From 8667d76449620558b007b01300134f4365ef4910 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Wed, 25 May 2022 11:03:25 +0200 Subject: [PATCH 1/5] nginxStable: 1.20.2 -> 1.22.0 (cherry picked from commit 14ef375cf036a7f8e3ed610f21ed5a591371d747) --- pkgs/servers/http/nginx/stable.nix | 13 +++---------- pkgs/top-level/all-packages.nix | 1 + 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix index c219b01fbb31..5d4db3a403b6 100644 --- a/pkgs/servers/http/nginx/stable.nix +++ b/pkgs/servers/http/nginx/stable.nix @@ -1,13 +1,6 @@ -{ callPackage, fetchpatch, ... } @ args: +{ callPackage, ... } @ args: callPackage ./generic.nix args { - version = "1.20.2"; - sha256 = "0hjsyjzd35qyw49w210f67g678kvzinw4kg1acb0l6c2fxspd24m"; - extraPatches = [ - (fetchpatch { - name = "CVE-2021-3618.patch"; - url = "https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a.patch"; - sha256 = "0cnxmbkp6ip61w7y1ihhnvziiwzz3p3wi2vpi5c7yaj5m964k5db"; - }) - ]; + version = "1.22.0"; + sha256 = "0lzb4sn8hv491zad9kbpvka3m5ayjf1pxqbwllri980idyd5cgdk"; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 956de5042779..012c7c598cba 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -21992,6 +21992,7 @@ with pkgs; nginxStable = callPackage ../servers/http/nginx/stable.nix { zlib = zlib-ng.override { withZlibCompat = true; }; + openssl = openssl_3_0; withPerl = false; # We don't use `with` statement here on purpose! # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 From c0a40d4492b48d6b140dc370e3bc7a44d7a604a4 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Wed, 25 May 2022 11:05:19 +0200 Subject: [PATCH 2/5] nginxMainline: 1.21.6 -> 1.22.0 (cherry picked from commit 893214cd0e6d15a2dbadfa5cc680e7ba18e4d1c0) --- pkgs/servers/http/nginx/generic.nix | 4 ++-- pkgs/servers/http/nginx/mainline.nix | 8 ++++---- pkgs/top-level/all-packages.nix | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix index 79ca0d2eb5d8..abba18a6bd7d 100644 --- a/pkgs/servers/http/nginx/generic.nix +++ b/pkgs/servers/http/nginx/generic.nix @@ -1,4 +1,4 @@ -outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt +outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre2, libxml2, libxslt , nginx-doc , nixosTests @@ -53,7 +53,7 @@ stdenv.mkDerivation { inherit sha256; }; - buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip perl ] + buildInputs = [ openssl zlib pcre2 libxml2 libxslt gd geoip perl ] ++ buildInputs ++ mapModules "inputs"; diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix index f4b5bf65fea0..dd5ae58d2a46 100644 --- a/pkgs/servers/http/nginx/mainline.nix +++ b/pkgs/servers/http/nginx/mainline.nix @@ -1,6 +1,6 @@ -{ callPackage, openssl_3_0, ... }@args: +{ callPackage, ... }@args: -callPackage ./generic.nix (args // { openssl = openssl_3_0; }) { - version = "1.21.6"; - sha256 = "1bh52jqqcaj5wlh2kvhxr00jhk2hnk8k97ki4pwyj4c8920p1p36"; +callPackage ./generic.nix args { + version = "1.22.0"; + sha256 = "0lzb4sn8hv491zad9kbpvka3m5ayjf1pxqbwllri980idyd5cgdk"; } diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 012c7c598cba..2545bc774afa 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -22001,6 +22001,7 @@ with pkgs; nginxMainline = callPackage ../servers/http/nginx/mainline.nix { zlib = zlib-ng.override { withZlibCompat = true; }; + openssl = openssl_3_0; withKTLS = true; withPerl = false; # We don't use `with` statement here on purpose! From 488f5502e6b3c2e303b2912799296bec8dd235a7 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Wed, 25 May 2022 21:34:21 +0200 Subject: [PATCH 3/5] nginx(Stable|Mainline|Quic): use pcre2 (cherry picked from commit b4849523302484e7cd365a2765f2e8894ace39fe) --- pkgs/servers/http/nginx/generic.nix | 4 ++-- pkgs/top-level/all-packages.nix | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix index abba18a6bd7d..79ca0d2eb5d8 100644 --- a/pkgs/servers/http/nginx/generic.nix +++ b/pkgs/servers/http/nginx/generic.nix @@ -1,4 +1,4 @@ -outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre2, libxml2, libxslt +outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt , nginx-doc , nixosTests @@ -53,7 +53,7 @@ stdenv.mkDerivation { inherit sha256; }; - buildInputs = [ openssl zlib pcre2 libxml2 libxslt gd geoip perl ] + buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip perl ] ++ buildInputs ++ mapModules "inputs"; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 2545bc774afa..31dd9ccb21a1 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -21982,6 +21982,7 @@ with pkgs; nginxQuic = callPackage ../servers/http/nginx/quic.nix { zlib = zlib-ng.override { withZlibCompat = true; }; + pcre = pcre2; withPerl = false; # We don't use `with` statement here on purpose! # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 @@ -21993,6 +21994,7 @@ with pkgs; nginxStable = callPackage ../servers/http/nginx/stable.nix { zlib = zlib-ng.override { withZlibCompat = true; }; openssl = openssl_3_0; + pcre = pcre2; withPerl = false; # We don't use `with` statement here on purpose! # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334 @@ -22002,6 +22004,7 @@ with pkgs; nginxMainline = callPackage ../servers/http/nginx/mainline.nix { zlib = zlib-ng.override { withZlibCompat = true; }; openssl = openssl_3_0; + pcre = pcre2; withKTLS = true; withPerl = false; # We don't use `with` statement here on purpose! From 3a8981f1846fac23d8624be07f3792749b655ed2 Mon Sep 17 00:00:00 2001 From: ajs124 Date: Fri, 27 May 2022 18:37:54 +0200 Subject: [PATCH 4/5] nginxQuic: update (cherry picked from commit c26e3354a7e8f5233f2a8d3755edbe4262193dae) --- pkgs/servers/http/nginx/quic.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/http/nginx/quic.nix b/pkgs/servers/http/nginx/quic.nix index 4db1b19644c3..8743d31939be 100644 --- a/pkgs/servers/http/nginx/quic.nix +++ b/pkgs/servers/http/nginx/quic.nix @@ -6,8 +6,8 @@ callPackage ./generic.nix args { src = fetchhg { url = "https://hg.nginx.org/nginx-quic"; - rev = "55b38514729b"; # branch=quic - sha256 = "sha256-EJ3Fuxb4Z43I5eSb3mzzIOBfppAZ4Adv1yVZWbVCv0A="; + rev = "5b1011b5702b"; # branch=quic + sha256 = "sha256-q1gsJ6CJ7SD1XLitygnRusJ+exFPFg+B3wdsN+NvuL8="; }; preConfigure = '' From 70fda42f22f4cf15920fc7772a461dd6923f718d Mon Sep 17 00:00:00 2001 From: ajs124 Date: Mon, 30 May 2022 11:57:10 +0200 Subject: [PATCH 5/5] nixos/nginx: fix SystemCallFilter for openresty (cherry picked from commit 30186896ee517990e51c5256b589c0224c971670) --- nixos/modules/services/web-servers/nginx/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 0c2333399e81..160d76597c88 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -932,7 +932,7 @@ in # System Call Filtering SystemCallArchitectures = "native"; SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] - ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ]; + ++ optionals ((cfg.package != pkgs.tengine) && (cfg.package != pkgs.openresty) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ]; }; };