rpms/nginx
7
0
Fork 1
Code Issues Pull Requests Releases Activity

import UBI nginx-1.20.1-1.module+el8.8.0+20359+9bd89172.1

Browse Source
This commit is contained in:
eabdullin 2023-10-16 14:22:21 +00:00
parent 1956affec0
commit 1389845fc8
9 changed files with 226 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -1 +1,2 @@
SOURCES/nginx-1.20.0.tar.gz
SOURCES/nginx-1.20.1.tar.gz
SOURCES/nginx-logo.png

3
.nginx.metadata
View File

@ -1 +1,2 @@
71dc4916e9ac7e15b03f7ea71577f72e0dd5dff1 SOURCES/nginx-1.20.0.tar.gz
6b4ab4eff3c617e133819f43fdfc14708e593a79 SOURCES/nginx-1.20.1.tar.gz
e28dd656984cc2894d8124c5278789c656f6a9cb SOURCES/nginx-logo.png

20
SOURCES/macros.nginxmods.in Normal file
View File

@ -0,0 +1,20 @@
%_nginx_abiversion @@NGINX_ABIVERSION@@
%_nginx_srcdir @@NGINX_SRCDIR@@
%_nginx_buildsrcdir nginx-src
%_nginx_modsrcdir ..
%_nginx_modbuilddir ../%{_vpath_builddir}
%nginx_moddir @@NGINX_MODDIR@@
%nginx_modconfdir @@NGINX_MODCONFDIR@@
%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion}
%nginx_modconfigure(:-:) \\\
%undefine _strict_symbol_defs_build \
cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \
cd "%{_nginx_buildsrcdir}" \
nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \
./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\
--add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \
cd -
%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} modules

74
SOURCES/nginx-1.20-CVE-2023-44487.patch Normal file
View File

@ -0,0 +1,74 @@
From b6aa9504cdfb6391d895dcbddc87b9260ea6968c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 11 Oct 2023 09:59:23 +0200
Subject: [PATCH] CVE-2023-44487 - HTTP/2: per-iteration stream handling limit.
To ensure that attempts to flood servers with many streams are detected
early, a limit of no more than 2 * max_concurrent_streams new streams per one
event loop iteration was introduced. This limit is applied even if
max_concurrent_streams is not yet reached - for example, if corresponding
streams are handled synchronously or reset.
Further, refused streams are now limited to maximum of max_concurrent_streams
and 100, similarly to priority_limit initial value, providing some tolerance
to clients trying to open several streams at the connection start, yet
low tolerance to flooding attempts.
---
src/http/v2/ngx_http_v2.c | 15 +++++++++++++++
src/http/v2/ngx_http_v2.h | 2 ++
2 files changed, 17 insertions(+)
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index 3611a2e..291677a 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -361,6 +361,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler");
h2c->blocked = 1;
+ h2c->new_streams = 0;
if (c->close) {
c->close = 0;
@@ -1320,6 +1321,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
goto rst_stream;
}
+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) {
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+ "client sent too many streams at once");
+
+ status = NGX_HTTP_V2_REFUSED_STREAM;
+ goto rst_stream;
+ }
+
if (!h2c->settings_ack
&& !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG)
&& h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW)
@@ -1385,6 +1394,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
rst_stream:
+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) {
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+ "client sent too many refused streams");
+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR);
+ }
+
if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) {
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
}
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
index 3492297..6a7aaa6 100644
--- a/src/http/v2/ngx_http_v2.h
+++ b/src/http/v2/ngx_http_v2.h
@@ -125,6 +125,8 @@ struct ngx_http_v2_connection_s {
ngx_uint_t processing;
ngx_uint_t frames;
ngx_uint_t idle;
+ ngx_uint_t new_streams;
+ ngx_uint_t refused_streams;
ngx_uint_t priority_limit;
ngx_uint_t pushing;

BIN
SOURCES/nginx-logo.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 368 B

1
SOURCES/nginx.logrotate
View File

@ -5,6 +5,7 @@
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true

2
SOURCES/nginxmods.attr Normal file
View File

@ -0,0 +1,2 @@
%__nginxmods_requires %{_rpmconfigdir}/nginxmods.req
%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$

6
SOURCES/nginxmods.req Normal file
View File

@ -0,0 +1,6 @@
#!/bin/sh
# Generate Requires: nginx(abi) = VERSION
echo "nginx(abi) = $(rpm --eval '%{_nginx_abiversion}')"
exit 0

