From ece00920d62d51a6c616091b9d194d71e42eeaa1 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Sat, 30 Mar 2024 05:31:27 +0000 Subject: [PATCH] import CS nginx-1.24.0-1.module_el9+833+e1ad0c2b --- .gitignore | 4 +- .nginx.metadata | 4 +- ...ove-Werror-in-upstream-build-scripts.patch | 31 + SOURCES/0002-fix-PIDFile-handling.patch | 108 +++ ...port-loading-cert-hardware-token-PKC.patch | 88 ++ ...er-optimalization-level-O2-for-perl.patch} | 13 + ...> 0005-Init-openssl-engine-properly.patch} | 16 +- ...h => 0007-Enable-TLSv1.3-by-default.patch} | 66 +- SOURCES/0008-add-ssl-pass-phrase-dialog.patch | 754 ++++++++++++++++++ ...HTTP-2-per-iteration-stream-handling.patch | 76 ++ SOURCES/README.dynamic | 2 +- SOURCES/index.html | 117 --- SOURCES/macros.nginxmods.in | 20 + SOURCES/maxim.key | 69 ++ SOURCES/mdounin.key | 33 + SOURCES/nginx-1.14.0-logs-perm.patch | 13 - SOURCES/nginx-1.24.0.tar.gz.asc | 14 + SOURCES/nginx-auto-cc-gcc.patch | 13 - SOURCES/nginx-logo.png | Bin 368 -> 0 bytes SOURCES/nginx-ssl-pass-dialog | 3 + SOURCES/nginx.conf | 27 +- SOURCES/nginx.logrotate | 5 +- SOURCES/nginx.service | 5 +- SOURCES/nginxmods.attr | 14 + SOURCES/sb.key | 41 + SOURCES/thresh.key | 147 ++++ SPECS/nginx.spec | 634 +++++++++++---- 27 files changed, 1947 insertions(+), 370 deletions(-) create mode 100644 SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch create mode 100644 SOURCES/0002-fix-PIDFile-handling.patch create mode 100644 SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch rename SOURCES/{nginx-1.14.1-perl-module-hardening.patch => 0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch} (54%) rename SOURCES/{nginx-1.16.0-pkcs11.patch => 0005-Init-openssl-engine-properly.patch} (64%) rename SOURCES/{nginx-1.16.0-enable-tls1v3-by-default.patch => 0007-Enable-TLSv1.3-by-default.patch} (72%) create mode 100644 SOURCES/0008-add-ssl-pass-phrase-dialog.patch create mode 100644 SOURCES/0009-CVE-2023-44487-HTTP-2-per-iteration-stream-handling.patch delete mode 100644 SOURCES/index.html create mode 100644 SOURCES/macros.nginxmods.in create mode 100644 SOURCES/maxim.key create mode 100644 SOURCES/mdounin.key delete mode 100644 SOURCES/nginx-1.14.0-logs-perm.patch create mode 100644 SOURCES/nginx-1.24.0.tar.gz.asc delete mode 100644 SOURCES/nginx-auto-cc-gcc.patch delete mode 100644 SOURCES/nginx-logo.png create mode 100755 SOURCES/nginx-ssl-pass-dialog create mode 100644 SOURCES/nginxmods.attr create mode 100644 SOURCES/sb.key create mode 100644 SOURCES/thresh.key diff --git a/.gitignore b/.gitignore index 7d5d140..c99aca9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -SOURCES/nginx-1.16.1.tar.gz -SOURCES/poweredby.png +SOURCES/nginx-1.24.0.tar.gz +SOURCES/nginx-logo.png diff --git a/.nginx.metadata b/.nginx.metadata index 7195b7f..1694920 100644 --- a/.nginx.metadata +++ b/.nginx.metadata @@ -1,2 +1,2 @@ -77ce4d26481b62f7a9d83e399454df0912f01a4b SOURCES/nginx-1.16.1.tar.gz -2ec82988cd0d9b1304c95a16b28eff70f0f69abc SOURCES/poweredby.png +fec561c95c0320f1860c0d55a8724cd45e5cc238 SOURCES/nginx-1.24.0.tar.gz +e28dd656984cc2894d8124c5278789c656f6a9cb SOURCES/nginx-logo.png diff --git a/SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch b/SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch new file mode 100644 index 0000000..2695031 --- /dev/null +++ b/SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch @@ -0,0 +1,31 @@ +From 00cab63102084b89de0a3494a1d023c4b1d4982b Mon Sep 17 00:00:00 2001 +From: Felix Kaechele +Date: Sun, 7 Jun 2020 12:14:02 -0400 +Subject: [PATCH 1/2] remove Werror in upstream build scripts + +removes -Werror in upstream build scripts. -Werror conflicts with +-D_FORTIFY_SOURCE=2 causing warnings to turn into errors. + +Signed-off-by: Felix Kaechele +--- + auto/cc/gcc | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/auto/cc/gcc b/auto/cc/gcc +index a5c5c18..cdbbadb 100644 +--- a/auto/cc/gcc ++++ b/auto/cc/gcc +@@ -166,7 +166,9 @@ esac + + + # stop on warning +-CFLAGS="$CFLAGS -Werror" ++# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx ++# to not compile. ++#CFLAGS="$CFLAGS -Werror" + + # debug + CFLAGS="$CFLAGS -g" +-- +2.31.1 + diff --git a/SOURCES/0002-fix-PIDFile-handling.patch b/SOURCES/0002-fix-PIDFile-handling.patch new file mode 100644 index 0000000..5748b63 --- /dev/null +++ b/SOURCES/0002-fix-PIDFile-handling.patch @@ -0,0 +1,108 @@ +From 62470498cca9a209aa9904668c1949f5229123af Mon Sep 17 00:00:00 2001 +From: Felix Kaechele +Date: Tue, 20 Apr 2021 21:28:18 -0400 +Subject: [PATCH 2/2] fix PIDFile handling + +Corresponding RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1869026 + +Rejected upstream: https://trac.nginx.org/nginx/ticket/1897 + +Taken from: https://git.launchpad.net/ubuntu/+source/nginx/tree/debian/patches/nginx-fix-pidfile.patch + +From original patch: +Author: Tj +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1581864 +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876365 +iLast-Update: 2020-06-24 + +Signed-off-by: Felix Kaechele +--- + src/core/nginx.c | 24 +++++++++++++++++++++--- + src/os/unix/ngx_daemon.c | 8 ++++++-- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/src/core/nginx.c b/src/core/nginx.c +index 48a20e9..32c0afe 100644 +--- a/src/core/nginx.c ++++ b/src/core/nginx.c +@@ -339,14 +339,21 @@ main(int argc, char *const *argv) + ngx_process = NGX_PROCESS_MASTER; + } + ++ /* tell-tale to detect if this is parent or child process */ ++ ngx_int_t child_pid = NGX_BUSY; ++ + #if !(NGX_WIN32) + + if (ngx_init_signals(cycle->log) != NGX_OK) { + return 1; + } + ++ /* tell-tale that this code has been executed */ ++ child_pid--; ++ + if (!ngx_inherited && ccf->daemon) { +- if (ngx_daemon(cycle->log) != NGX_OK) { ++ child_pid = ngx_daemon(cycle->log); ++ if (child_pid == NGX_ERROR) { + return 1; + } + +@@ -359,8 +366,19 @@ main(int argc, char *const *argv) + + #endif + +- if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) { +- return 1; ++ /* If ngx_daemon() returned the child's PID in the parent process ++ * after the fork() set ngx_pid to the child_pid, which gets ++ * written to the PID file, then exit. ++ * For NGX_WIN32 always write the PID file ++ * For others, only write it from the parent process */ ++ if (child_pid < NGX_OK || child_pid > NGX_OK) { ++ ngx_pid = child_pid > NGX_OK ? child_pid : ngx_pid; ++ if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) { ++ return 1; ++ } ++ } ++ if (child_pid > NGX_OK) { ++ exit(0); + } + + if (ngx_log_redirect_stderr(cycle) != NGX_OK) { +diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c +index 385c49b..3719854 100644 +--- a/src/os/unix/ngx_daemon.c ++++ b/src/os/unix/ngx_daemon.c +@@ -7,14 +7,17 @@ + + #include + #include ++#include + + + ngx_int_t + ngx_daemon(ngx_log_t *log) + { + int fd; ++ /* retain the return value for passing back to caller */ ++ pid_t pid_child = fork(); + +- switch (fork()) { ++ switch (pid_child) { + case -1: + ngx_log_error(NGX_LOG_EMERG, log, ngx_errno, "fork() failed"); + return NGX_ERROR; +@@ -23,7 +26,8 @@ ngx_daemon(ngx_log_t *log) + break; + + default: +- exit(0); ++ /* let caller do the exit() */ ++ return pid_child; + } + + ngx_parent = ngx_pid; +-- +2.31.1 + diff --git a/SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch b/SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch new file mode 100644 index 0000000..2d09c16 --- /dev/null +++ b/SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch @@ -0,0 +1,88 @@ +From 4e5f12d6584536ead82d20554d8f3f2ab0107b0b Mon Sep 17 00:00:00 2001 +From: Lubos Uhliarik +Date: Fri, 30 Apr 2021 13:07:45 +0000 +Subject: [PATCH 3/3] Support loading certificates from hardware token (PKCS#11) + +--- + src/event/ngx_event_openssl.c | 65 +++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index d762d6b..270b200 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -617,6 +617,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert, + X509 *x509, *temp; + u_long n; + ++ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) { ++ ++#ifndef OPENSSL_NO_ENGINE ++ ++ u_char *p, *last; ++ ENGINE *engine; ++ ++ p = cert->data + sizeof("engine:") - 1; ++ last = (u_char *) ngx_strchr(p, ':'); ++ ++ if (last == NULL) { ++ *err = "invalid syntax"; ++ return NULL; ++ } ++ ++ *last = '\0'; ++ ++ engine = ENGINE_by_id((char *) p); ++ ++ if (engine == NULL) { ++ *err = "ENGINE_by_id() failed"; ++ return NULL; ++ } ++ ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ *last++ = ':'; ++ ++ struct { ++ const char *cert_id; ++ X509 *cert; ++ } params = { (char *) last, NULL }; ++ ++ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) { ++ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ ENGINE_finish(engine); ++ ENGINE_free(engine); ++ ++ /* set chain to null */ ++ ++ *chain = sk_X509_new_null(); ++ if (*chain == NULL) { ++ *err = "sk_X509_new_null() failed"; ++ X509_free(params.cert); ++ return NULL; ++ } ++ ++ return params.cert; ++ ++#else ++ ++ *err = "loading \"engine:...\" certificate is not supported"; ++ return NULL; ++ ++#endif ++ } ++ + if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) { + + bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1, +-- +2.26.3 + diff --git a/SOURCES/nginx-1.14.1-perl-module-hardening.patch b/SOURCES/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch similarity index 54% rename from SOURCES/nginx-1.14.1-perl-module-hardening.patch rename to SOURCES/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch index 1915ebe..e59dd58 100644 --- a/SOURCES/nginx-1.14.1-perl-module-hardening.patch +++ b/SOURCES/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch @@ -1,3 +1,13 @@ +From 80c0ee172cceaef933ff5a451ec2a16213e03996 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 22 Sep 2021 15:55:39 +0200 +Subject: [PATCH] Set proper compiler optimalization level (O2) for perl + module. + +--- + src/http/modules/perl/Makefile.PL | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL index 7edadcb..2ebb7c4 100644 --- a/src/http/modules/perl/Makefile.PL @@ -11,3 +21,6 @@ index 7edadcb..2ebb7c4 100644 LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}", +-- +2.31.1 + diff --git a/SOURCES/nginx-1.16.0-pkcs11.patch b/SOURCES/0005-Init-openssl-engine-properly.patch similarity index 64% rename from SOURCES/nginx-1.16.0-pkcs11.patch rename to SOURCES/0005-Init-openssl-engine-properly.patch index b367d5b..99dc0a9 100644 --- a/SOURCES/nginx-1.16.0-pkcs11.patch +++ b/SOURCES/0005-Init-openssl-engine-properly.patch @@ -1,8 +1,17 @@ +From a769a35a6197c76390e1dd8f5054d426fbbbda05 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 22 Sep 2021 16:12:58 +0200 +Subject: [PATCH] Init openssl engine properly + +--- + src/event/ngx_event_openssl.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c -index 7be4fb4..ab3865a 100644 +index 270b200..f813458 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c -@@ -727,16 +727,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, +@@ -798,16 +798,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, return NULL; } @@ -27,3 +36,6 @@ index 7be4fb4..ab3865a 100644 ENGINE_free(engine); return pkey; +-- +2.31.1 + diff --git a/SOURCES/nginx-1.16.0-enable-tls1v3-by-default.patch b/SOURCES/0007-Enable-TLSv1.3-by-default.patch similarity index 72% rename from SOURCES/nginx-1.16.0-enable-tls1v3-by-default.patch rename to SOURCES/0007-Enable-TLSv1.3-by-default.patch index 553ea79..b1ef664 100644 --- a/SOURCES/nginx-1.16.0-enable-tls1v3-by-default.patch +++ b/SOURCES/0007-Enable-TLSv1.3-by-default.patch @@ -1,8 +1,8 @@ diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c -index 345914f..d23967f 100644 +index 948497c..c6dda52 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c -@@ -252,6 +252,8 @@ ngx_ssl_init(ngx_log_t *log) +@@ -266,6 +266,8 @@ ngx_ssl_init(ngx_log_t *log) ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) { @@ -11,7 +11,7 @@ index 345914f..d23967f 100644 ssl->ctx = SSL_CTX_new(SSLv23_method()); if (ssl->ctx == NULL) { -@@ -316,49 +318,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) +@@ -325,49 +327,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); @@ -63,21 +63,21 @@ index 345914f..d23967f 100644 + if (protocols & NGX_SSL_TLSv1) { + prot = TLS1_VERSION; + } -+ + +-#ifdef SSL_CTX_set_min_proto_version +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION); + if (prot == NGX_SSL_NO_PROT) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "No SSL protocols available [hint: ssl_protocols]"); + return NGX_ERROR; + } - --#ifdef SSL_CTX_set_min_proto_version -- SSL_CTX_set_min_proto_version(ssl->ctx, 0); -- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION); ++ + SSL_CTX_set_max_proto_version(ssl->ctx, prot); + + /* Now, we have to scan for minimal protocol version, + *without allowing holes between min and max*/ -+#if SSL_OP_NO_TLSv1_3 ++#ifdef SSL_OP_NO_TLSv1_3 + if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) { + prot = TLS1_2_VERSION; + } @@ -102,11 +102,11 @@ index 345914f..d23967f 100644 #ifdef SSL_OP_NO_COMPRESSION SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h -index 61da0c5..fa7ac41 100644 +index 41f4501..a346792 100644 --- a/src/event/ngx_event_openssl.h +++ b/src/event/ngx_event_openssl.h -@@ -145,6 +145,7 @@ typedef struct { - #endif +@@ -175,6 +175,7 @@ typedef struct { + } ngx_ssl_session_cache_t; +#define NGX_SSL_NO_PROT 0x0000 @@ -114,44 +114,50 @@ index 61da0c5..fa7ac41 100644 #define NGX_SSL_SSLv3 0x0004 #define NGX_SSL_TLSv1 0x0008 diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c -index b3f8f47..8340a12 100644 +index a147054..ad7e3fe 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c -@@ -613,8 +613,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) +@@ -646,10 +646,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) ngx_conf_merge_value(conf->early_data, prev->early_data, 0); + ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); - ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, -- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 -- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); -+ 0) +- ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET +- |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 +- |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ++ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0); ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, NGX_SSL_BUFSIZE); diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c -index 5544f75..3316a4b 100644 +index 728181d..066aef8 100644 --- a/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c -@@ -291,8 +291,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) +@@ -371,10 +371,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_value(conf->prefer_server_ciphers, prev->prefer_server_ciphers, 0); - ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, -- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 -- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); -+ 0); +- ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET +- |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 +- |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ++ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c -index ec9524e..37af046 100644 +index ba70547..a4c14ec 100644 --- a/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c -@@ -625,8 +625,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) +@@ -715,10 +715,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_value(conf->prefer_server_ciphers, prev->prefer_server_ciphers, 0); - ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, -- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 -- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); -+ 0); +- ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET +- |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 +- |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ++ ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); diff --git a/SOURCES/0008-add-ssl-pass-phrase-dialog.patch b/SOURCES/0008-add-ssl-pass-phrase-dialog.patch new file mode 100644 index 0000000..6e5986b --- /dev/null +++ b/SOURCES/0008-add-ssl-pass-phrase-dialog.patch @@ -0,0 +1,754 @@ +diff --git a/contrib/vim/syntax/nginx.vim b/contrib/vim/syntax/nginx.vim +index 7d587fc..15b21e2 100644 +--- a/contrib/vim/syntax/nginx.vim ++++ b/contrib/vim/syntax/nginx.vim +@@ -617,6 +617,7 @@ syn keyword ngxDirective contained ssl_ocsp + syn keyword ngxDirective contained ssl_ocsp_cache + syn keyword ngxDirective contained ssl_ocsp_responder + syn keyword ngxDirective contained ssl_password_file ++syn keyword ngxDirective contained ssl_pass_phrase_dialog + syn keyword ngxDirective contained ssl_prefer_server_ciphers + syn keyword ngxDirective contained ssl_preread + syn keyword ngxDirective contained ssl_protocols +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 104e8da..8cf777e 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -9,9 +9,8 @@ + #include + #include + +- + #define NGX_SSL_PASSWORD_BUFFER_SIZE 4096 +- ++#define NGX_PASS_PHRASE_ARG_MAX_LEN 255 + + typedef struct { + ngx_uint_t engine; /* unsigned engine:1; */ +@@ -20,8 +19,8 @@ typedef struct { + + static X509 *ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, + ngx_str_t *cert, STACK_OF(X509) **chain); +-static EVP_PKEY *ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, +- ngx_str_t *key, ngx_array_t *passwords); ++static EVP_PKEY *ngx_ssl_load_certificate_key(ngx_pool_t *pool, ++ char **err, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg); + static int ngx_ssl_password_callback(char *buf, int size, int rwflag, + void *userdata); + static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store); +@@ -88,6 +87,12 @@ static time_t ngx_ssl_parse_time( + #endif + ASN1_TIME *asn1time, ngx_log_t *log); + ++static int ngx_ssl_read_pstream(const char *cmd, char *buf, ++ ngx_int_t bufsize); ++ ++static int ngx_ssl_pass_phrase_callback(char *buf, int bufsize, ++ int rwflag, void *u); ++ + static void *ngx_openssl_create_conf(ngx_cycle_t *cycle); + static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf); + static void ngx_openssl_exit(ngx_cycle_t *cycle); +@@ -398,7 +403,7 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + + ngx_int_t + ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs, +- ngx_array_t *keys, ngx_array_t *passwords) ++ ngx_array_t *keys, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg) + { + ngx_str_t *cert, *key; + ngx_uint_t i; +@@ -408,7 +413,7 @@ ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs, + + for (i = 0; i < certs->nelts; i++) { + +- if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords) ++ if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords, dlg) + != NGX_OK) + { + return NGX_ERROR; +@@ -421,12 +426,13 @@ ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs, + + ngx_int_t + ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, +- ngx_str_t *key, ngx_array_t *passwords) ++ ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg) + { + char *err; + X509 *x509; + EVP_PKEY *pkey; + STACK_OF(X509) *chain; ++ EVP_PKEY *pubkey; + + x509 = ngx_ssl_load_certificate(cf->pool, &err, cert, &chain); + if (x509 == NULL) { +@@ -516,8 +522,19 @@ ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + } + #endif + +- pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords); +- if (pkey == NULL) { ++ pubkey = X509_get_pubkey(x509); ++ if (!pubkey){ ++ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, ++ "X509_get_pubkey() failed"); ++ return NGX_ERROR; ++ } ++ dlg->cryptosystem = EVP_PKEY_get_base_id(pubkey); ++ EVP_PKEY_free(pubkey); ++ ++ pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords, dlg); ++ if (ngx_test_config){ ++ return NGX_OK; ++ } else if (pkey == NULL) { + if (err != NULL) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "cannot load certificate key \"%s\": %s", +@@ -587,7 +604,7 @@ ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool, + + #endif + +- pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords); ++ pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords, NULL); + if (pkey == NULL) { + if (err != NULL) { + ngx_ssl_error(NGX_LOG_ERR, c->log, 0, +@@ -700,10 +717,81 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert, + return x509; + } + ++static int ++ngx_ssl_read_pstream(const char *cmd, char *buf, ngx_int_t bufsize) ++{ ++ FILE *fp; ++ ngx_int_t i; ++ char c; ++ ++ fp = popen(cmd, "r"); ++ if (fp == NULL) { ++ return -1; ++ } ++ ++ for (i = 0; (c = fgetc(fp)) != EOF && ++ (i < bufsize - 1); i++) { ++ ++ if (c == '\n' || c == '\r'){ ++ break; ++ } ++ ++ buf[i] = c; ++ } ++ buf[i] = '\0'; ++ ++ pclose(fp); ++ ++ return 0; ++} ++ ++static int ++ngx_ssl_pass_phrase_callback(char *buf, int bufsize, int rwflag, void *u) ++{ ++ u_char cmd[NGX_PASS_PHRASE_ARG_MAX_LEN + 1] = {0}; ++ u_char *cmd_end; ++ ngx_ssl_ppdialog_conf_t *dlg = (ngx_ssl_ppdialog_conf_t *)u; ++ ngx_str_t *pass_phrase_dialog = dlg->data; ++ char cryptosystem[4] = {0}; ++ int ret; ++ ++ /* remove exec: str from pass_phrase_dialog */ ++ pass_phrase_dialog->data = pass_phrase_dialog->data + 5; ++ pass_phrase_dialog->len = pass_phrase_dialog->len - 5; ++ ++ switch (dlg->cryptosystem){ ++ case EVP_PKEY_RSA: ++ strncpy(cryptosystem, "RSA", 4); ++ break; ++ case EVP_PKEY_DSA: ++ strncpy(cryptosystem, "DSA", 4); ++ break; ++ case EVP_PKEY_EC: ++ strncpy(cryptosystem, "EC", 3); ++ break; ++ case EVP_PKEY_DH: ++ strncpy(cryptosystem, "DH", 3); ++ break; ++ default: ++ strncpy(cryptosystem, "UNK", 4); ++ break; ++ } ++ ++ cmd_end = ngx_snprintf(cmd, NGX_PASS_PHRASE_ARG_MAX_LEN, "%V %V %s", ++ pass_phrase_dialog, dlg->server, cryptosystem); ++ *cmd_end = '\0'; ++ ++ ngx_log_stderr(0, "Executing external script: %s\n", cmd); ++ ++ if ((ret = ngx_ssl_read_pstream((char *)cmd, buf, bufsize)) != 0){ ++ return -1; ++ } ++ ++ return strlen(buf); ++} + + static EVP_PKEY * +-ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, +- ngx_str_t *key, ngx_array_t *passwords) ++ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg) + { + BIO *bio; + EVP_PKEY *pkey; +@@ -791,11 +879,26 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, + tries = 1; + pwd = NULL; + cb = NULL; ++ ++ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */ ++ if (dlg && ngx_strncasecmp(dlg->data->data, (u_char *)"exec:", 5) == 0){ ++ pwd = (void *)dlg; ++ cb = ngx_ssl_pass_phrase_callback; ++ } else { ++ pwd = NULL; ++ cb = NULL; ++ } + } + +- for ( ;; ) { ++ /* skip decrypting private keys in config test phase to avoid ++ asking for pass phase twice */ ++ if (ngx_test_config){ ++ return NULL; ++ } + ++ for ( ;; ) { + pkey = PEM_read_bio_PrivateKey(bio, NULL, cb, pwd); ++ + if (pkey != NULL) { + break; + } +diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h +index 860ea26..41f4501 100644 +--- a/src/event/ngx_event_openssl.h ++++ b/src/event/ngx_event_openssl.h +@@ -74,9 +74,19 @@ + #define ERR_peek_error_data(d, f) ERR_peek_error_line_data(NULL, NULL, d, f) + #endif + ++#define NGX_SSL_PASS_PHRASE_ARG_MAX_LEN 255 ++#define NGX_SSL_PASS_PHRASE_DEFAULT_VAL "builtin" ++#define NGX_SSL_SERVER_NULL "undefined" + + typedef struct ngx_ssl_ocsp_s ngx_ssl_ocsp_t; + ++typedef struct ngx_ssl_ppdialog_conf_s ngx_ssl_ppdialog_conf_t; ++ ++struct ngx_ssl_ppdialog_conf_s { ++ ngx_str_t *data; ++ ngx_str_t *server; ++ ngx_int_t cryptosystem; ++}; + + struct ngx_ssl_s { + SSL_CTX *ctx; +@@ -84,7 +94,6 @@ struct ngx_ssl_s { + size_t buffer_size; + }; + +- + struct ngx_ssl_connection_s { + ngx_ssl_conn_t *connection; + SSL_CTX *session_ctx; +@@ -184,9 +193,9 @@ ngx_int_t ngx_ssl_init(ngx_log_t *log); + ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data); + + ngx_int_t ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, +- ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords); ++ ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg); + ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +- ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); ++ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg); + ngx_int_t ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool, + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index dfe49c5..904263d 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -4983,7 +4983,7 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf) + if (ngx_ssl_certificate(cf, glcf->upstream.ssl, + &glcf->upstream.ssl_certificate->value, + &glcf->upstream.ssl_certificate_key->value, +- glcf->upstream.ssl_passwords) ++ glcf->upstream.ssl_passwords, NULL) + != NGX_OK) + { + return NGX_ERROR; +diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c +index 9cc202c..2c938d7 100644 +--- a/src/http/modules/ngx_http_proxy_module.c ++++ b/src/http/modules/ngx_http_proxy_module.c +@@ -5032,7 +5032,7 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf) + if (ngx_ssl_certificate(cf, plcf->upstream.ssl, + &plcf->upstream.ssl_certificate->value, + &plcf->upstream.ssl_certificate_key->value, +- plcf->upstream.ssl_passwords) ++ plcf->upstream.ssl_passwords, NULL) + != NGX_OK) + { + return NGX_ERROR; +diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c +index 4c4a598..a147054 100644 +--- a/src/http/modules/ngx_http_ssl_module.c ++++ b/src/http/modules/ngx_http_ssl_module.c +@@ -17,8 +17,9 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" + #define NGX_DEFAULT_ECDH_CURVE "auto" + +-#define NGX_HTTP_ALPN_PROTOS "\x08http/1.1\x08http/1.0\x08http/0.9" ++static ngx_str_t ngx_ssl_server_null = ngx_string(NGX_SSL_SERVER_NULL); + ++#define NGX_HTTP_ALPN_PROTOS "\x08http/1.1\x08http/1.0\x08http/0.9" + + #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation + static int ngx_http_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, +@@ -53,6 +54,9 @@ static char *ngx_http_ssl_conf_command_check(ngx_conf_t *cf, void *post, + + static ngx_int_t ngx_http_ssl_init(ngx_conf_t *cf); + ++static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, ++ void *conf); ++ + + static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = { + { ngx_string("SSLv2"), NGX_SSL_SSLv2 }, +@@ -296,6 +300,13 @@ static ngx_command_t ngx_http_ssl_commands[] = { + offsetof(ngx_http_ssl_srv_conf_t, reject_handshake), + NULL }, + ++ { ngx_string("ssl_pass_phrase_dialog"), ++ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, ++ ngx_conf_set_pass_phrase_dialog, ++ NGX_HTTP_SRV_CONF_OFFSET, ++ offsetof(ngx_http_ssl_srv_conf_t, pass_phrase_dialog), ++ NULL }, ++ + ngx_null_command + }; + +@@ -555,7 +566,7 @@ ngx_http_ssl_add_variables(ngx_conf_t *cf) + static void * + ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) + { +- ngx_http_ssl_srv_conf_t *sscf; ++ ngx_http_ssl_srv_conf_t *sscf; + + sscf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)); + if (sscf == NULL) { +@@ -577,6 +588,8 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf) + * sscf->ocsp_responder = { 0, NULL }; + * sscf->stapling_file = { 0, NULL }; + * sscf->stapling_responder = { 0, NULL }; ++ * sscf->pass_phrase_dialog = NULL; ++ * + */ + + sscf->enable = NGX_CONF_UNSET; +@@ -608,6 +621,8 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + { + ngx_http_ssl_srv_conf_t *prev = parent; + ngx_http_ssl_srv_conf_t *conf = child; ++ ngx_http_core_srv_conf_t *cscf; ++ ngx_ssl_ppdialog_conf_t dlg; + + ngx_pool_cleanup_t *cln; + +@@ -674,6 +689,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_str_value(conf->stapling_responder, + prev->stapling_responder, ""); + ++ ngx_conf_merge_str_value(conf->pass_phrase_dialog, ++ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL); ++ + conf->ssl.log = cf->log; + + if (conf->enable) { +@@ -736,6 +754,30 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + cln->handler = ngx_ssl_cleanup_ctx; + cln->data = &conf->ssl; + ++ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */ ++ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){ ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data); ++ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL, ++ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){ ++ ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog config directive accepts only the following " ++ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL); ++ ++ return NGX_CONF_ERROR; ++ } ++ ++ cscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_core_module); ++ ++ dlg.data = &conf->pass_phrase_dialog; ++ if (cscf->server_name.len != 0) { ++ dlg.server = &cscf->server_name; ++ } else { ++ dlg.server = &ngx_ssl_server_null; ++ } ++ ++ + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + + if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, +@@ -786,7 +828,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + /* configure certificates */ + + if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates, +- conf->certificate_keys, conf->passwords) ++ conf->certificate_keys, conf->passwords, &dlg) + != NGX_OK) + { + return NGX_CONF_ERROR; +@@ -1335,3 +1377,31 @@ ngx_http_ssl_init(ngx_conf_t *cf) + + return NGX_OK; + } ++ ++static char * ++ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) ++{ ++ ngx_http_ssl_srv_conf_t *sscf = conf; ++ ngx_str_t *value; ++ ++ if (sscf->pass_phrase_dialog.data){ ++ return "is duplicate"; ++ } ++ ++ value = cf->args->elts; ++ ++ sscf->pass_phrase_dialog = value[1]; ++ ++ if (sscf->pass_phrase_dialog.len == 0) { ++ return NGX_CONF_OK; ++ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) { ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d", ++ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN); ++ ++ return NGX_CONF_ERROR; ++ } ++ ++ return NGX_CONF_OK; ++} ++ +diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h +index 7ab0f7e..2f83d75 100644 +--- a/src/http/modules/ngx_http_ssl_module.h ++++ b/src/http/modules/ngx_http_ssl_module.h +@@ -67,6 +67,8 @@ typedef struct { + + u_char *file; + ngx_uint_t line; ++ ++ ngx_str_t pass_phrase_dialog; + } ngx_http_ssl_srv_conf_t; + + +diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c +index e4f721b..61efa99 100644 +--- a/src/http/modules/ngx_http_uwsgi_module.c ++++ b/src/http/modules/ngx_http_uwsgi_module.c +@@ -2564,7 +2564,7 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf) + if (ngx_ssl_certificate(cf, uwcf->upstream.ssl, + &uwcf->upstream.ssl_certificate->value, + &uwcf->upstream.ssl_certificate_key->value, +- uwcf->upstream.ssl_passwords) ++ uwcf->upstream.ssl_passwords, NULL) + != NGX_OK) + { + return NGX_ERROR; +diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c +index 28737ac..728181d 100644 +--- a/src/mail/ngx_mail_ssl_module.c ++++ b/src/mail/ngx_mail_ssl_module.c +@@ -13,6 +13,7 @@ + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" + #define NGX_DEFAULT_ECDH_CURVE "auto" + ++static ngx_str_t ngx_ssl_server_null = ngx_string(NGX_SSL_SERVER_NULL); + + #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation + static int ngx_mail_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn, +@@ -35,6 +36,8 @@ static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd, + static char *ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post, + void *data); + ++static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, ++ void *conf); + + static ngx_conf_enum_t ngx_mail_starttls_state[] = { + { ngx_string("off"), NGX_MAIL_STARTTLS_OFF }, +@@ -216,6 +219,13 @@ static ngx_command_t ngx_mail_ssl_commands[] = { + offsetof(ngx_mail_ssl_conf_t, conf_commands), + &ngx_mail_ssl_conf_command_post }, + ++ { ngx_string("ssl_pass_phrase_dialog"), ++ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, ++ ngx_conf_set_pass_phrase_dialog, ++ NGX_MAIL_SRV_CONF_OFFSET, ++ offsetof(ngx_mail_ssl_conf_t, pass_phrase_dialog), ++ NULL }, ++ + ngx_null_command + }; + +@@ -345,6 +355,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + { + ngx_mail_ssl_conf_t *prev = parent; + ngx_mail_ssl_conf_t *conf = child; ++ ngx_mail_core_srv_conf_t *cscf; ++ ngx_ssl_ppdialog_conf_t dlg; + + char *mode; + ngx_pool_cleanup_t *cln; +@@ -388,6 +400,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + + ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL); + ++ ngx_conf_merge_str_value(conf->pass_phrase_dialog, ++ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL); + + conf->ssl.log = cf->log; + +@@ -449,6 +463,29 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + cln->handler = ngx_ssl_cleanup_ctx; + cln->data = &conf->ssl; + ++ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */ ++ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){ ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data); ++ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL, ++ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){ ++ ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog config directive accepts only the following " ++ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL); ++ ++ return NGX_CONF_ERROR; ++ } ++ ++ cscf = ngx_mail_conf_get_module_srv_conf(cf, ngx_mail_core_module); ++ ++ dlg.data = &conf->pass_phrase_dialog; ++ if (cscf->server_name.len != 0) { ++ dlg.server = &cscf->server_name; ++ } else { ++ dlg.server = &ngx_ssl_server_null; ++ } ++ + #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation + SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_mail_ssl_alpn_select, NULL); + #endif +@@ -461,7 +498,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + } + + if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates, +- conf->certificate_keys, conf->passwords) ++ conf->certificate_keys, conf->passwords, &dlg) + != NGX_OK) + { + return NGX_CONF_ERROR; +@@ -745,3 +782,32 @@ ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data) + return NGX_CONF_OK; + #endif + } ++ ++static char * ++ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) ++{ ++ ngx_mail_ssl_conf_t *sscf = conf; ++ ngx_str_t *value; ++ ++ if (sscf->pass_phrase_dialog.data){ ++ return "is duplicate"; ++ } ++ ++ value = cf->args->elts; ++ ++ sscf->pass_phrase_dialog = value[1]; ++ ++ if (sscf->pass_phrase_dialog.len == 0) { ++ return NGX_CONF_OK; ++ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) { ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d", ++ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN); ++ ++ return NGX_CONF_ERROR; ++ } ++ ++ return NGX_CONF_OK; ++} ++ ++ +diff --git a/src/mail/ngx_mail_ssl_module.h b/src/mail/ngx_mail_ssl_module.h +index a0a6113..3d87d50 100644 +--- a/src/mail/ngx_mail_ssl_module.h ++++ b/src/mail/ngx_mail_ssl_module.h +@@ -57,6 +57,8 @@ typedef struct { + + u_char *file; + ngx_uint_t line; ++ ++ ngx_str_t pass_phrase_dialog; + } ngx_mail_ssl_conf_t; + + +diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c +index ed275c0..1747aed 100644 +--- a/src/stream/ngx_stream_proxy_module.c ++++ b/src/stream/ngx_stream_proxy_module.c +@@ -2305,7 +2305,7 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf) + if (ngx_ssl_certificate(cf, pscf->ssl, + &pscf->ssl_certificate->value, + &pscf->ssl_certificate_key->value, +- pscf->ssl_passwords) ++ pscf->ssl_passwords, NULL) + != NGX_OK) + { + return NGX_ERROR; +diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c +index 1ba1825..ba70547 100644 +--- a/src/stream/ngx_stream_ssl_module.c ++++ b/src/stream/ngx_stream_ssl_module.c +@@ -17,6 +17,8 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" + #define NGX_DEFAULT_ECDH_CURVE "auto" + ++#define NGX_SSL_STREAM_NAME "NGX_STREAM_SSL_MODULE" ++static ngx_str_t ngx_ssl_stream_default_name = ngx_string(NGX_SSL_STREAM_NAME); + + static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s); + static ngx_int_t ngx_stream_ssl_init_connection(ngx_ssl_t *ssl, +@@ -57,6 +59,9 @@ static char *ngx_stream_ssl_alpn(ngx_conf_t *cf, ngx_command_t *cmd, + static char *ngx_stream_ssl_conf_command_check(ngx_conf_t *cf, void *post, + void *data); + ++static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, ++ void *conf); ++ + static ngx_int_t ngx_stream_ssl_init(ngx_conf_t *cf); + + +@@ -226,6 +231,13 @@ static ngx_command_t ngx_stream_ssl_commands[] = { + 0, + NULL }, + ++ { ngx_string("ssl_pass_phrase_dialog"), ++ NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1, ++ ngx_conf_set_pass_phrase_dialog, ++ NGX_STREAM_SRV_CONF_OFFSET, ++ offsetof(ngx_stream_ssl_conf_t, pass_phrase_dialog), ++ NULL }, ++ + ngx_null_command + }; + +@@ -690,6 +702,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + { + ngx_stream_ssl_conf_t *prev = parent; + ngx_stream_ssl_conf_t *conf = child; ++ ngx_ssl_ppdialog_conf_t dlg; + + ngx_pool_cleanup_t *cln; + +@@ -732,6 +745,8 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + + ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL); + ++ ngx_conf_merge_str_value(conf->pass_phrase_dialog, ++ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL); + + conf->ssl.log = cf->log; + +@@ -779,6 +794,23 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + cln->handler = ngx_ssl_cleanup_ctx; + cln->data = &conf->ssl; + ++ /** directive format: ssl_pass_phrase_dialog buildin|exec:filepath */ ++ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){ ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data); ++ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL, ++ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){ ++ ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog config directive accepts only the following " ++ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL); ++ ++ return NGX_CONF_ERROR; ++ } ++ ++ dlg.data = &conf->pass_phrase_dialog; ++ dlg.server = &ngx_ssl_stream_default_name; ++ + #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx, + ngx_stream_ssl_servername); +@@ -823,7 +855,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + /* configure certificates */ + + if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates, +- conf->certificate_keys, conf->passwords) ++ conf->certificate_keys, conf->passwords, &dlg) + != NGX_OK) + { + return NGX_CONF_ERROR; +@@ -1209,3 +1241,31 @@ ngx_stream_ssl_init(ngx_conf_t *cf) + + return NGX_OK; + } ++ ++static char * ++ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) ++{ ++ ngx_stream_ssl_conf_t *sscf = conf; ++ ngx_str_t *value; ++ ++ if (sscf->pass_phrase_dialog.data){ ++ return "is duplicate"; ++ } ++ ++ value = cf->args->elts; ++ ++ sscf->pass_phrase_dialog = value[1]; ++ ++ if (sscf->pass_phrase_dialog.len == 0) { ++ return NGX_CONF_OK; ++ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) { ++ ngx_log_error(NGX_LOG_EMERG, cf->log, 0, ++ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d", ++ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN); ++ ++ return NGX_CONF_ERROR; ++ } ++ ++ return NGX_CONF_OK; ++} ++ +diff --git a/src/stream/ngx_stream_ssl_module.h b/src/stream/ngx_stream_ssl_module.h +index e7c825e..d80daa4 100644 +--- a/src/stream/ngx_stream_ssl_module.h ++++ b/src/stream/ngx_stream_ssl_module.h +@@ -56,6 +56,8 @@ typedef struct { + + u_char *file; + ngx_uint_t line; ++ ++ ngx_str_t pass_phrase_dialog; + } ngx_stream_ssl_conf_t; + + diff --git a/SOURCES/0009-CVE-2023-44487-HTTP-2-per-iteration-stream-handling.patch b/SOURCES/0009-CVE-2023-44487-HTTP-2-per-iteration-stream-handling.patch new file mode 100644 index 0000000..a73a597 --- /dev/null +++ b/SOURCES/0009-CVE-2023-44487-HTTP-2-per-iteration-stream-handling.patch @@ -0,0 +1,76 @@ +From b6aa9504cdfb6391d895dcbddc87b9260ea6968c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 11 Oct 2023 09:59:23 +0200 +Subject: [PATCH] CVE-2023-44487 - HTTP/2: per-iteration stream handling limit. + +To ensure that attempts to flood servers with many streams are detected +early, a limit of no more than 2 * max_concurrent_streams new streams per one +event loop iteration was introduced. This limit is applied even if +max_concurrent_streams is not yet reached - for example, if corresponding +streams are handled synchronously or reset. + +Further, refused streams are now limited to maximum of max_concurrent_streams +and 100, similarly to priority_limit initial value, providing some tolerance +to clients trying to open several streams at the connection start, yet +low tolerance to flooding attempts. +--- + src/http/v2/ngx_http_v2.c | 15 +++++++++++++++ + src/http/v2/ngx_http_v2.h | 2 ++ + 2 files changed, 17 insertions(+) + +diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c +index 3611a2e..291677a 100644 +--- a/src/http/v2/ngx_http_v2.c ++++ b/src/http/v2/ngx_http_v2.c +@@ -361,6 +361,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev) + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler"); + + h2c->blocked = 1; ++ h2c->new_streams = 0; + + if (c->close) { + c->close = 0; +@@ -1320,6 +1321,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos, + goto rst_stream; + } + ++ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) { ++ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, ++ "client sent too many streams at once"); ++ ++ status = NGX_HTTP_V2_REFUSED_STREAM; ++ goto rst_stream; ++ } ++ + if (!h2c->settings_ack + && !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG) + && h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW) +@@ -1385,6 +1394,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos, + + rst_stream: + ++ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) { ++ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, ++ "client sent too many refused streams"); ++ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR); ++ } ++ + if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) { + return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR); + } +diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h +index 3492297..6a7aaa6 100644 +--- a/src/http/v2/ngx_http_v2.h ++++ b/src/http/v2/ngx_http_v2.h +@@ -125,6 +125,8 @@ struct ngx_http_v2_connection_s { + ngx_uint_t processing; + ngx_uint_t frames; + ngx_uint_t idle; ++ ngx_uint_t new_streams; ++ ngx_uint_t refused_streams; + ngx_uint_t priority_limit; + + ngx_uint_t pushing; +-- +2.31.1 + diff --git a/SOURCES/README.dynamic b/SOURCES/README.dynamic index 59f03f6..5758858 100644 --- a/SOURCES/README.dynamic +++ b/SOURCES/README.dynamic @@ -16,5 +16,5 @@ Prevent dynamic modules from being enabled automatically You may want to avoid dynamic modules being enabled automatically. Simply remove this line from the top of /etc/nginx/nginx.conf: - include /usr/lib64/nginx/modules/*.conf; + include /usr/share/nginx/modules/*.conf; diff --git a/SOURCES/index.html b/SOURCES/index.html deleted file mode 100644 index 7756222..0000000 --- a/SOURCES/index.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux - - - - - -

Welcome to nginx on Red Hat Enterprise Linux!

- -
-

This page is used to test the proper operation of the - nginx HTTP server after it has been - installed. If you can read this page, it means that the - web server installed at this site is working - properly.

- -
-

Website Administrator

-
-

This is the default index.html page that - is distributed with nginx on - Red Hat Enterprise Linux. It is located in - /usr/share/nginx/html.

- -

You should now put your content in a location of - your choice and edit the root configuration - directive in the nginx - configuration file - /etc/nginx/nginx.conf.

- -

For information on Red Hat Enterprise Linux, please visit the Red Hat, Inc. website. The documentation for Red Hat Enterprise Linux is available on the Red Hat, Inc. website.

- -
-
- -
- [ Powered by nginx ] - [ Powered by Red Hat Enterprise Linux ] -
-
- - diff --git a/SOURCES/macros.nginxmods.in b/SOURCES/macros.nginxmods.in new file mode 100644 index 0000000..9b612b2 --- /dev/null +++ b/SOURCES/macros.nginxmods.in @@ -0,0 +1,20 @@ +%_nginx_abiversion @@NGINX_ABIVERSION@@ +%_nginx_srcdir @@NGINX_SRCDIR@@ +%_nginx_buildsrcdir nginx-src +%_nginx_modsrcdir .. +%_nginx_modbuilddir ../%{_vpath_builddir} +%nginx_moddir @@NGINX_MODDIR@@ +%nginx_modconfdir @@NGINX_MODCONFDIR@@ + +%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion} + +%nginx_modconfigure(:-:) \\\ + %undefine _strict_symbol_defs_build \ + cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \ + cd "%{_nginx_buildsrcdir}" \ + nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \ + ./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\ + --add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \ + cd - + +%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} %{_make_verbose} modules diff --git a/SOURCES/maxim.key b/SOURCES/maxim.key new file mode 100644 index 0000000..479efbe --- /dev/null +++ b/SOURCES/maxim.key @@ -0,0 +1,69 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF4TqFoBEADNbls05thIAYVVKdMDRdtzGk7HXGqx60u/kh4BL9HskUpyYFTp +N07RJ1TyyusfD7I3skuGHvtQhqdTwHPDEPL5qrAnHps9XWUQrtU7hflcIKt43iDe +TvfVVhN0nPir2++C4qvNnrC/UCisyz00H/I9mobl2qzyKyLT8BnUBVuXDfOTlUCY +oF4z5BieOMvg1DZNKFDnK67ZuO4JXgtMlu4Q3tFd7qSWCWGuCuAGgn6eWFYMzCbB +rPyBYwb7xyycQzqmJiD7Qm9OeVHmZj5rG5hGM14MyTSUVJle0U+CJCF9lmfVuR/c +ySy7WmQgIg327x5Y5xa3pKZAvIAycnDabAk/08p59BG7UdAi2S7+2SicAH89/81V +g4BI4mZp+IuxaP+S+ckaRf1CUvRAJuLTqUeBSuOzjag+ibD6rqusuZ1MZqLxnXyu +gAztNDcmEFa/pqp5bgWbrlTF6zKt4cQf+a/JqFGatsfSzmrIyIZ6GEqgb8oXDDIt +Z1AqsTfp6ZBC1vITE9+b0zBw6qq/nGD0Iq47Vp1VxmlxmnoeR4ir8z/oSukPulLU +K3IqkmRNGEilINrtBt5jFbBlx8kwdCYvxEF6ymibBBqvwwv65jrrKheBQm+HrrVS +aMQmo4Qzj/h/ZLL9KENHibNwUypJnvwEvw0YkAyjICvoNzDUsM+92+B/ewARAQAB +tCFNYXhpbSBLb25vdmFsb3YgPG1heGltQG5naW54LmNvbT6JAlcEEwEKAEECGwMF +CwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEWIQRB25JxPTv0v/PukQacXn+i9Ul3 +1AUCXhgw1wUJBagi/QAKCRCcXn+i9Ul31LltD/40KNFPvDaORz35udrm0cyVIgbI +lq7Vswfo5JIr8MyJ+VKJFQ2n2JiQT8QbX52Sy5P80ktSAFqcT3vtWB7bI6RfJ8Jx +YM/w3XKnNMoUt7Q/cqZK5Ra/csmaCWqP4UVUvUBjHvly0MpnE1kxEDUglrcyVKjt +fxB/GXeUpKOELXG44zvW2CP9Mce0FbDxrh8iCai9MK+2oSt1aJV+gONLWscRgsc7 +6q9/4KUXByt0qxScYPRQRIaxpIA8sCno21owcMOf8aQtun6Ytf+UIovl9DmK2pRm +Ifc2JruW1Jx2r7z955ZFNgTA380jEL85dWbgbHF/pYPlwcTCnaAf294kefjrX9DN +rejbZZ3Fh2QGs0tWW5+wncVWndq4jLQTeamUdzw5MPpOh+bZoHT+7z1PDGWe+PIn +DTbfaFYL7MsXwScMUsexKLOoDO6KKpZjcsw9/b5JsJmP73ZEj02BjRudapObiRxm +MtDl8Zmpg7ZUqMHEuUzyEyI5nSWu4njjrWJO0CnsjLpv2UxAbxDn1NGc/DoyxM1l +4SQv4AJuSLo1x7PTRb9V9HkWqxXf+yCkNpV9UjmlrH104gWL6sof6rX8Jo6k+Sz+ +yyQHcVbrJ95Y3hQU7QMMnotzVbL7BRtWMtDYTp7q+gYbZ0s+YRXjaHcA5IuV65tM +tEPwGpOCofQ2avkdqIhdBBARCgAdFiEEZVBsAu/CUPG3o9aU7PDpCywXIIMFAl4T +qXUACgkQ7PDpCywXIIN5CQCgyNFrUBGlUvH9QlDSE/umzoyXW/UAn0ve2/HzpMVN +uPMAAgnHYE2R0eiEtCNNYXhpbSBLb25vdmFsb3YgPG1heGltQEZyZWVCU0Qub3Jn +PokCVAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBEHbknE9O/S/ +8+6RBpxef6L1SXfUBQJeGDDXBQkFqCL9AAoJEJxef6L1SXfUJ/IQALtwaB7mlBUB +NdzqQRIZAVSnJZ2w6+Iul7Ax4gKrqWj6SvL/5jEdZm65D0kjxJIHq+dO+lJIMLzp +rBkfZ0kkxOPQ1rw/QR31qHLAibknrwIQQVtzFvVg4iW7IZefx6WGbJJC5IbjBUBf +HATqbXmMAcLILh9+t4q7Qvwi2b8ZIsC37cktthad7j4kvXqV5BJ4I+PoDT0CcW48 +wgTfMwhib52pLMu3Ghk56kwHBtYSHUDrA4KWRzRHxQ+RoUXLIdtmMRbp8ztwBMJZ ++J/9TLrb3YHUidS3l2nE55l9dJZycCU2EOAhJMbFKbmfW/9we/Sm+vnoALGExepl +FgdGz2NTqPA4ha2y2rBC73TSkfM+4amIrr6kSbeofjQL/w5+fhxAvM5oXuzffPK9 +8IR31d66JUTjeueobguzh9ApeHElmihimRJk0KP+NVAMNCIZmlMuOXHPwnCajcBh +Sh9kFGy6tPPPZYQOHSm5KvyjIJDfmkFfJ5ybazkmsGhZMzQs4ZHItC1jf0vYCqsr +d3eVEQesy5nDlSC2lWK84R+J+qTL82ZbCc/VZMniCBCC9xIvEOU9gtIH+58vF8dq +l/jTmGp2h1/kHlJfn0cnxKJDzn2IG16jqR7VdWQEO5hjEMaZdxhM1jPGRdkM82fB +Wwv8BLBpgBstyQlxJ/NNO5+dCtZYWRcviF0EEBEKAB0WIQRlUGwC78JQ8bej1pTs +8OkLLBcggwUCXhOpbwAKCRDs8OkLLBcgg/jfAKCO7DIiB2DGBfLCFftmyuZJN2A6 +ZgCfV/cclX++mLyiyYqr2BXnrQk4NVG5Ag0EXhOoWgEQAOmkirptbymUR2JP9DrP +e7aELbUw4bcMx4/nQo1QyKxjDhUdgUui4OiqxmhMjT2IlgFvcYsMeLiYGa/EdBkd +Yq4DtEwc++2eybFQA1z6Hrk+sxdd8neN4azUa5sqVvUwenQ7UMPclSQJaE1nVGCZ +KKVyNsK36RJrE0JfdmE1zKZFWmTCTZ/D/hTCq+hjMpCV+VWFaz3h4S+XsZiBgLB4 ++zmyHjyU6E+ecELvAHoXwMbAPiFzzms824Fc1BKHjnc8BBzfUVdIBGhxOVNHDSj3 +oxPsiBnuvSlQMlGx0YNLw/tTfw+CFOot5o/KIq9svUp8W9mdj6kKaqBLNxpjHbhQ +yvVSK7O5uS62emMHkRwgu1tmP98d3bGlXRn+S+2MCuyqdFaK40B6vnkPnXpl5ggE +w8JoH11ahNeJ5tX8/JpX/0aQmapt7CKwcgELJap+Qp8i/MFXef7FK/nE0lFIL95o +l9uthd/beX6dz/EEw61lC17Opd3y0N+Dy+eJ0wbULdgKrblZ0PxsumLeICGLs7/P +O9/3nQHJRjmFaVG10t5bL/77gvQ4l7HcuLS1GGHh+RM6EsFuuiqI+aFcDFyRITli +g0QRq4y/C6nqhTWEyYriIi8Dq6JxXisklC1WvSIgPwq1/msmrbiKcJZFPoNtMVtO +dzL3naM5IWOa290R541GjkEVABEBAAGJAjwEGAEKACYCGwwWIQRB25JxPTv0v/Pu +kQacXn+i9Ul31AUCXhgw/QUJBagjIwAKCRCcXn+i9Ul31MQDEACeO6ZBLEWswuyU +RErntoHkY6wIkpfMiERjgfqbNkrdBgXg8dT7kPsXFEtv3ZccjPbsRecJaXdmwGab +mp9MUDYG3SiqgFNriJTv2WECzgYKrZQg38JVwfl7OHPaV2fwZvG56a4qKpIZ3wIg +4acfEPkHQ2ygpKnEJD4IsEK225PtYq5lmNfntvDhbuTPh2vY8T9w0udGCzp4JS60 +zLeGGat+52PislEtrSa2B7zSMzGmOqDidaDbEfzdzL+IteZHWDGmYNQ8yICIv6Wj +A80k7uhzDWJf5RMQSNybBykrlWSooaVrBWHgDky5ldAQjDtVrMkBpzglH8FQ44i+ +la9caRDfw0Lfxg52vV4eXtpSHAYx3cFREEW9xpTOwOE7Qg0JyHAkUKNb8DJgyehC +BjSeeiMFiZX1plyYFrUAB8dVXi9Z7kqOjTpfYU6kAxDXzQhlqqgYRwoFJQcsQ1Ll +jKptAs6glmDx8dJcjUrK/eH24GGg46eGv2wxY4+sItXfLQ2oeU4uh/vORjvgeeNp +er4z5KLuKxwgpaobavtRZmZSZdGrdC93Si27dpSRiWYn1csoTxG0zZhUVFFW68I4 +I5PIdJwblvxayVKdg0aVW/RwDsOLH0twVxwnOPSjLPEB2IwGnlX6rN38cRnibPXM +yh4LsaVRdhbFe9aNd/O5iNgDcQtCUg== +=/pFc +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SOURCES/mdounin.key b/SOURCES/mdounin.key new file mode 100644 index 0000000..bbf2ca1 --- /dev/null +++ b/SOURCES/mdounin.key @@ -0,0 +1,33 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (FreeBSD) + +mQENBE7SKu8BCADQo6x4ZQfAcPlJMLmL8zBEBUS6GyKMMMDtrTh3Yaq481HB54oR +0cpKL05Ff9upjrIzLD5TJUCzYYM9GQOhguDUP8+ZU9JpSz3yO2TvH7WBbUZ8FADf +hblmmUBLNgOWgLo3W+FYhl3mz1GFS2Fvid6Tfn02L8CBAj7jxbjL1Qj/OA/WmLLc +m6BMTqI7IBlYW2vyIOIHasISGiAwZfp0ucMeXXvTtt14LGa8qXVcFnJTdwbf03AS +ljhYrQnKnpl3VpDAoQt8C68YCwjaNJW59hKqWB+XeIJ9CW98+EOAxLAFszSyGanp +rCqPd0numj9TIddjcRkTA/ZbmCWK+xjpVBGXABEBAAG0IU1heGltIERvdW5pbiA8 +bWRvdW5pbkBtZG91bmluLnJ1PokBOAQTAQIAIgUCTtIq7wIbAwYLCQgHAwIGFQgC +CQoLBBYCAwECHgECF4AACgkQUgqZk6HAUvj+iwf/b4FS6zVzJ5T0v1vcQGD4ZzXe +D5xMC4BJW414wVMU15rfX7aCdtoCYBNiApPxEd7SwiyxWRhRA9bikUq87JEgmnyV +0iYbHZvCvc1jOkx4WR7E45t1Mi29KBoPaFXA9X5adZkYcOQLDxa2Z8m6LGXnlF6N +tJkxQ8APrjZsdrbDvo3HxU9muPcq49ydzhgwfLwpUs11LYkwB0An9WRPuv3jporZ +/XgI6RfPMZ5NIx+FRRCjn6DnfHboY9rNF6NzrOReJRBhXCi6I+KkHHEnMoyg8XET +9lVkfHTOl81aIZqrAloX3/00TkYWyM2zO9oYpOg6eUFCX/Lw4MJZsTcT5EKVxIhG +BBARAgAGBQJO01Y/AAoJEOzw6QssFyCDVyQAn3qwTZlcZgyyzWu9Cs8gJ0CXREaS +AJ92QjGLT9DijTcbB+q9OS/nl16Z/IhGBBARAgAGBQJO02JDAAoJEKk3YTmlJMU+ +P64AnjCKEXFelSVMtgefJk3+vpyt3QX1AKCH9M3MbTWPeDUL+MpULlfdyfvjj7kB +DQRO0irvAQgA0LjCc8S6oZzjiap2MjRNhRFA5BYjXZRZBdKF2VP74avt2/RELq8G +W0n7JWmKn6vvrXabEGLyfkCngAhTq9tJ/K7LPx/bmlO5+jboO/1inH2BTtLiHjAX +vicXZk3oaZt2Sotx5mMI3yzpFQRVqZXsi0LpUTPJEh3oS8IdYRjslQh1A7P5hfCZ +wtzwb/hKm8upODe/ITUMuXeWfLuQj/uEU6wMzmfMHb+jlYMWtb+v98aJa2FODeKP +mWCXLa7bliXp1SSeBOEfIgEAmjM6QGlDx5sZhr2Ss2xSPRdZ8DqD7oiRVzmstX1Y +oxEzC0yXfaefC7SgM0nMnaTvYEOYJ9CH3wARAQABiQEfBBgBAgAJBQJO0irvAhsM +AAoJEFIKmZOhwFL4844H/jo8icCcS6eOWvnen7lg0FcCo1fIm4wW3tEmkQdchSHE +CJDq7pgTloN65pwB5tBoT47cyYNZA9eTfJVgRc74q5cexKOYrMC3KuAqWbwqXhkV +s0nkWxnOIidTHSXvBZfDFA4Idwte94Thrzf8Pn8UESudTiqrWoCBXk2UyVsl03gJ +blSJAeJGYPPeo+Yj6m63OWe2+/S2VTgmbPS/RObn0Aeg7yuff0n5+ytEt2KL51gO +QE2uIxTCawHr12PsllPkbqPk/PagIttfEJqn9b0CrqPC3HREePb2aMJ/Ctw/76CO +wn0mtXeIXLCTvBmznXfaMKllsqbsy2nCJ2P2uJjOntw= +=Tavt +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SOURCES/nginx-1.14.0-logs-perm.patch b/SOURCES/nginx-1.14.0-logs-perm.patch deleted file mode 100644 index 4884a84..0000000 --- a/SOURCES/nginx-1.14.0-logs-perm.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c -index aee7a58..bcceecb 100644 ---- a/src/core/ngx_cycle.c -+++ b/src/core/ngx_cycle.c -@@ -1108,7 +1108,7 @@ ngx_reopen_files(ngx_cycle_t *cycle, ngx_uid_t user) - } - - fd = ngx_open_file(file[i].name.data, NGX_FILE_APPEND, -- NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS); -+ NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS | 0220); - - ngx_log_debug3(NGX_LOG_DEBUG_EVENT, cycle->log, 0, - "reopen file \"%s\", old:%d new:%d", diff --git a/SOURCES/nginx-1.24.0.tar.gz.asc b/SOURCES/nginx-1.24.0.tar.gz.asc new file mode 100644 index 0000000..628ca93 --- /dev/null +++ b/SOURCES/nginx-1.24.0.tar.gz.asc @@ -0,0 +1,14 @@ +-----BEGIN PGP SIGNATURE----- + +iQHEBAABCAAuFiEEE8gqY7YDV2FW4wpOoOqYG2aw2WcFAmQ1hQ8QHGsucGF2bG92 +QGY1LmNvbQAKCRCg6pgbZrDZZ100C/9v9Gomc7MYxu+i8gQP0DxEp9oj2y6zNboa +jpR0TgfThqhxc2KNtziYuuQn81LohQ26C0mDoYbBTgRw5ZZDyzBPczC2gphvipIG +oaDE9jbEpscH22gEf7FBSva8M3zvg/jrUsLT53KR2wJt2bjl6oTUMRjaftulr3Ow +4mfYDZvU4lzaAbjQAI7WZnMAxCStJrIr8m0NiuSgcQoDVqbEYDXPhoSsE6+uR1iz +LSJIVepK4PhyHgLiWkejndnX7nNAwUv0rZMijlf1FsGZX25wXYXF4bUIHwLtH0F0 +e5Yd4DvNWoMrKqtgTF4mgBoIVfsF99jyjWW13A5V9+plye1xgVD0xRt06KpX9b9v +YTuZxrYHWKQYCIhDYhMeksVWNzVFy5O+cTZKFpMDUkYhB7+fvRRfo6TU9tymSUgS +sPFM4tD2HXXzclvLPzhpDlOBLlTQMVf9UFxjIeeZ8ZtVDvVB5f61qRJG/x4vMK4j +Fc0mDIIm+9mXqqMOA+7v6IB9UaJsStI= +=/CwQ +-----END PGP SIGNATURE----- diff --git a/SOURCES/nginx-auto-cc-gcc.patch b/SOURCES/nginx-auto-cc-gcc.patch deleted file mode 100644 index ff693dc..0000000 --- a/SOURCES/nginx-auto-cc-gcc.patch +++ /dev/null @@ -1,13 +0,0 @@ ---- auto/cc/gcc.orig 2007-03-22 08:34:53.000000000 -0600 -+++ auto/cc/gcc 2007-03-22 08:58:47.000000000 -0600 -@@ -172,7 +172,9 @@ - - - # stop on warning --CFLAGS="$CFLAGS -Werror" -+# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx -+# to not compile. -+#CFLAGS="$CFLAGS -Werror" - - # debug - CFLAGS="$CFLAGS -g" diff --git a/SOURCES/nginx-logo.png b/SOURCES/nginx-logo.png deleted file mode 100644 index 638b4995def7c1b20d134b658b7329df6769085e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 368 zcmeAS@N?(olHy`uVBq!ia0vp^l|Zb($P6TTwz`@EDYgKg5Lbqo4FCWCuRMQi4^V`u zB*-uLKf}}Q23|lOW0JSK3*&z#-FrX|XMsm#F_88EW4Dvpb|AsB0>^Y94K|u#P4&@5 zK+XeC7sn8d^J^~}W*spQV7-vPWkH&wxWK$_osXeK6Il6wB)u!@t!LR;Z1`jOgl#vL za0mW$xHRAX!tcUAjC`@)hl^x(*@@L!t}r;{;cA-8w@%+8JFuvL^LC)e)>-SHEZEyn z-1R1b^Y#?aw`OyX9{j^(p8qU?>+~&;gWt{{J(zibRXL2^_L)*=;bu0=9ro69%B|Hc zPq>@1-(2N7sd;S}vxgnqobNjml)gXTA+()O?(s$LX|@xCd-7Z7DIeufdw;RG=fy4S zDH4Y}Yiqg<_eHg/dev/null` 2>/dev/null || true diff --git a/SOURCES/nginx.service b/SOURCES/nginx.service index 8597eb4..b8e73a5 100644 --- a/SOURCES/nginx.service +++ b/SOURCES/nginx.service @@ -1,6 +1,7 @@ [Unit] Description=The nginx HTTP and reverse proxy server -After=network.target remote-fs.target nss-lookup.target +After=network-online.target remote-fs.target nss-lookup.target +Wants=network-online.target [Service] Type=forking @@ -11,7 +12,7 @@ PIDFile=/run/nginx.pid ExecStartPre=/usr/bin/rm -f /run/nginx.pid ExecStartPre=/usr/sbin/nginx -t ExecStart=/usr/sbin/nginx -ExecReload=/bin/kill -s HUP $MAINPID +ExecReload=/usr/sbin/nginx -s reload KillSignal=SIGQUIT TimeoutStopSec=5 KillMode=mixed diff --git a/SOURCES/nginxmods.attr b/SOURCES/nginxmods.attr new file mode 100644 index 0000000..102da1a --- /dev/null +++ b/SOURCES/nginxmods.attr @@ -0,0 +1,14 @@ +%__nginxmods_requires() %{lua: + -- Match buildroot paths of the form + -- /PATH/OF/BUILDROOT/usr/lib/nginx/modules/ and + -- /PATH/OF/BUILDROOT/usr/lib64/nginx/modules/ + -- generating a line of the form: + -- nginx(abi) = VERSION + local path = rpm.expand("%1") + if path:match("/usr/lib%d*/nginx/modules/.*") then + local requires = "nginx(abi) = " .. rpm.expand("%{_nginx_abiversion}") + print(requires) + end +} + +%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$ diff --git a/SOURCES/sb.key b/SOURCES/sb.key new file mode 100644 index 0000000..16c68c9 --- /dev/null +++ b/SOURCES/sb.key @@ -0,0 +1,41 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (FreeBSD) + +mQENBE5E4vkBCADPkWWzk7W5cXOqeZ1ULNSj8nt5azbYjfQ8OyR2AaDW8J7oazYH +reIHKid5uZVJxwr1uLoMloGiYTdy4XYIF2WcOfDnjNGumrAT0Nd4Kdax/pHr5Pdp +jFsO4BkHyWk/5/zDCijyoGYLBR6I8hqn+WDuLG/sTtVuTWkUeOlfxb2eZdLyZ3oP +5T5FXtWTpKvr2y7RGshmS6EJnjiVvvErdbNItFXghqvBBaFOJaS2PRBEO9RfKpti +i+eS/cmlrm+Tjv44EPfQyLtAmCQ8uqfL50uIKEp6/dsC/OVJ6JlJOYl4j90DX7vB +TJaOyUm4s+BLF2BK+Ow8+s+B6jQ5noa/o16NABEBAAG0IFNlcmdleSBCdWRuZXZp +dGNoIDxzYkBuZ2lueC5jb20+iQE+BBMBAgAoBQJOROQ6AhsDBQkJZgGABgsJCAcD +AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCmT9Wxets5qEQgB/43Mxmiy7DjXEbxIYkC +9xPC4kf1X+bHkJ9BtAgaYDQewjtQ7vS98TKJBibm3l4egmBjFWjCpL8845n966+u +XDqrDWJtOPUXvSEQNXGlijDGSxxpdK2dxDOKIOC8nIlZq/Xz/Uqjb2ZrszmYK2LD +IHI1mN9HdI6aTt41QbtG0nkaPPgv3MEvxSMVCzVddroyPXvf/ErT4OSYU+dqJhH+ +SBIezuF0suzH/siCksbSBZHIst5rggpjsZvijP5YFH/hpEsR+tKXo9EFk49xn9Ou +WdmpOEs7CKDbTApkh9XN/Pk5nJQ/HIDuW8pkgzf2wxNWlMSYw6xnozDkeIqpJcDD +4niqiEYEEBECAAYFAk5OYocACgkQ7PDpCywXIIMKtQCfaAl2rvbEImu6MnDR32KG +HTDH2TEAoNeWrSlavyFzbSQka53E9Gs6gF63tCBTZXJnZXkgQnVkbmV2aXRjaCA8 +c2JAd2FlbWUubmV0PokBQQQTAQIAKwIbAwUJCWYBgAYLCQgHAwIGFQgCCQoLBBYC +AwECHgECF4AFAk5OR38CGQEACgkQpk/VsXrbOagPmAf/QmIEDkkiovc1MgQ81lh4 +eeHfvtptb+U4GVCu07DQUR9kEtN6Jqi65gKb95fEztI14PpX+euiWrc/RlnsxWc0 +jYF0UmyacWLN6oHPoxlCK5+7zyoz5UTNrYGkTfWfcNtTU509CEZRClBNjMZOTZjP +QhdR+Ce6tngRcQvMGNaLjJkKuY7vPh6FjT5oqxpnEIRTsWq6bUaeCXm7j9x0as1Z +w1E5D5it3Ug3VlAe58jFJmRgatOsWznKuNoLRjQ2Chp2ce+dLgXriuJMrvEsn5S4 +dImUGL5DVYWDVZNG+r85XnOhMfKG308pZby1uzFvD+j3P6yMj1tpaCAAi5lUkHh6 +bIhGBBARAgAGBQJOTmJ/AAoJEOzw6QssFyCDH50AoMyJPvPDTYXK5KHOlPYPZQ5M +OuCAAJ9zQ/3hKedm3xCLGl4Y6hjxJNlUTbkBDQROROL5AQgAuGIfx9aVOOXVdj8b +XvjBQt+UkBURYGACHFQ69w71Aupsg9pZ7FgwgVKxnoNlmRag8sInjQbs3M/lS0sB +dg75zZ7Ph7aPev8RAqdtX5+xxvujv1cmkFBExFuC5Wp/Yfzk/lPWZR4vXZrTpRiF +PLMlRu0CEJFqoqPPygGFar02Q7rO+da35pxAuYrOWGM7MNr8H/vk13+GiqniBQCa +uSoWwZQzaEdG5VGgm/vAwPzO+Cbam3r+Hs7OieykAy8fv+B+qhHn8Vc/520iGvdO +IAKpxl6oZrkbNL/wozOOLZni7iWl30C43ujxPiGRlg/YotHmhlnMic85QKyakXCS +WXI/JQARAQABiQElBBgBAgAPBQJOROL5AhsMBQkJZgGAAAoJEKZP1bF62zmoGCwH +/2a6zlu4Jwmv21vuroaAzECV8gp1luBeagn23EgMMukYhkbwLtL/0twAHmZlkpzl +atfq/EH2PgOasl2biJixqp7o9V7Uw6PS5JoY+1IrLEurG+FU2TN/Ysp12al4Z0Hh +p4yBRSEikISO9gkeUThixDPX1PjCpx8G/ZYqk+8jRCcDgWsUc/WV3VGPht68oDd7 +56/hfQYc/V3eJmm5WYLVGV7Q69tGtp6D09SpoeqCD2K77auEBRVJ4jaT4B2/EfSb +x6y7Dy4Oxm8TBOQ2EZw2vEixKxtEt86/oBtLUkqVockPq/Ek9AL+KzT6VR1xU+Cm +CoHAyoqJeb/xLBwuKWg0/4U= +=iFlP +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SOURCES/thresh.key b/SOURCES/thresh.key new file mode 100644 index 0000000..ecc27c5 --- /dev/null +++ b/SOURCES/thresh.key @@ -0,0 +1,147 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGNBFrwMiUBDADo56OlDknN+ReCMP+8CN1biK5izmGd755TxktHLI9nAP8ociIq +Hjrps22pBtAIQ6eZpwCFBys2mR/441rOgZW+O6uqBYrttbxTMvE43EmKYGuFCmuR +u0JGMPuqnzF3Y+6uoKzqMzazSrZIBWsBKAkNYTw8+yPlxGgffhBp1ueME7Lskglh +EV9gmrEM0QlWod7wSQvyruExPm5INx3MG63Xfvc0bPiWUOGKyMb7kXA5VgnWuzmS +BCMm17+A32vMyxhYcvSEgUayQjGghI1uPDSqBQBMEFTgSK2wWzvAXf/M45nxKBgQ +IEDmvoC8RM9JTtUr7RE/E1mjsuefF2vYYYsWBstRFGAlUV1/lPNNibu3NqbCug6b +1IWJuV1DX9T9/f81GZJrsPgYYKC6Ai8C1B0NGWjos7/GzgEFENQgf5duOhFPadQz +QbRxBoId4Fe/Uwe2HxI8ESCQMwsq8bowcCn6XRA2EYkAt17Kab6LH6tTP54XG9TL +bV7bAhyrvZAk1lUAEQEAAbQjS29uc3RhbnRpbiBQYXZsb3YgPGsucGF2bG92QGY1 +LmNvbT6JAdcEEwEIAEECGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AWIQQT +yCpjtgNXYVbjCk6g6pgbZrDZZwUCYoTfvAUJEPqvFwAKCRCg6pgbZrDZZxFYDADK +R02XgC+AoyrqMwBNXC8Y6aiilEsyppsgj+KwZcGKDYN488gEmff+/KIEdtglw3I3 +tCMbo+FzFjHveeVCb0qrIMerWJg+o4YrxxqlQ9Q1InpduKLrIuGae0J1ybITS8+v +iYAmwzy1Wb2CDDuCnhCR/QDfOE1CvRILVqIKezC0tRrBTEvRO84m6YMBtJ1DP75Z +2cTNyjPos9+uxi4JcMKrMUBwZKya+z5i+Uxd66wuPj9KmggNG1x+bqMWmpTrSKUn +gbLabFUth+uWumpj3/7HBT8Ov7rPgzY/vn3Fn5mKdLQm+kRwSX9/FbtHAE3Qsm+f +6WW8CZ4XzL9ONfhQYwO2Jrq4HzgYloZkL+1Zs61X+zeEyr4o/mzt5DHbQRsD1UzQ +gnh7t3YdSAy6gBqevjPWkQlq9e8eoFRydN/htwjS7dleikOsYktSnTIKlRXAWGCm +jkRpQyZYuuPcWcGRt/0MVewRJmLemH6O+NviqhgGRePO9QR0R+yfdCwewPJEDk6J +AjMEEAEKAB0WIQTWeGzjA9mpAimY3GzIRk1UmvdcCgUCYoeH1wAKCRDIRk1Umvdc +Cqa9EAC8Li+w/sRwiu39vNUBogWiAKj3mlfS9lEdmPWx/MSzWtik+IlI931flFWI +GL3OWC0ZXVV9G3WXQmVUqMtW2Eachy1DOSwAh4nRn03udfeMG79DUJBvMpAKTSua +cVr2tRCFXQcx+6hmkZaANGjalzVu8tEcWfOiT19LS1QM+PH36adQCtRD+wwLgvVq +qVowo6yO6jdhCATakRWO9uqeQXvdhJ7n5A3/Hg4QKtbb5vbz6QTPOs1+prICBdfF +rVEdLx9BeZGVVoWeJNzbv9ZciC+8YYo/HOTbkccJSJ+G/FeHvshYL9Saxrsl1nUX +yNCHBdrUyxPfZMgPWD2k431uplUVCwV5MOaQR4KU8AO3lcKVs02viw4smo0mWa6O +pnMIHQ/cWgNxB5/66ch3r7YqosBi8KWHMVBejD+tOv/Y1Ey7v0mF7nBdIclbQz8t +6PlKN8cOggqWjczPo1BtwPxiAkI8Y4VyhOk4ncZnluY1CtM2rQipLfcVFC/z3UGh +ZuZ9WIi31ns8Va+msHyIaQx51PB0hSmL+AkDjUuB5APO9zFE2tGV9elbmant6f5c +k4F65i19kDcfPe397FjqgyCdIduEDDtoaSS+a6oUgffHgXMXhtP2hI9zQ6c8Bnnd +f10HDxakJEcNEz7m8i7VZ0xb+UsOej2rSgdyTIW+an9t8NF9eIkBMwQQAQgAHRYh +BHM4lzBp7T9EP00336ZP1bF62zmoBQJii0M3AAoJEKZP1bF62zmoEZYIAIK8SaCJ +KT/0NtCyzmFdjX6v+H+EYjEUJCx1QPsHt35Qglco24L/X9hnPJF9P6MY3S3PDLyd +9JsmD+mujgsShqYFME/GzSScYy5Mzm5FM0xXs9UJ51YL+frKknenN5eIr7WVjXnh +g0fKn2ZqXlZ/MozHKjKQhhzl9SN6b8eDbi1SFHS/FC7C4Tymnrkhi2KAvpEtUyvg +mRSCU5Hrqh6wvi1bCpZ4+vXzQG20CT2cxa1YmgJIDhBqKiWGLyEY2hMCoRKsx5CI +UVllc83Hrpk182DDOoVVhxFpStYD/4CNCP46oSeOtjv6EPLIIug25rsjBHPHPfMf +p64DcAoKkk6cuFWJAjMEEAEKAB0WIQRB25JxPTv0v/PukQacXn+i9Ul31AUCYoeM +ZQAKCRCcXn+i9Ul31EVUD/kB3lxEMDKFg/lFpSBxm1nxplmOCp5Nq9F8Rs9KDsbR +Rc4zKL+2PLkgfxh/Nk5+9zjclUjFMBzYS0vEEml7f1R6ceG1a9r7HrdkO581Mvwe +x90qVkMMKsShqIcuLzOK0LpvTobBlQpZCBImsNaEVHnmMR3hCz5OmUsGjxNgym87 ++ovRJKCZRbbJ36w+COf/jVEkczm+7OrG5BeTTPwWjoIkqs6dajYikfZI79J7FZ2C +pWpWeIgJA5emc3sAZWi0KTxlPZ9K4ff3iuV+Xf2PyuRC3iZlOuO66RJ/sl441ebN +ckn1Ngu3s48PyMjgD3VG8WDh4RCqBtLpMQJc60wboq9gPMhyyd5eyTYMI90HAEg9 +pYGsw6Wk8NpUmBzbSzqSOOdN/SvAXkJmQVGKEzgvDLEsmTeddsjE6U+KUS+8Y69k +Dc3sRIR3p5cKoPgZuK2mgbiXvF+TyVGODsyUUCygCGBNN8vsDDw4gpTuOhUm1nMP +3jagHWz2NnMRo00x2nayjffjpMHCKSoNy+UTBKhVLffeZ8df6fCD9SAK+UavPVFW +kMKhd+gofhrIbnca9ZL4K+CdyD1d0sxWNtoiDGi9HSnTwXhyGujv2QnNpBxCUZTD +nvOEUSNFP/9N+tkAAGiAvk5L5ZuwHRppvnv6t6JEbM7ryRBwWHwgWHConwiFWImN +XYkCMwQQAQoAHRYhBC6ZFqS4exJw9J8ez+sX9nTHmkCiBQJii1dOAAoJEOsX9nTH +mkCiKu4P/0+je/GsBE69YVAwEFBrrfhEJtVUY8GSYM8WeFoq20SX8SqwltGLFB5R +kbZGgPLe0lJrgXzL01GqjU1tnXPbtI7LEq1FKiTkcKVdne140oX1XJuxmFWBcldG +1IetinhJt5EkaYc6nyk9iWgCz9n5YDq9Lr/9jLhFQAgawuicwAfuB13MGbJZYm/Z +5eSdxnivXbrGAYR2TI6/kcf0JLGR03fKbrEM8uBnfZNkKZELyYrBCj4FYODT++Sx +pDyrNr2/FlierISJrs272JT7ICg7Knjh6X7BSzsgK7JxyG2UtJKK7qJXYEqMtYhH +U1tdh4Ru6zSd4DklgrFHwuUNlTm8f1gPQ4I46p2RCQy2HMnA9WhJ8kwE2JOAj83y +87f9hDwjmn8Pf/iksXGRFQcfDqkOIUf2EnyBvxrzS57Dfvk6WCaH+OLKn1jMyxL8 +BekCyk7L7wrMJI4yH51jyJySScGBg1CM0fYqLFWU/I+jw9bHROdCOK2LBajkAYgx +/eLG9WtS4etlNmpsxhSOi48wxa6kIOnD2rJGvQMALxhWJlVBEOMumv96qNCQCzHd +6NRLBWBva4qlKM5RlZreeVyArFtTiUmnp6RST4FrMpVgmhoeyos6P6GIG6QVPS2b +4dSRbeKmJFb15kZN8eYP4/BW7DMBzkFwtkRFDV5f/4W6CU6UIGzViQEcBBABCAAG +BQJii68XAAoJEFIKmZOhwFL4HY0IAKejouSXBCQWJmpdsA9TV2WVdMspUZHDGRAH +epQetm0+eX5Jh62ktuAZG+KCZ0bMdd8FJd6+RRpftUGhDibu9IFfyIK1v8jrChTU +/EwK8cPgLn4KveTgC58UrKt4NMpqcETUCrXHVwZzYK/sGZxxKVHhmnQJtfsvg7FV +7Ia9ohiUy1/rz9UlwLPUGmrDnSemSR9w1B3XeNN8SmTHQ5gpZt/rvsII0wMhvS7p +TXDpK5YNAqItC+7ZDaU1T21xeZx9OGSt/T2ETXb0rjIJAhKiSShqbiRonZHrxOcg +p0vSM1IAsgfnRihHu9YZ3Vj5ntegHh4fWdcTSZUx0n/YggArsyG0JEtvbnN0YW50 +aW4gUGF2bG92IDx0aHJlc2hAbmdpbnguY29tPokB1AQTAQgAPgIbAwULCQgHAwUV +CgkICwUWAwIBAAIeAQIXgBYhBBPIKmO2A1dhVuMKTqDqmBtmsNlnBQJihN+8BQkQ ++q8XAAoJEKDqmBtmsNlncQ0L/0Yk1QejO06gWwV1J2eK9LmjbMofy2ujZBgW1IGt +/goo5R4PzC8lBBcsBtsKyN0Rsh7QdLrtKKLQrE/gpwMTMdKhJTdP/c5tUY3EwgId +BMYVaxArZQiWlPgSnoKuKydnn6Rb+Qtrhvb9pjn5XlGd/VSbAXZe8YTj6B8qjUa2 +YY+IreyB6wkPN/ytV5vcocbS7mzXaibGPVT35e0Pl1Be+xbJkbTmJTSJCSPwyHm9 +t2Vuq4e/c3fMwhOUbBjfssspR103vo91XO5sY+v2aQJOctNrv4ZpHMrwBH7MeqDI +SCWg9PICUv0ewHzAEGB+K0v342rVAzVNEctwM3Jic7fEJYsItdw+Zk4r8NYqACoR +CdSUEHqhP0DbYoWdthpUwD1J5ryWyKTCpTL4wNhKEMcNaiHH3qorSssyMHMFRPoX +Kw9Pcay+Uo8NXc2KKxhEHTbQts0jYUNcq0yuWHoNQ4vhKkf9CHBrb/vS22vfEJyd +6FX6ZRYK56A3EFAV8hK0BvZAw4kCMwQQAQoAHRYhBNZ4bOMD2akCKZjcbMhGTVSa +91wKBQJih4fSAAoJEMhGTVSa91wKipoQAI3wkWd8HLQ0w4IFA6W3/igrZTut9sV+ +K5Veb61zCbJn6I2aO3ldSClMWpJfvG1OPKyaA6o4QfWt7KV9of8tu68k1rTrKKYe +qXe/0KNp9nzEwVmLASG2U6onwaCehGocvhWc9tE6MF2Gi+l+OufqsMzmx7gkdwE+ +4d/VpY/i+eZzqNi1WWNUR45mrItvw84enGW2u4JOaFdSOE2PAbSTUOlcLxfC9yCo +lxAkCsy+CsXM8WKlIDH8GpWh/mWyqjoAhZhrlGhdABjygqFAOrDhIaecc8eSOcD3 +6MQvhj/y1kh0Fe0rMCSdxUWtSjv+Sw5g1IG6GxhsqFxunxfGDpdbaLnyTQWahDfi +5OsOFl6JbPFiTaF9Xqz+8r0hiwusT4AJvM5M+q18f5dNCeqVKmuAn3BVBw4RdG62 +WXt4q6uE5rDI513dR8t84dTgOr9+tHKh5TJqw46aI+kMe36z7FPXBgDsGSkNtM4J +BYdZzxSoJCfsGCjlfapkLHrvI+S7AP2952WfYy36uuxBiuTp3vCghvKkXZUeN2kh +P++0Zo4OjZGOllhab1X5xZGO8AjWeei4pq66Ys94Veidw5VRi/eWyvB3OhfCq9fb +qZIKUfbgTu0y7vOEWWY9wQml12gpxQfkcI72NTiNMCH268WZoXYQJp0+NZtxjsHQ +PdhNxQOaJPqziQEzBBABCAAdFiEEcziXMGntP0Q/TTffpk/VsXrbOagFAmKLQzAA +CgkQpk/VsXrbOairRggArvsikhDrA1d/x1BXnzOxE2sznq/d84QCKMSQpavrzXHF +LQF/qIB+ePA4bmzwvTxQup7yTLK3mQDl0rejXEQMnXHvgfH73c6l6TdAwsoLmrpt +oGNzfzJsbiKD2hJT9jJVnipuqqOA7hPT73TA5KM4GzPupFTadB57lDxzzcRfALXi +t5Qa6A83tLelQXLOWP6IdyPjraa/kva5jYsMavZU0xWTx9nPeGCwqAnqdEN4Hp8K +WKYn9EzkBOL6pPB7GyG/G20ocTCv/ZCJMkamAxjprUovu9BUEg5fCcHrSBtsgGE0 +doPfqyOb4tCofZ8aXZYIu3+BEcNO0e5la+eW0YYYPIkCMwQQAQoAHRYhBEHbknE9 +O/S/8+6RBpxef6L1SXfUBQJih4xhAAoJEJxef6L1SXfUb8AQAML5vwKOTw6Bn0tA +1ypo6DmlJUWalGgEkFheUC02s+BT+bL/fMsiXd6dBHHl/93bVBQBL/AjVBVv7viQ +kfQLLk7iQmEQ/mljvImGkA/W+vyHKDue6n79Ccjfx/ECQB4Y8mmFhOqhDjEC6oR6 +ny77QbqmzvjkhfncD26cJq+qRGnE7EwuQI49bR1deQGxr5apqx5XRbf+GPnXlPTc +nKxctRsw6PLOjFoyGhBnvC/rEzBUx+wE7jK+bY1TSdW8x91LA/SseWqsmEFzbZRt +KKaHE9wD2DB9UvdBAjXdBZvKQ35zSJRWQByODztI9ZcaOWopK3UtIhG/eNIaJGcD +9h3SaeVE8PcUkvZqhLtQf49KlUBc8/g6Nj1wqcBbHDXjbwzt9Qoh6uFyjMkbG3NP +BXn7cT8888fJ9Oi53XjjZEVKA88AdcqWpUZtyElNwGtj8IvJ0R9SMKR/7KIYPFWm +R04Uok+oj0wQABHkcLmYMUd8psw6aQWG7oybfgPokRChExigLWrCJbYd00banL18 +W6RxOQzceiKeZ5sZ5Y+yjQIrKxXKSLl42s8zol05TPScnBn+SAWigG4eEEJhT2by +2WqbhCG9snN9/YMlY8MffOFnD05ps40CSdSCsRgcmaqxgjy75h/z5LYO4HnHwPdY +p2ysNzlruScewHvijYJhEKxo17lBiQIzBBABCgAdFiEELpkWpLh7EnD0nx7P6xf2 +dMeaQKIFAmKLV00ACgkQ6xf2dMeaQKLLQg//etbDTflbm+HbxI/YyNQhyQfk7icE +ytLL+wT9zDW9iq3AMdaPZwT690CsJhr7yzqjk0AGoMyuPfntvcvYb1mPTObXHMzh +Rh7+tViPixkJd3hnjSrPBEOkpAghk6xWMx1wldZ9x5XyJ0yC+toBkSaB/KIQeRG2 +8/jHtxIQKvPGL28gUjdzW+jopSA4x6gSZAgQLyfsjoUHcMrRJXrwWcmSe8faD8qX +XD4z4hN3wQg6olSuaxLM7OoNgbiEjKaL1LaX/xzvC0lGs9o2JBfNFDrng9Y/fZ4o +9aGqx7AZey+4wTKjXqbdEqfDiHfzHxkLBunPxSjJAploOcuvhNOQAY7tv19/mYY1 +UoILY9ninCrXthe9ZqhaXxhRhqYhzrE8svF+R01I/U+N4985AnDKRkJ944pZfeh1 +wYzEZOPXWvvTsiBLbgi9LuAzoFjA4WJsJBp4AP/U7DtsuhMTmxyBJa+zg8PHj1Ew +jBYYuE++ulsilS+76sQawT5KbszpYmEDJiQUuEJkujPQ+hGzuuocoqHrM/IcoAoy +i5I/JMAYRqCQfGMFjirmVj3c01jgsOYl7ZgchtCBJfG8V6rlYdTq2FTdaLYdleZC +kS7N4jtm+6/KEsf6ukeGNEMbsxTSPHq4RL13eSitRd9Ms+ukSZFFgE0rEiztcdxQ +h1PeaEVaxHaSSWiJARwEEAEIAAYFAmKLrxcACgkQUgqZk6HAUvihvAgAk1ETByL3 +FZtIlk8scREfwzyqyXuSYWdJ5ED61fKnpcfwGKsOkd+4MwHOSgvxPdnLhBEsMkNq +sV82EqX7lTIGoFBLTeW8ZGAxmt/88j3z6mnm33lSTreeVwsQ+B9ZKVAv4E/liDVm +6iq9aYJni4FUoFjFhtgsvJUNs3oX0gaEXdaCqzIDysU2m01vOPx0HTeI95+HdlJW +Iwwh/cp+YuclHppI+b0OQKJwLQDVyudzX0JYTWvgE/NCS6/rP8fjaqtFMWwL0tZl +3JJAoLSAuhPyc+V2LkRVoETQGF9nRil2zSyy77Stfm2fRGstnQGOrNTud06el68/ +hYfWcCqooHNiMrkBjQRa8DInAQwA2Rk7UdUgpCWl+BMz9B9eKj0XtsNEciXHHKnS +FYaSNCWNwib/FsiMfcPFh7xwUTof7e7HBFkvv0QEMCEp7R1MVNBfMiGtG1ICFIt9 +nByznPsRk4VvbY/prK4DZy2AmlwhNcT2pQO3AascgsCWdf6G+wcwnHg9tWCp0Xs9 +BNXuppmcRrpP4M1PPRIVeG1jeVXvuSHO2HjqPSXP5DhGgSGN7uLOhiLTnPINd186 +vf6tqRdqYw3g0W1ImEjGXHeNQfnieIWdU3X4C8KTEPsV3lvtmSAQCoge0CyKfz4c +ORi4j8Edp8JpDQlbAThe529+R3eKUw7I/3ESxJBdqzLE/ItWvAcbGEserLDFrg9J +1ojiKhsw3TVcDk+HIDzVakMz6HTd4ExSijMqTehzgKSVHDL+l2jc0f4VSecI+xwC +3/kNsNTBpiPoUYtXBbJllHgQAakREkSKQBas02eqRu8SlQ3yEn87zTtNW8L7xpe7 +ZVtxwUgp40PUrsb8uMDJG7ZP5rhLABEBAAGJAbwEGAEIACYCGwwWIQQTyCpjtgNX +YVbjCk6g6pgbZrDZZwUCYoTfwQUJEPqvGgAKCRCg6pgbZrDZZ3oEDAC1J3BVwlkX ++eoo8VsXAYxMXm8kIaTqOn/tHMOYepK+cWUdHaeCH3N8LigwN4Ve2LtzLBqN3WRA +xFNy0DIzdBfA7QdcAoDLnB2FNrWTmwvC9nXkCogFfSCq7c+1oFHdn7M/VZNU4o0n +hVOnqM8NLGcgzX3K3hr+WLYUgNQ9G6x0N9VU43tqVwJhvNv4pyiRpRdLlmhOEf35 +a/sWE1dttSKdrBhyzTbptw4dXr4lUpvlswWs+dLpSPPhWAuifORv/amWh3bxIxYE +qE4o5NI/PQLJvJJLsJvMIIjpKlAGBJg5h3WCiIAkl7H+BesOUIIg8ava5ZUyjlFd +szBMaBosZvRgFAlfnYhSGqzhip6PvXfK1YokNv7kqw43c0f1SmtSXZR43SRv/4vp +XG7IqtTuqgSwn1qDJgr4yfs8QQykO/jG+cz7X+5OKSAulWi9OoqLyDWlsm3WccPI +cJfbm71P+I/ha7ESVQfOxC92fQ7HQAboj7NhecJ4RLqjzrWSHmPGClI= +=t1B0 +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SPECS/nginx.spec b/SPECS/nginx.spec index 09a2f5b..8504552 100644 --- a/SPECS/nginx.spec +++ b/SPECS/nginx.spec @@ -5,10 +5,20 @@ # See: https://src.fedoraproject.org/rpms/redhat-rpm-config/c/078af19 %undefine _strict_symbol_defs_build -%global with_gperftools 0 - %bcond_with geoip +# nginx gperftools support should be disabled for RHEL >= 8 +# see: https://bugzilla.redhat.com/show_bug.cgi?id=1931402 +%if 0%{?rhel} >= 8 +%global with_gperftools 0 +%else +# gperftools exists only on selected arches +# gperftools *detection* is failing on ppc64*, possibly only configure +# bug, but disable anyway. +%ifnarch s390 s390x ppc64 ppc64le +%global with_gperftools 1 +%endif +%endif %global with_aio 1 @@ -16,26 +26,59 @@ %global with_mailcap_mimetypes 1 %endif +# kTLS requires OpenSSL 3.0 (default in F36+ and EL9+, available in EPEL8) +%if 0%{?fedora} >= 36 || 0%{?rhel} >= 8 +%global with_ktls 1 +%endif + +# Build against OpenSSL 1.1 on EL7 +%if 0%{?rhel} == 7 +%global openssl_pkgversion 11 +%endif + +# Build against OpenSSL 3 on EL8 +%if 0%{?rhel} == 8 +%global openssl_pkgversion 3 +%endif + +# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/ +%global nginx_abiversion %{version} + +%global nginx_moduledir %{_libdir}/nginx/modules +%global nginx_moduleconfdir %{_datadir}/nginx/modules +%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release} + +# Do not generate provides/requires from nginx sources +%global __provides_exclude_from ^%{nginx_srcdir}/.*$ +%global __requires_exclude_from ^%{nginx_srcdir}/.*$ + + Name: nginx Epoch: 1 -Version: 1.16.1 +Version: 1.24.0 Release: 1%{?dist} Summary: A high performance web server and reverse proxy server -Group: System Environment/Daemons # BSD License (two clause) # http://www.freebsd.org/copyright/freebsd-license.html License: BSD -URL: http://nginx.org/ +URL: https://nginx.org Source0: https://nginx.org/download/nginx-%{version}.tar.gz +Source1: https://nginx.org/download/nginx-%{version}.tar.gz.asc +# Keys are found here: https://nginx.org/en/pgp_keys.html +Source2: https://nginx.org/keys/maxim.key +Source3: https://nginx.org/keys/mdounin.key +Source4: https://nginx.org/keys/sb.key +Source5: https://nginx.org/keys/thresh.key Source10: nginx.service Source11: nginx.logrotate Source12: nginx.conf Source13: nginx-upgrade Source14: nginx-upgrade.8 -Source100: index.html -Source101: poweredby.png +Source15: macros.nginxmods.in +Source16: nginxmods.attr +Source17: nginx-ssl-pass-dialog Source102: nginx-logo.png Source103: 404.html Source104: 50x.html @@ -44,55 +87,86 @@ Source210: UPGRADE-NOTES-1.6-to-1.10 # removes -Werror in upstream build scripts. -Werror conflicts with # -D_FORTIFY_SOURCE=2 causing warnings to turn into errors. -Patch0: nginx-auto-cc-gcc.patch +Patch0: 0001-remove-Werror-in-upstream-build-scripts.patch -# downstream patch - changing logs permissions to 664 instead -# previous 644 -Patch1: nginx-1.14.0-logs-perm.patch +# downstream patch - fix PIDFile race condition (rhbz#1869026) +# rejected upstream: https://trac.nginx.org/nginx/ticket/1897 +Patch1: 0002-fix-PIDFile-handling.patch -# PKCS#11 engine fix -Patch2: nginx-1.16.0-pkcs11.patch +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=1955564 +Patch2: 0003-Support-loading-cert-hardware-token-PKC.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1655530 -Patch3: nginx-1.14.1-perl-module-hardening.patch +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2006822 +Patch3: 0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1643647 -Patch4: nginx-1.16.0-enable-tls1v3-by-default.patch +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2006420 +Patch4: 0005-Init-openssl-engine-properly.patch +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2028781 +Patch5: 0007-Enable-TLSv1.3-by-default.patch + +# downstream patch - Add ssl-pass-phrase-dialog helper script for +# encrypted private keys with pass phrase decryption +# +# https://bugzilla.redhat.com/show_bug.cgi?id=2170808 +Patch6: 0008-add-ssl-pass-phrase-dialog.patch + +# security fix - https://issues.redhat.com/browse/RHEL-12737 +Patch7: 0009-CVE-2023-44487-HTTP-2-per-iteration-stream-handling.patch + +BuildRequires: make +BuildRequires: gcc +BuildRequires: gnupg2 %if 0%{?with_gperftools} BuildRequires: gperftools-devel %endif -BuildRequires: openssl-devel -BuildRequires: pcre-devel +BuildRequires: openssl%{?openssl_pkgversion}-devel +BuildRequires: pcre2-devel BuildRequires: zlib-devel Requires: nginx-filesystem = %{epoch}:%{version}-%{release} - -%if 0%{?rhel} > 0 && 0%{?rhel} < 8 -# Introduced at 1:1.10.0-1 to ease upgrade path. To be removed later. -Requires: nginx-all-modules = %{epoch}:%{version}-%{release} +%if 0%{?el7} +# centos-logos el7 does not provide 'system-indexhtml' +Requires: system-logos redhat-indexhtml +# need to remove epel7 geoip sub-package, doesn't work anymore +# https://bugzilla.redhat.com/show_bug.cgi?id=1576034 +# https://bugzilla.redhat.com/show_bug.cgi?id=1664957 +Obsoletes: nginx-mod-http-geoip <= 1:1.16 +%else +Requires: system-logos-httpd %endif -Requires: openssl -Requires: pcre -Requires(pre): nginx-filesystem -%if 0%{?with_mailcap_mimetypes} -Requires: nginx-mimetypes -%endif Provides: webserver +%if 0%{?fedora} || 0%{?rhel} >= 8 +Recommends: logrotate +%endif +Requires: %{name}-core = %{epoch}:%{version}-%{release} BuildRequires: systemd Requires(post): systemd Requires(preun): systemd Requires(postun): systemd +# For external nginx modules +Provides: nginx(abi) = %{nginx_abiversion} %description Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage. +%package core +Summary: nginx minimal core +%if 0%{?with_mailcap_mimetypes} +Requires: nginx-mimetypes +%endif +Requires: openssl%{?openssl_pkgversion}-libs +Requires(pre): nginx-filesystem +Conflicts: nginx < 1:1.20.1-13 + +%description core +nginx minimal core + %package all-modules -Group: System Environment/Daemons Summary: A meta package that installs all available Nginx modules BuildArch: noarch @@ -106,10 +180,9 @@ Requires: nginx-mod-mail = %{epoch}:%{version}-%{release} Requires: nginx-mod-stream = %{epoch}:%{version}-%{release} %description all-modules -A meta package that installs all available Nginx modules. +Meta package that installs all available nginx modules. %package filesystem -Group: System Environment/Daemons Summary: The basic directory layout for the Nginx server BuildArch: noarch Requires(pre): shadow-utils @@ -121,10 +194,9 @@ directories. %if %{with geoip} %package mod-http-geoip -Group: System Environment/Daemons Summary: Nginx HTTP geoip module BuildRequires: GeoIP-devel -Requires: nginx +Requires: nginx(abi) = %{nginx_abiversion} Requires: GeoIP %description mod-http-geoip @@ -132,24 +204,22 @@ Requires: GeoIP %endif %package mod-http-image-filter -Group: System Environment/Daemons Summary: Nginx HTTP image filter module BuildRequires: gd-devel -Requires: nginx +Requires: nginx(abi) = %{nginx_abiversion} Requires: gd %description mod-http-image-filter %{summary}. %package mod-http-perl -Group: System Environment/Daemons Summary: Nginx HTTP perl module BuildRequires: perl-devel -%if 0%{?fedora} >= 24 +%if 0%{?fedora} >= 24 || 0%{?rhel} >= 7 BuildRequires: perl-generators %endif BuildRequires: perl(ExtUtils::Embed) -Requires: nginx +Requires: nginx(abi) = %{nginx_abiversion} Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Requires: perl(constant) @@ -157,39 +227,55 @@ Requires: perl(constant) %{summary}. %package mod-http-xslt-filter -Group: System Environment/Daemons Summary: Nginx XSLT module BuildRequires: libxslt-devel -Requires: nginx +Requires: nginx(abi) = %{nginx_abiversion} %description mod-http-xslt-filter %{summary}. %package mod-mail -Group: System Environment/Daemons Summary: Nginx mail modules -Requires: nginx +Requires: nginx(abi) = %{nginx_abiversion} %description mod-mail %{summary}. %package mod-stream -Group: System Environment/Daemons Summary: Nginx stream modules -Requires: nginx +Requires: nginx(abi) = %{nginx_abiversion} %description mod-stream %{summary}. +%package mod-devel +Summary: Nginx module development files +Requires: nginx = %{epoch}:%{version}-%{release} +Requires: make +Requires: gcc +Requires: gd-devel +%if 0%{?with_gperftools} +Requires: gperftools-devel +%endif +%if %{with geoip} +Requires: GeoIP-devel +%endif +Requires: libxslt-devel +Requires: openssl%{?openssl_pkgversion}-devel +Requires: pcre2-devel +Requires: perl-devel +Requires: perl(ExtUtils::Embed) +Requires: zlib-devel + +%description mod-devel +%{summary}. + %prep -%setup -q -%patch0 -p0 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 - +# Combine all keys from upstream into one file +cat %{S:2} %{S:3} %{S:4} %{S:5} > %{_builddir}/%{name}.gpg +%{gpgverify} --keyring='%{_builddir}/%{name}.gpg' --signature='%{SOURCE1}' --data='%{SOURCE0}' +%autosetup -p1 cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} . %if 0%{?rhel} > 0 && 0%{?rhel} < 8 @@ -197,6 +283,17 @@ sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf %endif +%if 0%{?openssl_pkgversion} +sed \ + -e 's|\(ngx_feature_path=\)$|\1%{_includedir}/openssl%{openssl_pkgversion}|' \ + -e 's|\(ngx_feature_libs="\)|\1-L%{_libdir}/openssl%{openssl_pkgversion} |' \ + -i auto/lib/openssl/conf +%endif + +# Prepare sources for installation +cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src +mv ../%{name}-%{version}-%{release}-src . + %build # nginx does not utilize a standard configure script. It has its own @@ -204,10 +301,12 @@ sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf # to error out. This is is also the reason for the DESTDIR environment # variable. export DESTDIR=%{buildroot} -./configure \ +# So the perl module finds its symbols: +nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" +if ! ./configure \ --prefix=%{_datadir}/nginx \ --sbin-path=%{_sbindir}/nginx \ - --modules-path=%{_libdir}/nginx/modules \ + --modules-path=%{nginx_moduledir} \ --conf-path=%{_sysconfdir}/nginx/nginx.conf \ --error-log-path=%{_localstatedir}/log/nginx/error.log \ --http-log-path=%{_localstatedir}/log/nginx/access.log \ @@ -220,51 +319,61 @@ export DESTDIR=%{buildroot} --lock-path=/run/lock/subsys/nginx \ --user=%{nginx_user} \ --group=%{nginx_user} \ + --with-compat \ + --with-debug \ %if 0%{?with_aio} --with-file-aio \ %endif - --with-ipv6 \ - --with-http_ssl_module \ - --with-http_v2_module \ - --with-http_realip_module \ - --with-stream_ssl_preread_module \ - --with-http_addition_module \ - --with-http_xslt_module=dynamic \ - --with-http_image_filter_module=dynamic \ -%if %{with geoip} - --with-http_geoip_module=dynamic \ -%endif - --with-http_sub_module \ - --with-http_dav_module \ - --with-http_flv_module \ - --with-http_mp4_module \ - --with-http_gunzip_module \ - --with-http_gzip_static_module \ - --with-http_random_index_module \ - --with-http_secure_link_module \ - --with-http_degradation_module \ - --with-http_slice_module \ - --with-http_stub_status_module \ - --with-http_perl_module=dynamic \ - --with-http_auth_request_module \ - --with-mail=dynamic \ - --with-mail_ssl_module \ - --with-pcre \ - --with-pcre-jit \ - --with-stream=dynamic \ - --with-stream_ssl_module \ %if 0%{?with_gperftools} --with-google_perftools_module \ %endif - --with-debug \ - --with-cc-opt="%{optflags} $(pcre-config --cflags)" \ - --with-ld-opt="$RPM_LD_FLAGS -Wl,-E" # so the perl module finds its symbols + --with-http_addition_module \ + --with-http_auth_request_module \ + --with-http_dav_module \ + --with-http_degradation_module \ + --with-http_flv_module \ +%if %{with geoip} + --with-http_geoip_module=dynamic \ + --with-stream_geoip_module=dynamic \ +%endif + --with-http_gunzip_module \ + --with-http_gzip_static_module \ + --with-http_image_filter_module=dynamic \ + --with-http_mp4_module \ + --with-http_perl_module=dynamic \ + --with-http_random_index_module \ + --with-http_realip_module \ + --with-http_secure_link_module \ + --with-http_slice_module \ + --with-http_ssl_module \ + --with-http_stub_status_module \ + --with-http_sub_module \ + --with-http_v2_module \ + --with-http_xslt_module=dynamic \ + --with-mail=dynamic \ + --with-mail_ssl_module \ +%if 0%{?with_ktls} + --with-openssl-opt=enable-ktls \ +%endif + --with-pcre \ + --with-pcre-jit \ + --with-stream=dynamic \ + --with-stream_realip_module \ + --with-stream_ssl_module \ + --with-stream_ssl_preread_module \ + --with-threads \ + --with-cc-opt="%{optflags} $(pcre2-config --cflags)" \ + --with-ld-opt="$nginx_ldopts"; then + : configure failed + cat objs/autoconf.err + exit 1 +fi -make %{?_smp_mflags} +%make_build %install -make install DESTDIR=%{buildroot} INSTALLDIRS=vendor +%make_install INSTALLDIRS=vendor find %{buildroot} -type f -name .packlist -exec rm -f '{}' \; find %{buildroot} -type f -name perllocal.pod -exec rm -f '{}' \; @@ -287,15 +396,39 @@ install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html -install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/modules -install -p -d -m 0755 %{buildroot}%{_libdir}/nginx/modules +install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir} +install -p -d -m 0755 %{buildroot}%{nginx_moduledir} + install -p -m 0644 ./nginx.conf \ %{buildroot}%{_sysconfdir}/nginx -install -p -m 0644 %{SOURCE100} \ - %{buildroot}%{_datadir}/nginx/html -install -p -m 0644 %{SOURCE101} %{SOURCE102} \ + +rm -f %{buildroot}%{_datadir}/nginx/html/index.html +%if 0%{?el7} +ln -s ../../doc/HTML/index.html \ + %{buildroot}%{_datadir}/nginx/html/index.html +ln -s ../../doc/HTML/img \ + %{buildroot}%{_datadir}/nginx/html/img +ln -s ../../doc/HTML/en-US \ + %{buildroot}%{_datadir}/nginx/html/en-US +%else +ln -s ../../testpage/index.html \ + %{buildroot}%{_datadir}/nginx/html/index.html +%endif +install -p -m 0644 %{SOURCE102} \ %{buildroot}%{_datadir}/nginx/html +ln -s nginx-logo.png %{buildroot}%{_datadir}/nginx/html/poweredby.png +mkdir -p %{buildroot}%{_datadir}/nginx/html/icons + +# Symlink for the powered-by-$DISTRO image: +ln -s ../../../pixmaps/poweredby.png \ + %{buildroot}%{_datadir}/nginx/html/icons/poweredby.png + +%if 0%{?rhel} >= 9 +ln -s ../../pixmaps/system-noindex-logo.png \ + %{buildroot}%{_datadir}/nginx/html/system_noindex_logo.png +%endif + install -p -m 0644 %{SOURCE103} %{SOURCE104} \ %{buildroot}%{_datadir}/nginx/html @@ -309,25 +442,45 @@ install -p -D -m 0644 %{_builddir}/nginx-%{version}/objs/nginx.8 \ install -p -D -m 0755 %{SOURCE13} %{buildroot}%{_bindir}/nginx-upgrade install -p -D -m 0644 %{SOURCE14} %{buildroot}%{_mandir}/man8/nginx-upgrade.8 -for i in ftdetect indent syntax; do +for i in ftdetect ftplugin indent syntax; do install -p -D -m644 contrib/vim/${i}/nginx.vim \ %{buildroot}%{_datadir}/vim/vimfiles/${i}/nginx.vim done %if %{with geoip} -echo 'load_module "%{_libdir}/nginx/modules/ngx_http_geoip_module.so";' \ - > %{buildroot}%{_datadir}/nginx/modules/mod-http-geoip.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf %endif -echo 'load_module "%{_libdir}/nginx/modules/ngx_http_image_filter_module.so";' \ - > %{buildroot}%{_datadir}/nginx/modules/mod-http-image-filter.conf -echo 'load_module "%{_libdir}/nginx/modules/ngx_http_perl_module.so";' \ - > %{buildroot}%{_datadir}/nginx/modules/mod-http-perl.conf -echo 'load_module "%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so";' \ - > %{buildroot}%{_datadir}/nginx/modules/mod-http-xslt-filter.conf -echo 'load_module "%{_libdir}/nginx/modules/ngx_mail_module.so";' \ - > %{buildroot}%{_datadir}/nginx/modules/mod-mail.conf -echo 'load_module "%{_libdir}/nginx/modules/ngx_stream_module.so";' \ - > %{buildroot}%{_datadir}/nginx/modules/mod-stream.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf +echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf +echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf + +# Install files for supporting nginx module builds +## Install source files +mkdir -p %{buildroot}%{_usrsrc} +mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir} +## Install rpm macros +mkdir -p %{buildroot}%{_rpmmacrodir} +sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \ + -e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \ + -e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \ + -e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \ + %{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods +## Install dependency generator +install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16} + +# install http-ssl-pass-dialog +mkdir -p $RPM_BUILD_ROOT%{_libexecdir} +install -m755 $RPM_SOURCE_DIR/nginx-ssl-pass-dialog \ + $RPM_BUILD_ROOT%{_libexecdir}/nginx-ssl-pass-dialog + %pre filesystem getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user} @@ -381,21 +534,25 @@ if [ $1 -ge 1 ]; then fi %files -%license LICENSE -%doc CHANGES README README.dynamic %if 0%{?rhel} == 7 %doc UPGRADE-NOTES-1.6-to-1.10 %endif %{_datadir}/nginx/html/* %{_bindir}/nginx-upgrade -%{_sbindir}/nginx %{_datadir}/vim/vimfiles/ftdetect/nginx.vim +%{_datadir}/vim/vimfiles/ftplugin/nginx.vim %{_datadir}/vim/vimfiles/syntax/nginx.vim %{_datadir}/vim/vimfiles/indent/nginx.vim %{_mandir}/man3/nginx.3pm* %{_mandir}/man8/nginx.8* %{_mandir}/man8/nginx-upgrade.8* %{_unitdir}/nginx.service +%{_libexecdir}/nginx-ssl-pass-dialog + +%files core +%license LICENSE +%doc CHANGES README README.dynamic +%{_sbindir}/nginx %config(noreplace) %{_sysconfdir}/nginx/fastcgi.conf %config(noreplace) %{_sysconfdir}/nginx/fastcgi.conf.default %config(noreplace) %{_sysconfdir}/nginx/fastcgi_params @@ -416,8 +573,11 @@ fi %config(noreplace) %{_sysconfdir}/logrotate.d/nginx %attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx %attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp -%attr(770,%{nginx_user},root) %dir %{_localstatedir}/log/nginx -%dir %{_libdir}/nginx/modules +%attr(711,root,root) %dir %{_localstatedir}/log/nginx +%ghost %attr(640,%{nginx_user},root) %{_localstatedir}/log/nginx/access.log +%ghost %attr(640,%{nginx_user},root) %{_localstatedir}/log/nginx/error.log +%dir %{nginx_moduledir} +%dir %{nginx_moduleconfdir} %files all-modules @@ -432,97 +592,233 @@ fi %if %{with geoip} %files mod-http-geoip -%{_datadir}/nginx/modules/mod-http-geoip.conf -%{_libdir}/nginx/modules/ngx_http_geoip_module.so +%{nginx_moduleconfdir}/mod-http-geoip.conf +%{nginx_moduledir}/ngx_http_geoip_module.so %endif %files mod-http-image-filter -%{_datadir}/nginx/modules/mod-http-image-filter.conf -%{_libdir}/nginx/modules/ngx_http_image_filter_module.so +%{nginx_moduleconfdir}/mod-http-image-filter.conf +%{nginx_moduledir}/ngx_http_image_filter_module.so %files mod-http-perl -%{_datadir}/nginx/modules/mod-http-perl.conf -%{_libdir}/nginx/modules/ngx_http_perl_module.so +%{nginx_moduleconfdir}/mod-http-perl.conf +%{nginx_moduledir}/ngx_http_perl_module.so %dir %{perl_vendorarch}/auto/nginx %{perl_vendorarch}/nginx.pm %{perl_vendorarch}/auto/nginx/nginx.so %files mod-http-xslt-filter -%{_datadir}/nginx/modules/mod-http-xslt-filter.conf -%{_libdir}/nginx/modules/ngx_http_xslt_filter_module.so +%{nginx_moduleconfdir}/mod-http-xslt-filter.conf +%{nginx_moduledir}/ngx_http_xslt_filter_module.so %files mod-mail -%{_datadir}/nginx/modules/mod-mail.conf -%{_libdir}/nginx/modules/ngx_mail_module.so +%{nginx_moduleconfdir}/mod-mail.conf +%{nginx_moduledir}/ngx_mail_module.so %files mod-stream -%{_datadir}/nginx/modules/mod-stream.conf -%{_libdir}/nginx/modules/ngx_stream_module.so +%{nginx_moduleconfdir}/mod-stream.conf +%{nginx_moduledir}/ngx_stream_module.so + +%files mod-devel +%{_rpmmacrodir}/macros.nginxmods +%{_fileattrsdir}/nginxmods.attr +%{nginx_srcdir}/ %changelog -* Thu Aug 29 2019 Lubos Uhliarik - 1:1.16.1-1 -- update to 1.16.1 -- Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount - of data request leads to denial of service -- Resolves: #1745690 - CVE-2019-9513 nginx:1.16/nginx: HTTP/2: flood using - PRIORITY frames resulting in excessive resource consumption -- Resolves: #1745645 - CVE-2019-9516 nginx:1.16/nginx: HTTP/2: 0-length - headers leads to denial of service +* Thu Jan 18 2024 Luboš Uhliarik - 1:1.24.0-1 +- new version 1.24.0 -* Wed Jun 26 2019 Lubos Uhliarik - 1:1.16.0-2 -- Resolves: #1718929 - ssl_protocols config option has faulty behavior - in nginx:1.16 +* Mon Oct 16 2023 Luboš Uhliarik - 1:1.22.1-5 +- Resolves: RHEL-12737 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web + servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) -* Mon May 06 2019 Lubos Uhliarik - 1:1.16.0-1 -- new version 1.16.0 -- enable ngx_stream_ssl_preread module -- main package does NOT require all-modules package +* Mon Aug 07 2023 Luboš Uhliarik - 1:1.22.1-4 +- Resolves: #2170808 - Running nginx with systemctl and entering ssl + private key's pass phrase +- added new ssl_pass_phrase_dialog directive which enables setting + external program for entering password for encrypted private key -* Wed Dec 12 2018 Lubos Uhliarik - 1:1.14.1-8 -- enable TLS 1.3 by default (#1643647) -- TLSv1.0 and TLSv1.1 can be enabled now (#1644746) +* Sun Dec 18 2022 Luboš Uhliarik - 1:1.22.1-3 +- Resolves: #2150932 - No logrotating nginx logs from nginx:1.22 + +* Thu Dec 01 2022 Neal Gompa - 1:1.22.1-2 +- Require pcre2-devel instead of pcre-devel in -mod-devel subpackage + Resolves: rhbz#2149965 + +* Sat Oct 22 2022 Luboš Uhliarik - 1:1.22.1-1 +- Resolves: #2096174 - RFE: add nginx:1.22 module stream +- switch to pcre2 +- add stream_geoip_module and stream_realip_module +- enable kTLS support + +* Wed Jun 22 2022 Luboš Uhliarik - 1:1.20.1-13 +- Resolves: #2099752 - nginx minimisation for ubi-micro + +* Tue Jun 21 2022 Luboš Uhliarik - 1:1.20.1-11 +- Resolves: #2028781 - Protocol : TLSv1.3 missing in rhel9 + +* Wed Feb 02 2022 Luboš Uhliarik - 1:1.20.1-10 +- Resolves: #1975747 - CVE-2021-3618 nginx: ALPACA: Application Layer Protocol + Confusion - Analyzing and Mitigating Cracks in TLS Authentication + +* Thu Dec 2 2021 Joe Orton - 1:1.20.1-9 +- add delaycompress to logrotate config (#2015250) + +* Wed Sep 22 2021 Luboš Uhliarik - 1:1.20.1-8 +- Resolves: #2007019 - use proper wording in error pages + +* Wed Sep 22 2021 Luboš Uhliarik - 1:1.20.1-7 +- Resolves: #2006420 - Broken loading certificates from hardware token (PKCS#11) + +* Wed Sep 22 2021 Luboš Uhliarik - 1:1.20.1-6 +- Resolves: #2006822 - Hardening tests fail for nginx + +* Tue Sep 21 2021 Luboš Uhliarik - 1:1.20.1-5 +- Add -mod-devel subpackage for building external nginx modules + Resolves: rhbz#1991720 (Neal Gompa) + +* Mon Aug 09 2021 Mohan Boddu - 1:1.20.1-4 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Mon Aug 09 2021 Luboš Uhliarik - 1:1.20.1-3 +- Resolves: #1991600 - Add logo symlink required by new testpage + +* Wed Jun 16 2021 Mohan Boddu - 1:1.20.1-2 +- Rebuilt for RHEL 9 BETA for openssl 3.0 + Related: rhbz#1971065 + +* Wed Jun 02 2021 Luboš Uhliarik - 1:1.20.1-1 +- new version 1.20.1 +- Resolves: #1964814 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy() + when labels are followed by a pointer to a root domain name + +* Fri Apr 30 2021 Lubos Uhliarik - 1:1.20.0-5 +- Resolves: #1955564 - [RFE] Support loading certificates from hardware + token (PKCS#11) + +* Fri Apr 30 2021 Lubos Uhliarik - 1:1.20.0-4 +- Resolves: #1955560 - centralizing default index.html on nginx + +* Mon Apr 26 2021 Lubos Uhliarik - 1:1.20.0-3 +- Resolve: #1953639 - Rebase nginx to 1.20 + +* Wed Apr 21 2021 Felix Kaechele - 1:1.20.0-2 +- sync rawhide and EPEL7 spec files again +- systemd service reload now checks config file (rhbz#1565377) +- drop nginx requirement on nginx-all-modules (rhbz#1708799) +- let nginx handle log creation on logrotate (rhbz#1683388) +- have log directory owned by root (rhbz#1390183, CVE-2016-1247) +- remove obsolete --with-ipv6 (src PR#8) +- correction: pcre2 is actually not supported by nginx, reintroduce pcre + +* Wed Apr 21 2021 Felix Kaechele - 1:1.20.0-1 +- update to 1.20.0 +- sync with mainline spec file +- order configure options alphabetically for easier comparinggit +- add --with-compat option (rhbz#1834452) +- add patch to fix PIDFile race condition (rhbz#1869026) +- use pcre2 instead of pcre (rhbz#1938984) +- add Wants=network-online.target to systemd unit (rhbz#1943779) + +* Fri Apr 16 2021 Mohan Boddu - 1:1.18.0-6 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Mon Feb 22 2021 Lubos Uhliarik - 1:1.18.0-5 +- Resolves: #1931402 - drop gperftools module + +* Tue Jan 26 2021 Fedora Release Engineering - 1:1.18.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 1:1.18.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jun 22 2020 Jitka Plesnikova - 1:1.18.0-2 +- Perl 5.32 rebuild + +* Fri Apr 24 2020 Felix Kaechele - 1:1.18.0-1 +- Update to 1.18.0 +- Increased types_hash_max_size to 4096 in default config +- Add gpg source verification +- Add Recommends: logrotate +- Drop location / from default config (rhbz#1564768) +- Drop default_sever from default config (rhbz#1373822) + +* Wed Jan 29 2020 Fedora Release Engineering - 1:1.16.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sun Sep 15 2019 Warren Togami +- add conditionals for EPEL7, see rhbz#1750857 + +* Tue Aug 13 2019 Jamie Nguyen - 1:1.16.1-1 +- Update to upstream release 1.16.1 +- Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 + +* Thu Jul 25 2019 Fedora Release Engineering - 1:1.16.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu May 30 2019 Jitka Plesnikova - 1:1.16.0-4 +- Perl 5.30 rebuild + +* Tue May 14 2019 Stephen Gallagher - 1.16.0-3 +- Move to common default index.html +- Resolves: rhbz#1636235 + +* Tue May 07 2019 Jamie Nguyen - 1:1.16.0-2 +- Add missing directory for vim plugin + +* Fri Apr 26 2019 Jamie Nguyen - 1:1.16.0-1 +- Update to upstream release 1.16.0 + +* Mon Mar 04 2019 Jamie Nguyen - 1:1.15.9-1 +- Update to upstream release 1.15.9 +- Enable ngx_stream_ssl_preread module +- Remove redundant conditionals + +* Fri Feb 01 2019 Fedora Release Engineering - 1:1.14.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 1:1.14.1-4 +- Rebuilt for libcrypt.so.2 (#1666033) * Tue Dec 11 2018 Joe Orton - 1:1.14.1-3 -- fix unexpanded paths in nginx(8) (#1643069) +- fix unexpanded paths in nginx(8) -* Mon Dec 03 2018 Lubos Uhliarik - 1:1.14.1-2 -- Resolves: #1655530 - Hardening tests fail for nginx - -* Mon Nov 19 2018 Lubos Uhliarik - 1:1.14.1-1 +* Tue Nov 20 2018 Luboš Uhliarik - 1:1.14.1-2 - new version 1.14.1 -- Resolves: #1647257 - CVE-2018-16845 nginx: Denial of service and - memory disclosure via mp4 module -- Resolves: #1647262 - CVE-2018-16844 nginx: Excessive CPU usage - via flaw in HTTP/2 implementation -- Resolves: #1647263 - CVE-2018-16843 nginx: Excessive memory consumption +- Resolves: #1584426 - Upstream Nginx 1.14.0 is now available +- Resolves: #1647255 - CVE-2018-16845 nginx: Denial of service and memory + disclosure via mp4 module +- Resolves: #1647259 - CVE-2018-16843 nginx: Excessive memory consumption via flaw in HTTP/2 implementation +- Resolves: #1647258 - CVE-2018-16844 nginx: Excessive CPU usage via flaw + in HTTP/2 implementation -* Wed Aug 8 2018 Joe Orton - 1:1.14.0-3 -- fix PKCS#11 support (Anderson Sasaki, #1545526) +* Mon Aug 06 2018 Luboš Uhliarik - 1:1.12.1-14 +- add requires on perl(constant) for mod-http-perl -* Mon Aug 06 2018 Lubos Uhliarik - 1:1.14.0-2 -- add dependency on perl(constant) - -* Mon Jul 30 2018 Luboš Uhliarik - 1:1.14.0-1 -- Resolves: #1558420 - directory permissions are now correct after processing - USR1 signal -- Resolves: #1601414 - nginx: drop GeoIP support +* Mon Jul 30 2018 Luboš Uhliarik - 1:1.12.1-13 +- don't build with geoip by default * Thu Jul 19 2018 Joe Orton - 1:1.12.1-12 - add build conditional for geoip support -* Thu May 03 2018 Luboš Uhliarik - 1:1.14.0-1 -- new version 1.14.0 +* Mon Jul 16 2018 Tadej Janež - 1:1.12.1-11 +- Add gcc to BuildRequires to account for + https://fedoraproject.org/wiki/Changes/Remove_GCC_from_BuildRoot -* Wed Apr 25 2018 Luboš Uhliarik - 1:1.12.1-9 -- changed directory permissions (#1558420) +* Fri Jul 13 2018 Fedora Release Engineering - 1:1.12.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild -* Fri Mar 23 2018 Joe Orton - 1:1.12.1-8 -- disable gperftools (#1496868) +* Wed Jun 27 2018 Jitka Plesnikova - 1:1.12.1-9 +- Perl 5.28 rebuild -* Thu Mar 22 2018 Joe Orton - 1:1.12.1-7 -- update branding (#1512565) +* Mon May 14 2018 Luboš Uhliarik - 1:1.12.1-8 +- Related: #1573942 - nginx fails on start + +* Wed May 02 2018 Luboš Uhliarik - 1:1.12.1-7 +- Resolves: #1573942 - nginx fails on start * Thu Feb 08 2018 Fedora Release Engineering - 1:1.12.1-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild