Merge commit '9117cd73047101b1201ff00f25bfc8e0a7bcb214' into dev

src/deps/src/lua-resty-core/.travis.yml

@@ -34,9 +34,13 @@ env:
     - LUA_INCLUDE_DIR=$LUAJIT_INC
     - LUA_CMODULE_DIR=/lib
     - PCRE_VER=8.45
+    - PCRE2_VER=10.37
     - PCRE_PREFIX=/opt/pcre
+    - PCRE2_PREFIX=/opt/pcre2
     - PCRE_LIB=$PCRE_PREFIX/lib
+    - PCRE2_LIB=$PCRE2_PREFIX/lib
     - PCRE_INC=$PCRE_PREFIX/include
+    - PCRE2_INC=$PCRE2_PREFIX/include
     - OPENSSL_PREFIX=/opt/ssl
     - OPENSSL_LIB=$OPENSSL_PREFIX/lib
     - OPENSSL_INC=$OPENSSL_PREFIX/include
@@ -45,7 +49,8 @@ env:
     - TEST_NGINX_RANDOMIZE=1
     - LUACHECK_VER=0.21.1
   matrix:
-    - NGINX_VERSION=1.21.4 OPENSSL_VER=1.1.1u OPENSSL_PATCH_VER=1.1.1f
+    - NGINX_VERSION=1.25.1 OPENSSL_VER=1.1.1w OPENSSL_PATCH_VER=1.1.1f USE_PCRE2=Y
+    - NGINX_VERSION=1.21.4 OPENSSL_VER=1.1.1w OPENSSL_PATCH_VER=1.1.1f
 
 services:
   - memcache
@@ -60,7 +65,8 @@ before_install:
 install:
   - if [ ! -d download-cache ]; then mkdir download-cache; fi
   - if [ ! -f download-cache/openssl-$OPENSSL_VER.tar.gz ]; then wget -P download-cache https://www.openssl.org/source/openssl-$OPENSSL_VER.tar.gz || wget -P download-cache https://www.openssl.org/source/old/${OPENSSL_VER//[a-z]/}/openssl-$OPENSSL_VER.tar.gz; fi
-  - if [ ! -f download-cache/pcre-$PCRE_VER.tar.gz ]; then wget -P download-cache http://ftp.cs.stanford.edu/pub/exim/pcre/pcre-$PCRE_VER.tar.gz; fi
+  - if [ "$USE_PCRE2" != "Y" ] && [ ! -f download-cache/pcre-$PCRE_VER.tar.gz ]; then wget -P download-cache http://ftp.cs.stanford.edu/pub/exim/pcre/pcre-$PCRE_VER.tar.gz; fi
+  - if [ "$USE_PCRE2" = "Y" ] && [ ! -f download-cache/pcre2-$PCRE2_VER.tar.gz ]; then wget -P download-cache https://downloads.sourceforge.net/project/pcre/pcre2/${PCRE2_VER}/pcre2-${PCRE2_VER}.tar.gz; fi
   - git clone https://github.com/openresty/openresty.git ../openresty
   - git clone https://github.com/openresty/openresty-devel-utils.git
   - git clone https://github.com/simpl/ngx_devel_kit.git ../ndk-nginx-module
@@ -88,18 +94,20 @@ script:
   - make -j$JOBS > build.log 2>&1 || (cat build.log && exit 1)
   - sudo make PATH=$PATH install_sw > build.log 2>&1 || (cat build.log && exit 1)
   - cd ../mockeagain/ && make CC=$CC -j$JOBS && cd ..
-  - tar zxf download-cache/pcre-$PCRE_VER.tar.gz
-  - cd pcre-$PCRE_VER/
-  - ./configure --prefix=$PCRE_PREFIX --enable-jit --enable-utf --enable-unicode-properties > build.log 2>&1 || (cat build.log && exit 1)
-  - make -j$JOBS > build.log 2>&1 || (cat build.log && exit 1)
-  - sudo PATH=$PATH make install > build.log 2>&1 || (cat build.log && exit 1)
-  - cd ..
+  - if [ "$USE_PCRE2" != "Y" ]; then tar zxf download-cache/pcre-$PCRE_VER.tar.gz; cd pcre-$PCRE_VER/; ./configure --prefix=$PCRE_PREFIX --enable-jit --enable-utf --enable-unicode-properties > build.log 2>&1 || (cat build.log && exit 1); make -j$JOBS > build.log 2>&1 || (cat build.log && exit 1); sudo PATH=$PATH make install > build.log 2>&1 || (cat build.log && exit 1); cd ..; fi
+  - if [ "$USE_PCRE2" = "Y" ]; then tar zxf download-cache/pcre2-$PCRE2_VER.tar.gz; cd pcre2-$PCRE2_VER/; ./configure --prefix=$PCRE2_PREFIX --enable-jit --enable-utf > build.log 2>&1 || (cat build.log && exit 1); make -j$JOBS > build.log 2>&1 || (cat build.log && exit 1); sudo PATH=$PATH make install > build.log 2>&1 || (cat build.log && exit 1); cd ..; fi
   - export PATH=$PWD/work/nginx/sbin:$PWD/openresty-devel-utils:$PATH
   - export LD_PRELOAD=$PWD/mockeagain/mockeagain.so
   - export LD_LIBRARY_PATH=$PWD/mockeagain:$LD_LIBRARY_PATH
   - export TEST_NGINX_RESOLVER=8.8.4.4
   - export NGX_BUILD_CC=$CC
-  - ngx-build $NGINX_VERSION --with-ipv6 --with-http_realip_module --with-http_ssl_module --with-pcre-jit --with-cc-opt="-I$OPENSSL_INC -I$PCRE_INC" --with-ld-opt="-L$OPENSSL_LIB -Wl,-rpath,$OPENSSL_LIB -L$PCRE_LIB -Wl,-rpath,$PCRE_LIB" --add-module=../ndk-nginx-module --add-module=../echo-nginx-module --add-module=../set-misc-nginx-module --add-module=../headers-more-nginx-module --add-module=../lua-nginx-module --with-debug --with-stream_ssl_module --with-stream --with-ipv6 --add-module=../stream-lua-nginx-module > build.log 2>&1 || (cat build.log && exit 1)
+  - export add_http3_module=--with-http_v3_module
+  - export disable_pcre2=--without-pcre2
+  - answer=`util/ver-ge "$NGINX_VERSION" 1.25.1`
+  - if [ "$OPENSSL_VER" = "1.1.0l" ] || [ "$answer" = "N" ]; then add_http3_module=""; fi
+  - if [ "$answer" = "N" ] || [ "$USE_PCRE2" = "Y" ]; then disable_pcre2=""; fi
+  - if [ "$USE_PCRE2" = "Y" ]; then PCRE_INC=$PCRE2_INC; PCRE_LIB=$PCRE2_LIB; fi
+  - ngx-build $NGINX_VERSION --with-ipv6 $disable_pcre2 $add_http3_module --with-http_realip_module --with-http_ssl_module --with-pcre-jit --with-cc-opt="-I$OPENSSL_INC -I$PCRE_INC" --with-ld-opt="-L$OPENSSL_LIB -Wl,-rpath,$OPENSSL_LIB -L$PCRE_LIB -Wl,-rpath,$PCRE_LIB" --add-module=../ndk-nginx-module --add-module=../echo-nginx-module --add-module=../set-misc-nginx-module --add-module=../headers-more-nginx-module --add-module=../lua-nginx-module --with-debug --with-stream_ssl_module --with-stream --with-ipv6 --add-module=../stream-lua-nginx-module > build.log 2>&1 || (cat build.log && exit 1)
   - nginx -V
   - ldd `which nginx`|grep -E 'luajit|ssl|pcre'
   - prove -I. -Itest-nginx/lib -j$JOBS -r t

src/deps/src/lua-resty-core/README.markdown

@@ -55,7 +55,7 @@ This library is production ready.
 Synopsis
 ========
 
-This library is automatically loaded by default in OpenResty 1.15.8.1. This
+This library is automatically loaded by default since OpenResty 1.15.8.1. This
 behavior can be disabled via the
 [lua_load_resty_core](https://github.com/openresty/lua-nginx-module#lua_load_resty_core)
 directive, but note that the use of this library is vividly recommended, as its
@@ -112,8 +112,8 @@ of this library in the particular OpenResty release you are using. Otherwise you
 into serious compatibility issues.
 
 * LuaJIT 2.1 (for now, it is the v2.1 git branch in the official luajit-2.0 git repository: http://luajit.org/download.html )
-* [ngx_http_lua_module](https://github.com/openresty/lua-nginx-module) v0.10.21.
-* [ngx_stream_lua_module](https://github.com/openresty/stream-lua-nginx-module) v0.0.11.
+* [ngx_http_lua_module](https://github.com/openresty/lua-nginx-module) v0.10.25.
+* [ngx_stream_lua_module](https://github.com/openresty/stream-lua-nginx-module) v0.0.13.
 * [lua-resty-lrucache](https://github.com/openresty/lua-resty-lrucache)
 
 [Back to TOC](#table-of-contents)

src/deps/src/lua-resty-core/lib/ngx/balancer.md

@@ -29,7 +29,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/errlog.md

@@ -26,9 +26,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
-
-The API is still in flux and may change in the future without notice.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/ocsp.md

@@ -26,7 +26,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/pipe.md

@@ -37,7 +37,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/process.md

@@ -25,8 +25,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
-The API is still in flux and may change in the future without notice.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/re.md

@@ -24,7 +24,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/req.md

@@ -22,7 +22,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/resp.md

@@ -22,7 +22,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/ngx/ssl/clienthello.lua

@@ -193,12 +193,12 @@ end
 
 
 local prot_map  = {
-  ["SSLv2"] = 0x0002,
-  ["SSLv3"] = 0x0004,
-  ["TLSv1"] = 0x0008,
-  ["TLSv1.1"] = 0x0010,
-  ["TLSv1.2"] = 0x0020,
-  ["TLSv1.3"] = 0x0040
+    ["SSLv2"] = 0x0002,
+    ["SSLv3"] = 0x0004,
+    ["TLSv1"] = 0x0008,
+    ["TLSv1.1"] = 0x0010,
+    ["TLSv1.2"] = 0x0020,
+    ["TLSv1.3"] = 0x0040
 }
 
 

src/deps/src/lua-resty-core/lib/ngx/ssl/clienthello.md

@@ -25,7 +25,7 @@ Table of Contents
 Status
 ======
 
-This Lua module is currently considered experimental.
+This Lua module is production ready.
 
 Synopsis
 ========

src/deps/src/lua-resty-core/lib/resty/core/base.lua

@@ -19,22 +19,22 @@ local FREE_LIST_REF = 0
 if subsystem == 'http' then
     if not ngx.config
        or not ngx.config.ngx_lua_version
-       or ngx.config.ngx_lua_version ~= 10025
+       or ngx.config.ngx_lua_version ~= 10026
     then
-        error("ngx_http_lua_module 0.10.25 required")
+        error("ngx_http_lua_module 0.10.26 required")
     end
 
 elseif subsystem == 'stream' then
     if not ngx.config
        or not ngx.config.ngx_lua_version
-       or ngx.config.ngx_lua_version ~= 13
+       or ngx.config.ngx_lua_version ~= 14
     then
-        error("ngx_stream_lua_module 0.0.13 required")
+        error("ngx_stream_lua_module 0.0.14 required")
     end
 
 else
-    error("ngx_http_lua_module 0.10.25 or "
-          .. "ngx_stream_lua_module 0.0.13 required")
+    error("ngx_http_lua_module 0.10.26 or "
+          .. "ngx_stream_lua_module 0.0.14 required")
 end
 
 
@@ -141,7 +141,7 @@ local c_buf_type = ffi.typeof("char[?]")
 local _M = new_tab(0, 18)
 
 
-_M.version = "0.1.27"
+_M.version = "0.1.28"
 _M.new_tab = new_tab
 _M.clear_tab = clear_tab
 

src/deps/src/lua-resty-core/lib/resty/core/regex.lua

@@ -82,7 +82,7 @@ if not pcall(function() pcre_ver = ffi_string(pcre_ver_fn()) end) then
 end
 
 
-local MAX_ERR_MSG_LEN = 128
+local MAX_ERR_MSG_LEN = 256
 
 
 local FLAG_COMPILE_ONCE  = 0x01
@@ -102,6 +102,7 @@ local PCRE_DUPNAMES          = 0x0080000
 local PCRE_JAVASCRIPT_COMPAT = 0x2000000
 
 
+-- PCRE2_ERROR_NOMATCH uses the same value
 local PCRE_ERROR_NOMATCH = -1
 
 
@@ -135,22 +136,44 @@ local ngx_lua_ffi_script_eval_data
 -- TODO: improve this workaround when PCRE allows for unspecifying the MAP_JIT
 -- option.
 local no_jit_in_init
+local pcre_ver_num
+
+local maj, min = string.match(pcre_ver, "^(%d+)%.(%d+)")
+if maj and min then
+    pcre_ver_num = tonumber(maj .. min)
+end
 
 if jit.os == "OSX" then
-    local maj, min = string.match(pcre_ver, "^(%d+)%.(%d+)")
-    if maj and min then
-        local pcre_ver_num = tonumber(maj .. min)
-
-        if pcre_ver_num >= 843 then
-            no_jit_in_init = true
-        end
-
-    else
+    if pcre_ver_num == nil then
         -- assume this version is faulty as well
         no_jit_in_init = true
+
+    -- PCRE2 is also subject to this issue on macOS
+    elseif pcre_ver_num >= 843 then
+        no_jit_in_init = true
     end
 end
 
+-- pcre2
+if pcre_ver_num > 845 then
+    -- option
+    PCRE_CASELESS          = 0x00000008
+    PCRE_MULTILINE         = 0x00000400
+    PCRE_DOTALL            = 0x00000020
+    PCRE_EXTENDED          = 0x00000080
+    PCRE_ANCHORED          = 0x80000000
+    PCRE_UTF8              = 0x00080000
+    PCRE_DUPNAMES          = 0x00000040
+    -- In the pcre2, The PCRE_JAVASCRIPT_COMPAT option has been split into
+    -- independent functional options PCRE2_ALT_BSUX, PCRE2_ALLOW_EMPTY_CLASS,
+    -- and PCRE2_MATCH_UNSET_BACKREF.
+    local PCRE2_ALT_BSUX            = 0x00000002
+    local PCRE2_ALLOW_EMPTY_CLASS   = 0x00000001
+    local PCRE2_MATCH_UNSET_BACKREF = 0x00000200
+    PCRE_JAVASCRIPT_COMPAT = bor(PCRE2_ALT_BSUX, PCRE2_ALLOW_EMPTY_CLASS)
+    PCRE_JAVASCRIPT_COMPAT = bor(PCRE2_MATCH_UNSET_BACKREF,
+                                 PCRE_JAVASCRIPT_COMPAT)
+end
 
 if subsystem == 'http' then
     ffi.cdef[[

src/deps/src/lua-resty-core/lib/resty/core/time.md

@@ -57,7 +57,7 @@ monotonic_msec
 
 **syntax:** *monotonic_msec()*
 
-Returns the elapsed time in microseconds from the machine boot for the current time stamp from the Nginx cached time (no syscall involved unlike Lua's date library).
+Returns the elapsed time in milliseconds from the machine boot for the current time stamp from the Nginx cached time (no syscall involved unlike Lua's date library).
 
 ```lua
 local cur_msec = require "resty.core.time".monotonic_msec

src/deps/src/lua-resty-core/lib/resty/core/worker.lua

@@ -74,6 +74,8 @@ end
 
 if is_not_windows then
     if subsystem == "http" then
+        require "resty.core.phase"  -- for ngx.get_phase
+
         ffi.cdef[[
         int ngx_http_lua_ffi_worker_pids(int *pids, size_t *pids_len);
         ]]
@@ -88,16 +90,18 @@ if is_not_windows then
         ngx_lua_ffi_worker_pids = C.ngx_stream_lua_ffi_worker_pids
     end
 
+    local ngx_phase = ngx.get_phase
 
     function ngx.worker.pids()
-        if ngx.get_phase() == "init" or ngx.get_phase() == "init_worker" then
+        local phase = ngx_phase()
+        if phase == "init" or phase == "init_worker" then
             return nil, "API disabled in the current context"
         end
 
         local pids = {}
         local size_ptr = get_size_ptr()
         -- the old and the new workers coexist during reloading
-        local worker_cnt = ngx.worker.count() * 4
+        local worker_cnt = ngx_lua_ffi_worker_count() * 4
         if worker_cnt == 0 then
             return pids
         end
@@ -117,6 +121,7 @@ if is_not_windows then
     end
 end
 
+
 function ngx.worker.id()
     local id = ngx_lua_ffi_worker_id()
     if id < 0 then

src/deps/src/lua-resty-core/t/ctx.t

@@ -379,6 +379,7 @@ lua release ngx.ctx at ref 1
     }
 --- config
     lua_ssl_trusted_certificate ../../cert/test.crt;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         content_by_lua_block {
@@ -481,6 +482,7 @@ lua release ngx.ctx at ref 1
     }
 --- config
     lua_ssl_trusted_certificate ../../cert/test.crt;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         content_by_lua_block {
@@ -535,6 +537,7 @@ lua release ngx.ctx at ref 1
         ssl_session_tickets off;
         ssl_certificate ../../cert/test.crt;
         ssl_certificate_key ../../cert/test.key;
+        ssl_protocols TLSv1.2;
 
         server_tokens off;
         location /foo {
@@ -636,6 +639,7 @@ lua release ngx.ctx at ref 1
         ssl_session_tickets off;
         ssl_certificate ../../cert/test.crt;
         ssl_certificate_key ../../cert/test.key;
+        ssl_protocols TLSv1.2;
 
         server_tokens off;
         location /foo {
@@ -702,6 +706,7 @@ lua release ngx.ctx at ref 1
         ssl_session_tickets off;
         ssl_certificate ../../cert/test.crt;
         ssl_certificate_key ../../cert/test.key;
+        ssl_protocols TLSv1.2;
 
         ssl_certificate_by_lua_block {
             ngx.ctx.count = ngx.ctx.count and (ngx.ctx.count + 100) or 100

src/deps/src/lua-resty-core/t/pipe.t

@@ -1025,6 +1025,7 @@ MD5\([^)]+\)= 8bc944dbd052ef51652e70a5104492e3
     }
 --- response_body
 closed
+--- timeout: 10s
 
 
 

src/deps/src/lua-resty-core/t/re-base.t

@@ -26,8 +26,11 @@ __DATA__
     }
 --- request
     GET /re
---- response_body
-error: pcre_compile() failed: missing ) in "(abc"
+--- response_body eval
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre2_compile() failed: missing closing parenthesis in \"(abc\"\n"
+:
+"error: pcre_compile() failed: missing ) in \"(abc\"\n"
 --- no_error_log
 [error]
 
@@ -63,8 +66,11 @@ error: pcre_compile() failed: missing ) in "(abc"
     }
 --- request
 GET /t
---- response_body_like chop
-error: pcre_exec\(\) failed: -10
+--- response_body eval
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre_exec\(\) failed: -4\n"
+:
+"error: pcre_exec\(\) failed: -10\n"
 
 --- no_error_log
 [error]
@@ -128,6 +134,7 @@ probe process("$LIBPCRE_PATH").function("pcre_exec") {
     printf("exec opts: %x\n", $options)
 }
 
+# TODO: PCRE2 use different option values from PCRE
 --- stap_out
 compile opts: 800
 exec opts: 0
@@ -172,8 +179,14 @@ end
 
 --- request
     GET /re
---- response_body
-error: pcre_exec() failed: -8
+--- response_body eval
+# lua_regex_match_limit uses pcre_extra->match_limit in the PCRE,
+# but PCRE2 replaces this with pcre2_set_match_limit interface,
+# which has different effects.
+$Test::Nginx::Util::PcreVersion == 2 ?
+"failed to match\n"
+:
+"error: pcre_exec() failed: -8\n"
 
 
 

src/deps/src/lua-resty-core/t/re-gmatch.t

@@ -446,9 +446,13 @@ matched: nil
     }
 --- request
 GET /re
---- response_body
-error: pcre_exec() failed: -10
-not matched
+--- response_body eval
+# PCRE2_ERROR_UTF8_ERR2 (-4)
+# PCRE_ERROR_BADUTF8 (-10)
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre_exec\(\) failed: -4\nnot matched\n"
+:
+"error: pcre_exec\(\) failed: -10\nnot matched\n"
 --- no_error_log
 [error]
 

src/deps/src/lua-resty-core/t/re-match.t

@@ -306,8 +306,11 @@ NYI
     }
 --- request
     GET /re
---- response_body_like chop
-error: pcre_compile\(\) failed: two named subpatterns have the same name
+--- response_body eval
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre2_compile\(\) failed: two named subpatterns have the same name \(PCRE2_DUPNAMES not set\) in \"\(\?<first>[a-z])\(\?<first>[a-z]+\), [0-9]+\" at \"[a-z]+\), [0-9]+\"\n"
+:
+"error: pcre_compile\(\) failed: two named subpatterns have the same name in \"\(\?<first>[a-z])\(\?<first>[a-z]+\), [0-9]+\" at \">[a-z]+\), [0-9]+\"\n"
 
 --- error_log eval
 qr/\[TRACE\s+\d+/

src/deps/src/lua-resty-core/t/re-opt.t

@@ -39,8 +39,13 @@ __DATA__
     }
 --- request
     GET /re
---- response_body
-error: pcre_exec() failed: -27
+--- response_body eval
+# PCRE2_ERROR_JIT_STACKLIMIT (-46)
+# PCRE_ERROR_JIT_STACKLIMIT  (-27)
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre_exec\(\) failed: -46\n"
+:
+"error: pcre_exec\(\) failed: -27\n"
 --- no_error_log
 [error]
 --- timeout: 10

src/deps/src/lua-resty-core/t/ssl-session-fetch.t

@@ -51,6 +51,7 @@ __DATA__
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -97,7 +98,7 @@ qr/ssl_session_fetch_by_lua\(nginx.conf:\d+\):\d+: session id: [a-fA-f\d]+/s
 
 --- grep_error_log_out eval
 [
-qr/ssl_session_fetch_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-f\d]+/s,
+"",
 qr/ssl_session_fetch_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-f\d]+/s,
 qr/ssl_session_fetch_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-f\d]+/s,
 ]
@@ -138,6 +139,7 @@ qr/ssl_session_fetch_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-f\d]+/s,
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -184,8 +186,7 @@ qr/ssl_session_fetch_by_lua:\d: session size: [a-fA-f\d]+|get session error: bad
 
 --- grep_error_log_out eval
 [
-'get session error: bad session in lua context
-',
+"",
 'get session error: bad session in lua context
 ',
 'get session error: bad session in lua context
@@ -246,6 +247,7 @@ In practice, never store session in plaintext on persistent storage.
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -342,6 +344,7 @@ able to carry on and negotiate a new session.
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -388,10 +391,7 @@ qr/failed to resume session: failed to de-serialize session|ssl_session_(fetch|s
 
 --- grep_error_log_out eval
 [
-qr/^ssl_session_fetch_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-F\d]+
-failed to resume session: failed to de-serialize session
-ssl_session_store_by_lua\(nginx.conf:\d+\):5: session id: [a-fA-F\d]+
-$/s,
+qr/^ssl_session_store_by_lua\(nginx.conf:\d+\):5: session id: [a-fA-F\d]+$/s,
 qr/^ssl_session_fetch_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-F\d]+
 failed to resume session: failed to de-serialize session
 ssl_session_store_by_lua\(nginx.conf:\d+\):5: session id: [a-fA-F\d]+
@@ -440,6 +440,7 @@ $/s,
         ssl_session_tickets off;
         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
+        ssl_protocols TLSv1.2;
 
         location / {
             content_by_lua_block {
@@ -557,6 +558,7 @@ $/s,
 --- config
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;

src/deps/src/lua-resty-core/t/ssl-session-store.t

@@ -49,6 +49,7 @@ __DATA__
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -121,6 +122,7 @@ qr/ssl_session_store_by_lua\(nginx.conf:\d+\):4: session size: \d+/s
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -229,6 +231,7 @@ qr/ssl_session_store_by_lua\(nginx.conf:\d+\):4: session id: [a-fA-f\d]+/s
     resolver $TEST_NGINX_RESOLVER;
     lua_ssl_trusted_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
     lua_ssl_verify_depth 3;
+    lua_ssl_protocols TLSv1.2;
 
     location /t {
         set $port $TEST_NGINX_MEMCACHED_PORT;

src/deps/src/lua-resty-core/t/stream/re-base.t

@@ -22,8 +22,11 @@ __DATA__
             ngx.say("error: ", err)
         end
     }
---- stream_response
-error: pcre_compile() failed: missing ) in "(abc"
+--- stream_response eval
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre2_compile() failed: missing closing parenthesis in \"(abc\"\n"
+:
+"error: pcre_compile() failed: missing ) in \"(abc\"\n"
 --- no_error_log
 [error]
 
@@ -55,12 +58,17 @@ error: pcre_compile() failed: missing ) in "(abc"
             ngx.say("not matched")
         end
     }
---- stream_response_like chop
-error: pcre_exec\(\) failed: -10
+--- stream_response eval
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre_exec\(\) failed: -4\n"
+:
+"error: pcre_exec\(\) failed: -10\n"
 
 --- no_error_log
 [error]
 
+--- ONLY
+
 
 
 === TEST 3: UTF-8 mode without UTF-8 sequence checks
@@ -114,6 +122,7 @@ probe process("$LIBPCRE_PATH").function("pcre_exec") {
     printf("exec opts: %x\n", $options)
 }
 
+# TODO: PCRE2 use different option values from PCRE
 --- stap_out
 compile opts: 800
 exec opts: 0
@@ -152,8 +161,14 @@ if not res then
     return
 end
 
---- stream_response
-error: pcre_exec() failed: -8
+--- stream_response eval
+# lua_regex_match_limit uses pcre_extra->match_limit in the PCRE,
+# but PCRE2 replaces this with pcre2_set_match_limit interface,
+# which has different effects.
+$Test::Nginx::Util::PcreVersion == 2 ?
+"failed to match\n"
+:
+"error: pcre_exec() failed: -8\n"
 
 
 

src/deps/src/lua-resty-core/t/stream/re-gmatch.t

@@ -394,9 +394,13 @@ matched: nil
             ngx.say("not matched")
         end
     }
---- stream_response
-error: pcre_exec() failed: -10
-not matched
+--- stream_response eval
+# PCRE2_ERROR_UTF8_ERR2 (-4)
+# PCRE_ERROR_BADUTF8 (-10)
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre_exec\(\) failed: -4\nnot matched\n"
+:
+"error: pcre_exec\(\) failed: -10\nnot matched\n"
 --- no_error_log
 [error]
 

src/deps/src/lua-resty-core/t/stream/re-match.t

@@ -268,8 +268,11 @@ NYI
             ngx.say("not matched!")
         end
     }
---- stream_response_like chop
-error: pcre_compile\(\) failed: two named subpatterns have the same name
+--- stream_response eval
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre2_compile\(\) failed: two named subpatterns have the same name \(PCRE2_DUPNAMES not set\) in \"\(\?<first>[a-z])\(\?<first>[a-z]+\), [0-9]+\" at \"[a-z]+\), [0-9]+\"\n"
+:
+"error: pcre_compile\(\) failed: two named subpatterns have the same name in \"\(\?<first>[a-z])\(\?<first>[a-z]+\), [0-9]+\" at \">[a-z]+\), [0-9]+\"\n"
 
 --- error_log eval
 qr/\[TRACE\s+\d+/

src/deps/src/lua-resty-core/t/stream/re-opt.t

@@ -36,8 +36,13 @@ __DATA__
             ngx.say("not matched!")
         end
     }
---- stream_response
-error: pcre_exec() failed: -27
+--- stream_response eval
+# PCRE2_ERROR_JIT_STACKLIMIT (-46)
+# PCRE_ERROR_JIT_STACKLIMIT  (-27)
+$Test::Nginx::Util::PcreVersion == 2 ?
+"error: pcre_exec\(\) failed: -46\n"
+:
+"error: pcre_exec\(\) failed: -27\n"
 --- no_error_log
 [error]
 --- timeout: 10

src/deps/src/lua-resty-core/util/ver-ge

@@ -0,0 +1,41 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+
+sub usage {
+    die "Usage: $0 <ver1> <ver2>\n";
+}
+
+my $a = shift or usage();
+my $b = shift or usage();
+
+my @as = split /\./, $a;
+my @bs = split /\./, $b;
+
+my $n = @as > @bs ? scalar(@as) : scalar(@bs);
+
+for (my $i = 0; $i < $n; $i++) {
+    my $x = $as[$i];
+    my $y = $bs[$i];
+
+    if (!defined $x) {
+        $x = 0;
+    }
+
+    if (!defined $y) {
+        $y = 0;
+    }
+
+    if ($x > $y) {
+        print "Y\n";
+        exit;
+
+    } elsif ($x < $y) {
+        print "N\n";
+        exit;
+    }
+}
+
+print "Y\n";
+