155
SPECS/nginx.spec
View File

@ -16,10 +16,21 @@
%global with_mailcap_mimetypes 1
%endif
# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/
%global nginx_abiversion %{version}
%global nginx_moduledir %{_libdir}/nginx/modules
%global nginx_moduleconfdir %{_datadir}/nginx/modules
%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release}
# Do not generate provides/requires from nginx sources
%global __provides_exclude_from ^%{nginx_srcdir}/.*$
%global __requires_exclude_from ^%{nginx_srcdir}/.*$
Name: nginx
Epoch: 1
Version: 1.20.0
Release: 2%{?dist}
Version: 1.20.1
Release: 1%{?dist}.1
Summary: A high performance web server and reverse proxy server
Group: System Environment/Daemons
@ -34,6 +45,9 @@ Source11: nginx.logrotate
Source12: nginx.conf
Source13: nginx-upgrade
Source14: nginx-upgrade.8
Source15: macros.nginxmods.in
Source16: nginxmods.attr
Source17: nginxmods.req
Source102: nginx-logo.png
Source103: 404.html
Source104: 50x.html
@ -60,6 +74,9 @@ Patch4: nginx-1.20.0-enable-tls1v3-by-default.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1668717
Patch5: nginx-1.18.0-pkcs11-cert.patch
# https://issues.redhat.com/browse/RHEL-12730
Patch6: nginx-1.20-CVE-2023-44487.patch
%if 0%{?with_gperftools}
BuildRequires: gperftools-devel
%endif
@ -87,6 +104,8 @@ BuildRequires: systemd
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
# For external nginx modules
Provides: nginx(abi) = %{nginx_abiversion}
%description
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
@ -126,7 +145,7 @@ directories.
Group: System Environment/Daemons
Summary: Nginx HTTP geoip module
BuildRequires: GeoIP-devel
Requires: nginx
Requires: nginx(abi) = %{nginx_abiversion}
Requires: GeoIP
%description mod-http-geoip
@ -137,7 +156,7 @@ Requires: GeoIP
Group: System Environment/Daemons
Summary: Nginx HTTP image filter module
BuildRequires: gd-devel
Requires: nginx
Requires: nginx(abi) = %{nginx_abiversion}
Requires: gd
%description mod-http-image-filter
@ -151,7 +170,7 @@ BuildRequires: perl-devel
BuildRequires: perl-generators
%endif
BuildRequires: perl(ExtUtils::Embed)
Requires: nginx
Requires: nginx(abi) = %{nginx_abiversion}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
Requires: perl(constant)
@ -162,7 +181,7 @@ Requires: perl(constant)
Group: System Environment/Daemons
Summary: Nginx XSLT module
BuildRequires: libxslt-devel
Requires: nginx
Requires: nginx(abi) = %{nginx_abiversion}
%description mod-http-xslt-filter
%{summary}.
@ -170,7 +189,7 @@ Requires: nginx
%package mod-mail
Group: System Environment/Daemons
Summary: Nginx mail modules
Requires: nginx
Requires: nginx(abi) = %{nginx_abiversion}
%description mod-mail
%{summary}.
@ -178,11 +197,33 @@ Requires: nginx
%package mod-stream
Group: System Environment/Daemons
Summary: Nginx stream modules
Requires: nginx
Requires: nginx(abi) = %{nginx_abiversion}
%description mod-stream
%{summary}.
%package mod-devel
Summary: Nginx module development files
Requires: nginx = %{epoch}:%{version}-%{release}
Requires: make
Requires: gcc
Requires: gd-devel
%if 0%{?with_gperftools}
Requires: gperftools-devel
%endif
%if %{with geoip}
Requires: GeoIP-devel
%endif
Requires: libxslt-devel
Requires: openssl-devel
Requires: pcre-devel
Requires: perl-devel
Requires: perl(ExtUtils::Embed)
Requires: zlib-devel
%description mod-devel
%{summary}.
%prep
%setup -q
@ -192,6 +233,7 @@ Requires: nginx
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
@ -200,6 +242,10 @@ sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service
sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf
%endif
# Prepare sources for installation
cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src
mv ../%{name}-%{version}-%{release}-src .
%build
# nginx does not utilize a standard configure script. It has its own
@ -210,7 +256,7 @@ export DESTDIR=%{buildroot}
./configure \
--prefix=%{_datadir}/nginx \
--sbin-path=%{_sbindir}/nginx \
--modules-path=%{_libdir}/nginx/modules \
--modules-path=%{nginx_moduledir} \
--conf-path=%{_sysconfdir}/nginx/nginx.conf \
--error-log-path=%{_localstatedir}/log/nginx/error.log \
--http-log-path=%{_localstatedir}/log/nginx/access.log \
@ -291,8 +337,8 @@ install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp
install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/modules
install -p -d -m 0755 %{buildroot}%{_libdir}/nginx/modules
install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir}
install -p -d -m 0755 %{buildroot}%{nginx_moduledir}
install -p -m 0644 ./nginx.conf \
%{buildroot}%{_sysconfdir}/nginx
@ -328,19 +374,35 @@ for i in ftdetect indent syntax; do
