commit dc526c90102aa451d4dbc29bd462bc707945e6b3 Author: CentOS Sources Date: Tue Nov 15 01:41:48 2022 -0500 import nginx-1.20.1-13.el9 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..364a91d --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +SOURCES/maxim.key +SOURCES/mdounin.key +SOURCES/nginx-1.20.1.tar.gz +SOURCES/sb.key diff --git a/.nginx.metadata b/.nginx.metadata new file mode 100644 index 0000000..6ade8c8 --- /dev/null +++ b/.nginx.metadata @@ -0,0 +1,4 @@ +fe1bb3869c51a54f28e7e7a2c1d8a790a2ca7789 SOURCES/maxim.key +145bf87154a2689f7c09a376c11f307012a439de SOURCES/mdounin.key +6b4ab4eff3c617e133819f43fdfc14708e593a79 SOURCES/nginx-1.20.1.tar.gz +baa71c22e4e2b67be2a5f4f4df25a99962488f90 SOURCES/sb.key diff --git a/SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch b/SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch new file mode 100644 index 0000000..2695031 --- /dev/null +++ b/SOURCES/0001-remove-Werror-in-upstream-build-scripts.patch @@ -0,0 +1,31 @@ +From 00cab63102084b89de0a3494a1d023c4b1d4982b Mon Sep 17 00:00:00 2001 +From: Felix Kaechele +Date: Sun, 7 Jun 2020 12:14:02 -0400 +Subject: [PATCH 1/2] remove Werror in upstream build scripts + +removes -Werror in upstream build scripts. -Werror conflicts with +-D_FORTIFY_SOURCE=2 causing warnings to turn into errors. + +Signed-off-by: Felix Kaechele +--- + auto/cc/gcc | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/auto/cc/gcc b/auto/cc/gcc +index a5c5c18..cdbbadb 100644 +--- a/auto/cc/gcc ++++ b/auto/cc/gcc +@@ -166,7 +166,9 @@ esac + + + # stop on warning +-CFLAGS="$CFLAGS -Werror" ++# This combined with Fedora's FORTIFY_SOURCE=2 option causes it nginx ++# to not compile. ++#CFLAGS="$CFLAGS -Werror" + + # debug + CFLAGS="$CFLAGS -g" +-- +2.31.1 + diff --git a/SOURCES/0002-fix-PIDFile-handling.patch b/SOURCES/0002-fix-PIDFile-handling.patch new file mode 100644 index 0000000..5748b63 --- /dev/null +++ b/SOURCES/0002-fix-PIDFile-handling.patch @@ -0,0 +1,108 @@ +From 62470498cca9a209aa9904668c1949f5229123af Mon Sep 17 00:00:00 2001 +From: Felix Kaechele +Date: Tue, 20 Apr 2021 21:28:18 -0400 +Subject: [PATCH 2/2] fix PIDFile handling + +Corresponding RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1869026 + +Rejected upstream: https://trac.nginx.org/nginx/ticket/1897 + +Taken from: https://git.launchpad.net/ubuntu/+source/nginx/tree/debian/patches/nginx-fix-pidfile.patch + +From original patch: +Author: Tj +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1581864 +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876365 +iLast-Update: 2020-06-24 + +Signed-off-by: Felix Kaechele +--- + src/core/nginx.c | 24 +++++++++++++++++++++--- + src/os/unix/ngx_daemon.c | 8 ++++++-- + 2 files changed, 27 insertions(+), 5 deletions(-) + +diff --git a/src/core/nginx.c b/src/core/nginx.c +index 48a20e9..32c0afe 100644 +--- a/src/core/nginx.c ++++ b/src/core/nginx.c +@@ -339,14 +339,21 @@ main(int argc, char *const *argv) + ngx_process = NGX_PROCESS_MASTER; + } + ++ /* tell-tale to detect if this is parent or child process */ ++ ngx_int_t child_pid = NGX_BUSY; ++ + #if !(NGX_WIN32) + + if (ngx_init_signals(cycle->log) != NGX_OK) { + return 1; + } + ++ /* tell-tale that this code has been executed */ ++ child_pid--; ++ + if (!ngx_inherited && ccf->daemon) { +- if (ngx_daemon(cycle->log) != NGX_OK) { ++ child_pid = ngx_daemon(cycle->log); ++ if (child_pid == NGX_ERROR) { + return 1; + } + +@@ -359,8 +366,19 @@ main(int argc, char *const *argv) + + #endif + +- if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) { +- return 1; ++ /* If ngx_daemon() returned the child's PID in the parent process ++ * after the fork() set ngx_pid to the child_pid, which gets ++ * written to the PID file, then exit. ++ * For NGX_WIN32 always write the PID file ++ * For others, only write it from the parent process */ ++ if (child_pid < NGX_OK || child_pid > NGX_OK) { ++ ngx_pid = child_pid > NGX_OK ? child_pid : ngx_pid; ++ if (ngx_create_pidfile(&ccf->pid, cycle->log) != NGX_OK) { ++ return 1; ++ } ++ } ++ if (child_pid > NGX_OK) { ++ exit(0); + } + + if (ngx_log_redirect_stderr(cycle) != NGX_OK) { +diff --git a/src/os/unix/ngx_daemon.c b/src/os/unix/ngx_daemon.c +index 385c49b..3719854 100644 +--- a/src/os/unix/ngx_daemon.c ++++ b/src/os/unix/ngx_daemon.c +@@ -7,14 +7,17 @@ + + #include + #include ++#include + + + ngx_int_t + ngx_daemon(ngx_log_t *log) + { + int fd; ++ /* retain the return value for passing back to caller */ ++ pid_t pid_child = fork(); + +- switch (fork()) { ++ switch (pid_child) { + case -1: + ngx_log_error(NGX_LOG_EMERG, log, ngx_errno, "fork() failed"); + return NGX_ERROR; +@@ -23,7 +26,8 @@ ngx_daemon(ngx_log_t *log) + break; + + default: +- exit(0); ++ /* let caller do the exit() */ ++ return pid_child; + } + + ngx_parent = ngx_pid; +-- +2.31.1 + diff --git a/SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch b/SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch new file mode 100644 index 0000000..2d09c16 --- /dev/null +++ b/SOURCES/0003-Support-loading-cert-hardware-token-PKC.patch @@ -0,0 +1,88 @@ +From 4e5f12d6584536ead82d20554d8f3f2ab0107b0b Mon Sep 17 00:00:00 2001 +From: Lubos Uhliarik +Date: Fri, 30 Apr 2021 13:07:45 +0000 +Subject: [PATCH 3/3] Support loading certificates from hardware token (PKCS#11) + +--- + src/event/ngx_event_openssl.c | 65 +++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index d762d6b..270b200 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -617,6 +617,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert, + X509 *x509, *temp; + u_long n; + ++ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) { ++ ++#ifndef OPENSSL_NO_ENGINE ++ ++ u_char *p, *last; ++ ENGINE *engine; ++ ++ p = cert->data + sizeof("engine:") - 1; ++ last = (u_char *) ngx_strchr(p, ':'); ++ ++ if (last == NULL) { ++ *err = "invalid syntax"; ++ return NULL; ++ } ++ ++ *last = '\0'; ++ ++ engine = ENGINE_by_id((char *) p); ++ ++ if (engine == NULL) { ++ *err = "ENGINE_by_id() failed"; ++ return NULL; ++ } ++ ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ *last++ = ':'; ++ ++ struct { ++ const char *cert_id; ++ X509 *cert; ++ } params = { (char *) last, NULL }; ++ ++ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) { ++ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ ++ ENGINE_finish(engine); ++ ENGINE_free(engine); ++ ++ /* set chain to null */ ++ ++ *chain = sk_X509_new_null(); ++ if (*chain == NULL) { ++ *err = "sk_X509_new_null() failed"; ++ X509_free(params.cert); ++ return NULL; ++ } ++ ++ return params.cert; ++ ++#else ++ ++ *err = "loading \"engine:...\" certificate is not supported"; ++ return NULL; ++ ++#endif ++ } ++ + if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) { + + bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1, +-- +2.26.3 + diff --git a/SOURCES/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch b/SOURCES/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch new file mode 100644 index 0000000..e59dd58 --- /dev/null +++ b/SOURCES/0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch @@ -0,0 +1,26 @@ +From 80c0ee172cceaef933ff5a451ec2a16213e03996 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 22 Sep 2021 15:55:39 +0200 +Subject: [PATCH] Set proper compiler optimalization level (O2) for perl + module. + +--- + src/http/modules/perl/Makefile.PL | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/http/modules/perl/Makefile.PL b/src/http/modules/perl/Makefile.PL +index 7edadcb..2ebb7c4 100644 +--- a/src/http/modules/perl/Makefile.PL ++++ b/src/http/modules/perl/Makefile.PL +@@ -14,7 +14,7 @@ WriteMakefile( + AUTHOR => 'Igor Sysoev', + + CCFLAGS => "$ENV{NGX_PM_CFLAGS}", +- OPTIMIZE => '-O', ++ OPTIMIZE => '-O2', + + LDDLFLAGS => "$ENV{NGX_PM_LDFLAGS}", + +-- +2.31.1 + diff --git a/SOURCES/0005-Init-openssl-engine-properly.patch b/SOURCES/0005-Init-openssl-engine-properly.patch new file mode 100644 index 0000000..99dc0a9 --- /dev/null +++ b/SOURCES/0005-Init-openssl-engine-properly.patch @@ -0,0 +1,41 @@ +From a769a35a6197c76390e1dd8f5054d426fbbbda05 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 22 Sep 2021 16:12:58 +0200 +Subject: [PATCH] Init openssl engine properly + +--- + src/event/ngx_event_openssl.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 270b200..f813458 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -798,16 +798,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err, + return NULL; + } + ++ if (!ENGINE_init(engine)) { ++ *err = "ENGINE_init() failed"; ++ ENGINE_free(engine); ++ return NULL; ++ } ++ + *last++ = ':'; + + pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0); + + if (pkey == NULL) { + *err = "ENGINE_load_private_key() failed"; ++ ENGINE_finish(engine); + ENGINE_free(engine); + return NULL; + } + ++ ENGINE_finish(engine); + ENGINE_free(engine); + + return pkey; +-- +2.31.1 + diff --git a/SOURCES/0006-Fix-ALPACA-security-issue.patch b/SOURCES/0006-Fix-ALPACA-security-issue.patch new file mode 100644 index 0000000..754e8cc --- /dev/null +++ b/SOURCES/0006-Fix-ALPACA-security-issue.patch @@ -0,0 +1,96 @@ +From ee8ea4f1c88a0393206769cd30a545dc3375f868 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Wed, 2 Feb 2022 20:14:55 +0100 +Subject: [PATCH] Fix ALPACA security issue + +--- + src/mail/ngx_mail.h | 3 +++ + src/mail/ngx_mail_core_module.c | 10 ++++++++++ + src/mail/ngx_mail_handler.c | 15 ++++++++++++++- + 3 files changed, 27 insertions(+), 1 deletion(-) + +diff --git a/src/mail/ngx_mail.h b/src/mail/ngx_mail.h +index b865a3b..76cae37 100644 +--- a/src/mail/ngx_mail.h ++++ b/src/mail/ngx_mail.h +@@ -115,6 +115,8 @@ typedef struct { + ngx_msec_t timeout; + ngx_msec_t resolver_timeout; + ++ ngx_uint_t max_errors; ++ + ngx_str_t server_name; + + u_char *file_name; +@@ -231,6 +233,7 @@ typedef struct { + ngx_uint_t command; + ngx_array_t args; + ++ ngx_uint_t errors; + ngx_uint_t login_attempt; + + /* used to parse POP3/IMAP/SMTP command */ +diff --git a/src/mail/ngx_mail_core_module.c b/src/mail/ngx_mail_core_module.c +index 4083124..115671c 100644 +--- a/src/mail/ngx_mail_core_module.c ++++ b/src/mail/ngx_mail_core_module.c +@@ -85,6 +85,13 @@ static ngx_command_t ngx_mail_core_commands[] = { + offsetof(ngx_mail_core_srv_conf_t, resolver_timeout), + NULL }, + ++ { ngx_string("max_errors"), ++ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, ++ ngx_conf_set_num_slot, ++ NGX_MAIL_SRV_CONF_OFFSET, ++ offsetof(ngx_mail_core_srv_conf_t, max_errors), ++ NULL }, ++ + ngx_null_command + }; + +@@ -163,6 +170,8 @@ ngx_mail_core_create_srv_conf(ngx_conf_t *cf) + cscf->timeout = NGX_CONF_UNSET_MSEC; + cscf->resolver_timeout = NGX_CONF_UNSET_MSEC; + ++ cscf->max_errors = NGX_CONF_UNSET_UINT; ++ + cscf->resolver = NGX_CONF_UNSET_PTR; + + cscf->file_name = cf->conf_file->file.name.data; +@@ -182,6 +191,7 @@ ngx_mail_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_msec_value(conf->resolver_timeout, prev->resolver_timeout, + 30000); + ++ ngx_conf_merge_uint_value(conf->max_errors, prev->max_errors, 5); + + ngx_conf_merge_str_value(conf->server_name, prev->server_name, ""); + +diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c +index 0aaa0e7..71b8151 100644 +--- a/src/mail/ngx_mail_handler.c ++++ b/src/mail/ngx_mail_handler.c +@@ -871,7 +871,20 @@ ngx_mail_read_command(ngx_mail_session_t *s, ngx_connection_t *c) + return NGX_MAIL_PARSE_INVALID_COMMAND; + } + +- if (rc == NGX_IMAP_NEXT || rc == NGX_MAIL_PARSE_INVALID_COMMAND) { ++ if (rc == NGX_MAIL_PARSE_INVALID_COMMAND) { ++ ++ s->errors++; ++ ++ if (s->errors >= cscf->max_errors) { ++ ngx_log_error(NGX_LOG_INFO, c->log, 0, ++ "client sent too many invalid commands"); ++ s->quit = 1; ++ } ++ ++ return rc; ++ } ++ ++ if (rc == NGX_IMAP_NEXT) { + return rc; + } + +-- +2.31.1 + diff --git a/SOURCES/0007-Enable-TLSv1.3-by-default.patch b/SOURCES/0007-Enable-TLSv1.3-by-default.patch new file mode 100644 index 0000000..c8bac0b --- /dev/null +++ b/SOURCES/0007-Enable-TLSv1.3-by-default.patch @@ -0,0 +1,173 @@ +From cc7b92c61a2833ff9dc2b4dfba4591966769da78 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= +Date: Tue, 21 Jun 2022 13:55:04 +0200 +Subject: [PATCH] Enable TLSv1.3 by default in nginx + +--- + src/event/ngx_event_openssl.c | 77 ++++++++++++++------------ + src/event/ngx_event_openssl.h | 1 + + src/http/modules/ngx_http_ssl_module.c | 3 +- + src/mail/ngx_mail_ssl_module.c | 3 +- + src/stream/ngx_stream_ssl_module.c | 3 +- + 5 files changed, 46 insertions(+), 41 deletions(-) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index f813458..2e6a6c0 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log) + ngx_int_t + ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + { ++ ngx_uint_t prot = NGX_SSL_NO_PROT; ++ + ssl->ctx = SSL_CTX_new(SSLv23_method()); + + if (ssl->ctx == NULL) { +@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) + + SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); + +-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL +- /* only in 0.9.8m+ */ +- SSL_CTX_clear_options(ssl->ctx, +- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1); +-#endif +- +- if (!(protocols & NGX_SSL_SSLv2)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2); +- } +- if (!(protocols & NGX_SSL_SSLv3)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3); +- } +- if (!(protocols & NGX_SSL_TLSv1)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1); +- } +-#ifdef SSL_OP_NO_TLSv1_1 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1); +- if (!(protocols & NGX_SSL_TLSv1_1)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1); +- } ++ if (protocols){ ++#ifdef SSL_OP_NO_TLSv1_3 ++ if (protocols & NGX_SSL_TLSv1_3) { ++ prot = TLS1_3_VERSION; ++ } else + #endif + #ifdef SSL_OP_NO_TLSv1_2 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2); +- if (!(protocols & NGX_SSL_TLSv1_2)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2); +- } ++ if (protocols & NGX_SSL_TLSv1_2) { ++ prot = TLS1_2_VERSION; ++ } else + #endif +-#ifdef SSL_OP_NO_TLSv1_3 +- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3); +- if (!(protocols & NGX_SSL_TLSv1_3)) { +- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3); +- } ++#ifdef SSL_OP_NO_TLSv1_1 ++ if (protocols & NGX_SSL_TLSv1_1) { ++ prot = TLS1_1_VERSION; ++ } else + #endif ++ if (protocols & NGX_SSL_TLSv1) { ++ prot = TLS1_VERSION; ++ } ++ ++ if (prot == NGX_SSL_NO_PROT) { ++ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, ++ "No SSL protocols available [hint: ssl_protocols]"); ++ return NGX_ERROR; ++ } + +-#ifdef SSL_CTX_set_min_proto_version +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION); ++ SSL_CTX_set_max_proto_version(ssl->ctx, prot); ++ ++ /* Now, we have to scan for minimal protocol version, ++ *without allowing holes between min and max*/ ++#ifdef SSL_OP_NO_TLSv1_3 ++ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) { ++ prot = TLS1_2_VERSION; ++ } + #endif + +-#ifdef TLS1_3_VERSION +- SSL_CTX_set_min_proto_version(ssl->ctx, 0); +- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION); ++#ifdef SSL_OP_NO_TLSv1_1 ++ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) { ++ prot = TLS1_1_VERSION; ++ } ++#endif ++#ifdef SSL_OP_NO_TLSv1_2 ++ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) { ++ prot = TLS1_VERSION; ++ } + #endif ++ SSL_CTX_set_min_proto_version(ssl->ctx, prot); ++ } + + #ifdef SSL_OP_NO_COMPRESSION + SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); +diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h +index 329760d..5cee113 100644 +--- a/src/event/ngx_event_openssl.h ++++ b/src/event/ngx_event_openssl.h +@@ -152,6 +152,7 @@ typedef struct { + #endif + + ++#define NGX_SSL_NO_PROT 0x0000 + #define NGX_SSL_SSLv2 0x0002 + #define NGX_SSL_SSLv3 0x0004 + #define NGX_SSL_TLSv1 0x0008 +diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c +index a47d696..94f30db 100644 +--- a/src/http/modules/ngx_http_ssl_module.c ++++ b/src/http/modules/ngx_http_ssl_module.c +@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) + ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0) + + ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, + NGX_SSL_BUFSIZE); +diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c +index 7eae83e..8328560 100644 +--- a/src/mail/ngx_mail_ssl_module.c ++++ b/src/mail/ngx_mail_ssl_module.c +@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + prev->prefer_server_ciphers, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0); + + ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); + ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); +diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c +index d8c0471..cef590d 100644 +--- a/src/stream/ngx_stream_ssl_module.c ++++ b/src/stream/ngx_stream_ssl_module.c +@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) + prev->prefer_server_ciphers, 0); + + ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, +- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 +- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); ++ 0); + + ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); + ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); +-- +2.31.1 + diff --git a/SOURCES/404.html b/SOURCES/404.html new file mode 100644 index 0000000..c6014a7 --- /dev/null +++ b/SOURCES/404.html @@ -0,0 +1,120 @@ + + + + + The page is not found + + + + + +

nginx error!

+ +
+ +

The page you are looking for is not found.

+ +
+

Website Administrator

+
+

Something has triggered missing webpage on your + website. This is the default 404 error page for + nginx that is distributed with + Red Hat Enterprise Linux. It is located + /usr/share/nginx/html/404.html

+ +

You should customize this error page for your own + site or edit the error_page directive in + the nginx configuration file + /etc/nginx/nginx.conf.

+ +

For information on Red Hat Enterprise Linux, please visit the Red Hat, Inc. website. The documentation for Red Hat Enterprise Linux is available on the Red Hat, Inc. website.

+ +
+
+ +
+ [ Powered by nginx ] + [ Powered by Red Hat Enterprise Linux ] +
+
+ + diff --git a/SOURCES/50x.html b/SOURCES/50x.html new file mode 100644 index 0000000..5d8d957 --- /dev/null +++ b/SOURCES/50x.html @@ -0,0 +1,120 @@ + + + + + The page is temporarily unavailable + + + + + +

nginx error!

+ +
+ +

The page you are looking for is temporarily unavailable. Please try again later.

+ +
+

Website Administrator

+
+

Something has triggered missing webpage on your + website. This is the default error page for + nginx that is distributed with + Red Hat Enterprise Linux. It is located + /usr/share/nginx/html/50x.html

+ +

You should customize this error page for your own + site or edit the error_page directive in + the nginx configuration file + /etc/nginx/nginx.conf.

+ +

For information on Red Hat Enterprise Linux, please visit the Red Hat, Inc. website. The documentation for Red Hat Enterprise Linux is available on the Red Hat, Inc. website.

+ +
+
+ +
+ [ Powered by nginx ] + [ Powered by Red Hat Enterprise Linux ] +
+
+ + diff --git a/SOURCES/README.dynamic b/SOURCES/README.dynamic new file mode 100644 index 0000000..59f03f6 --- /dev/null +++ b/SOURCES/README.dynamic @@ -0,0 +1,20 @@ +############### +Dynamic modules +############### + +Dynamic modules are loaded using the "load_modules" directive. The RPM package +for each module has a '.conf' file in the /usr/share/nginx/modules directory. +The '.conf' file contains a single "load_modules" directive. + +This means that whenever a new dynamic module is installed, it will +automatically be enabled and Nginx will be reloaded. + +-------------------------------------------------------- +Prevent dynamic modules from being enabled automatically +-------------------------------------------------------- + +You may want to avoid dynamic modules being enabled automatically. Simply +remove this line from the top of /etc/nginx/nginx.conf: + + include /usr/lib64/nginx/modules/*.conf; + diff --git a/SOURCES/UPGRADE-NOTES-1.6-to-1.10 b/SOURCES/UPGRADE-NOTES-1.6-to-1.10 new file mode 100644 index 0000000..65760bf --- /dev/null +++ b/SOURCES/UPGRADE-NOTES-1.6-to-1.10 @@ -0,0 +1,88 @@ +############# +Upgrade notes +############# + +To resolve numerous security flaws, the nginx package was updated to 1.10.x. + +You should review your configuration files in /etc/nginx to determine if there +are any incompatibilities. Below is a summary of the main incompatible changes. +Some nginx directives have been changed or removed, so you may need to modify +your configuration. + +Please see upstream release notes for a complete list of new features, +bug fixes, and changes: http://nginx.org/en/CHANGES-1.10 +One notable feature is support for HTTP/2. + +Nginx gained support for dynamic modules. As part of this update, dynamic +modules have been split into subpackages. For the time being these are hard +dependencies to aid the upgrade path. When you install nginx, all of these +modules are installed and enabled by default: + - nginx-mod-http-geoip + - nginx-mod-http-image-filter + - nginx-mod-http-perl + - nginx-mod-http-xslt-filter + - nginx-mod-mail + - nginx-mod-stream + +Changes with nginx 1.10.x + + *) Change: non-idempotent requests (POST, LOCK, PATCH) are no longer + passed to the next server by default if a request has been sent to a + backend; the "non_idempotent" parameter of the "proxy_next_upstream" + directive explicitly allows retrying such requests. + + *) Change: now the "output_buffers" directive uses two buffers by + default. + + *) Change: now nginx limits subrequests recursion, not simultaneous + subrequests. + + *) Change: now nginx checks the whole cache key when returning a + response from cache. + Thanks to Gena Makhomed and Sergey Brester. + + *) Change: the "proxy_downstream_buffer" and "proxy_upstream_buffer" + directives of the stream module are replaced with the + "proxy_buffer_size" directive. + + *) Change: duplicate "http", "mail", and "stream" blocks are now + disallowed. + + *) Change: now SSLv3 protocol is disabled by default. + + *) Change: some long deprecated directives are not supported anymore. + + *) Change: obsolete aio and rtsig event methods have been removed. + +Changes with nginx 1.8.x + + *) Change: the "sendfile" parameter of the "aio" directive is + deprecated; now nginx automatically uses AIO to pre-load data for + sendfile if both "aio" and "sendfile" directives are used. + + *) Change: now the "If-Modified-Since", "If-Range", etc. client request + header lines are passed to a backend while caching if nginx knows in + advance that the response will not be cached (e.g., when using + proxy_cache_min_uses). + + *) Change: now after proxy_cache_lock_timeout nginx sends a request to a + backend with caching disabled; the new directives + "proxy_cache_lock_age", "fastcgi_cache_lock_age", + "scgi_cache_lock_age", and "uwsgi_cache_lock_age" specify a time + after which the lock will be released and another attempt to cache a + response will be made. + + *) Change: the "log_format" directive can now be used only at http + level. + + *) Change: now nginx takes into account the "Vary" header line in a + backend response while caching. + + *) Change: the deprecated "limit_zone" directive is not supported + anymore. + + *) Change: now the "stub_status" directive does not require a parameter. + + *) Change: URI escaping now uses uppercase hexadecimal digits. + Thanks to Piotr Sikora. + diff --git a/SOURCES/macros.nginxmods.in b/SOURCES/macros.nginxmods.in new file mode 100644 index 0000000..9b612b2 --- /dev/null +++ b/SOURCES/macros.nginxmods.in @@ -0,0 +1,20 @@ +%_nginx_abiversion @@NGINX_ABIVERSION@@ +%_nginx_srcdir @@NGINX_SRCDIR@@ +%_nginx_buildsrcdir nginx-src +%_nginx_modsrcdir .. +%_nginx_modbuilddir ../%{_vpath_builddir} +%nginx_moddir @@NGINX_MODDIR@@ +%nginx_modconfdir @@NGINX_MODCONFDIR@@ + +%nginx_modrequires Requires: nginx(abi) = %{_nginx_abiversion} + +%nginx_modconfigure(:-:) \\\ + %undefine _strict_symbol_defs_build \ + cp -a "%{_nginx_srcdir}" "%{_nginx_buildsrcdir}" \ + cd "%{_nginx_buildsrcdir}" \ + nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" \ + ./configure --with-compat --with-cc-opt="%{optflags} $(pcre-config --cflags)" --with-ld-opt="$nginx_ldopts" \\\ + --add-dynamic-module=$(realpath %{_nginx_modsrcdir}) --builddir=$(realpath %{_nginx_modbuilddir}) %{**} \ + cd - + +%nginx_modbuild %{__make} -C "%{_nginx_buildsrcdir}" %{_make_output_sync} %{?_smp_mflags} %{_make_verbose} modules diff --git a/SOURCES/nginx-1.20.1.tar.gz.asc b/SOURCES/nginx-1.20.1.tar.gz.asc new file mode 100644 index 0000000..70729d2 --- /dev/null +++ b/SOURCES/nginx-1.20.1.tar.gz.asc @@ -0,0 +1,10 @@ +-----BEGIN PGP SIGNATURE----- + +iQEcBAABCAAGBQJgrPDQAAoJEFIKmZOhwFL4dlIH/RFvUn4wiazXVujdm1df2/Q5 +b+NVlr+O9WZ2Mb35dooOshG/G2wVjI95Cd5NU6svulJ05uv6tGgHA0CUZP6PLqIm +4os5QcgbEbfdDbfQEw7wyc831DqiBPwzk/xt954vsqwzX3mkXvUNTEYpynguwN1J +2iMb/bFRSlLZkKGbKOmLMO7iav0r88qtpmQIzG1mFTDg3leH0q3hEMAJl7pIicYd +Of3+/EHnM8CXORtA1q6YTLbcHAzhSmjdrMyw+RQGQkxoPtdj9vwL4Z6Wk8+6dDK7 +dVBaiKp80tDM/iJizPbkbrBVbnR/9W48+QBC7tmOJMuj2c1Q/kvwJg9CLyHlqCU= +=tPti +-----END PGP SIGNATURE----- diff --git a/SOURCES/nginx-logo.png b/SOURCES/nginx-logo.png new file mode 100644 index 0000000..638b499 Binary files /dev/null and b/SOURCES/nginx-logo.png differ diff --git a/SOURCES/nginx-upgrade b/SOURCES/nginx-upgrade new file mode 100644 index 0000000..f84d91a --- /dev/null +++ b/SOURCES/nginx-upgrade @@ -0,0 +1,19 @@ +#!/bin/sh +[ ! -f /run/nginx.pid ] && exit 1 +echo "Start new nginx master..." +/bin/systemctl kill --signal=SIGUSR2 nginx.service +sleep 5 +[ ! -f /run/nginx.pid.oldbin ] && sleep 10 +if [ ! -f /run/nginx.pid.oldbin ]; then + echo "Failed to start new nginx master." + exit 1 +fi +echo "Stop old nginx master gracefully..." +oldpid=`/usr/bin/cat /run/nginx.pid.oldbin 2>/dev/null` +/bin/kill -s QUIT $oldpid 2>/dev/null +sleep 5 +[ -f /run/nginx.pid.oldbin ] && sleep 10 +if [ -f /run/nginx.pid.oldbin ]; then + echo "Failed to stop old nginx master." + exit 1 +fi diff --git a/SOURCES/nginx-upgrade.8 b/SOURCES/nginx-upgrade.8 new file mode 100644 index 0000000..2a435ab --- /dev/null +++ b/SOURCES/nginx-upgrade.8 @@ -0,0 +1,151 @@ +.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16) +.\" +.\" Standard preamble: +.\" ======================================================================== +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Vb \" Begin verbatim text +.ft CW +.nf +.ne \\$1 +.. +.de Ve \" End verbatim text +.ft R +.fi +.. +.\" Set up some character translations and predefined strings. \*(-- will +.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +.\" double quote, and \*(R" will give a right double quote. \*(C+ will +.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +.\" nothing in troff, for use with C<>. +.tr \(*W- +.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +.ie n \{\ +. ds -- \(*W- +. ds PI pi +. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +. ds L" "" +. ds R" "" +. ds C` "" +. ds C' "" +'br\} +.el\{\ +. ds -- \|\(em\| +. ds PI \(*p +. ds L" `` +. ds R" '' +'br\} +.\" +.\" Escape single quotes in literal strings from groff's Unicode transform. +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" +.\" If the F register is turned on, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. +.ie \nF \{\ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" +.. +. nr % 0 +. rr F +.