rpms/nginx
7
0
Fork 1
Code Issues Pull Requests Releases Activity

import CS nginx-1.24.0-1.module_el8+834+8508b655

Browse Source
This commit is contained in:
eabdullin 2024-03-29 14:59:49 +00:00
parent b39c4d372c
commit 8f891460b6
15 changed files with 397 additions and 210 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@ -1,2 +1,2 @@
SOURCES/nginx-1.16.1.tar.gz SOURCES/nginx-1.24.0.tar.gz
SOURCES/poweredby.png SOURCES/nginx-logo.png

4
.nginx.metadata
View File

@ -1,2 +1,2 @@
77ce4d26481b62f7a9d83e399454df0912f01a4b SOURCES/nginx-1.16.1.tar.gz fec561c95c0320f1860c0d55a8724cd45e5cc238 SOURCES/nginx-1.24.0.tar.gz
2ec82988cd0d9b1304c95a16b28eff70f0f69abc SOURCES/poweredby.png e28dd656984cc2894d8124c5278789c656f6a9cb SOURCES/nginx-logo.png

2
SOURCES/README.dynamic
View File

@ -16,5 +16,5 @@ Prevent dynamic modules from being enabled automatically
You may want to avoid dynamic modules being enabled automatically. Simply You may want to avoid dynamic modules being enabled automatically. Simply
remove this line from the top of /etc/nginx/nginx.conf: remove this line from the top of /etc/nginx/nginx.conf:
include /usr/lib64/nginx/modules/*.conf; include /usr/share/nginx/modules/*.conf;

117
SOURCES/index.html
View File

@ -1,117 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<title>Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<style type="text/css">
/*<![CDATA[*/
body {
background-color: #fff;
color: #000;
font-size: 0.9em;
font-family: sans-serif,helvetica;
margin: 0;
padding: 0;
}
:link {
color: #c00;
}
:visited {
color: #c00;
}
a:hover {
color: #f50;
}
h1 {
text-align: center;
margin: 0;
padding: 0.6em 2em 0.4em;
background-color: #900;
color: #fff;
font-weight: normal;
font-size: 1.75em;
border-bottom: 2px solid #000;
}
h1 strong {
font-weight: bold;
font-size: 1.5em;
}
h2 {
text-align: center;
background-color: #900;
font-size: 1.1em;
font-weight: bold;
color: #fff;
margin: 0;
padding: 0.5em;
border-bottom: 2px solid #000;
}
hr {
display: none;
}
.content {
padding: 1em 5em;
}
.alert {
border: 2px solid #000;
}
img {
border: 2px solid #fff;
padding: 2px;
margin: 2px;
}
a:hover img {
border: 2px solid #294172;
}
.logos {
margin: 1em;
text-align: center;
}
/*]]>*/
</style>
</head>
<body>
<h1>Welcome to <strong>nginx</strong> on Red Hat Enterprise Linux!</h1>
<div class="content">
<p>This page is used to test the proper operation of the
<strong>nginx</strong> HTTP server after it has been
installed. If you can read this page, it means that the
web server installed at this site is working
properly.</p>
<div class="alert">
<h2>Website Administrator</h2>
<div class="content">
<p>This is the default <tt>index.html</tt> page that
is distributed with <strong>nginx</strong> on
Red Hat Enterprise Linux. It is located in
<tt>/usr/share/nginx/html</tt>.</p>
<p>You should now put your content in a location of
your choice and edit the <tt>root</tt> configuration
directive in the <strong>nginx</strong>
configuration file
<tt>/etc/nginx/nginx.conf</tt>.</p>
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
</div>
</div>
<div class="logos">
<a href="http://nginx.net/"><img
src="nginx-logo.png"
alt="[ Powered by nginx ]"
width="121" height="32" /></a>
<a href="http://www.redhat.com/"><img
src="poweredby.png"
alt="[ Powered by Red Hat Enterprise Linux ]"
width="88" height="31" /></a>
</div>
</div>
</body>
</html>

20
SOURCES/macros.nginxmods.in Normal file
View File

@ -0,0 +1,20 @@
%_nginx_abiversion @@NGINX_ABIVERSION@@
%_nginx_srcdir @@NGINX_SRCDIR@@
%_nginx_buildsrcdir nginx-src
%_nginx_modsrcdir ..
%_nginx_modbuilddir ../%{_vpath_builddir}
%nginx_moddir @@NGINX_MODDIR@@
%nginx_modconfdir @@NGINX_MODCONFDIR@@
%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion}
%nginx_modconfigure(:-:) \\\
%undefine _strict_symbol_defs_build \
cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \
cd "%{_nginx_buildsrcdir}" \
nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \
./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\
--add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \
cd -
%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} modules

76
SOURCES/nginx-1.18.0-pkcs11-cert.patch Normal file
View File

@ -0,0 +1,76 @@
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 0a2f260..606b6e2 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -616,6 +616,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
X509 *x509, *temp;
u_long n;
+ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) {
+
+#ifndef OPENSSL_NO_ENGINE
+
+ u_char *p, *last;
+ ENGINE *engine;
+
+ p = cert->data + sizeof("engine:") - 1;
+ last = (u_char *) ngx_strchr(p, ':');
+
+ if (last == NULL) {
+ *err = "invalid syntax";
+ return NULL;
+ }
+
+ *last = '\0';
+
+ engine = ENGINE_by_id((char *) p);
+
+ if (engine == NULL) {
+ *err = "ENGINE_by_id() failed";
+ return NULL;
+ }
+
+ if (!ENGINE_init(engine)) {
+ *err = "ENGINE_init() failed";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
+ *last++ = ':';
+
+ struct {
+ const char *cert_id;
+ X509 *cert;
+ } params = { (char *) last, NULL };
+
+ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
+ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate";
+ ENGINE_free(engine);
+ return NULL;
+ }
+
+ ENGINE_finish(engine);
+ ENGINE_free(engine);
+
+ /* set chain to null */
+
+ *chain = sk_X509_new_null();
+ if (*chain == NULL) {
+ *err = "sk_X509_new_null() failed";
+ X509_free(params.cert);
+ return NULL;
+ }
+
+ return params.cert;
+
+#else
+
+ *err = "loading \"engine:...\" certificate is not supported";
+ return NULL;
+
+#endif
+ }
+
if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,

73
SOURCES/nginx-1.22-CVE-2023-44487.patch Normal file
View File

@ -0,0 +1,73 @@
From b6aa9504cdfb6391d895dcbddc87b9260ea6968c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 11 Oct 2023 09:59:23 +0200
Subject: [PATCH] CVE-2023-44487 - HTTP/2: per-iteration stream handling limit.
To ensure that attempts to flood servers with many streams are detected
early, a limit of no more than 2 * max_concurrent_streams new streams per one
event loop iteration was introduced. This limit is applied even if
max_concurrent_streams is not yet reached - for example, if corresponding
streams are handled synchronously or reset.
Further, refused streams are now limited to maximum of max_concurrent_streams
and 100, similarly to priority_limit initial value, providing some tolerance
to clients trying to open several streams at the connection start, yet
low tolerance to flooding attempts.
---
src/http/v2/ngx_http_v2.c | 15 +++++++++++++++
src/http/v2/ngx_http_v2.h | 2 ++
2 files changed, 17 insertions(+)
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index 0e45a7b..253718f 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -361,6 +361,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler");
h2c->blocked = 1;
+ h2c->new_streams = 0;
if (c->close) {
c->close = 0;
@@ -1321,6 +1322,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
goto rst_stream;
}
+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) {
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+ "client sent too many streams at once");
+
+ status = NGX_HTTP_V2_REFUSED_STREAM;
+ goto rst_stream;
+ }
+
if (!h2c->settings_ack
&& !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG)
&& h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW)
@@ -1386,6 +1395,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
rst_stream:
+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) {
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
+ "client sent too many refused streams");
+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR);
+ }
+
if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) {
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
}
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
index 70ee287..7593f1c 100644
--- a/src/http/v2/ngx_http_v2.h
+++ b/src/http/v2/ngx_http_v2.h
@@ -124,6 +124,8 @@ struct ngx_http_v2_connection_s {
ngx_uint_t processing;
ngx_uint_t frames;
ngx_uint_t idle;
+ ngx_uint_t new_streams;
+ ngx_uint_t refused_streams;
ngx_uint_t priority_limit;
ngx_uint_t pushing;

54
SOURCES/nginx-1.16.0-enable-tls1v3-by-default.patch → SOURCES/nginx-1.24.0-enable-tls1v3-by-default.patch
View File

@ -1,8 +1,8 @@
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 345914f..d23967f 100644 index 894a134..0ccd439 100644
--- a/src/event/ngx_event_openssl.c --- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c
@@ -252,6 +252,8 @@ ngx_ssl_init(ngx_log_t *log) @@ -261,6 +261,8 @@ ngx_ssl_init(ngx_log_t *log)
ngx_int_t ngx_int_t
ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
{ {
@ -11,7 +11,7 @@ index 345914f..d23967f 100644
ssl->ctx = SSL_CTX_new(SSLv23_method()); ssl->ctx = SSL_CTX_new(SSLv23_method());
if (ssl->ctx == NULL) { if (ssl->ctx == NULL) {
@@ -316,49 +318,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) @@ -320,49 +322,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
@ -102,11 +102,11 @@ index 345914f..d23967f 100644
#ifdef SSL_OP_NO_COMPRESSION #ifdef SSL_OP_NO_COMPRESSION
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 61da0c5..fa7ac41 100644 index 860ea26..7759e1a 100644
--- a/src/event/ngx_event_openssl.h --- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h +++ b/src/event/ngx_event_openssl.h
@@ -145,6 +145,7 @@ typedef struct { @@ -166,6 +166,7 @@ typedef struct {
#endif } ngx_ssl_session_cache_t;
+#define NGX_SSL_NO_PROT 0x0000 +#define NGX_SSL_NO_PROT 0x0000
@ -114,44 +114,50 @@ index 61da0c5..fa7ac41 100644
#define NGX_SSL_SSLv3 0x0004 #define NGX_SSL_SSLv3 0x0004
#define NGX_SSL_TLSv1 0x0008 #define NGX_SSL_TLSv1 0x0008
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index b3f8f47..8340a12 100644 index 4c4a598..f1fae50 100644
--- a/src/http/modules/ngx_http_ssl_module.c --- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c
@@ -613,8 +613,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) @@ -631,10 +631,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_value(conf->early_data, prev->early_data, 0); ngx_conf_merge_value(conf->early_data, prev->early_data, 0);
ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - (NGX_CONF_BITMASK_SET
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); - |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
+ 0) - |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
+ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0);
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
NGX_SSL_BUFSIZE); NGX_SSL_BUFSIZE);
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
index 5544f75..3316a4b 100644 index 28737ac..01a04c8 100644
--- a/src/mail/ngx_mail_ssl_module.c --- a/src/mail/ngx_mail_ssl_module.c
+++ b/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c
@@ -291,8 +291,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) @@ -359,10 +359,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_value(conf->prefer_server_ciphers,
prev->prefer_server_ciphers, 0); prev->prefer_server_ciphers, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - (NGX_CONF_BITMASK_SET
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); - |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
+ 0); - |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
+ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0);
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
index ec9524e..37af046 100644 index 1ba1825..c692884 100644
--- a/src/stream/ngx_stream_ssl_module.c --- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c
@@ -625,8 +625,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) @@ -702,10 +702,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_value(conf->prefer_server_ciphers,
prev->prefer_server_ciphers, 0); prev->prefer_server_ciphers, 0);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - (NGX_CONF_BITMASK_SET
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); - |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
+ 0); - |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
+ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0);
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);

BIN
SOURCES/nginx-logo.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 368 B

27
SOURCES/nginx.conf
View File

@ -4,7 +4,7 @@
user nginx; user nginx;
worker_processes auto; worker_processes auto;
error_log /var/log/nginx/error.log; error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid; pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. # Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
@ -23,9 +23,8 @@ http {
sendfile on; sendfile on;
tcp_nopush on; tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65; keepalive_timeout 65;
types_hash_max_size 2048; types_hash_max_size 4096;
include /etc/nginx/mime.types; include /etc/nginx/mime.types;
default_type application/octet-stream; default_type application/octet-stream;
@ -36,31 +35,28 @@ http {
include /etc/nginx/conf.d/*.conf; include /etc/nginx/conf.d/*.conf;
server { server {
listen 80 default_server; listen 80;
listen [::]:80 default_server; listen [::]:80;
server_name _; server_name _;
root /usr/share/nginx/html; root /usr/share/nginx/html;
# Load configuration files for the default server block. # Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf; include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html; error_page 404 /404.html;
location = /40x.html { location = /404.html {
} }
error_page 500 502 503 504 /50x.html; error_page 500 502 503 504 /50x.html;
location = /50x.html { location = /50x.html {
} }
} }
# Settings for a TLS enabled server. # Settings for a TLS enabled server.
# #
# server { # server {
# listen 443 ssl http2 default_server; # listen 443 ssl http2;
# listen [::]:443 ssl http2 default_server; # listen [::]:443 ssl http2;
# server_name _; # server_name _;
# root /usr/share/nginx/html; # root /usr/share/nginx/html;
# #
@ -74,15 +70,12 @@ http {
# # Load configuration files for the default server block. # # Load configuration files for the default server block.
# include /etc/nginx/default.d/*.conf; # include /etc/nginx/default.d/*.conf;
# #
# location / {
# }
#
# error_page 404 /404.html; # error_page 404 /404.html;
# location = /40x.html { # location = /404.html {
# } # }
# #
# error_page 500 502 503 504 /50x.html; # error_page 500 502 503 504 /50x.html;
# location = /50x.html { # location = /50x.html {
# } # }
# } # }

5
SOURCES/nginx.logrotate
View File

@ -1,10 +1,11 @@
/var/log/nginx/*log { /var/log/nginx/*.log {
create 0664 nginx root create 0640 nginx root
daily daily
rotate 10 rotate 10
missingok missingok
notifempty notifempty
compress compress
delaycompress
sharedscripts sharedscripts
postrotate postrotate
/bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true /bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true

5
SOURCES/nginx.service
View File

@ -1,6 +1,7 @@
[Unit] [Unit]
Description=The nginx HTTP and reverse proxy server Description=The nginx HTTP and reverse proxy server
After=network.target remote-fs.target nss-lookup.target After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target
[Service] [Service]
Type=forking Type=forking
@ -11,7 +12,7 @@ PIDFile=/run/nginx.pid
ExecStartPre=/usr/bin/rm -f /run/nginx.pid ExecStartPre=/usr/bin/rm -f /run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx ExecStart=/usr/sbin/nginx
ExecReload=/bin/kill -s HUP $MAINPID ExecReload=/usr/sbin/nginx -s reload
KillSignal=SIGQUIT KillSignal=SIGQUIT
TimeoutStopSec=5 TimeoutStopSec=5
KillMode=mixed KillMode=mixed

2
SOURCES/nginxmods.attr Normal file
View File

@ -0,0 +1,2 @@
%__nginxmods_requires %{_rpmconfigdir}/nginxmods.req
%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$

6
SOURCES/nginxmods.req Normal file
View File

@ -0,0 +1,6 @@
#!/bin/sh
# Generate Requires: nginx(abi) = VERSION
echo "nginx(abi) = $(rpm --eval '%{_nginx_abiversion}')"
exit 0

212
SPECS/nginx.spec
View File

@ -16,9 +16,20 @@
%global with_mailcap_mimetypes 1 %global with_mailcap_mimetypes 1
%endif %endif
# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/
%global nginx_abiversion %{version}
%global nginx_moduledir %{_libdir}/nginx/modules
%global nginx_moduleconfdir %{_datadir}/nginx/modules
%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release}
# Do not generate provides/requires from nginx sources
%global __provides_exclude_from ^%{nginx_srcdir}/.*$
%global __requires_exclude_from ^%{nginx_srcdir}/.*$
Name: nginx Name: nginx
Epoch: 1 Epoch: 1
Version: 1.16.1 Version: 1.24.0
Release: 1%{?dist} Release: 1%{?dist}
Summary: A high performance web server and reverse proxy server Summary: A high performance web server and reverse proxy server
@ -34,8 +45,9 @@ Source11: nginx.logrotate
Source12: nginx.conf Source12: nginx.conf
Source13: nginx-upgrade Source13: nginx-upgrade
Source14: nginx-upgrade.8 Source14: nginx-upgrade.8
Source100: index.html Source15: macros.nginxmods.in
Source101: poweredby.png Source16: nginxmods.attr
Source17: nginxmods.req
Source102: nginx-logo.png Source102: nginx-logo.png
Source103: 404.html Source103: 404.html
Source104: 50x.html Source104: 50x.html
@ -57,7 +69,13 @@ Patch2: nginx-1.16.0-pkcs11.patch
Patch3: nginx-1.14.1-perl-module-hardening.patch Patch3: nginx-1.14.1-perl-module-hardening.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1643647 # https://bugzilla.redhat.com/show_bug.cgi?id=1643647
Patch4: nginx-1.16.0-enable-tls1v3-by-default.patch Patch4: nginx-1.24.0-enable-tls1v3-by-default.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1668717
Patch5: nginx-1.18.0-pkcs11-cert.patch
# https://issues.redhat.com/browse/RHEL-12728
Patch6: nginx-1.22-CVE-2023-44487.patch
%if 0%{?with_gperftools} %if 0%{?with_gperftools}
BuildRequires: gperftools-devel BuildRequires: gperftools-devel
@ -67,6 +85,7 @@ BuildRequires: pcre-devel
BuildRequires: zlib-devel BuildRequires: zlib-devel
Requires: nginx-filesystem = %{epoch}:%{version}-%{release} Requires: nginx-filesystem = %{epoch}:%{version}-%{release}
Requires: system-logos-httpd >= 82.0
%if 0%{?rhel} > 0 && 0%{?rhel} < 8 %if 0%{?rhel} > 0 && 0%{?rhel} < 8
# Introduced at 1:1.10.0-1 to ease upgrade path. To be removed later. # Introduced at 1:1.10.0-1 to ease upgrade path. To be removed later.
@ -85,6 +104,8 @@ BuildRequires: systemd
Requires(post): systemd Requires(post): systemd
Requires(preun): systemd Requires(preun): systemd
Requires(postun): systemd Requires(postun): systemd
# For external nginx modules
Provides: nginx(abi) = %{nginx_abiversion}
%description %description
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
@ -124,7 +145,7 @@ directories.
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx HTTP geoip module Summary: Nginx HTTP geoip module
BuildRequires: GeoIP-devel BuildRequires: GeoIP-devel
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
Requires: GeoIP Requires: GeoIP
%description mod-http-geoip %description mod-http-geoip
@ -135,7 +156,7 @@ Requires: GeoIP
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx HTTP image filter module Summary: Nginx HTTP image filter module
BuildRequires: gd-devel BuildRequires: gd-devel
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
Requires: gd Requires: gd
%description mod-http-image-filter %description mod-http-image-filter
@ -149,7 +170,7 @@ BuildRequires: perl-devel
BuildRequires: perl-generators BuildRequires: perl-generators
%endif %endif
BuildRequires: perl(ExtUtils::Embed) BuildRequires: perl(ExtUtils::Embed)
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
Requires: perl(constant) Requires: perl(constant)
@ -160,7 +181,7 @@ Requires: perl(constant)
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx XSLT module Summary: Nginx XSLT module
BuildRequires: libxslt-devel BuildRequires: libxslt-devel