done
%if %{with geoip}
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_geoip_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-geoip.conf
echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \
> %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf
%endif
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_image_filter_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-image-filter.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_perl_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-perl.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-xslt-filter.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_mail_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-mail.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_stream_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-stream.conf
echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \
> %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf
echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \
> %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf
echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \
> %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf
echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \
> %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf
echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \
> %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf
# Install files for supporting nginx module builds
## Install source files
mkdir -p %{buildroot}%{_usrsrc}
mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir}
## Install rpm macros
mkdir -p %{buildroot}%{_rpmmacrodir}
sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \
-e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \
-e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \
-e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \
%{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods
## Install dependency generator
install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16}
install -Dpm0755 -t %{buildroot}%{_rpmconfigdir} %{SOURCE17}
%pre filesystem
getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user}
@ -430,7 +492,8 @@ fi
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/log/nginx
%dir %{_libdir}/nginx/modules
%dir %{nginx_moduledir}
%dir %{nginx_moduleconfdir}
%files all-modules
@ -445,35 +508,55 @@ fi
%if %{with geoip}
%files mod-http-geoip
%{_datadir}/nginx/modules/mod-http-geoip.conf
%{_libdir}/nginx/modules/ngx_http_geoip_module.so
%{nginx_moduleconfdir}/mod-http-geoip.conf
%{nginx_moduledir}/ngx_http_geoip_module.so
%endif
%files mod-http-image-filter
%{_datadir}/nginx/modules/mod-http-image-filter.conf
%{_libdir}/nginx/modules/ngx_http_image_filter_module.so
%{nginx_moduleconfdir}/mod-http-image-filter.conf
%{nginx_moduledir}/ngx_http_image_filter_module.so
%files mod-http-perl
%{_datadir}/nginx/modules/mod-http-perl.conf
%{_libdir}/nginx/modules/ngx_http_perl_module.so
%{nginx_moduleconfdir}/mod-http-perl.conf
%{nginx_moduledir}/ngx_http_perl_module.so
%dir %{perl_vendorarch}/auto/nginx
%{perl_vendorarch}/nginx.pm
%{perl_vendorarch}/auto/nginx/nginx.so
%files mod-http-xslt-filter
%{_datadir}/nginx/modules/mod-http-xslt-filter.conf
%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so
%{nginx_moduleconfdir}/mod-http-xslt-filter.conf
%{nginx_moduledir}/ngx_http_xslt_filter_module.so
%files mod-mail
%{_datadir}/nginx/modules/mod-mail.conf
%{_libdir}/nginx/modules/ngx_mail_module.so
%{nginx_moduleconfdir}/mod-mail.conf
%{nginx_moduledir}/ngx_mail_module.so
%files mod-stream
%{_datadir}/nginx/modules/mod-stream.conf
%{_libdir}/nginx/modules/ngx_stream_module.so
%{nginx_moduleconfdir}/mod-stream.conf
%{nginx_moduledir}/ngx_stream_module.so
%files mod-devel
%{_rpmmacrodir}/macros.nginxmods
%{_fileattrsdir}/nginxmods.attr
%{_rpmconfigdir}/nginxmods.req
%{nginx_srcdir}/
%changelog
* Thu Oct 12 2023 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.1-1.1
- Resolves: RHEL-12730 - nginx:1.20/nginx: HTTP/2: Multiple HTTP/2 enabled web
servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
* Tue Dec 21 2021 Joe Orton <jorton@redhat.com> - 1:1.20.1-1
- rebase to 1.20.1 (addressing CVE-2021-23017)
* Wed Dec 1 2021 Joe Orton <jorton@redhat.com> - 1:1.20.0-4
- add delaycompress to logrotate config (#2015243)
* Fri Sep 10 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-3
- Add -mod-devel subpackage for building external nginx modules (Neal Gompa)
Resolves: #1991787
* Fri Aug 20 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-2
- Resolves: #1991796 - build nginx with --with-compat