verschelde 2014-02-13 12:23:57 CET
Validating update, advisory has been uploaded. Please push to 4 core/updates.

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA4-64-OK MGA4-32-OK => has_procedure MGA4-64-OK MGA4-32-OK advisory
CC: (none) => remi, sysadmin-bugs

Comment 12 Thomas Backlund 2014-02-13 21:11:19 CET
Update pushed:
http://advisories.mageia.org/MGAA-2014-0046.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.