\} +.el \{\ +. de IX +.. +.\} +.\" +.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +.\" Fear. Run. Save yourself. No user-serviceable parts. +. \" fudge factors for nroff and troff +.if n \{\ +. ds #H 0 +. ds #V .8m +. ds #F .3m +. ds #[ \f1 +. ds #] \fP +.\} +.if t \{\ +. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +. ds #V .6m +. ds #F 0 +. ds #[ \& +. ds #] \& +.\} +. \" simple accents for nroff and troff +.if n \{\ +. ds ' \& +. ds ` \& +. ds ^ \& +. ds , \& +. ds ~ ~ +. ds / +.\} +.if t \{\ +. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' +.\} +. \" troff and (daisy-wheel) nroff accents +.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' +.ds 8 \h'\*(#H'\(*b\h'-\*(#H' +.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] +.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' +.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' +.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] +.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] +.ds ae a\h'-(\w'a'u*4/10)'e +.ds Ae A\h'-(\w'A'u*4/10)'E +. \" corrections for vroff +.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' +.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' +. \" for low resolution devices (crt and lpr) +.if \n(.H>23 .if \n(.V>19 \ +\{\ +. ds : e +. ds 8 ss +. ds o a +. ds d- d\h'-1'\(ga +. ds D- D\h'-1'\(hy +. ds th \o'bp' +. ds Th \o'LP' +. ds ae ae +. ds Ae AE +.\} +.rm #[ #] #H #V #F C +.\" ======================================================================== +.\" +.IX Title "NGINX-UPGRADE 8" +.TH NGINX-UPGRADE 8 "2012-10-28" " " " " +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.if n .ad l +.nh +.SH "NAME" +nginx\-upgrade \- tool to upgrade nginx without any downtime +.SH "SYNOPSIS" +.IX Header "SYNOPSIS" +\&\fInginx-upgrade\fR +.SH "DESCRIPTION" +.IX Header "DESCRIPTION" +This downstream shell script updates nginx without any downtime. After +upgrading nginx via the package manager, running this script will create +a new nginx master. This master takes over all new requests. The old +masters and workers are then gracefully shutdown without breaking any +existing connections. +.PP +For further information, see: +.SH "BUGS" +.IX Header "BUGS" +If you find any bugs, please send an email to the author. +.SH "AUTHOR" +.IX Header "AUTHOR" +Jamie Nguyen diff --git a/SOURCES/nginx.conf b/SOURCES/nginx.conf new file mode 100644 index 0000000..3cfe698 --- /dev/null +++ b/SOURCES/nginx.conf @@ -0,0 +1,84 @@ +# For more information on configuration, see: +# * Official English Documentation: http://nginx.org/en/docs/ +# * Official Russian Documentation: http://nginx.org/ru/docs/ + +user nginx; +worker_processes auto; +error_log /var/log/nginx/error.log; +pid /run/nginx.pid; + +# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. +include /usr/share/nginx/modules/*.conf; + +events { + worker_connections 1024; +} + +http { + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 4096; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + # Load modular configuration files from the /etc/nginx/conf.d directory. + # See http://nginx.org/en/docs/ngx_core_module.html#include + # for more information. + include /etc/nginx/conf.d/*.conf; + + server { + listen 80; + listen [::]:80; + server_name _; + root /usr/share/nginx/html; + + # Load configuration files for the default server block. + include /etc/nginx/default.d/*.conf; + + error_page 404 /404.html; + location = /404.html { + } + + error_page 500 502 503 504 /50x.html; + location = /50x.html { + } + } + +# Settings for a TLS enabled server. +# +# server { +# listen 443 ssl http2; +# listen [::]:443 ssl http2; +# server_name _; +# root /usr/share/nginx/html; +# +# ssl_certificate "/etc/pki/nginx/server.crt"; +# ssl_certificate_key "/etc/pki/nginx/private/server.key"; +# ssl_session_cache shared:SSL:1m; +# ssl_session_timeout 10m; +# ssl_ciphers PROFILE=SYSTEM; +# ssl_prefer_server_ciphers on; +# +# # Load configuration files for the default server block. +# include /etc/nginx/default.d/*.conf; +# +# error_page 404 /404.html; +# location = /40x.html { +# } +# +# error_page 500 502 503 504 /50x.html; +# location = /50x.html { +# } +# } + +} + diff --git a/SOURCES/nginx.logrotate b/SOURCES/nginx.logrotate new file mode 100644 index 0000000..2fef5aa --- /dev/null +++ b/SOURCES/nginx.logrotate @@ -0,0 +1,13 @@ +/var/log/nginx/*log { + daily + rotate 10 + missingok + notifempty + compress + delaycompress + sharedscripts + postrotate + /bin/kill -USR1 `cat /run/nginx.pid 2>/dev/null` 2>/dev/null || true + endscript +} + diff --git a/SOURCES/nginx.service b/SOURCES/nginx.service new file mode 100644 index 0000000..b8e73a5 --- /dev/null +++ b/SOURCES/nginx.service @@ -0,0 +1,22 @@ +[Unit] +Description=The nginx HTTP and reverse proxy server +After=network-online.target remote-fs.target nss-lookup.target +Wants=network-online.target + +[Service] +Type=forking +PIDFile=/run/nginx.pid +# Nginx will fail to start if /run/nginx.pid already exists but has the wrong +# SELinux context. This might happen when running `nginx -t` from the cmdline. +# https://bugzilla.redhat.com/show_bug.cgi?id=1268621 +ExecStartPre=/usr/bin/rm -f /run/nginx.pid +ExecStartPre=/usr/sbin/nginx -t +ExecStart=/usr/sbin/nginx +ExecReload=/usr/sbin/nginx -s reload +KillSignal=SIGQUIT +TimeoutStopSec=5 +KillMode=mixed +PrivateTmp=true + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/nginxmods.attr b/SOURCES/nginxmods.attr new file mode 100644 index 0000000..102da1a --- /dev/null +++ b/SOURCES/nginxmods.attr @@ -0,0 +1,14 @@ +%__nginxmods_requires() %{lua: + -- Match buildroot paths of the form + -- /PATH/OF/BUILDROOT/usr/lib/nginx/modules/ and + -- /PATH/OF/BUILDROOT/usr/lib64/nginx/modules/ + -- generating a line of the form: + -- nginx(abi) = VERSION + local path = rpm.expand("%1") + if path:match("/usr/lib%d*/nginx/modules/.*") then + local requires = "nginx(abi) = " .. rpm.expand("%{_nginx_abiversion}") + print(requires) + end +} + +%__nginxmods_path ^%{_prefix}/lib(64)?/nginx/modules/.*\\.so$ diff --git a/SPECS/nginx.spec b/SPECS/nginx.spec new file mode 100644 index 0000000..19bb1d1 --- /dev/null +++ b/SPECS/nginx.spec @@ -0,0 +1,1156 @@ +%global _hardened_build 1 +%global nginx_user nginx + +# Disable strict symbol checks in the link editor. +# See: https://src.fedoraproject.org/rpms/redhat-rpm-config/c/078af19 +%undefine _strict_symbol_defs_build + +%bcond_with geoip + +# nginx gperftools support should be dissabled for RHEL >= 8 +# see: https://bugzilla.redhat.com/show_bug.cgi?id=1931402 +%if 0%{?rhel} >= 8 +%global with_gperftools 0 +%else +# gperftools exist only on selected arches +# gperftools *detection* is failing on ppc64*, possibly only configure +# bug, but disable anyway. +%ifnarch s390 s390x ppc64 ppc64le +%global with_gperftools 1 +%endif +%endif + +%global with_aio 1 + +%if 0%{?fedora} > 22 +%global with_mailcap_mimetypes 1 +%endif + +# Cf. https://www.nginx.com/blog/creating-installable-packages-dynamic-modules/ +%global nginx_abiversion %{version} + +%global nginx_moduledir %{_libdir}/nginx/modules +%global nginx_moduleconfdir %{_datadir}/nginx/modules +%global nginx_srcdir %{_usrsrc}/%{name}-%{version}-%{release} + +# Do not generate provides/requires from nginx sources +%global __provides_exclude_from ^%{nginx_srcdir}/.*$ +%global __requires_exclude_from ^%{nginx_srcdir}/.*$ + + +Name: nginx +Epoch: 1 +Version: 1.20.1 +Release: 13%{?dist} + +Summary: A high performance web server and reverse proxy server +# BSD License (two clause) +# http://www.freebsd.org/copyright/freebsd-license.html +License: BSD +URL: https://nginx.org + +Source0: https://nginx.org/download/nginx-%{version}.tar.gz +Source1: https://nginx.org/download/nginx-%{version}.tar.gz.asc +# Keys are found here: https://nginx.org/en/pgp_keys.html +Source2: https://nginx.org/keys/maxim.key +Source3: https://nginx.org/keys/mdounin.key +Source4: https://nginx.org/keys/sb.key +Source10: nginx.service +Source11: nginx.logrotate +Source12: nginx.conf +Source13: nginx-upgrade +Source14: nginx-upgrade.8 +Source15: macros.nginxmods.in +Source16: nginxmods.attr +Source102: nginx-logo.png +Source103: 404.html +Source104: 50x.html +Source200: README.dynamic +Source210: UPGRADE-NOTES-1.6-to-1.10 + +# removes -Werror in upstream build scripts. -Werror conflicts with +# -D_FORTIFY_SOURCE=2 causing warnings to turn into errors. +Patch0: 0001-remove-Werror-in-upstream-build-scripts.patch + +# downstream patch - fix PIDFile race condition (rhbz#1869026) +# rejected upstream: https://trac.nginx.org/nginx/ticket/1897 +Patch1: 0002-fix-PIDFile-handling.patch + +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=1955564 +Patch2: 0003-Support-loading-cert-hardware-token-PKC.patch + +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2006822 +Patch3: 0004-Set-proper-compiler-optimalization-level-O2-for-perl.patch + +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2006420 +Patch4: 0005-Init-openssl-engine-properly.patch + +# upstream patch - fixing ALPACA(CVE-2021-3618) security issue - https://bugzilla.redhat.com/show_bug.cgi?id=1975623 +Patch5: 0006-Fix-ALPACA-security-issue.patch + +# downstream patch for RHEL - https://bugzilla.redhat.com/show_bug.cgi?id=2028781 +Patch6: 0007-Enable-TLSv1.3-by-default.patch + +BuildRequires: make +BuildRequires: gcc +BuildRequires: gnupg2 +%if 0%{?with_gperftools} +BuildRequires: gperftools-devel +%endif +%if 0%{?fedora} || 0%{?rhel} >= 8 +BuildRequires: openssl-devel +%else +BuildRequires: openssl11-devel +%endif +BuildRequires: pcre-devel +BuildRequires: zlib-devel + +Requires: nginx-filesystem = %{epoch}:%{version}-%{release} +%if 0%{?el7} +# centos-logos el7 does not provide 'system-indexhtml' +Requires: system-logos redhat-indexhtml +# need to remove epel7 geoip sub-package, doesn't work anymore +# https://bugzilla.redhat.com/show_bug.cgi?id=1576034 +# https://bugzilla.redhat.com/show_bug.cgi?id=1664957 +Obsoletes: nginx-mod-http-geoip <= 1:1.16 +%else +Requires: system-logos-httpd +%endif + +Requires: pcre +Provides: webserver +%if 0%{?fedora} || 0%{?rhel} >= 8 +Recommends: logrotate +%endif +Requires: %{name}-core = %{epoch}:%{version}-%{release} + +BuildRequires: systemd +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +# For external nginx modules +Provides: nginx(abi) = %{nginx_abiversion} + +%description +Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and +IMAP protocols, with a strong focus on high concurrency, performance and low +memory usage. + +%package core +Summary: nginx minimal core +%if 0%{?with_mailcap_mimetypes} +Requires: nginx-mimetypes +%endif +Requires: openssl-libs +Requires(pre): nginx-filesystem +Conflicts: nginx < 1:1.20.1-13 + +%description core +nginx minimal core + +%package all-modules +Summary: A meta package that installs all available Nginx modules +BuildArch: noarch + +%if %{with geoip} +Requires: nginx-mod-http-geoip = %{epoch}:%{version}-%{release} +%endif +Requires: nginx-mod-http-image-filter = %{epoch}:%{version}-%{release} +Requires: nginx-mod-http-perl = %{epoch}:%{version}-%{release} +Requires: nginx-mod-http-xslt-filter = %{epoch}:%{version}-%{release} +Requires: nginx-mod-mail = %{epoch}:%{version}-%{release} +Requires: nginx-mod-stream = %{epoch}:%{version}-%{release} + +%description all-modules +Meta package that installs all available nginx modules. + +%package filesystem +Summary: The basic directory layout for the Nginx server +BuildArch: noarch +Requires(pre): shadow-utils + +%description filesystem +The nginx-filesystem package contains the basic directory layout +for the Nginx server including the correct permissions for the +directories. + +%if %{with geoip} +%package mod-http-geoip +Summary: Nginx HTTP geoip module +BuildRequires: GeoIP-devel +Requires: nginx(abi) = %{nginx_abiversion} +Requires: GeoIP + +%description mod-http-geoip +%{summary}. +%endif + +%package mod-http-image-filter +Summary: Nginx HTTP image filter module +BuildRequires: gd-devel +Requires: nginx(abi) = %{nginx_abiversion} +Requires: gd + +%description mod-http-image-filter +%{summary}. + +%package mod-http-perl +Summary: Nginx HTTP perl module +BuildRequires: perl-devel +%if 0%{?fedora} >= 24 || 0%{?rhel} >= 7 +BuildRequires: perl-generators +%endif +BuildRequires: perl(ExtUtils::Embed) +Requires: nginx(abi) = %{nginx_abiversion} +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) +Requires: perl(constant) + +%description mod-http-perl +%{summary}. + +%package mod-http-xslt-filter +Summary: Nginx XSLT module +BuildRequires: libxslt-devel +Requires: nginx(abi) = %{nginx_abiversion} + +%description mod-http-xslt-filter +%{summary}. + +%package mod-mail +Summary: Nginx mail modules +Requires: nginx(abi) = %{nginx_abiversion} + +%description mod-mail +%{summary}. + +%package mod-stream +Summary: Nginx stream modules +Requires: nginx(abi) = %{nginx_abiversion} + +%description mod-stream +%{summary}. + +%package mod-devel +Summary: Nginx module development files +Requires: nginx = %{epoch}:%{version}-%{release} +Requires: make +Requires: gcc +Requires: gd-devel +%if 0%{?with_gperftools} +Requires: gperftools-devel +%endif +%if %{with geoip} +Requires: GeoIP-devel +%endif +Requires: libxslt-devel +%if 0%{?fedora} || 0%{?rhel} >= 8 +Requires: openssl-devel +%else +Requires: openssl11-devel +%endif +Requires: pcre-devel +Requires: perl-devel +Requires: perl(ExtUtils::Embed) +Requires: zlib-devel + +%description mod-devel +%{summary}. + + +%prep +# Combine all keys from upstream into one file +cat %{S:2} %{S:3} %{S:4} > %{_builddir}/%{name}.gpg +%{gpgverify} --keyring='%{_builddir}/%{name}.gpg' --signature='%{SOURCE1}' --data='%{SOURCE0}' +%autosetup -p1 +cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} . + +%if 0%{?rhel} > 0 && 0%{?rhel} < 8 +sed -i -e 's#KillMode=.*#KillMode=process#g' nginx.service +sed -i -e 's#PROFILE=SYSTEM#HIGH:!aNULL:!MD5#' nginx.conf +%endif + +%if 0%{?rhel} == 7 +sed \ + -e 's|\(ngx_feature_path=\)$|\1%{_includedir}/openssl11|' \ + -e 's|\(ngx_feature_libs="\)|\1-L%{_libdir}/openssl11 |' \ + -i auto/lib/openssl/conf +%endif + +# Prepare sources for installation +cp -a ../%{name}-%{version} ../%{name}-%{version}-%{release}-src +mv ../%{name}-%{version}-%{release}-src . + + +%build +# nginx does not utilize a standard configure script. It has its own +# and the standard configure options cause the nginx configure script +# to error out. This is is also the reason for the DESTDIR environment +# variable. +export DESTDIR=%{buildroot} +# So the perl module finds its symbols: +nginx_ldopts="$RPM_LD_FLAGS -Wl,-E" +if ! ./configure \ + --prefix=%{_datadir}/nginx \ + --sbin-path=%{_sbindir}/nginx \ + --modules-path=%{nginx_moduledir} \ + --conf-path=%{_sysconfdir}/nginx/nginx.conf \ + --error-log-path=%{_localstatedir}/log/nginx/error.log \ + --http-log-path=%{_localstatedir}/log/nginx/access.log \ + --http-client-body-temp-path=%{_localstatedir}/lib/nginx/tmp/client_body \ + --http-proxy-temp-path=%{_localstatedir}/lib/nginx/tmp/proxy \ + --http-fastcgi-temp-path=%{_localstatedir}/lib/nginx/tmp/fastcgi \ + --http-uwsgi-temp-path=%{_localstatedir}/lib/nginx/tmp/uwsgi \ + --http-scgi-temp-path=%{_localstatedir}/lib/nginx/tmp/scgi \ + --pid-path=/run/nginx.pid \ + --lock-path=/run/lock/subsys/nginx \ + --user=%{nginx_user} \ + --group=%{nginx_user} \ + --with-compat \ + --with-debug \ +%if 0%{?with_aio} + --with-file-aio \ +%endif +%if 0%{?with_gperftools} + --with-google_perftools_module \ +%endif + --with-http_addition_module \ + --with-http_auth_request_module \ + --with-http_dav_module \ + --with-http_degradation_module \ + --with-http_flv_module \ +%if %{with geoip} + --with-http_geoip_module=dynamic \ +%endif + --with-http_gunzip_module \ + --with-http_gzip_static_module \ + --with-http_image_filter_module=dynamic \ + --with-http_mp4_module \ + --with-http_perl_module=dynamic \ + --with-http_random_index_module \ + --with-http_realip_module \ + --with-http_secure_link_module \ + --with-http_slice_module \ + --with-http_ssl_module \ + --with-http_stub_status_module \ + --with-http_sub_module \ + --with-http_v2_module \ + --with-http_xslt_module=dynamic \ + --with-mail=dynamic \ + --with-mail_ssl_module \ + --with-pcre \ + --with-pcre-jit \ + --with-stream=dynamic \ + --with-stream_ssl_module \ + --with-stream_ssl_preread_module \ + --with-threads \ + --with-cc-opt="%{optflags} $(pcre-config --cflags)" \ + --with-ld-opt="$nginx_ldopts"; then + : configure failed + cat objs/autoconf.err + exit 1 +fi + +%make_build + + +%install +%make_install INSTALLDIRS=vendor + +find %{buildroot} -type f -name .packlist -exec rm -f '{}' \; +find %{buildroot} -type f -name perllocal.pod -exec rm -f '{}' \; +find %{buildroot} -type f -empty -exec rm -f '{}' \; +find %{buildroot} -type f -iname '*.so' -exec chmod 0755 '{}' \; + +install -p -D -m 0644 ./nginx.service \ + %{buildroot}%{_unitdir}/nginx.service +install -p -D -m 0644 %{SOURCE11} \ + %{buildroot}%{_sysconfdir}/logrotate.d/nginx + +install -p -d -m 0755 %{buildroot}%{_sysconfdir}/systemd/system/nginx.service.d +install -p -d -m 0755 %{buildroot}%{_unitdir}/nginx.service.d + +install -p -d -m 0755 %{buildroot}%{_sysconfdir}/nginx/conf.d +install -p -d -m 0755 %{buildroot}%{_sysconfdir}/nginx/default.d + +install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx +install -p -d -m 0700 %{buildroot}%{_localstatedir}/lib/nginx/tmp +install -p -d -m 0700 %{buildroot}%{_localstatedir}/log/nginx + +install -p -d -m 0755 %{buildroot}%{_datadir}/nginx/html +install -p -d -m 0755 %{buildroot}%{nginx_moduleconfdir} +install -p -d -m 0755 %{buildroot}%{nginx_moduledir} + + +install -p -m 0644 ./nginx.conf \ + %{buildroot}%{_sysconfdir}/nginx + +rm -f %{buildroot}%{_datadir}/nginx/html/index.html +%if 0%{?el7} +ln -s ../../doc/HTML/index.html \ + %{buildroot}%{_datadir}/nginx/html/index.html +ln -s ../../doc/HTML/img \ + %{buildroot}%{_datadir}/nginx/html/img +ln -s ../../doc/HTML/en-US \ + %{buildroot}%{_datadir}/nginx/html/en-US +%else +ln -s ../../testpage/index.html \ + %{buildroot}%{_datadir}/nginx/html/index.html +%endif +install -p -m 0644 %{SOURCE102} \ + %{buildroot}%{_datadir}/nginx/html +ln -s nginx-logo.png %{buildroot}%{_datadir}/nginx/html/poweredby.png +mkdir -p %{buildroot}%{_datadir}/nginx/html/icons + +# Symlink for the powered-by-$DISTRO image: +ln -s ../../../pixmaps/poweredby.png \ + %{buildroot}%{_datadir}/nginx/html/icons/poweredby.png + +%if 0%{?rhel} >= 9 +ln -s ../../pixmaps/system-noindex-logo.png \ + %{buildroot}%{_datadir}/nginx/html/system_noindex_logo.png +%endif + +install -p -m 0644 %{SOURCE103} %{SOURCE104} \ + %{buildroot}%{_datadir}/nginx/html + +%if 0%{?with_mailcap_mimetypes} +rm -f %{buildroot}%{_sysconfdir}/nginx/mime.types +%endif + +install -p -D -m 0644 %{_builddir}/nginx-%{version}/objs/nginx.8 \ + %{buildroot}%{_mandir}/man8/nginx.8 + +install -p -D -m 0755 %{SOURCE13} %{buildroot}%{_bindir}/nginx-upgrade +install -p -D -m 0644 %{SOURCE14} %{buildroot}%{_mandir}/man8/nginx-upgrade.8 + +for i in ftdetect ftplugin indent syntax; do + install -p -D -m644 contrib/vim/${i}/nginx.vim \ + %{buildroot}%{_datadir}/vim/vimfiles/${i}/nginx.vim +done + +%if %{with geoip} +echo 'load_module "%{nginx_moduledir}/ngx_http_geoip_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-geoip.conf +%endif +echo 'load_module "%{nginx_moduledir}/ngx_http_image_filter_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-image-filter.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_perl_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-perl.conf +echo 'load_module "%{nginx_moduledir}/ngx_http_xslt_filter_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-http-xslt-filter.conf +echo 'load_module "%{nginx_moduledir}/ngx_mail_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-mail.conf +echo 'load_module "%{nginx_moduledir}/ngx_stream_module.so";' \ + > %{buildroot}%{nginx_moduleconfdir}/mod-stream.conf + +# Install files for supporting nginx module builds +## Install source files +mkdir -p %{buildroot}%{_usrsrc} +mv %{name}-%{version}-%{release}-src %{buildroot}%{nginx_srcdir} +## Install rpm macros +mkdir -p %{buildroot}%{_rpmmacrodir} +sed -e "s|@@NGINX_ABIVERSION@@|%{nginx_abiversion}|g" \ + -e "s|@@NGINX_MODDIR@@|%{nginx_moduledir}|g" \ + -e "s|@@NGINX_MODCONFDIR@@|%{nginx_moduleconfdir}|g" \ + -e "s|@@NGINX_SRCDIR@@|%{nginx_srcdir}|g" \ + %{SOURCE15} > %{buildroot}%{_rpmmacrodir}/macros.nginxmods +## Install dependency generator +install -Dpm0644 -t %{buildroot}%{_fileattrsdir} %{SOURCE16} + + + +%pre filesystem +getent group %{nginx_user} > /dev/null || groupadd -r %{nginx_user} +getent passwd %{nginx_user} > /dev/null || \ + useradd -r -d %{_localstatedir}/lib/nginx -g %{nginx_user} \ + -s /sbin/nologin -c "Nginx web server" %{nginx_user} +exit 0 + +%post +%systemd_post nginx.service + +%if %{with geoip} +%post mod-http-geoip +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi +%endif + +%post mod-http-image-filter +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-http-perl +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-http-xslt-filter +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-mail +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%post mod-stream +if [ $1 -eq 1 ]; then + /usr/bin/systemctl reload nginx.service >/dev/null 2>&1 || : +fi + +%preun +%systemd_preun nginx.service + +%postun +%systemd_postun nginx.service +if [ $1 -ge 1 ]; then + /usr/bin/nginx-upgrade >/dev/null 2>&1 || : +fi + +%files +%if 0%{?rhel} == 7 +%doc UPGRADE-NOTES-1.6-to-1.10 +%endif +%{_datadir}/nginx/html/* +%{_bindir}/nginx-upgrade +%{_datadir}/vim/vimfiles/ftdetect/nginx.vim +%{_datadir}/vim/vimfiles/ftplugin/nginx.vim +%{_datadir}/vim/vimfiles/syntax/nginx.vim +%{_datadir}/vim/vimfiles/indent/nginx.vim +%{_mandir}/man3/nginx.3pm* +%{_mandir}/man8/nginx.8* +%{_mandir}/man8/nginx-upgrade.8* +%{_unitdir}/nginx.service + +%files core +%license LICENSE +%doc CHANGES README README.dynamic +%{_sbindir}/nginx +%config(noreplace) %{_sysconfdir}/nginx/fastcgi.conf +%config(noreplace) %{_sysconfdir}/nginx/fastcgi.conf.default +%config(noreplace) %{_sysconfdir}/nginx/fastcgi_params +%config(noreplace) %{_sysconfdir}/nginx/fastcgi_params.default +%config(noreplace) %{_sysconfdir}/nginx/koi-utf +%config(noreplace) %{_sysconfdir}/nginx/koi-win +%if ! 0%{?with_mailcap_mimetypes} +%config(noreplace) %{_sysconfdir}/nginx/mime.types +%endif +%config(noreplace) %{_sysconfdir}/nginx/mime.types.default +%config(noreplace) %{_sysconfdir}/nginx/nginx.conf +%config(noreplace) %{_sysconfdir}/nginx/nginx.conf.default +%config(noreplace) %{_sysconfdir}/nginx/scgi_params +%config(noreplace) %{_sysconfdir}/nginx/scgi_params.default +%config(noreplace) %{_sysconfdir}/nginx/uwsgi_params +%config(noreplace) %{_sysconfdir}/nginx/uwsgi_params.default +%config(noreplace) %{_sysconfdir}/nginx/win-utf +%config(noreplace) %{_sysconfdir}/logrotate.d/nginx +%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx +%attr(770,%{nginx_user},root) %dir %{_localstatedir}/lib/nginx/tmp +%dir %{_localstatedir}/log/nginx +%dir %{nginx_moduledir} +%dir %{nginx_moduleconfdir} + +%files all-modules + +%files filesystem +%dir %{_datadir}/nginx +%dir %{_datadir}/nginx/html +%dir %{_sysconfdir}/nginx +%dir %{_sysconfdir}/nginx/conf.d +%dir %{_sysconfdir}/nginx/default.d +%dir %{_sysconfdir}/systemd/system/nginx.service.d +%dir %{_unitdir}/nginx.service.d + +%if %{with geoip} +%files mod-http-geoip +%{nginx_moduleconfdir}/mod-http-geoip.conf +%{nginx_moduledir}/ngx_http_geoip_module.so +%endif + +%files mod-http-image-filter +%{nginx_moduleconfdir}/mod-http-image-filter.conf +%{nginx_moduledir}/ngx_http_image_filter_module.so + +%files mod-http-perl +%{nginx_moduleconfdir}/mod-http-perl.conf +%{nginx_moduledir}/ngx_http_perl_module.so +%dir %{perl_vendorarch}/auto/nginx +%{perl_vendorarch}/nginx.pm +%{perl_vendorarch}/auto/nginx/nginx.so + +%files mod-http-xslt-filter +%{nginx_moduleconfdir}/mod-http-xslt-filter.conf +%{nginx_moduledir}/ngx_http_xslt_filter_module.so + +%files mod-mail +%{nginx_moduleconfdir}/mod-mail.conf +%{nginx_moduledir}/ngx_mail_module.so + +%files mod-stream +%{nginx_moduleconfdir}/mod-stream.conf +%{nginx_moduledir}/ngx_stream_module.so + +%files mod-devel +%{_rpmmacrodir}/macros.nginxmods +%{_fileattrsdir}/nginxmods.attr +%{nginx_srcdir}/ + + +%changelog +* Wed Jun 22 2022 Luboš Uhliarik - 1:1.20.1-13 +- Resolves: #2099752 - nginx minimisation for ubi-micro + +* Tue Jun 21 2022 Luboš Uhliarik - 1:1.20.1-11 +- Resolves: #2028781 - Protocol : TLSv1.3 missing in rhel9 + +* Wed Feb 02 2022 Luboš Uhliarik - 1:1.20.1-10 +- Resolves: #1975747 - CVE-2021-3618 nginx: ALPACA: Application Layer Protocol + Confusion - Analyzing and Mitigating Cracks in TLS Authentication + +* Thu Dec 2 2021 Joe Orton - 1:1.20.1-9 +- add delaycompress to logrotate config (#2015250) + +* Wed Sep 22 2021 Luboš Uhliarik - 1:1.20.1-8 +- Resolves: #2007019 - use proper wording in error pages + +* Wed Sep 22 2021 Luboš Uhliarik - 1:1.20.1-7 +- Resolves: #2006420 - Broken loading certificates from hardware token (PKCS#11) + +* Wed Sep 22 2021 Luboš Uhliarik - 1:1.20.1-6 +- Resolves: #2006822 - Hardening tests fail for nginx + +* Tue Sep 21 2021 Luboš Uhliarik - 1:1.20.1-5 +- Add -mod-devel subpackage for building external nginx modules + Resolves: rhbz#1991720 (Neal Gompa) + +* Mon Aug 09 2021 Mohan Boddu - 1:1.20.1-4 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Mon Aug 09 2021 Luboš Uhliarik - 1:1.20.1-3 +- Resolves: #1991600 - Add logo symlink required by new testpage + +* Wed Jun 16 2021 Mohan Boddu - 1:1.20.1-2 +- Rebuilt for RHEL 9 BETA for openssl 3.0 + Related: rhbz#1971065 + +* Wed Jun 02 2021 Luboš Uhliarik - 1:1.20.1-1 +- new version 1.20.1 +- Resolves: #1964814 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy() + when labels are followed by a pointer to a root domain name + +* Fri Apr 30 2021 Lubos Uhliarik - 1:1.20.0-5 +- Resolves: #1955564 - [RFE] Support loading certificates from hardware + token (PKCS#11) + +* Fri Apr 30 2021 Lubos Uhliarik - 1:1.20.0-4 +- Resolves: #1955560 - centralizing default index.html on nginx + +* Mon Apr 26 2021 Lubos Uhliarik - 1:1.20.0-3 +- Resolve: #1953639 - Rebase nginx to 1.20 + +* Wed Apr 21 2021 Felix Kaechele - 1:1.20.0-2 +- sync rawhide and EPEL7 spec files again +- systemd service reload now checks config file (rhbz#1565377) +- drop nginx requirement on nginx-all-modules (rhbz#1708799) +- let nginx handle log creation on logrotate (rhbz#1683388) +- have log directory owned by root (rhbz#1390183, CVE-2016-1247) +- remove obsolete --with-ipv6 (src PR#8) +- correction: pcre2 is actually not supported by nginx, reintroduce pcre + +* Wed Apr 21 2021 Felix Kaechele - 1:1.20.0-1 +- update to 1.20.0 +- sync with mainline spec file +- order configure options alphabetically for easier comparinggit +- add --with-compat option (rhbz#1834452) +- add patch to fix PIDFile race condition (rhbz#1869026) +- use pcre2 instead of pcre (rhbz#1938984) +- add Wants=network-online.target to systemd unit (rhbz#1943779) + +* Fri Apr 16 2021 Mohan Boddu - 1:1.18.0-6 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Mon Feb 22 2021 Lubos Uhliarik - 1:1.18.0-5 +- Resolves: #1931402 - drop gperftools module + +* Tue Jan 26 2021 Fedora Release Engineering - 1:1.18.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 1:1.18.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jun 22 2020 Jitka Plesnikova - 1:1.18.0-2 +- Perl 5.32 rebuild + +* Fri Apr 24 2020 Felix Kaechele - 1:1.18.0-1 +- Update to 1.18.0 +- Increased types_hash_max_size to 4096 in default config +- Add gpg source verification +- Add Recommends: logrotate +- Drop location / from default config (rhbz#1564768) +- Drop default_sever from default config (rhbz#1373822) + +* Wed Jan 29 2020 Fedora Release Engineering - 1:1.16.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sun Sep 15 2019 Warren Togami +- add conditionals for EPEL7, see rhbz#1750857 + +* Tue Aug 13 2019 Jamie Nguyen - 1:1.16.1-1 +- Update to upstream release 1.16.1 +- Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 + +* Thu Jul 25 2019 Fedora Release Engineering - 1:1.16.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu May 30 2019 Jitka Plesnikova - 1:1.16.0-4 +- Perl 5.30 rebuild + +* Tue May 14 2019 Stephen Gallagher - 1.16.0-3 +- Move to common default index.html +- Resolves: rhbz#1636235 + +* Tue May 07 2019 Jamie Nguyen - 1:1.16.0-2 +- Add missing directory for vim plugin + +* Fri Apr 26 2019 Jamie Nguyen - 1:1.16.0-1 +- Update to upstream release 1.16.0 + +* Mon Mar 04 2019 Jamie Nguyen - 1:1.15.9-1 +- Update to upstream release 1.15.9 +- Enable ngx_stream_ssl_preread module +- Remove redundant conditionals + +* Fri Feb 01 2019 Fedora Release Engineering - 1:1.14.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 1:1.14.1-4 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Tue Dec 11 2018 Joe Orton - 1:1.14.1-3 +- fix unexpanded paths in nginx(8) + +* Tue Nov 20 2018 Luboš Uhliarik - 1:1.14.1-2 +- new version 1.14.1 +- Resolves: #1584426 - Upstream Nginx 1.14.0 is now available +- Resolves: #1647255 - CVE-2018-16845 nginx: Denial of service and memory + disclosure via mp4 module +- Resolves: #1647259 - CVE-2018-16843 nginx: Excessive memory consumption + via flaw in HTTP/2 implementation +- Resolves: #1647258 - CVE-2018-16844 nginx: Excessive CPU usage via flaw + in HTTP/2 implementation + +* Mon Aug 06 2018 Luboš Uhliarik - 1:1.12.1-14 +- add requires on perl(constant) for mod-http-perl + +* Mon Jul 30 2018 Luboš Uhliarik - 1:1.12.1-13 +- don't build with geoip by default + +* Thu Jul 19 2018 Joe Orton - 1:1.12.1-12 +- add build conditional for geoip support + +* Mon Jul 16 2018 Tadej Janež - 1:1.12.1-11 +- Add gcc to BuildRequires to account for + https://fedoraproject.org/wiki/Changes/Remove_GCC_from_BuildRoot + +* Fri Jul 13 2018 Fedora Release Engineering - 1:1.12.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Jun 27 2018 Jitka Plesnikova - 1:1.12.1-9 +- Perl 5.28 rebuild + +* Mon May 14 2018 Luboš Uhliarik - 1:1.12.1-8 +- Related: #1573942 - nginx fails on start + +* Wed May 02 2018 Luboš Uhliarik - 1:1.12.1-7 +- Resolves: #1573942 - nginx fails on start + +* Thu Feb 08 2018 Fedora Release Engineering - 1:1.12.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Wed Jan 24 2018 Björn Esser - 1:1.12.1-5 +- Add patch to apply glibc bugfix if really needed only +- Disable strict symbol checks in the link editor + +* Sat Jan 20 2018 Björn Esser - 1:1.12.1-4 +- Rebuilt for switch to libxcrypt + +* Tue Oct 24 2017 Joe Orton - 1:1.12.1-3 +- rebuild + +* Tue Sep 19 2017 Remi Collet - 1:1.12.1-2 +- own system drop-in directories #1493036 + +* Tue Aug 15 2017 Joe Orton - 1:1.12.1-1 +- update to 1.12.1 (#1469924) +- enable http_auth_request_module (Tim Niemueller, #1471106) + +* Thu Aug 03 2017 Fedora Release Engineering - 1:1.12.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1:1.12.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jun 04 2017 Jitka Plesnikova - 1:1.12.0-2 +- Perl 5.26 rebuild + +* Tue May 30 2017 Luboš Uhliarik - 1:1.12.0-1 +- new version 1.12.0 + +* Wed Feb 8 2017 Joe Orton - 1:1.10.3-1 +- update to upstream release 1.10.3 + +* Mon Oct 31 2016 Jamie Nguyen - 1:1.10.2-1 +- update to upstream release 1.10.2 + +* Tue May 31 2016 Jamie Nguyen - 1:1.10.1-1 +- update to upstream release 1.10.1 + +* Sun May 15 2016 Jitka Plesnikova - 1:1.10.0-4 +- Perl 5.24 rebuild + +* Sun May 8 2016 Peter Robinson 1:1.10.0-3 +- Enable AIO on aarch64 (rhbz 1258414) + +* Wed Apr 27 2016 Jamie Nguyen - 1:1.10.0-2 +- only Require nginx-all-modules for EPEL and current Fedora releases + +* Wed Apr 27 2016 Jamie Nguyen - 1:1.10.0-1 +- update to upstream release 1.10.0 +- split dynamic modules into subpackages +- spec file cleanup + +* Thu Feb 04 2016 Fedora Release Engineering - 1:1.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Tue Jan 26 2016 Jamie Nguyen - 1:1.8.1-1 +- update to upstream release 1.8.1 +- CVE-2016-0747: Insufficient limits of CNAME resolution in resolver +- CVE-2016-0746: Use-after-free during CNAME response processing in resolver +- CVE-2016-0742: Invalid pointer dereference in resolver + +* Sun Oct 04 2015 Jamie Nguyen - 1:1.8.0-14 +- consistently use '%%global with_foo' style of logic +- remove PID file before starting nginx (#1268621) + +* Fri Sep 25 2015 Ville Skyttä - 1:1.8.0-13 +- Use nginx-mimetypes from mailcap (#1248736) +- Mark LICENSE as %%license + +* Thu Sep 10 2015 Jamie Nguyen - 1:1.8.0-12 +- also build with gperftools on aarch64 (#1258412) + +* Wed Aug 12 2015 Nikos Mavrogiannopoulos - 1:1.8.0-11 +- nginx.conf: added commented-out SSL configuration directives (#1179232) + +* Fri Jul 03 2015 Jamie Nguyen - 1:1.8.0-10 +- switch back to /bin/kill in logrotate script due to SELinux denials + +* Tue Jun 16 2015 Jamie Nguyen - 1:1.8.0-9 +- fix path to png in error pages (#1232277) +- optimize png images with optipng + +* Sun Jun 14 2015 Jamie Nguyen - 1:1.8.0-8 +- replace /bin/kill with /usr/bin/systemctl kill in logrotate script (#1231543) +- remove After=syslog.target in nginx.service (#1231543) +- replace ExecStop with KillSignal=SIGQUIT in nginx.service (#1231543) + +* Wed Jun 03 2015 Jitka Plesnikova - 1:1.8.0-7 +- Perl 5.22 rebuild + +* Sun May 10 2015 Jamie Nguyen - 1:1.8.0-6 +- revert previous change + +* Sun May 10 2015 Jamie Nguyen - 1:1.8.0-5 +- move default server to default.conf (#1220094) + +* Sun May 10 2015 Jamie Nguyen - 1:1.8.0-4 +- add TimeoutStopSec=5 and KillMode=mixed to nginx.service +- set worker_processes to auto +- add some common options to the http block in nginx.conf +- run nginx-upgrade on package update +- remove some redundant scriptlet commands +- listen on ipv6 for default server (#1217081) + +* Wed Apr 22 2015 Jamie Nguyen - 1:1.8.0-3 +- improve nginx-upgrade script + +* Wed Apr 22 2015 Jamie Nguyen - 1:1.8.0-2 +- add --with-pcre-jit + +* Wed Apr 22 2015 Jamie Nguyen - 1:1.8.0-1 +- update to upstream release 1.8.0 + +* Thu Apr 09 2015 Jamie Nguyen - 1:1.7.12-1 +- update to upstream release 1.7.12 + +* Sun Feb 15 2015 Jamie Nguyen - 1:1.7.10-1 +- update to upstream release 1.7.10 +- remove systemd conditionals + +* Wed Oct 22 2014 Jamie Nguyen - 1:1.6.2-4 +- fix package ownership of directories + +* Wed Oct 22 2014 Jamie Nguyen - 1:1.6.2-3 +- add vim files (#1142849) + +* Mon Sep 22 2014 Jamie Nguyen - 1:1.6.2-2 +- create nginx-filesystem subpackage (patch from Remi Collet) +- create /etc/nginx/default.d as a drop-in directory for configuration files + for the default server block +- clean up nginx.conf + +* Wed Sep 17 2014 Jamie Nguyen - 1:1.6.2-1 +- update to upstream release 1.6.2 +- CVE-2014-3616 nginx: virtual host confusion (#1142573) + +* Wed Aug 27 2014 Jitka Plesnikova - 1:1.6.1-4 +- Perl 5.20 rebuild + +* Sun Aug 17 2014 Fedora Release Engineering - 1:1.6.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Tue Aug 05 2014 Jamie Nguyen - 1:1.6.1-2 +- add logic for EPEL 7 + +* Tue Aug 05 2014 Jamie Nguyen - 1:1.6.1-1 +- update to upstream release 1.6.1 +- (#1126891) CVE-2014-3556: SMTP STARTTLS plaintext injection flaw + +* Wed Jul 02 2014 Yaakov Selkowitz - 1:1.6.0-3 +- Fix FTBFS on aarch64 (#1115559) + +* Sat Jun 07 2014 Fedora Release Engineering - 1:1.6.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sat Apr 26 2014 Jamie Nguyen - 1:1.6.0-1 +- update to upstream release 1.6.0 + +* Tue Mar 18 2014 Jamie Nguyen - 1:1.4.7-1 +- update to upstream release 1.4.7 + +* Wed Mar 05 2014 Jamie Nguyen - 1:1.4.6-1 +- update to upstream release 1.4.6 + +* Sun Feb 16 2014 Jamie Nguyen - 1:1.4.5-2 +- avoid multiple index directives (#1065488) + +* Sun Feb 16 2014 Jamie Nguyen - 1:1.4.5-1 +- update to upstream release 1.4.5 + +* Wed Nov 20 2013 Peter Borsa - 1:1.4.4-1 +- Update to upstream release 1.4.4 +- Security fix BZ 1032267 + +* Sun Nov 03 2013 Jamie Nguyen - 1:1.4.3-1 +- update to upstream release 1.4.3 + +* Fri Aug 09 2013 Jonathan Steffan - 1:1.4.2-3 +- Add in conditionals to build for non-systemd targets + +* Sat Aug 03 2013 Petr Pisar - 1:1.4.2-2 +- Perl 5.18 rebuild + +* Fri Jul 19 2013 Jamie Nguyen - 1:1.4.2-1 +- update to upstream release 1.4.2 + +* Wed Jul 17 2013 Petr Pisar - 1:1.4.1-3 +- Perl 5.18 rebuild + +* Tue Jun 11 2013 Remi Collet - 1:1.4.1-2 +- rebuild for new GD 2.1.0 + +* Tue May 07 2013 Jamie Nguyen - 1:1.4.1-1 +- update to upstream release 1.4.1 (#960605, #960606): + CVE-2013-2028 stack-based buffer overflow when handling certain chunked + transfer encoding requests + +* Sun Apr 28 2013 Dan Horák - 1:1.4.0-2 +- gperftools exist only on selected arches + +* Fri Apr 26 2013 Jamie Nguyen - 1:1.4.0-1 +- update to upstream release 1.4.0 +- enable SPDY module (new in this version) +- enable http gunzip module (new in this version) +- enable google perftools module and add gperftools-devel to BR +- enable debugging (#956845) +- trim changelog + +* Tue Apr 02 2013 Jamie Nguyen - 1:1.2.8-1 +- update to upstream release 1.2.8 + +* Fri Feb 22 2013 Jamie Nguyen - 1:1.2.7-2 +- make sure nginx directories are not world readable (#913724, #913735) + +* Sat Feb 16 2013 Jamie Nguyen - 1:1.2.7-1 +- update to upstream release 1.2.7 +- add .asc file + +* Tue Feb 05 2013 Jamie Nguyen - 1:1.2.6-6 +- use 'kill' instead of 'systemctl' when rotating log files to workaround + SELinux issue (#889151) + +* Wed Jan 23 2013 Jamie Nguyen - 1:1.2.6-5 +- uncomment "include /etc/nginx/conf.d/*.conf by default but leave the + conf.d directory empty (#903065) + +* Wed Jan 23 2013 Jamie Nguyen - 1:1.2.6-4 +- add comment in nginx.conf regarding "include /etc/nginf/conf.d/*.conf" + (#903065) + +* Wed Dec 19 2012 Jamie Nguyen - 1:1.2.6-3 +- use correct file ownership when rotating log files + +* Tue Dec 18 2012 Jamie Nguyen - 1:1.2.6-2 +- send correct kill signal and use correct file permissions when rotating + log files (#888225) +- send correct kill signal in nginx-upgrade + +* Tue Dec 11 2012 Jamie Nguyen - 1:1.2.6-1 +- update to upstream release 1.2.6 + +* Sat Nov 17 2012 Jamie Nguyen - 1:1.2.5-1 +- update to upstream release 1.2.5 + +* Sun Oct 28 2012 Jamie Nguyen - 1:1.2.4-1 +- update to upstream release 1.2.4 +- introduce new systemd-rpm macros (#850228) +- link to official documentation not the community wiki (#870733) +- do not run systemctl try-restart after package upgrade to allow the + administrator to run nginx-upgrade and avoid downtime +- add nginx man page (#870738) +- add nginx-upgrade man page and remove README.fedora +- remove chkconfig from Requires(post/preun) +- remove initscripts from Requires(preun/postun) +- remove separate configuration files in "/etc/nginx/conf.d" directory + and revert to upstream default of a centralized nginx.conf file + (#803635) (#842738) + +* Fri Sep 21 2012 Jamie Nguyen - 1:1.2.3-1 +- update to upstream release 1.2.3 + +* Fri Jul 20 2012 Fedora Release Engineering - 1:1.2.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Thu Jun 28 2012 Petr Pisar - 1:1.2.1-2 +- Perl 5.16 rebuild + +* Sun Jun 10 2012 Jamie Nguyen - 1:1.2.1-1 +- update to upstream release 1.2.1 + +* Fri Jun 08 2012 Petr Pisar - 1:1.2.0-2 +- Perl 5.16 rebuild + +* Wed May 16 2012 Jamie Nguyen - 1:1.2.0-1 +- update to upstream release 1.2.0 + +* Wed May 16 2012 Jamie Nguyen - 1:1.0.15-4 +- add nginx-upgrade to replace functionality from the nginx initscript + that was lost after migration to systemd +- add README.fedora to describe usage of nginx-upgrade +- nginx.logrotate: use built-in systemd kill command in postrotate script +- nginx.service: start after syslog.target and network.target +- nginx.service: remove unnecessary references to config file location +- nginx.service: use /bin/kill instead of "/usr/sbin/nginx -s" following + advice from nginx-devel +- nginx.service: use private /tmp + +* Mon May 14 2012 Jamie Nguyen - 1:1.0.15-3 +- fix incorrect postrotate script in nginx.logrotate + +* Thu Apr 19 2012 Jamie Nguyen - 1:1.0.15-2 +- renable auto-cc-gcc patch due to warnings on rawhide + +* Sat Apr 14 2012 Jamie Nguyen - 1:1.0.15-1 +- update to upstream release 1.0.15 +- no need to apply auto-cc-gcc patch +- add %%global _hardened_build 1 + +* Thu Mar 15 2012 Jamie Nguyen - 1:1.0.14-1 +- update to upstream release 1.0.14 +- amend some %%changelog formatting + +* Tue Mar 06 2012 Jamie Nguyen - 1:1.0.13-1 +- update to upstream release 1.0.13 +- amend --pid-path and --log-path + +* Sun Mar 04 2012 Jamie Nguyen - 1:1.0.12-5 +- change pid path in nginx.conf to match systemd service file + +* Sun Mar 04 2012 Jamie Nguyen - 1:1.0.12-3 +- fix %%pre scriptlet + +* Mon Feb 20 2012 Jamie Nguyen - 1:1.0.12-2 +- update upstream URL +- replace %%define with %%global +- remove obsolete BuildRoot tag, %%clean section and %%defattr +- remove various unnecessary commands +- add systemd service file and update scriptlets +- add Epoch to accommodate %%triggerun as part of systemd migration + +* Sun Feb 19 2012 Jeremy Hinegardner - 1.0.12-1 +- Update to 1.0.12 + +* Thu Nov 17 2011 Keiran "Affix" Smith - 1.0.10-1 +- Bugfix: a segmentation fault might occur in a worker process if resolver got a big DNS response. Thanks to Ben Hawkes. +- Bugfix: in cache key calculation if internal MD5 implementation wasused; the bug had appeared in 1.0.4. +- Bugfix: the module ngx_http_mp4_module sent incorrect "Content-Length" response header line if the "start" argument was used. Thanks to Piotr Sikora. + +* Thu Oct 27 2011 Keiran "Affix" Smith - 1.0.8-1 +- Update to new 1.0.8 stable release + +* Fri Aug 26 2011 Keiran "Affix" Smith - 1.0.5-1 +- Update nginx to Latest Stable Release + +* Fri Jun 17 2011 Marcela Mašláňová - 1.0.0-3 +- Perl mass rebuild + +* Thu Jun 09 2011 Marcela Mašláňová - 1.0.0-2 +- Perl 5.14 mass rebuild + +* Wed Apr 27 2011 Jeremy Hinegardner - 1.0.0-1 +- Update to 1.0.0 + +* Tue Feb 08 2011 Fedora Release Engineering - 0.8.53-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Sun Dec 12 2010 Jeremy Hinegardner - 0.8.53.5 +- Extract out default config into its own file (bug #635776) + +* Sun Dec 12 2010 Jeremy Hinegardner - 0.8.53-4 +- Revert ownership of log dir + +* Sun Dec 12 2010 Jeremy Hinegardner - 0.8.53-3 +- Change ownership of /var/log/nginx to be 0700 nginx:nginx +- update init script to use killproc -p +- add reopen_logs command to init script +- update init script to use nginx -q option + +* Sun Oct 31 2010 Jeremy Hinegardner - 0.8.53-2 +- Fix linking of perl module + +* Sun Oct 31 2010 Jeremy Hinegardner - 0.8.53-1 +- Update to new stable 0.8.53 + +* Sat Jul 31 2010 Jeremy Hinegardner - 0.7.67-2 +- add Provides: webserver (bug #619693) + +* Sun Jun 20 2010 Jeremy Hinegardner - 0.7.67-1 +- Update to new stable 0.7.67 +- fix bugzilla #591543 + +* Tue Jun 01 2010 Marcela Maslanova - 0.7.65-2 +- Mass rebuild with perl-5.12.0 + +* Mon Feb 15 2010 Jeremy Hinegardner - 0.7.65-1 +- Update to new stable 0.7.65 +- change ownership of logdir to root:root +- add support for ipv6 (bug #561248) +- add random_index_module +- add secure_link_module + +* Fri Dec 04 2009 Jeremy Hinegardner - 0.7.64-1 +- Update to new stable 0.7.64