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
%description mod-http-xslt-filter %description mod-http-xslt-filter
%{summary}. %{summary}.
@ -168,7 +189,7 @@ Requires: nginx
%package mod-mail %package mod-mail
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx mail modules Summary: Nginx mail modules
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
%description mod-mail %description mod-mail
%{summary}. %{summary}.
@ -176,11 +197,33 @@ Requires: nginx
%package mod-stream %package mod-stream
Group: System Environment/Daemons Group: System Environment/Daemons
Summary: Nginx stream modules Summary: Nginx stream modules
Requires: nginx Requires: nginx(abi) = %{nginx_abiversion}
%description mod-stream %description mod-stream
%{summary}. %{summary}.
%package mod-devel
Summary: Nginx module development files
Requires: nginx = %{epoch}:%{version}-%{release}
Requires: make
Requires: gcc
Requires: gd-devel
%if 0%{?with_gperftools}
Requires: gperftools-devel
%endif
%if %{with geoip}
Requires: GeoIP-devel
%endif
Requires: libxslt-devel
Requires: openssl-devel
Requires: pcre-devel
Requires: perl-devel
Requires: perl(ExtUtils::Embed)
Requires: zlib-devel
%description mod-devel
%{summary}.
%prep %prep
%setup -q %setup -q
@ -189,6 +232,8 @@ Requires: nginx
%patch2 -p1 %patch2 -p1
%patch3 -p1 %patch3 -p1
%patch4 -p1 %patch4 -p1
%patch5 -p1
%patch6 -p1
cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} . cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
@ -197,6 +242,10 @@ sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service
sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf
%endif %endif
# Prepare sources for installation
cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src
mv ../%{name}-%{version}-%{release}-src .
%build %build
# nginx does not utilize a standard configure script. It has its own # nginx does not utilize a standard configure script. It has its own
@ -207,7 +256,7 @@ export DESTDIR=%{buildroot}
./configure \ ./configure \
--prefix=%{_datadir}/nginx \ --prefix=%{_datadir}/nginx \
--sbin-path=%{_sbindir}/nginx \ --sbin-path=%{_sbindir}/nginx \
--modules-path=%{_libdir}/nginx/modules \ --modules-path=%{nginx_moduledir} \
--conf-path=%{_sysconfdir}/nginx/nginx.conf \ --conf-path=%{_sysconfdir}/nginx/nginx.conf \
--error-log-path=%{_localstatedir}/log/nginx/error.log \ --error-log-path=%{_localstatedir}/log/nginx/error.log \
--http-log-path=%{_localstatedir}/log/nginx/access.log \ --http-log-path=%{_localstatedir}/log/nginx/access.log \
@ -223,7 +272,6 @@ export DESTDIR=%{buildroot}
%if 0%{?with_aio} %if 0%{?with_aio}
--with-file-aio \ --with-file-aio \
%endif %endif
--with-ipv6 \
--with-http_ssl_module \ --with-http_ssl_module \
--with-http_v2_module \ --with-http_v2_module \
--with-http_realip_module \ --with-http_realip_module \
@ -233,6 +281,7 @@ export DESTDIR=%{buildroot}
--with-http_image_filter_module=dynamic \ --with-http_image_filter_module=dynamic \
%if %{with geoip} %if %{with geoip}
--with-http_geoip_module=dynamic \ --with-http_geoip_module=dynamic \
--with-stream_geoip_module=dynamic \
%endif %endif
--with-http_sub_module \ --with-http_sub_module \
--with-http_dav_module \ --with-http_dav_module \
@ -252,12 +301,14 @@ export DESTDIR=%{buildroot}
--with-pcre \ --with-pcre \
--with-pcre-jit \ --with-pcre-jit \
--with-stream=dynamic \ --with-stream=dynamic \
--with-stream_realip_module \
--with-stream_ssl_module \ --with-stream_ssl_module \
%if 0%{?with_gperftools} %if 0%{?with_gperftools}
--with-google_perftools_module \ --with-google_perftools_module \
%endif %endif
--with-debug \ --with-debug \
--with-cc-opt="%{optflags} $(pcre-config --cflags)" \ --with-cc-opt="%{optflags} $(pcre-config --cflags)" \
--with-compat \
--with-ld-opt="$RPM_LD_FLAGS -Wl,-E" # so the perl module finds its symbols --with-ld-opt="$RPM_LD_FLAGS -Wl,-E" # so the perl module finds its symbols
make %{?_smp_mflags} make %{?_smp_mflags}
@ -287,15 +338,24 @@ install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp
install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html
install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/modules install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir}
install -p -d -m 0755 %{buildroot}%{_libdir}/nginx/modules install -p -d -m 0755 %{buildroot}%{nginx_moduledir}
install -p -m 0644 ./nginx.conf \ install -p -m 0644 ./nginx.conf \
%{buildroot}%{_sysconfdir}/nginx %{buildroot}%{_sysconfdir}/nginx
install -p -m 0644 %{SOURCE100} \
%{buildroot}%{_datadir}/nginx/html rm -f %{buildroot}%{_datadir}/nginx/html/index.html
install -p -m 0644 %{SOURCE101} %{SOURCE102} \ ln -s ../../testpage/index.html \
%{buildroot}%{_datadir}/nginx/html/index.html
install -p -m 0644 %{SOURCE102} \
%{buildroot}%{_datadir}/nginx/html %{buildroot}%{_datadir}/nginx/html
ln -s nginx-logo.png %{buildroot}%{_datadir}/nginx/html/poweredby.png
mkdir -p %{buildroot}%{_datadir}/nginx/html/icons
# Symlink for the powered-by-$DISTRO image:
ln -s ../../../pixmaps/poweredby.png \
%{buildroot}%{_datadir}/nginx/html/icons/poweredby.png
install -p -m 0644 %{SOURCE103} %{SOURCE104} \ install -p -m 0644 %{SOURCE103} %{SOURCE104} \
%{buildroot}%{_datadir}/nginx/html %{buildroot}%{_datadir}/nginx/html
@ -315,19 +375,35 @@ for i in ftdetect indent syntax; do
done done
%if %{with geoip} %if %{with geoip}
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_geoip_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-geoip.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf
%endif %endif
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_image_filter_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-image-filter.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_perl_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-perl.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-http-xslt-filter.conf > %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_mail_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-mail.conf > %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf
echo 'load_module "%{_libdir}/nginx/modules/ngx_stream_module.so";' \ echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \
> %{buildroot}%{_datadir}/nginx/modules/mod-stream.conf > %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf
# Install files for supporting nginx module builds
## Install source files
mkdir -p %{buildroot}%{_usrsrc}
mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir}
## Install rpm macros
mkdir -p %{buildroot}%{_rpmmacrodir}
sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \
-e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \
-e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \
-e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \
%{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods
## Install dependency generator
install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16}
install -Dpm0755 -t %{buildroot}%{_rpmconfigdir} %{SOURCE17}
%pre filesystem %pre filesystem
getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user} getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user}
@ -416,8 +492,11 @@ fi
%config(noreplace) %{_sysconfdir}/logrotate.d/nginx %config(noreplace) %{_sysconfdir}/logrotate.d/nginx
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx %attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp %attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp
%attr(770,%{nginx_user},root) %dir %{_localstatedir}/log/nginx %attr(711,root,root) %dir %{_localstatedir}/log/nginx
%dir %{_libdir}/nginx/modules %ghost %attr(640,%{nginx_user},root) %{_localstatedir}/log/nginx/access.log
%ghost %attr(640,%{nginx_user},root) %{_localstatedir}/log/nginx/error.log
%dir %{nginx_moduledir}
%dir %{nginx_moduleconfdir}
%files all-modules %files all-modules
@ -432,35 +511,82 @@ fi
%if %{with geoip} %if %{with geoip}
%files mod-http-geoip %files mod-http-geoip
%{_datadir}/nginx/modules/mod-http-geoip.conf %{nginx_moduleconfdir}/mod-http-geoip.conf
%{_libdir}/nginx/modules/ngx_http_geoip_module.so %{nginx_moduledir}/ngx_http_geoip_module.so
%endif %endif
%files mod-http-image-filter %files mod-http-image-filter
%{_datadir}/nginx/modules/mod-http-image-filter.conf %{nginx_moduleconfdir}/mod-http-image-filter.conf
%{_libdir}/nginx/modules/ngx_http_image_filter_module.so %{nginx_moduledir}/ngx_http_image_filter_module.so
%files mod-http-perl %files mod-http-perl
%{_datadir}/nginx/modules/mod-http-perl.conf %{nginx_moduleconfdir}/mod-http-perl.conf
%{_libdir}/nginx/modules/ngx_http_perl_module.so %{nginx_moduledir}/ngx_http_perl_module.so
%dir %{perl_vendorarch}/auto/nginx %dir %{perl_vendorarch}/auto/nginx
%{perl_vendorarch}/nginx.pm %{perl_vendorarch}/nginx.pm
%{perl_vendorarch}/auto/nginx/nginx.so %{perl_vendorarch}/auto/nginx/nginx.so
%files mod-http-xslt-filter %files mod-http-xslt-filter
%{_datadir}/nginx/modules/mod-http-xslt-filter.conf %{nginx_moduleconfdir}/mod-http-xslt-filter.conf
%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so %{nginx_moduledir}/ngx_http_xslt_filter_module.so
%files mod-mail %files mod-mail
%{_datadir}/nginx/modules/mod-mail.conf %{nginx_moduleconfdir}/mod-mail.conf
%{_libdir}/nginx/modules/ngx_mail_module.so %{nginx_moduledir}/ngx_mail_module.so
%files mod-stream %files mod-stream
%{_datadir}/nginx/modules/mod-stream.conf %{nginx_moduleconfdir}/mod-stream.conf
%{_libdir}/nginx/modules/ngx_stream_module.so %{nginx_moduledir}/ngx_stream_module.so
%files mod-devel
%{_rpmmacrodir}/macros.nginxmods
%{_fileattrsdir}/nginxmods.attr
%{_rpmconfigdir}/nginxmods.req
%{nginx_srcdir}/
%changelog %changelog
* Thu Jan 18 2024 Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-1
- Resolves: RHEL-14714 - add nginx:1.24 to RHEL 8.10
* Mon Oct 16 2023 Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-2
- Resolves: RHEL-12728 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web
servers are vulnerable to a DDoS attack (Rapid Reset Attack)(CVE-2023-44487)
* Thu Dec 01 2022 Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-1
- Resolves: #2112345 - nginx:1.22 for RHEL 8
- add stream_geoip_module and stream_realip_module
- remove obsolete --with-ipv6
* Tue Dec 21 2021 Joe Orton <jorton@redhat.com> - 1:1.20.1-1
- rebase to 1.20.1 (addressing CVE-2021-23017)
* Wed Dec 1 2021 Joe Orton <jorton@redhat.com> - 1:1.20.0-4
- add delaycompress to logrotate config (#2015243)
* Fri Sep 10 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-3
- Add -mod-devel subpackage for building external nginx modules (Neal Gompa)
Resolves: #1991787
* Fri Aug 20 2021 Luboš Uhliarik <luhliari@redhat.com> - 1:1.20.0-2
- Resolves: #1991796 - build nginx with --with-compat
* Wed May 05 2021 Lubos Uhliarik <luhliari@redhat.com> - 1:1.20.0-1
- new version 1.20.0
- Resolves: #1945671 - RFE: add nginx:1.20 module stream
* Thu Nov 12 2020 Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-3
- Resolves: #1651377 - centralizing default index.html on nginx
- Resolves: #1825683 - Outdated Red Hat branding used in nginx default pages
* Wed Apr 22 2020 Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-2
- new version 1.18.0
- Resolves: #1668717 - [RFE] Support loading certificates from hardware token
(PKCS#11)
- Increased types_hash_max_size to 4096 in default config
- Drop location / from default config (rhbz#1564768)
- Drop default_sever from default config (rhbz#1373822)
* Thu Aug 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1 * Thu Aug 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
- update to 1.16.1 - update to 1.16.1
- Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount - Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount