Compare commits

..

No commits in common. "c8-stream-1.16" and "stream-nginx-1.22-rhel-8.9.0" have entirely different histories.

35 changed files with 1010 additions and 198 deletions

4
.gitignore vendored
View File

@ -1,2 +1,2 @@
SOURCES/nginx-1.16.1.tar.gz SOURCES/nginx-1.22.1.tar.gz
SOURCES/poweredby.png /nginx-1.22.1.tar.gz

View File

@ -1,2 +1 @@
77ce4d26481b62f7a9d83e399454df0912f01a4b SOURCES/nginx-1.16.1.tar.gz 45a89797f7c789287c7f663811efbbd19e84f154 nginx-1.22.1.tar.gz
2ec82988cd0d9b1304c95a16b28eff70f0f69abc SOURCES/poweredby.png

View File

@ -0,0 +1,31 @@
From 00cab63102084b89de0a3494a1d023c4b1d4982b Mon Sep 17 00:00:00 2001
From: Felix Kaechele <felix@kaechele.ca>
Date: Sun, 7 Jun 2020 12:14:02 -0400
Subject: [PATCH 1/2] remove Werror in upstream build scripts
removes -Werror in upstream build scripts. -Werror conflicts with
-D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
---
auto/cc/gcc | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/auto/cc/gcc b/auto/cc/gcc
index a5c5c18..cdbbadb 100644
--- a/auto/cc/gcc
+++ b/auto/cc/gcc
@@ -166,7 +166,9 @@ esac
# stop on warning
-CFLAGS="$CFLAGS -Werror"
+# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx
+# to not compile.
+#CFLAGS="$CFLAGS -Werror"
# debug
CFLAGS="$CFLAGS -g"
--
2.31.1

View File

@ -0,0 +1,108 @@
From 62470498cca9a209aa9904668c1949f5229123af Mon Sep 17 00:00:00 2001
From: Felix Kaechele <felix@kaechele.ca>
Date: Tue, 20 Apr 2021 21:28:18 -0400
Subject: [PATCH 2/2] fix PIDFile handling
Corresponding RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1869026
Rejected upstream: https://trac.nginx.org/nginx/ticket/1897
Taken from: https://git.launchpad.net/ubuntu/+source/nginx/tree/debian/patches/nginx-fix-pidfile.patch
From original patch:
Author: Tj <ubuntu@iam.tj>
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1581864
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876365
iLast-Update: 2020-06-24
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
---
src/core/nginx.c | 24 +++++++++++++++++++++---
src/os/unix/ngx_daemon.c | 8 ++++++--
2 files changed, 27 insertions(+), 5 deletions(-)
diff --git a/src/core/nginx.c b/src/core/nginx.c
index 48a20e9..32c0afe 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -339,14 +339,21 @@ main(int argc, char *const *argv)
ngx_process = NGX_PROCESS_MASTER;
}
+ /* tell-tale to detect if this is parent or child process */
+ ngx_int_t child_pid = NGX_BUSY;
+
#if !(NGX_WIN32)
if (ngx_init_signals(cycle->log) != NGX_OK) {
return 1;
}
+ /* tell-tale that this code has been executed */
+ child_pid--;
+
if (!ngx_inherited && ccf->daemon) {
- if (ngx_daemon(cycle->log) != NGX_OK) {
+ child_pid = ngx_daemon(cycle->log);
+ if (child_pid == NGX_ERROR) {
return 1;
}
@@ -359,8 +366,19 @@ main(int argc, char *const *argv)
#endif
- if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) {
- return 1;
+ /* If ngx_daemon() returned the child's PID in the parent process
+ * after the fork() set ngx_pid to the child_pid, which gets
+ * written to the PID file, then exit.
+ * For NGX_WIN32 always write the PID file
+ * For others, only write it from the parent process */
+ if (child_pid < NGX_OK || child_pid > NGX_OK) {
+ ngx_pid = child_pid > NGX_OK ? child_pid : ngx_pid;
+ if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) {
+ return 1;
+ }
+ }
+ if (child_pid > NGX_OK) {
+ exit(0);
}
if (ngx_log_redirect_stderr(cycle) != NGX_OK) {
diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c
index 385c49b..3719854 100644
--- a/src/os/unix/ngx_daemon.c
+++ b/src/os/unix/ngx_daemon.c
@@ -7,14 +7,17 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#include <unistd.h>
ngx_int_t
ngx_daemon(ngx_log_t *log)
{
int fd;
+ /* retain the return value for passing back to caller */
+ pid_t pid_child = fork();
- switch (fork()) {
+ switch (pid_child) {
case -1:
ngx_log_error(NGX_LOG_EMERG, log, ngx_errno, "fork() failed");
return NGX_ERROR;
@@ -23,7 +26,8 @@ ngx_daemon(ngx_log_t *log)
break;
default:
- exit(0);
+ /* let caller do the exit() */
+ return pid_child;
}
ngx_parent = ngx_pid;
--
2.31.1

View File

@ -0,0 +1,88 @@
From 4e5f12d6584536ead82d20554d8f3f2ab0107b0b Mon Sep 17 00:00:00 2001
From: Lubos Uhliarik <luhliari@redhat.com>
Date: Fri, 30 Apr 2021 13:07:45 +0000
Subject: [PATCH 3/3] Support loading certificates from hardware token (PKCS#11)
---
src/event/ngx_event_openssl.c | 65 +++++++++++++++++++++++++++++++++++
1 file changed, 65 insertions(+)
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index d762d6b..270b200 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -617,6 +617,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
X509 *x509, *temp;
u_long n;
+ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) {
+
+#ifndef OPENSSL_NO_ENGINE
+
+ u_char *p, *last;
+ ENGINE *engine;
+
+ p = cert->data + sizeof("engine:") - 1;
+ last = (u_char *) ngx_strchr(p, ':');
+
+ if (last == NULL) {
+ *err = "invalid syntax";
+ return NULL;
+ }
+
+ *last = '\0';
+
+ engine = ENGINE_by_id((char *) p);
+
+ if (engine == NULL) {
+ *err = "ENGINE_by_id() failed";
+ return NULL;
+ }
+
+ if (!ENGINE_init(engine)) {
+ *err = "ENGINE_init() failed";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
+ *last++ = ':';
+
+ struct {
+ const char *cert_id;
+ X509 *cert;
+ } params = { (char *) last, NULL };
+
+ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
+ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
+ ENGINE_finish(engine);
+ ENGINE_free(engine);
+
+ /* set chain to null */
+
+ *chain = sk_X509_new_null();
+ if (*chain == NULL) {
+ *err = "sk_X509_new_null() failed";
+ X509_free(params.cert);
+ return NULL;
+ }
+
+ return params.cert;
+
+#else
+
+ *err = "loading \"engine:...\" certificate is not supported";
+ return NULL;
+
+#endif
+ }
+
if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,
--
2.26.3

View File

@ -0,0 +1,26 @@
From 80c0ee172cceaef933ff5a451ec2a16213e03996 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 22 Sep 2021 15:55:39 +0200
Subject: [PATCH] Set proper compiler optimalization level (O2) for perl
module.
---
src/http/modules/perl/Makefile.PL | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL
index 7edadcb..2ebb7c4 100644
--- a/src/http/modules/perl/Makefile.PL
+++ b/src/http/modules/perl/Makefile.PL
@@ -14,7 +14,7 @@ WriteMakefile(
AUTHOR => 'Igor Sysoev',
CCFLAGS => "$ENV{NGX_PM_CFLAGS}",
- OPTIMIZE => '-O',
+ OPTIMIZE => '-O2',
LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}",
--
2.31.1

