Tengine last release 3.1.0 #2050

Activity

1. therzv

   assigned

   chobits

   on Jul 27, 2026
2. lianglli commented on Aug 1, 2026

   

   lianglli

   on Aug 1, 2026

   Member

   More actions

   Yes, you should move off 3.1.0 — but please don't build from master HEAD. Use the tengine-3.2.0-rc1 tag, or wait a little for the 3.2.0 final release.

   The real problem is 3.1.0's age, not FreeBSD

   Tengine 3.1.0 was tagged in October 2023 and is based on nginx 1.24.0. The current line is based on nginx 1.31.3 (July 2026). That's seven nginx minor releases apart, and 26 CVEs — all of which are still open on 3.1.0.

   Quite a few of them hit load-balancer configurations directly, with no exotic setup needed:

   • CVE-2026-42945 and CVE-2026-9256 — heap overflow in the rewrite module, potentially arbitrary code execution. Triggered via regex captures in rewrite, which nearly every LB config has.
   • CVE-2026-42533 — heap overflow in map with regex matching. Same story.
   • CVE-2025-23419 — TLS session resumption can bypass client certificate verification. Matters if you do mTLS.
   • CVE-2026-28755 — in the stream module, the SSL handshake succeeds even when OCSP rejects the client certificate.
   • CVE-2026-40701 — use-after-free during DNS response processing when ssl_ocsp is in use.
   • CVE-2026-1642 — an attacker can inject plain text into a response coming from an SSL backend.
   • CVE-2026-42926 — proxy_set_body allows injecting data into requests sent to HTTP/2 backends.

   There is also a Tengine-specific fix you'll probably want: ngx_http_upstream_check_module was not draining the health-check response body, which corrupted keepalive connection reuse. Fixed in commit 7b8aa9b5 (July 2026) and included in rc1. 3.1.0 still has the bug.

   Backporting 26 CVEs across seven nginx minor versions isn't realistic — upgrading is far less work.

   About FreeBSD 15.1 specifically

   Runtime risk is low. auto/os/freebsd probes the platform via __FreeBSD_version and kern.osreldate, and every check there is a lower bound (sendfile, SF_NODISKIO, POSIX semaphores, and so on). There is no upper version ceiling, so 15.x won't be misdetected as lacking features. kqueue, sendfile and accept filters have been stable contracts for many years.

   The build is where you'll actually get bitten, for two reasons:

   1. -Werror is enabled unconditionally in auto/cc/clang. FreeBSD 15.1 ships a base clang several major versions newer than 14.0's, and new diagnostics turning 2023-era code into hard errors is common. If the build fails, configure with --with-cc-opt="-Wno-error".
   2. The base OpenSSL has moved to a newer 3.x branch. nginx 1.31.3 has much more complete version gating for recent OpenSSL than 1.24.0 does. Compiling 1.24.0 against 15.1's base OpenSSL will likely produce deprecation warnings — which, combined with -Werror, means it simply won't build. So this is one more argument for 3.2.0 over staying on 3.1.0.

   One thing worth being upfront about: Tengine's CI only runs on ubuntu-24.04 and arm64. There is no FreeBSD runner, so FreeBSD behaviour has no upstream regression coverage. Running the test suite yourself on the target box is genuinely worthwhile.

   Behaviour changes to check during the upgrade

   These change existing behaviour rather than adding features:

   • nginx 1.29.7 — keepalive in upstream blocks is now enabled by default, proxy_http_version defaults to 1.1, and the Connection header is no longer sent by default. This is the big one: retest anything that relied on Connection: close.
   • nginx 1.31.0 — HTTP/2 and HTTP/3 requests carrying Connection, Proxy-Connection, Keep-Alive, Transfer-Encoding or Upgrade are now rejected, as is TE with any value other than trailers.
   • nginx 1.31.3 — header and trailer sizes in HTTP/2 responses are now bounded by proxy_buffer_size and grpc_buffer_size.

   You also get some useful LB features for free: native sticky sessions (1.29.6), least_time (1.31.0), the local parameter for keepalive and multipath on listen (1.29.7), and proxy_socket_sndbuf / proxy_socket_rcvbuf (1.31.3).

   Suggested path

   Don't build master HEAD — the commits on top of rc1 are all packaging work (Debian 13, Alpine 3.22, RPM LTO). They bring you nothing but unverified changes.

   On a FreeBSD 15.1 test box: check out tengine-3.2.0-rc1, build with your existing configure arguments (add --with-cc-opt="-Wno-error" if it fails), verify your config with nginx -t, then concentrate your testing on upstream keepalive behaviour and mTLS before canarying a single node.

   Worth noting too: FreeBSD 14.0 itself went end-of-life back in 2024, so upgrading the OS is the right call regardless.
3. lianglli commented on Aug 1, 2026

   

   lianglli

   on Aug 1, 2026

   Member

   More actions

   用 tengine-3.2.0-rc1 这个 tag，或者稍等一下 3.2.0 正式版。

   Tengine 3.1.0 打 tag 于 2023 年 10 月，基线是 nginx 1.24.0。当前开发线基线是 nginx 1.31.3（2026 年 7 月）。中间隔了 7 个 nginx 小版本、26 个 CVE，这些在 3.1.0 上全部还开着。

   其中不少直接命中负载均衡配置，且不需要什么特殊配置就能触发：

   • CVE-2026-42945 与 CVE-2026-9256 —— rewrite 模块堆溢出，可能导致任意代码执行。通过 rewrite 里的正则 capture 触发，几乎每份 LB 配置都有。
   • CVE-2026-42533 —— map 做正则匹配时堆溢出，同理。
   • CVE-2025-23419 —— TLS session resumption 可绕过客户端证书校验。用 mTLS 的话很关键。
   • CVE-2026-28755 —— stream 模块中，OCSP 已拒绝客户端证书，SSL 握手却仍然成功。
   • CVE-2026-40701 —— 启用 ssl_ocsp 时，处理 DNS 响应过程中的 use-after-free。
   • CVE-2026-1642 —— 攻击者可向来自 SSL 后端的响应中注入明文数据。
   • CVE-2026-42926 —— proxy_set_body 允许向发往 HTTP/2 后端的请求注入数据。

   另外还有一条 Tengine 自己的修复，你大概率吃得到：ngx_http_upstream_check_module 没有排空健康检查的响应体，污染了 keepalive 连接复用。修复在 commit 7b8aa9b5（2026 年 7 月），已包含在 rc1 中。3.1.0 仍带着这个 bug。

   跨 7 个 nginx 小版本 backport 26 个 CVE 并不现实 —— 直接升级的工作量小得多。

   关于 FreeBSD 15.1

   运行期风险很低。 auto/os/freebsd 通过 __FreeBSD_version 和 kern.osreldate 探测平台，里面每个判断都是下限（sendfile、SF_NODISKIO、POSIX 信号量等），没有版本上限，所以 15.x 不会被误判成缺特性。kqueue、sendfile、accept filter 这些内核契约多年来都很稳定。

   真正会咬到你的是编译期，两个原因：

   1. -Werror 在 auto/cc/clang 里是无条件打开的。FreeBSD 15.1 自带的 base clang 比 14.0 时代新了好几个大版本，新增诊断把 2023 年的代码打成 error 很常见。编不过就加 --with-cc-opt="-Wno-error"。
   2. base OpenSSL 已经换到更新的 3.x 分支。nginx 1.31.3 对新版 OpenSSL 的版本 gate 比 1.24.0 完善得多。拿 15.1 的 base OpenSSL 去编 1.24.0，很可能冒出 deprecation 警告，叠加 -Werror 就是直接编不过。所以这也是「升到 3.2.0 比留在 3.1.0 更省事」的又一个理由。

   有一点得说清楚：Tengine 的 CI 只跑 ubuntu-24.04 和 arm64，没有 FreeBSD runner，所以 FreeBSD 上的行为没有上游回归覆盖。自己在目标机上把测试集跑一遍，价值是实打实的。

   升级时需要复查的行为变更

   下面这些是改变既有行为，不是新增特性：

   • nginx 1.29.7 —— upstream 块里的 keepalive 默认启用，proxy_http_version 默认值变为 1.1，Connection 头默认不再发送。这条影响最大：任何依赖 Connection: close 的地方都要复测。
   • nginx 1.31.0 —— 带 Connection、Proxy-Connection、Keep-Alive、Transfer-Encoding、Upgrade 的 HTTP/2 与 HTTP/3 请求现在会被拒绝，TE 取值非 trailers 也一样。
   • nginx 1.31.3 —— HTTP/2 响应的 header 与 trailer 大小开始受 proxy_buffer_size 和 grpc_buffer_size 限制。

   顺带白拿一些 LB 能力：原生 sticky 会话（1.29.6）、least_time（1.31.0）、keepalive 的 local 参数与 listen 的 multipath（1.29.7）、以及 proxy_socket_sndbuf / proxy_socket_rcvbuf（1.31.3）。

   建议路线

   不要编 master HEAD —— rc1 之上的提交全是打包相关（Debian 13、Alpine 3.22、RPM LTO），对你没有收益，只会引入未验证的变更。

   在一台 FreeBSD 15.1 测试机上：checkout tengine-3.2.0-rc1，用你现有的 configure 参数编译（编不过就加 --with-cc-opt="-Wno-error"），用 nginx -t 验证现有配置，然后把测试重点放在 upstream keepalive 行为和 mTLS 上，再灰度一台。

   另外提一句：FreeBSD 14.0 本身早在 2024 年就已经 EOL 了，所以升级操作系统本来就是对的选择。