View File

@ -0,0 +1,41 @@
From a769a35a6197c76390e1dd8f5054d426fbbbda05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 22 Sep 2021 16:12:58 +0200
Subject: [PATCH] Init openssl engine properly
---
src/event/ngx_event_openssl.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 270b200..f813458 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -798,16 +798,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
return NULL;
}
+ if (!ENGINE_init(engine)) {
+ *err = "ENGINE_init() failed";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
*last++ = ':';
pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
if (pkey == NULL) {
*err = "ENGINE_load_private_key() failed";
+ ENGINE_finish(engine);
ENGINE_free(engine);
return NULL;
}
+ ENGINE_finish(engine);
ENGINE_free(engine);
return pkey;
--
2.31.1

View File

@ -0,0 +1,96 @@
From ee8ea4f1c88a0393206769cd30a545dc3375f868 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 2 Feb 2022 20:14:55 +0100
Subject: [PATCH] Fix ALPACA security issue
---
src/mail/ngx_mail.h | 3 +++
src/mail/ngx_mail_core_module.c | 10 ++++++++++
src/mail/ngx_mail_handler.c | 15 ++++++++++++++-
3 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/src/mail/ngx_mail.h b/src/mail/ngx_mail.h
index b865a3b..76cae37 100644
--- a/src/mail/ngx_mail.h
+++ b/src/mail/ngx_mail.h
@@ -115,6 +115,8 @@ typedef struct {
ngx_msec_t timeout;
ngx_msec_t resolver_timeout;
+ ngx_uint_t max_errors;
+
ngx_str_t server_name;
u_char *file_name;
@@ -231,6 +233,7 @@ typedef struct {
ngx_uint_t command;
ngx_array_t args;
+ ngx_uint_t errors;
ngx_uint_t login_attempt;
/* used to parse POP3/IMAP/SMTP command */
diff --git a/src/mail/ngx_mail_core_module.c b/src/mail/ngx_mail_core_module.c
index 4083124..115671c 100644
--- a/src/mail/ngx_mail_core_module.c
+++ b/src/mail/ngx_mail_core_module.c
@@ -85,6 +85,13 @@ static ngx_command_t ngx_mail_core_commands[] = {
offsetof(ngx_mail_core_srv_conf_t, resolver_timeout),
NULL },
+ { ngx_string("max_errors"),
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
+ ngx_conf_set_num_slot,
+ NGX_MAIL_SRV_CONF_OFFSET,
+ offsetof(ngx_mail_core_srv_conf_t, max_errors),
+ NULL },
+
ngx_null_command
};
@@ -163,6 +170,8 @@ ngx_mail_core_create_srv_conf(ngx_conf_t *cf)
cscf->timeout = NGX_CONF_UNSET_MSEC;
cscf->resolver_timeout = NGX_CONF_UNSET_MSEC;
+ cscf->max_errors = NGX_CONF_UNSET_UINT;
+
cscf->resolver = NGX_CONF_UNSET_PTR;
cscf->file_name = cf->conf_file->file.name.data;
@@ -182,6 +191,7 @@ ngx_mail_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_msec_value(conf->resolver_timeout, prev->resolver_timeout,
30000);
+ ngx_conf_merge_uint_value(conf->max_errors, prev->max_errors, 5);
ngx_conf_merge_str_value(conf->server_name, prev->server_name, "");
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
index 0aaa0e7..71b8151 100644
--- a/src/mail/ngx_mail_handler.c
+++ b/src/mail/ngx_mail_handler.c
@@ -871,7 +871,20 @@ ngx_mail_read_command(ngx_mail_session_t *s, ngx_connection_t *c)
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
- if (rc == NGX_IMAP_NEXT || rc == NGX_MAIL_PARSE_INVALID_COMMAND) {
+ if (rc == NGX_MAIL_PARSE_INVALID_COMMAND) {
+
+ s->errors++;
+
+ if (s->errors >= cscf->max_errors) {
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
+ "client sent too many invalid commands");
+ s->quit = 1;
+ }
+
+ return rc;
+ }
+
+ if (rc == NGX_IMAP_NEXT) {
return rc;
}
--
2.31.1

View File

@ -0,0 +1,173 @@
From cc7b92c61a2833ff9dc2b4dfba4591966769da78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 21 Jun 2022 13:55:04 +0200
Subject: [PATCH] Enable TLSv1.3 by default in nginx
---
src/event/ngx_event_openssl.c | 77 ++++++++++++++------------
src/event/ngx_event_openssl.h | 1 +
src/http/modules/ngx_http_ssl_module.c | 3 +-
src/mail/ngx_mail_ssl_module.c | 3 +-
src/stream/ngx_stream_ssl_module.c | 3 +-
5 files changed, 46 insertions(+), 41 deletions(-)
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index f813458..2e6a6c0 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log)
ngx_int_t
ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
{
+ ngx_uint_t prot = NGX_SSL_NO_PROT;
+
ssl->ctx = SSL_CTX_new(SSLv23_method());
if (ssl->ctx == NULL) {
@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL
- /* only in 0.9.8m+ */
- SSL_CTX_clear_options(ssl->ctx,
- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
-#endif
-
- if (!(protocols & NGX_SSL_SSLv2)) {
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
- }
- if (!(protocols & NGX_SSL_SSLv3)) {
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
- }
- if (!(protocols & NGX_SSL_TLSv1)) {
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
- }
-#ifdef SSL_OP_NO_TLSv1_1
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
- if (!(protocols & NGX_SSL_TLSv1_1)) {
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
- }
+ if (protocols){
+#ifdef SSL_OP_NO_TLSv1_3
+ if (protocols & NGX_SSL_TLSv1_3) {
+ prot = TLS1_3_VERSION;
+ } else
#endif
#ifdef SSL_OP_NO_TLSv1_2
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
- if (!(protocols & NGX_SSL_TLSv1_2)) {
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
- }
+ if (protocols & NGX_SSL_TLSv1_2) {
+ prot = TLS1_2_VERSION;
+ } else
#endif
-#ifdef SSL_OP_NO_TLSv1_3
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
- if (!(protocols & NGX_SSL_TLSv1_3)) {
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
- }
+#ifdef SSL_OP_NO_TLSv1_1
+ if (protocols & NGX_SSL_TLSv1_1) {
+ prot = TLS1_1_VERSION;
+ } else
#endif
+ if (protocols & NGX_SSL_TLSv1) {
+ prot = TLS1_VERSION;
+ }
+
+ if (prot == NGX_SSL_NO_PROT) {
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+ "No SSL protocols available [hint: ssl_protocols]");
+ return NGX_ERROR;
+ }
-#ifdef SSL_CTX_set_min_proto_version
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
+ SSL_CTX_set_max_proto_version(ssl->ctx, prot);
+
+ /* Now, we have to scan for minimal protocol version,
+ *without allowing holes between min and max*/
+#ifdef SSL_OP_NO_TLSv1_3
+ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) {
+ prot = TLS1_2_VERSION;
+ }
#endif
-#ifdef TLS1_3_VERSION
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
+#ifdef SSL_OP_NO_TLSv1_1
+ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) {
+ prot = TLS1_1_VERSION;
+ }
+#endif
+#ifdef SSL_OP_NO_TLSv1_2
+ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) {
+ prot = TLS1_VERSION;
+ }
#endif
+ SSL_CTX_set_min_proto_version(ssl->ctx, prot);
+ }
#ifdef SSL_OP_NO_COMPRESSION
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 329760d..5cee113 100644
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -152,6 +152,7 @@ typedef struct {
#endif
+#define NGX_SSL_NO_PROT 0x0000
#define NGX_SSL_SSLv2 0x0002
#define NGX_SSL_SSLv3 0x0004
#define NGX_SSL_TLSv1 0x0008
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index a47d696..94f30db 100644
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
+ 0)
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
NGX_SSL_BUFSIZE);
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
index 7eae83e..8328560 100644
--- a/src/mail/ngx_mail_ssl_module.c
+++ b/src/mail/ngx_mail_ssl_module.c
@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
prev->prefer_server_ciphers, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
+ 0);
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
index d8c0471..cef590d 100644
--- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c
@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
prev->prefer_server_ciphers, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
+ 0);
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
--
2.31.1

View File

@ -16,5 +16,5 @@ Prevent dynamic modules from being enabled automatically
You may want to avoid dynamic modules being enabled automatically. Simply You may want to avoid dynamic modules being enabled automatically. Simply
remove this line from the top of /etc/nginx/nginx.conf: remove this line from the top of /etc/nginx/nginx.conf:
include /usr/lib64/nginx/modules/*.conf; include /usr/share/nginx/modules/*.conf;

View File

@ -1,117 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<style type="text/css">
/*<![CDATA[*/
body {
background-color: #fff;
color: #000;
font-size: 0.9em;
font-family: sans-serif,helvetica;
margin: 0;
padding: 0;
}
:link {
color: #c00;
}
:visited {
color: #c00;
}
a:hover {
color: #f50;
}
h1 {
text-align: center;
margin: 0;
padding: 0.6em 2em 0.4em;
background-color: #900;
color: #fff;
font-weight: normal;
font-size: 1.75em;
border-bottom: 2px solid #000;
}
h1 strong {
font-weight: bold;
font-size: 1.5em;
}
h2 {
text-align: center;
background-color: #900;
font-size: 1.1em;
font-weight: bold;
color: #fff;
margin: 0;
padding: 0.5em;
border-bottom: 2px solid #000;
}
hr {
display: none;
}
.content {
padding: 1em 5em;
}
.alert {
border: 2px solid #000;
}
img {
border: 2px solid #fff;
padding: 2px;
margin: 2px;
}
a:hover img {
border: 2px solid #294172;
}
.logos {
margin: 1em;
text-align: center;
}
/*]]>*/
</style>
</head>
<body>
<h1>Welcome to <strong>nginx</strong> on Red Hat Enterprise Linux!</h1>
<div class="content">
<p>This page is used to test the proper operation of the
<strong>nginx</strong> HTTP server after it has been
installed. If you can read this page, it means that the
web server installed at this site is working
properly.</p>
<div class="alert">
<h2>Website Administrator</h2>
<div class="content">
<p>This is the default <tt>index.html</tt> page that
is distributed with <strong>nginx</strong> on
Red Hat Enterprise Linux. It is located in
<tt>/usr/share/nginx/html</tt>.</p>
<p>You should now put your content in a location of
your choice and edit the <tt>root</tt> configuration
directive in the <strong>nginx</strong>
configuration file
<tt>/etc/nginx/nginx.conf</tt>.</p>
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
</div>
</div>
<div class="logos">
<a href="http://nginx.net/"><img
src="nginx-logo.png"
alt="[ Powered by nginx ]"
width="121" height="32" /></a>
<a href="http://www.redhat.com/"><img
src="poweredby.png"
alt="[ Powered by Red Hat Enterprise Linux ]"
width="88" height="31" /></a>
</div>
</div>
</body>
</html>

9
gating.yaml Normal file
View File

@ -0,0 +1,9 @@
--- !Policy
product_versions:
- rhel-9
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.acceptance-tier.functional}

20
macros.nginxmods.in Normal file
View File

@ -0,0 +1,20 @@
%_nginx_abiversion @@NGINX_ABIVERSION@@
%_nginx_srcdir @@NGINX_SRCDIR@@
%_nginx_buildsrcdir nginx-src
%_nginx_modsrcdir ..
%_nginx_modbuilddir ../%{_vpath_builddir}
%nginx_moddir @@NGINX_MODDIR@@
%nginx_modconfdir @@NGINX_MODCONFDIR@@
%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion}
%nginx_modconfigure(:-:) \\\
%undefine _strict_symbol_defs_build \
cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \
cd "%{_nginx_buildsrcdir}" \
nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \
./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\
--add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \
cd -
%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} modules

69
maxim.key Normal file
View File

@ -0,0 +1,69 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBF4TqFoBEADNbls05thIAYVVKdMDRdtzGk7HXGqx60u/kh4BL9HskUpyYFTp
N07RJ1TyyusfD7I3skuGHvtQhqdTwHPDEPL5qrAnHps9XWUQrtU7hflcIKt43iDe
TvfVVhN0nPir2++C4qvNnrC/UCisyz00H/I9mobl2qzyKyLT8BnUBVuXDfOTlUCY
oF4z5BieOMvg1DZNKFDnK67ZuO4JXgtMlu4Q3tFd7qSWCWGuCuAGgn6eWFYMzCbB
rPyBYwb7xyycQzqmJiD7Qm9OeVHmZj5rG5hGM14MyTSUVJle0U+CJCF9lmfVuR/c
ySy7WmQgIg327x5Y5xa3pKZAvIAycnDabAk/08p59BG7UdAi2S7+2SicAH89/81V
g4BI4mZp+IuxaP+S+ckaRf1CUvRAJuLTqUeBSuOzjag+ibD6rqusuZ1MZqLxnXyu
gAztNDcmEFa/pqp5bgWbrlTF6zKt4cQf+a/JqFGatsfSzmrIyIZ6GEqgb8oXDDIt
Z1AqsTfp6ZBC1vITE9+b0zBw6qq/nGD0Iq47Vp1VxmlxmnoeR4ir8z/oSukPulLU
K3IqkmRNGEilINrtBt5jFbBlx8kwdCYvxEF6ymibBBqvwwv65jrrKheBQm+HrrVS
aMQmo4Qzj/h/ZLL9KENHibNwUypJnvwEvw0YkAyjICvoNzDUsM+92+B/ewARAQAB
tCFNYXhpbSBLb25vdmFsb3YgPG1heGltQG5naW54LmNvbT6JAlcEEwEKAEECGwMF
CwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEWIQRB25JxPTv0v/PukQacXn+i9Ul3
1AUCXhgw1wUJBagi/QAKCRCcXn+i9Ul31LltD/40KNFPvDaORz35udrm0cyVIgbI
lq7Vswfo5JIr8MyJ+VKJFQ2n2JiQT8QbX52Sy5P80ktSAFqcT3vtWB7bI6RfJ8Jx
YM/w3XKnNMoUt7Q/cqZK5Ra/csmaCWqP4UVUvUBjHvly0MpnE1kxEDUglrcyVKjt
fxB/GXeUpKOELXG44zvW2CP9Mce0FbDxrh8iCai9MK+2oSt1aJV+gONLWscRgsc7
6q9/4KUXByt0qxScYPRQRIaxpIA8sCno21owcMOf8aQtun6Ytf+UIovl9DmK2pRm
Ifc2JruW1Jx2r7z955ZFNgTA380jEL85dWbgbHF/pYPlwcTCnaAf294kefjrX9DN
rejbZZ3Fh2QGs0tWW5+wncVWndq4jLQTeamUdzw5MPpOh+bZoHT+7z1PDGWe+PIn
DTbfaFYL7MsXwScMUsexKLOoDO6KKpZjcsw9/b5JsJmP73ZEj02BjRudapObiRxm
MtDl8Zmpg7ZUqMHEuUzyEyI5nSWu4njjrWJO0CnsjLpv2UxAbxDn1NGc/DoyxM1l
4SQv4AJuSLo1x7PTRb9V9HkWqxXf+yCkNpV9UjmlrH104gWL6sof6rX8Jo6k+Sz+
yyQHcVbrJ95Y3hQU7QMMnotzVbL7BRtWMtDYTp7q+gYbZ0s+YRXjaHcA5IuV65tM
tEPwGpOCofQ2avkdqIhdBBARCgAdFiEEZVBsAu/CUPG3o9aU7PDpCywXIIMFAl4T
qXUACgkQ7PDpCywXIIN5CQCgyNFrUBGlUvH9QlDSE/umzoyXW/UAn0ve2/HzpMVN
uPMAAgnHYE2R0eiEtCNNYXhpbSBLb25vdmFsb3YgPG1heGltQEZyZWVCU0Qub3Jn
PokCVAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBEHbknE9O/S/
8+6RBpxef6L1SXfUBQJeGDDXBQkFqCL9AAoJEJxef6L1SXfUJ/IQALtwaB7mlBUB
NdzqQRIZAVSnJZ2w6+Iul7Ax4gKrqWj6SvL/5jEdZm65D0kjxJIHq+dO+lJIMLzp
rBkfZ0kkxOPQ1rw/QR31qHLAibknrwIQQVtzFvVg4iW7IZefx6WGbJJC5IbjBUBf
HATqbXmMAcLILh9+t4q7Qvwi2b8ZIsC37cktthad7j4kvXqV5BJ4I+PoDT0CcW48
wgTfMwhib52pLMu3Ghk56kwHBtYSHUDrA4KWRzRHxQ+RoUXLIdtmMRbp8ztwBMJZ
+J/9TLrb3YHUidS3l2nE55l9dJZycCU2EOAhJMbFKbmfW/9we/Sm+vnoALGExepl
FgdGz2NTqPA4ha2y2rBC73TSkfM+4amIrr6kSbeofjQL/w5+fhxAvM5oXuzffPK9
8IR31d66JUTjeueobguzh9ApeHElmihimRJk0KP+NVAMNCIZmlMuOXHPwnCajcBh
Sh9kFGy6tPPPZYQOHSm5KvyjIJDfmkFfJ5ybazkmsGhZMzQs4ZHItC1jf0vYCqsr
d3eVEQesy5nDlSC2lWK84R+J+qTL82ZbCc/VZMniCBCC9xIvEOU9gtIH+58vF8dq
l/jTmGp2h1/kHlJfn0cnxKJDzn2IG16jqR7VdWQEO5hjEMaZdxhM1jPGRdkM82fB
Wwv8BLBpgBstyQlxJ/NNO5+dCtZYWRcviF0EEBEKAB0WIQRlUGwC78JQ8bej1pTs
8OkLLBcggwUCXhOpbwAKCRDs8OkLLBcgg/jfAKCO7DIiB2DGBfLCFftmyuZJN2A6
ZgCfV/cclX++mLyiyYqr2BXnrQk4NVG5Ag0EXhOoWgEQAOmkirptbymUR2JP9DrP
e7aELbUw4bcMx4/nQo1QyKxjDhUdgUui4OiqxmhMjT2IlgFvcYsMeLiYGa/EdBkd
Yq4DtEwc++2eybFQA1z6Hrk+sxdd8neN4azUa5sqVvUwenQ7UMPclSQJaE1nVGCZ
KKVyNsK36RJrE0JfdmE1zKZFWmTCTZ/D/hTCq+hjMpCV+VWFaz3h4S+XsZiBgLB4
+zmyHjyU6E+ecELvAHoXwMbAPiFzzms824Fc1BKHjnc8BBzfUVdIBGhxOVNHDSj3
oxPsiBnuvSlQMlGx0YNLw/tTfw+CFOot5o/KIq9svUp8W9mdj6kKaqBLNxpjHbhQ
yvVSK7O5uS62emMHkRwgu1tmP98d3bGlXRn+S+2MCuyqdFaK40B6vnkPnXpl5ggE
w8JoH11ahNeJ5tX8/JpX/0aQmapt7CKwcgELJap+Qp8i/MFXef7FK/nE0lFIL95o
l9uthd/beX6dz/EEw61lC17Opd3y0N+Dy+eJ0wbULdgKrblZ0PxsumLeICGLs7/P
O9/3nQHJRjmFaVG10t5bL/77gvQ4l7HcuLS1GGHh+RM6EsFuuiqI+aFcDFyRITli
g0QRq4y/C6nqhTWEyYriIi8Dq6JxXisklC1WvSIgPwq1/msmrbiKcJZFPoNtMVtO
dzL3naM5IWOa290R541GjkEVABEBAAGJAjwEGAEKACYCGwwWIQRB25JxPTv0v/Pu
kQacXn+i9Ul31AUCXhgw/QUJBagjIwAKCRCcXn+i9Ul31MQDEACeO6ZBLEWswuyU
RErntoHkY6wIkpfMiERjgfqbNkrdBgXg8dT7kPsXFEtv3ZccjPbsRecJaXdmwGab
mp9MUDYG3SiqgFNriJTv2WECzgYKrZQg38JVwfl7OHPaV2fwZvG56a4qKpIZ3wIg
4acfEPkHQ2ygpKnEJD4IsEK225PtYq5lmNfntvDhbuTPh2vY8T9w0udGCzp4JS60
zLeGGat+52PislEtrSa2B7zSMzGmOqDidaDbEfzdzL+IteZHWDGmYNQ8yICIv6Wj
A80k7uhzDWJf5RMQSNybBykrlWSooaVrBWHgDky5ldAQjDtVrMkBpzglH8FQ44i+
la9caRDfw0Lfxg52vV4eXtpSHAYx3cFREEW9xpTOwOE7Qg0JyHAkUKNb8DJgyehC
BjSeeiMFiZX1plyYFrUAB8dVXi9Z7kqOjTpfYU6kAxDXzQhlqqgYRwoFJQcsQ1Ll
jKptAs6glmDx8dJcjUrK/eH24GGg46eGv2wxY4+sItXfLQ2oeU4uh/vORjvgeeNp
er4z5KLuKxwgpaobavtRZmZSZdGrdC93Si27dpSRiWYn1csoTxG0zZhUVFFW68I4
I5PIdJwblvxayVKdg0aVW/RwDsOLH0twVxwnOPSjLPEB2IwGnlX6rN38cRnibPXM
yh4LsaVRdhbFe9aNd/O5iNgDcQtCUg==
=/pFc
-----END PGP PUBLIC KEY BLOCK-----

33
mdounin.key Normal file
View File

@ -0,0 +1,33 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.11 (FreeBSD)
mQENBE7SKu8BCADQo6x4ZQfAcPlJMLmL8zBEBUS6GyKMMMDtrTh3Yaq481HB54oR
0cpKL05Ff9upjrIzLD5TJUCzYYM9GQOhguDUP8+ZU9JpSz3yO2TvH7WBbUZ8FADf
hblmmUBLNgOWgLo3W+FYhl3mz1GFS2Fvid6Tfn02L8CBAj7jxbjL1Qj/OA/WmLLc
m6BMTqI7IBlYW2vyIOIHasISGiAwZfp0ucMeXXvTtt14LGa8qXVcFnJTdwbf03AS
ljhYrQnKnpl3VpDAoQt8C68YCwjaNJW59hKqWB+XeIJ9CW98+EOAxLAFszSyGanp
rCqPd0numj9TIddjcRkTA/ZbmCWK+xjpVBGXABEBAAG0IU1heGltIERvdW5pbiA8
bWRvdW5pbkBtZG91bmluLnJ1PokBOAQTAQIAIgUCTtIq7wIbAwYLCQgHAwIGFQgC
CQoLBBYCAwECHgECF4AACgkQUgqZk6HAUvj+iwf/b4FS6zVzJ5T0v1vcQGD4ZzXe
D5xMC4BJW414wVMU15rfX7aCdtoCYBNiApPxEd7SwiyxWRhRA9bikUq87JEgmnyV
0iYbHZvCvc1jOkx4WR7E45t1Mi29KBoPaFXA9X5adZkYcOQLDxa2Z8m6LGXnlF6N
tJkxQ8APrjZsdrbDvo3HxU9muPcq49ydzhgwfLwpUs11LYkwB0An9WRPuv3jporZ
/XgI6RfPMZ5NIx+FRRCjn6DnfHboY9rNF6NzrOReJRBhXCi6I+KkHHEnMoyg8XET
9lVkfHTOl81aIZqrAloX3/00TkYWyM2zO9oYpOg6eUFCX/Lw4MJZsTcT5EKVxIhG
BBARAgAGBQJO01Y/AAoJEOzw6QssFyCDVyQAn3qwTZlcZgyyzWu9Cs8gJ0CXREaS
AJ92QjGLT9DijTcbB+q9OS/nl16Z/IhGBBARAgAGBQJO02JDAAoJEKk3YTmlJMU+
P64AnjCKEXFelSVMtgefJk3+vpyt3QX1AKCH9M3MbTWPeDUL+MpULlfdyfvjj7kB
DQRO0irvAQgA0LjCc8S6oZzjiap2MjRNhRFA5BYjXZRZBdKF2VP74avt2/RELq8G
W0n7JWmKn6vvrXabEGLyfkCngAhTq9tJ/K7LPx/bmlO5+jboO/1inH2BTtLiHjAX
vicXZk3oaZt2Sotx5mMI3yzpFQRVqZXsi0LpUTPJEh3oS8IdYRjslQh1A7P5hfCZ
wtzwb/hKm8upODe/ITUMuXeWfLuQj/uEU6wMzmfMHb+jlYMWtb+v98aJa2FODeKP
mWCXLa7bliXp1SSeBOEfIgEAmjM6QGlDx5sZhr2Ss2xSPRdZ8DqD7oiRVzmstX1Y
oxEzC0yXfaefC7SgM0nMnaTvYEOYJ9CH3wARAQABiQEfBBgBAgAJBQJO0irvAhsM
AAoJEFIKmZOhwFL4844H/jo8icCcS6eOWvnen7lg0FcCo1fIm4wW3tEmkQdchSHE
CJDq7pgTloN65pwB5tBoT47cyYNZA9eTfJVgRc74q5cexKOYrMC3KuAqWbwqXhkV
s0nkWxnOIidTHSXvBZfDFA4Idwte94Thrzf8Pn8UESudTiqrWoCBXk2UyVsl03gJ
blSJAeJGYPPeo+Yj6m63OWe2+/S2VTgmbPS/RObn0Aeg7yuff0n5+ytEt2KL51gO
QE2uIxTCawHr12PsllPkbqPk/PagIttfEJqn9b0CrqPC3HREePb2aMJ/Ctw/76CO
wn0mtXeIXLCTvBmznXfaMKllsqbsy2nCJ2P2uJjOntw=
=Tavt
-----END PGP PUBLIC KEY BLOCK-----

View File

@ -0,0 +1,76 @@
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 0a2f260..606b6e2 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -616,6 +616,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
X509 *x509, *temp;
u_long n;
+ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) {
+
+#ifndef OPENSSL_NO_ENGINE
+
+ u_char *p, *last;
+ ENGINE *engine;
+
+ p = cert->data + sizeof("engine:") - 1;
+ last = (u_char *) ngx_strchr(p, ':');
+
+ if (last == NULL) {
+ *err = "invalid syntax";
+ return NULL;
+ }
+
+ *last = '\0';
+
+ engine = ENGINE_by_id((char *) p);
+
+ if (engine == NULL) {
+ *err = "ENGINE_by_id() failed";
+ return NULL;
+ }
+
+ if (!ENGINE_init(engine)) {
+ *err = "ENGINE_init() failed";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
+ *last++ = ':';
+
+ struct {
+ const char *cert_id;
+ X509 *cert;
+ } params = { (char *) last, NULL };
+
+ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
+ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
+ ENGINE_finish(engine);
+ ENGINE_free(engine);
+
+ /* set chain to null */
+
+ *chain = sk_X509_new_null();
+ if (*chain == NULL) {
+ *err = "sk_X509_new_null() failed";
+ X509_free(params.cert);
+ return NULL;
+ }
+
+ return params.cert;
+
+#else
+
+ *err = "loading \"engine:...\" certificate is not supported";
+ return NULL;
+
+#endif
+ }
+
if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,

View File

@ -1,8 +1,8 @@
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 345914f..d23967f 100644 index 2b0c5e6..9278087 100644
--- a/src/event/ngx_event_openssl.c --- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c
@@ -252,6 +252,8 @@ ngx_ssl_init(ngx_log_t *log) @@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log)
ngx_int_t ngx_int_t
ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
{ {
@ -11,7 +11,7 @@ index 345914f..d23967f 100644
ssl->ctx = SSL_CTX_new(SSLv23_method()); ssl->ctx = SSL_CTX_new(SSLv23_method());
if (ssl->ctx == NULL) { if (ssl->ctx == NULL) {
@@ -316,49 +318,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) @@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
@ -102,10 +102,10 @@ index 345914f..d23967f 100644
#ifdef SSL_OP_NO_COMPRESSION #ifdef SSL_OP_NO_COMPRESSION
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 61da0c5..fa7ac41 100644 index 329760d..5cee113 100644
--- a/src/event/ngx_event_openssl.h --- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h +++ b/src/event/ngx_event_openssl.h
@@ -145,6 +145,7 @@ typedef struct { @@ -152,6 +152,7 @@ typedef struct {
#endif #endif
@ -114,11 +114,11 @@ index 61da0c5..fa7ac41 100644
#define NGX_SSL_SSLv3 0x0004 #define NGX_SSL_SSLv3 0x0004
#define NGX_SSL_TLSv1 0x0008 #define NGX_SSL_TLSv1 0x0008
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index b3f8f47..8340a12 100644 index a47d696..94f30db 100644
--- a/src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c
@@ -613,8 +613,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) @@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_value(conf->early_data, prev->early_data, 0); ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
@ -128,10 +128,10 @@ index b3f8f47..8340a12 100644
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
NGX_SSL_BUFSIZE); NGX_SSL_BUFSIZE);
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
index 5544f75..3316a4b 100644 index 7eae83e..8328560 100644
--- a/src/mail/ngx_mail_ssl_module.c --- a/src/mail/ngx_mail_ssl_module.c
+++ b/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c
@@ -291,8 +291,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) @@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
prev->prefer_server_ciphers, 0); prev->prefer_server_ciphers, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
@ -142,10 +142,10 @@ index 5544f75..3316a4b 100644
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
index ec9524e..37af046 100644 index d8c0471..cef590d 100644
--- a/src/stream/ngx_stream_ssl_module.c --- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c
@@ -625,8 +625,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) @@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
prev->prefer_server_ciphers, 0); prev->prefer_server_ciphers, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,

View File

Before

Width:  |  Height:  |  Size: 368 B

After

Width:  |  Height:  |  Size: 368 B

View File

@ -4,7 +4,7 @@
user nginx; user nginx;
worker_processes auto; worker_processes auto;
error_log /var/log/nginx/error.log; error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid; pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. # Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
@ -23,9 +23,8 @@ http {
sendfile on; sendfile on;
tcp_nopush on; tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65; keepalive_timeout 65;
types_hash_max_size 2048; types_hash_max_size 4096;
include /etc/nginx/mime.types; include /etc/nginx/mime.types;
default_type application/octet-stream; default_type application/octet-stream;
@ -36,31 +35,28 @@ http {
include /etc/nginx/conf.d/*.conf; include /etc/nginx/conf.d/*.conf;
server { server {
listen 80 default_server; listen 80;
listen [::]:80 default_server; listen [::]:80;
server_name _; server_name _;
root /usr/share/nginx/html; root /usr/share/nginx/html;
# Load configuration files for the default server block. # Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf; include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html; error_page 404 /404.html;
location = /40x.html { location = /404.html {
} }
error_page 500 502 503 504 /50x.html; error_page 500 502 503 504 /50x.html;
location = /50x.html { location = /50x.html {
} }
} }
# Settings for a TLS enabled server. # Settings for a TLS enabled server.
# #
# server { # server {
# listen 443 ssl http2 default_server; # listen 443 ssl http2;
# listen [::]:443 ssl http2 default_server; # listen [::]:443 ssl http2;
# server_name _; # server_name _;
# root /usr/share/nginx/html; # root /usr/share/nginx/html;
# #
@ -74,15 +70,12 @@ http {
# # Load configuration files for the default server block. # # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf; # include /etc/nginx/default.d/*.conf;
# #
# location / {
# }
#
# error_page 404 /404.html; # error_page 404 /404.html;
# location = /40x.html { # location = /404.html {
# } # }
# #
# error_page 500 502 503 504 /50x.html; # error_page 500 502 503 504 /50x.html;
# location = /50x.html { # location = /50x.html {
# } # }
# } # }

View File

@ -1,10 +1,11 @@
/var/log/nginx/*log { /var/log/nginx/*.log {
create 0664 nginx root create 0640 nginx root
daily daily
rotate 10 rotate 10
missingok missingok
notifempty notifempty
compress compress
delaycompress
sharedscripts sharedscripts
postrotate postrotate
/bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true /bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true

View File

@ -1,6 +1,7 @@
[Unit] [Unit]
Description=The nginx HTTP and reverse proxy server Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target
[Service] [Service]
Type=forking Type=forking
@ -11,7 +12,7 @@ PIDFile=/run/nginx.pid
ExecStartPre=/usr/bin/rm -f /run/nginx.pid ExecStartPre=/usr/bin/rm -f /run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID ExecReload=/usr/sbin/nginx -s reload
KillSignal=SIGQUIT KillSignal=SIGQUIT
TimeoutStopSec=5 TimeoutStopSec=5
KillMode=mixed KillMode=mixed

View File

@ -16,9 +16,20 @@
%global with_mailcap_mimetypes 1 %global with_mailcap_mimetypes 1
%endif %endif
# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/
%global nginx_abiversion %{version}
%global nginx_moduledir %{_libdir}/nginx/modules
%global nginx_moduleconfdir %{_datadir}/nginx/modules
%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release}
# Do not generate provides/requires from nginx sources
%global __provides_exclude_from ^%{nginx_srcdir}/.*$
%global __requires_exclude_from ^%{nginx_srcdir}/.*$
Name: nginx Name: nginx
Epoch: 1 Epoch: 1
Version: 1.16.1 Version: 1.22.1
Release: 1%{?dist} Release: 1%{?dist}
Summary: A high performance web server and reverse proxy server Summary: A high performance web server and reverse proxy server
@ -34,8 +45,9 @@ Source11: nginx.logrotate
Source12: nginx.conf Source12: nginx.conf
Source13: nginx-upgrade Source13: nginx-upgrade
Source14: nginx-upgrade.8 Source14: nginx-upgrade.8
Source100: index.html Source15: macros.nginxmods.in
Source101: poweredby.png Source16: nginxmods.attr
Source17: nginxmods.req
Source102: nginx-logo.png Source102: nginx-logo.png
Source103: 404.html Source103: 404.html
Source104: 50x.html Source104: 50x.html
@ -57,7 +69,10 @@ Patch2: nginx-1.16.0-pkcs11.patch
Patch3: nginx-1.14.1-perl-module-hardening.patch Patch3: nginx-1.14.1-perl-module-hardening.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1643647 # https://bugzilla.redhat.com/show_bug.cgi?id=1643647
Patch4: nginx-1.16.0-enable-tls1v3-by-default.patch Patch4: nginx-1.20.0-enable-tls1v3-by-default.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1668717
Patch5: nginx-1.18.0-pkcs11-cert.patch
%if 0%{?with_gperftools} %if 0%{?with_gperftools}
BuildRequires: gperftools-devel BuildRequires: gperftools-devel
@ -67,6 +82,7 @@ BuildRequires: pcre-devel
BuildRequires: zlib-devel BuildRequires: zlib-devel
Requires: nginx-filesystem = %{epoch}:%{version}-%{release} Requires: nginx-filesystem = %{epoch}:%{version}-%{release}
Requires: system-logos-httpd >= 82.0
%if 0%{?rhel} > 0 && 0%{?rhel} < 8 %if 0%{?rhel} > 0 && 0%{?rhel} < 8
# Introduced at 1:1.10.0-1 to ease upgrade path. To be removed later. # Introduced at 1:1.10.0-1 to ease upgrade path. To be removed later.
@ -85,6 +101,8 @@ BuildRequires: systemd
Requires(post): systemd Requires(post): systemd
Requires(preun): systemd Requires(preun): systemd
Requires(postun): systemd Requires(postun): systemd
# For external nginx modules
Provides: nginx(abi) = %{nginx_abiversion}
%description %description
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
@ -124,7 +142,7 @@ directories.
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx HTTP geoip module Summary: Nginx HTTP geoip module
BuildRequires: GeoIP-devel BuildRequires: GeoIP-devel
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
Requires: GeoIP Requires: GeoIP
%description mod-http-geoip %description mod-http-geoip
@ -135,7 +153,7 @@ Requires: GeoIP
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx HTTP image filter module Summary: Nginx HTTP image filter module
BuildRequires: gd-devel BuildRequires: gd-devel
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
Requires: gd Requires: gd
%description mod-http-image-filter %description mod-http-image-filter
@ -149,7 +167,7 @@ BuildRequires: perl-devel
BuildRequires: perl-generators BuildRequires: perl-generators
%endif %endif
BuildRequires: perl(ExtUtils::Embed) BuildRequires: perl(ExtUtils::Embed)
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
Requires: perl(constant) Requires: perl(constant)
@ -160,7 +178,7 @@ Requires: perl(constant)
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx XSLT module Summary: Nginx XSLT module
BuildRequires: libxslt-devel BuildRequires: libxslt-devel
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
%description mod-http-xslt-filter %description mod-http-xslt-filter
%{summary}. %{summary}.
@ -168,7 +186,7 @@ Requires: nginx
%package mod-mail %package mod-mail
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx mail modules Summary: Nginx mail modules
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
%description mod-mail %description mod-mail
%{summary}. %{summary}.
@ -176,11 +194,33 @@ Requires: nginx
%package mod-stream %package mod-stream
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx stream modules Summary: Nginx stream modules
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
%description mod-stream %description mod-stream
%{summary}. %{summary}.
%package mod-devel
Summary: Nginx module development files
Requires: nginx = %{epoch}:%{version}-%{release}
Requires: make
Requires: gcc
Requires: gd-devel
%if 0%{?with_gperftools}
Requires: gperftools-devel
%endif
%if %{with geoip}
Requires: GeoIP-devel
%endif
Requires: libxslt-devel
Requires: openssl-devel
Requires: pcre-devel
Requires: perl-devel
Requires: perl(ExtUtils::Embed)
Requires: zlib-devel
%description mod-devel
%{summary}.
%prep %prep
%setup -q %setup -q
@ -189,6 +229,7 @@ Requires: nginx
%patch2 -p1 %patch2 -p1
%patch3 -p1 %patch3 -p1
%patch4 -p1 %patch4 -p1
%patch5 -p1
cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} . cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
@ -197,6 +238,10 @@ sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service
sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf
%endif %endif
# Prepare sources for installation
cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src
mv ../%{name}-%{version}-%{release}-src .
%build %build
# nginx does not utilize a standard configure script. It has its own # nginx does not utilize a standard configure script. It has its own
@ -207,7 +252,7 @@ export DESTDIR=%{buildroot}
./configure \ ./configure \
--prefix=%{_datadir}/nginx \ --prefix=%{_datadir}/nginx \
--sbin-path=%{_sbindir}/nginx \ --sbin-path=%{_sbindir}/nginx \
--modules-path=%{_libdir}/nginx/modules \ --modules-path=%{nginx_moduledir} \
--conf-path=%{_sysconfdir}/nginx/nginx.conf \ --conf-path=%{_sysconfdir}/nginx/nginx.conf \
--error-log-path=%{_localstatedir}/log/nginx/error.log \ --error-log-path=%{_localstatedir}/log/nginx/error.log \
--http-log-path=%{_localstatedir}/log/nginx/access.log \ --http-log-path=%{_localstatedir}/log/nginx/access.log \
@ -223,7 +268,6 @@ export DESTDIR=%{buildroot}
%if 0%{?with_aio} %if 0%{?with_aio}
--with-file-aio \ --with-file-aio \
%endif %endif
--with-ipv6 \
--with-http_ssl_module \ --with-http_ssl_module \
--with-http_v2_module \ --with-http_v2_module \
--with-http_realip_module \ --with-http_realip_module \
@ -233,6 +277,7 @@ export DESTDIR=%{buildroot}
--with-http_image_filter_module=dynamic \ --with-http_image_filter_module=dynamic \
%if %{with geoip} %if %{with geoip}
--with-http_geoip_module=dynamic \ --with-http_geoip_module=dynamic \
--with-stream_geoip_module=dynamic \
%endif %endif
--with-http_sub_module \ --with-http_sub_module \
--with-http_dav_module \ --with-http_dav_module \
@ -252,12 +297,14 @@ export DESTDIR=%{buildroot}
--with-pcre \ --with-pcre \
--with-pcre-jit \ --with-pcre-jit \
--with-stream=dynamic \ --with-stream=dynamic \
--with-stream_realip_module \
--with-stream_ssl_module \ --with-stream_ssl_module \
%if 0%{?with_gperftools} %if 0%{?with_gperftools}
--with-google_perftools_module \ --with-google_perftools_module \
%endif %endif
--with-debug \ --with-debug \
--with-cc-opt="%{optflags} $(pcre-config --cflags)" \ --with-cc-opt="%{optflags} $(pcre-config --cflags)" \
--with-compat \
--with-ld-opt="$RPM_LD_FLAGS -Wl,-E" # so the perl module finds its symbols --with-ld-opt="$RPM_LD_FLAGS -Wl,-E" # so the perl module finds its symbols
make %{?_smp_mflags} make %{?_smp_mflags}
@ -287,15 +334,24 @@ install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp
install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/modules install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir}
install -p -d -m 0755 %{buildroot}%{_libdir}/nginx/modules install -p -d -m 0755 %{buildroot}%{nginx_moduledir}
install -p -m 0644 ./nginx.conf \ install -p -m 0644 ./nginx.conf \
%{buildroot}%{_sysconfdir}/nginx %{buildroot}%{_sysconfdir}/nginx
install -p -m 0644 %{SOURCE100} \
%{buildroot}%{_datadir}/nginx/html rm -f %{buildroot}%{_datadir}/nginx/html/index.html
install -p -m 0644 %{SOURCE101} %{SOURCE102} \ ln -s ../../testpage/index.html \
%{buildroot}%{_datadir}/nginx/html/index.html
install -p -m 0644 %{SOURCE102} \
%{buildroot}%{_datadir}/nginx/html %{buildroot}%{_datadir}/nginx/html
ln -s nginx-logo.png %{buildroot}%{_datadir}/nginx/html/poweredby.png
mkdir -p %{buildroot}%{_datadir}/nginx/html/icons
# Symlink for the powered-by-$DISTRO image:
ln -s ../../../pixmaps/poweredby.png \
%{buildroot}%{_datadir}/nginx/html/icons/poweredby.png
install -p -m 0644 %{SOURCE103} %{SOURCE104} \ install -p -m 0644 %{SOURCE103} %{SOURCE104} \
%{buildroot}%{_datadir}/nginx/html %{buildroot}%{_datadir}/nginx/html
@ -315,19 +371,35 @@ for i in ftdetect indent syntax; do
done done
%if %{with geoip} %if %{with geoip}
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_geoip_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-geoip.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf
%endif %endif
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_image_filter_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-image-filter.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_perl_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-perl.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-xslt-filter.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_mail_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-mail.conf > %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_stream_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-stream.conf > %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf
# Install files for supporting nginx module builds
## Install source files
mkdir -p %{buildroot}%{_usrsrc}
mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir}
## Install rpm macros
mkdir -p %{buildroot}%{_rpmmacrodir}
sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \
-e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \
-e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \
-e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \
%{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods
## Install dependency generator
install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16}
install -Dpm0755 -t %{buildroot}%{_rpmconfigdir} %{SOURCE17}
%pre filesystem %pre filesystem
getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user} getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user}
@ -416,8 +488,11 @@ fi
%config(noreplace) %{_sysconfdir}/logrotate.d/nginx %config(noreplace) %{_sysconfdir}/logrotate.d/nginx
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx %attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp %attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/log/nginx %attr(711,root,root) %dir %{_localstatedir}/log/nginx
%dir %{_libdir}/nginx/modules %ghost %attr(640,%{nginx_user},root) %{_localstatedir}/log/nginx/access.log
%ghost %attr(640,%{nginx_user},root) %{_localstatedir}/log/nginx/error.log
%dir %{nginx_moduledir}
%dir %{nginx_moduleconfdir}
%files all-modules %files all-modules
@ -432,35 +507,75 @@ fi
%if %{with geoip} %if %{with geoip}
%files mod-http-geoip %files mod-http-geoip
%{_datadir}/nginx/modules/mod-http-geoip.conf %{nginx_moduleconfdir}/mod-http-geoip.conf
%{_libdir}/nginx/modules/ngx_http_geoip_module.so %{nginx_moduledir}/ngx_http_geoip_module.so
%endif %endif
%files mod-http-image-filter %files mod-http-image-filter
%{_datadir}/nginx/modules/mod-http-image-filter.conf %{nginx_moduleconfdir}/mod-http-image-filter.conf
%{_libdir}/nginx/modules/ngx_http_image_filter_module.so %{nginx_moduledir}/ngx_http_image_filter_module.so
%files mod-http-perl %files mod-http-perl
%{_datadir}/nginx/modules/mod-http-perl.conf %{nginx_moduleconfdir}/mod-http-perl.conf
%{_libdir}/nginx/modules/ngx_http_perl_module.so %{nginx_moduledir}/ngx_http_perl_module.so
%dir %{perl_vendorarch}/auto/nginx %dir %{perl_vendorarch}/auto/nginx
%{perl_vendorarch}/nginx.pm %{perl_vendorarch}/nginx.pm
%{perl_vendorarch}/auto/nginx/nginx.so %{perl_vendorarch}/auto/nginx/nginx.so
%files mod-http-xslt-filter %files mod-http-xslt-filter
%{_datadir}/nginx/modules/mod-http-xslt-filter.conf %{nginx_moduleconfdir}/mod-http-xslt-filter.conf
%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so %{nginx_moduledir}/ngx_http_xslt_filter_module.so
%files mod-mail %files mod-mail
%{_datadir}/nginx/modules/mod-mail.conf %{nginx_moduleconfdir}/mod-mail.conf
%{_libdir}/nginx/modules/ngx_mail_module.so %{nginx_moduledir}/ngx_mail_module.so
%files mod-stream %files mod-stream
%{_datadir}/nginx/modules/mod-stream.conf %{nginx_moduleconfdir}/mod-stream.conf
%{_libdir}/nginx/modules/ngx_stream_module.so %{nginx_moduledir}/ngx_stream_module.so
%files mod-devel
%{_rpmmacrodir}/macros.nginxmods
%{_fileattrsdir}/nginxmods.attr
%{_rpmconfigdir}/nginxmods.req
%{nginx_srcdir}/
%changelog %changelog
* Thu Dec 01 2022 Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-1
- Resolves: #2112345 - nginx:1.22 for RHEL 8
- add stream_geoip_module and stream_realip_module
- remove obsolete --with-ipv6
* Tue Dec 21 2021 Joe Orton <jorton@redhat.com> - 1:1.20.1-1
- rebase to 1.20.1 (addressing CVE-2021-23017)
* Wed Dec 1 2021 Joe Orton <jorton@redhat.com> - 1:1.20.0-4
- add delaycompress to logrotate config (#2015243)
* Fri Sep 10 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-3
- Add -mod-devel subpackage for building external nginx modules (Neal Gompa)
Resolves: #1991787
* Fri Aug 20 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-2
- Resolves: #1991796 - build nginx with --with-compat
* Wed May 05 2021 Lubos Uhliarik <luhliari@redhat.com> - 1:1.20.0-1
- new version 1.20.0
- Resolves: #1945671 - RFE: add nginx:1.20 module stream
* Thu Nov 12 2020 Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-3
- Resolves: #1651377 - centralizing default index.html on nginx
- Resolves: #1825683 - Outdated Red Hat branding used in nginx default pages
* Wed Apr 22 2020 Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-2
- new version 1.18.0
- Resolves: #1668717 - [RFE] Support loading certificates from hardware token
(PKCS#11)
- Increased types_hash_max_size to 4096 in default config
- Drop location / from default config (rhbz#1564768)
- Drop default_sever from default config (rhbz#1373822)
* Thu Aug 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1 * Thu Aug 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
- update to 1.16.1 - update to 1.16.1
- Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount - Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount

2
nginxmods.attr Normal file
View File

@ -0,0 +1,2 @@
%__nginxmods_requires %{_rpmconfigdir}/nginxmods.req
%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$

6
nginxmods.req Normal file
View File

@ -0,0 +1,6 @@
#!/bin/sh
# Generate Requires: nginx(abi) = VERSION
echo "nginx(abi) = $(rpm --eval '%{_nginx_abiversion}')"
exit 0

41
sb.key Normal file
View File

@ -0,0 +1,41 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.11 (FreeBSD)
mQENBE5E4vkBCADPkWWzk7W5cXOqeZ1ULNSj8nt5azbYjfQ8OyR2AaDW8J7oazYH
reIHKid5uZVJxwr1uLoMloGiYTdy4XYIF2WcOfDnjNGumrAT0Nd4Kdax/pHr5Pdp
jFsO4BkHyWk/5/zDCijyoGYLBR6I8hqn+WDuLG/sTtVuTWkUeOlfxb2eZdLyZ3oP
5T5FXtWTpKvr2y7RGshmS6EJnjiVvvErdbNItFXghqvBBaFOJaS2PRBEO9RfKpti
i+eS/cmlrm+Tjv44EPfQyLtAmCQ8uqfL50uIKEp6/dsC/OVJ6JlJOYl4j90DX7vB
TJaOyUm4s+BLF2BK+Ow8+s+B6jQ5noa/o16NABEBAAG0IFNlcmdleSBCdWRuZXZp
dGNoIDxzYkBuZ2lueC5jb20+iQE+BBMBAgAoBQJOROQ6AhsDBQkJZgGABgsJCAcD
AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCmT9Wxets5qEQgB/43Mxmiy7DjXEbxIYkC
9xPC4kf1X+bHkJ9BtAgaYDQewjtQ7vS98TKJBibm3l4egmBjFWjCpL8845n966+u
XDqrDWJtOPUXvSEQNXGlijDGSxxpdK2dxDOKIOC8nIlZq/Xz/Uqjb2ZrszmYK2LD
IHI1mN9HdI6aTt41QbtG0nkaPPgv3MEvxSMVCzVddroyPXvf/ErT4OSYU+dqJhH+
SBIezuF0suzH/siCksbSBZHIst5rggpjsZvijP5YFH/hpEsR+tKXo9EFk49xn9Ou
WdmpOEs7CKDbTApkh9XN/Pk5nJQ/HIDuW8pkgzf2wxNWlMSYw6xnozDkeIqpJcDD
4niqiEYEEBECAAYFAk5OYocACgkQ7PDpCywXIIMKtQCfaAl2rvbEImu6MnDR32KG
HTDH2TEAoNeWrSlavyFzbSQka53E9Gs6gF63tCBTZXJnZXkgQnVkbmV2aXRjaCA8
c2JAd2FlbWUubmV0PokBQQQTAQIAKwIbAwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYC
AwECHgECF4AFAk5OR38CGQEACgkQpk/VsXrbOagPmAf/QmIEDkkiovc1MgQ81lh4
eeHfvtptb+U4GVCu07DQUR9kEtN6Jqi65gKb95fEztI14PpX+euiWrc/RlnsxWc0
jYF0UmyacWLN6oHPoxlCK5+7zyoz5UTNrYGkTfWfcNtTU509CEZRClBNjMZOTZjP
QhdR+Ce6tngRcQvMGNaLjJkKuY7vPh6FjT5oqxpnEIRTsWq6bUaeCXm7j9x0as1Z
w1E5D5it3Ug3VlAe58jFJmRgatOsWznKuNoLRjQ2Chp2ce+dLgXriuJMrvEsn5S4
dImUGL5DVYWDVZNG+r85XnOhMfKG308pZby1uzFvD+j3P6yMj1tpaCAAi5lUkHh6
bIhGBBARAgAGBQJOTmJ/AAoJEOzw6QssFyCDH50AoMyJPvPDTYXK5KHOlPYPZQ5M
OuCAAJ9zQ/3hKedm3xCLGl4Y6hjxJNlUTbkBDQROROL5AQgAuGIfx9aVOOXVdj8b
XvjBQt+UkBURYGACHFQ69w71Aupsg9pZ7FgwgVKxnoNlmRag8sInjQbs3M/lS0sB
dg75zZ7Ph7aPev8RAqdtX5+xxvujv1cmkFBExFuC5Wp/Yfzk/lPWZR4vXZrTpRiF
PLMlRu0CEJFqoqPPygGFar02Q7rO+da35pxAuYrOWGM7MNr8H/vk13+GiqniBQCa
uSoWwZQzaEdG5VGgm/vAwPzO+Cbam3r+Hs7OieykAy8fv+B+qhHn8Vc/520iGvdO
IAKpxl6oZrkbNL/wozOOLZni7iWl30C43ujxPiGRlg/YotHmhlnMic85QKyakXCS
WXI/JQARAQABiQElBBgBAgAPBQJOROL5AhsMBQkJZgGAAAoJEKZP1bF62zmoGCwH
/2a6zlu4Jwmv21vuroaAzECV8gp1luBeagn23EgMMukYhkbwLtL/0twAHmZlkpzl
atfq/EH2PgOasl2biJixqp7o9V7Uw6PS5JoY+1IrLEurG+FU2TN/Ysp12al4Z0Hh
p4yBRSEikISO9gkeUThixDPX1PjCpx8G/ZYqk+8jRCcDgWsUc/WV3VGPht68oDd7
56/hfQYc/V3eJmm5WYLVGV7Q69tGtp6D09SpoeqCD2K77auEBRVJ4jaT4B2/EfSb
x6y7Dy4Oxm8TBOQ2EZw2vEixKxtEt86/oBtLUkqVockPq/Ek9AL+KzT6VR1xU+Cm
CoHAyoqJeb/xLBwuKWg0/4U=
=iFlP
-----END PGP PUBLIC KEY BLOCK-----

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (nginx-1.22.1.tar.gz) = 1d468dcfa9bbd348b8a5dc514ac1428a789e73a92384c039b73a51ce376785f74bf942872c5594a9fcda6bbf44758bd727ce15ac2395f1aa989c507014647dcc