public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #122068 from NixOS/staging-next

Browse Source 
Staging next
This commit is contained in:
Jonathan Ringer
2021-05-16 12:25:50 -07:00
committed by GitHub
parent b3a8cab594 8c6d819143
commit 2ba3a65a7d
407 changed files with 13563 additions and 2796 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/tools/backup/rdedup/default.nix
+1 -1
View File
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
++ (lib.optional stdenv.isDarwin Security);
configurePhase = ''
export LIBCLANG_PATH="${llvmPackages.libclang}/lib"
export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
'';
meta = with lib; {
pkgs/tools/filesystems/btrfs-progs/default.nix
+2 -2
View File
@@ -4,11 +4,11 @@
stdenv.mkDerivation rec {
pname = "btrfs-progs";
version = "5.11";
version = "5.11.1";
src = fetchurl {
url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
sha256 = "sha256-1BlhsKkhYMgPiUrZoYgoIoicLh0ITL8+CLjCFKXPATc=";
sha256 = "sha256-46rMxHVuxOVQLLKp+Ftn1SiWZE9MPA+IprxZjHC96/4=";
};
nativeBuildInputs = [
pkgs/tools/filesystems/irods/common.nix
+1 -1
View File
@@ -19,7 +19,7 @@
"-DIRODS_LINUX_DISTRIBUTION_NAME=nix"
"-DIRODS_LINUX_DISTRIBUTION_VERSION_MAJOR=${builtins.nixVersion}"
"-DCPACK_GENERATOR=TGZ"
"-DCMAKE_CXX_FLAGS=-I${libcxx}/include/c++/v1"
"-DCMAKE_CXX_FLAGS=-I${lib.getDev libcxx}/include/c++/v1"
];
preConfigure = ''
pkgs/tools/filesystems/supertag/default.nix
+1 -1
View File
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
cargoSha256 = "1mzmp1jcxgn2swp52r9y7k09fk0z67i1qafzkkzlfxxd10vfr70v";
LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
nativeBuildInputs = [ clang pkg-config ];
buildInputs = [ dbus fuse sqlite ];
pkgs/tools/graphics/fbv/default.nix
+16 -5
View File
@@ -1,14 +1,25 @@
{ lib, stdenv, fetchurl, getopt, libjpeg, libpng12, libungif }:
{ lib, stdenv, fetchurl, fetchpatch, getopt, libjpeg, libpng12, giflib }:
stdenv.mkDerivation rec {
name = "fbv-1.0b";
pname = "fbv";
version = "1.0b";
src = fetchurl {
url = "http://s-tech.elsat.net.pl/fbv/${name}.tar.gz";
url = "http://s-tech.elsat.net.pl/fbv/fbv-${version}.tar.gz";
sha256 = "0g5b550vk11l639y8p5sx1v1i6ihgqk0x1hd0ri1bc2yzpdbjmcv";
};
buildInputs = [ getopt libjpeg libpng12 libungif ];
patches = [
(fetchpatch {
url = "https://raw.githubusercontent.com/void-linux/void-packages/4a5bfe522ea5afd8203e804dc6a642d0871cd6dd/srcpkgs/fbv/patches/giflib-5.1.patch";
sha256 = "00q1zcn92yvvyij68bnq0m1sr3a411w914f4nyp6mpz0j5xc6dc7";
})
];
patchFlags = [ "-p0" ];
buildInputs = [ getopt libjpeg libpng12 giflib ];
makeFlags = [ "LDFLAGS=-lgif" ];
enableParallelBuilding = true;
@@ -19,7 +30,7 @@ stdenv.mkDerivation rec {
meta = with lib; {
description = "View pictures on a linux framebuffer device";
homepage = "http://s-tech.elsat.net.pl/fbv/";
license = licenses.gpl2;
license = licenses.gpl2Only;
maintainers = with maintainers; [ peterhoeg ];
};
}
pkgs/tools/inputmethods/kime/default.nix
+1 -1
View File
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
];
RUST_BACKTRACE = 1;
LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
meta = with lib; {
homepage = "https://github.com/Riey/kime";
pkgs/tools/misc/chezmoi/default.nix
+3 -3
View File
@@ -2,16 +2,16 @@
buildGoModule rec {
pname = "chezmoi";
version = "2.0.10";
version = "2.0.11";
src = fetchFromGitHub {
owner = "twpayne";
repo = "chezmoi";
rev = "v${version}";
sha256 = "sha256-WVG4rww9Wd1H6zw5lRBErX9VwnA21dhvith9BQFYqxw=";
sha256 = "sha256-z9ALpoF2ZLigAG/uvoYVG1YTy+EM4bDQDDtxd3PgQW8=";
};
vendorSha256 = "sha256-khYcNP3xAXeQR9vaghkGq8x6KB1k5hLEcE7Zx8H+CfA=";
vendorSha256 = "sha256-CYDFEVZ04csn4BjvwUvfOafEjucnDHyeYU7gNwO1xTQ=";
doCheck = false;
pkgs/tools/misc/fontforge/default.nix
+2 -2
View File
@@ -1,6 +1,6 @@
{ stdenv, fetchpatch, fetchFromGitHub, lib
, cmake, perl, uthash, pkg-config, gettext
, python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
, python, freetype, zlib, glib, giflib, libpng, libjpeg, libtiff, libxml2, cairo, pango
, readline, woff2, zeromq, libuninameslist
, withSpiro ? false, libspiro
, withGTK ? false, gtk3
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
nativeBuildInputs = [ pkg-config cmake ];
buildInputs = [
readline uthash woff2 zeromq libuninameslist
python freetype zlib glib libungif libpng libjpeg libtiff libxml2
python freetype zlib glib giflib libpng libjpeg libtiff libxml2
]
++ lib.optionals withSpiro [libspiro]
++ lib.optionals withGUI [ gtk3 cairo pango ]
pkgs/tools/misc/gringo/default.nix
+2 -2
View File
@@ -32,12 +32,12 @@ stdenv.mkDerivation {
substituteInPlace ./SConstruct \
--replace \
"env['CPPPATH'] = []" \
"env['CPPPATH'] = ['${libcxx}/include/c++/v1']"
"env['CPPPATH'] = ['${lib.getDev libcxx}/include/c++/v1']"
substituteInPlace ./SConstruct \
--replace \
"env['LIBPATH'] = []" \
"env['LIBPATH'] = ['${libcxx}/lib']"
"env['LIBPATH'] = ['${lib.getLib libcxx}/lib']"
'';
buildPhase = ''
pkgs/tools/misc/silicon/default.nix
+1 -1
View File
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
nativeBuildInputs = [ cmake pkg-config ]
++ lib.optionals stdenv.isLinux [ python3 ];
LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
meta = with lib; {
description = "Create beautiful image of your source code";
pkgs/tools/misc/tremor-rs/default.nix
+1 -1
View File
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
--zsh <($out/bin/tremor completions zsh)
'';
LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
# OPENSSL_NO_VENDOR - If set, always find OpenSSL in the system, even if the vendored feature is enabled.
OPENSSL_NO_VENDOR = 1;
pkgs/tools/networking/curl/7.74.0-CVE-2021-22876.patch
-139
View File
@@ -1,139 +0,0 @@
Based on upstream 7214288898f5625a6cc196e22a74232eada7861c, adapted by ris to
compensate for lack of 95cbcec8f986492766c4be3922af1e7644e1e7c5
---
lib/transfer.c | 25 ++++++++++++++--
tests/data/Makefile.inc | 2 +-
tests/data/test2081 | 66 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 90 insertions(+), 3 deletions(-)
create mode 100644 tests/data/test2081
diff --git a/lib/transfer.c b/lib/transfer.c
index 1976bc0338bc..a68c021c84d6 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1581,6 +1581,9 @@ CURLcode Curl_follow(struct Curl_easy *data,
data->set.followlocation++; /* count location-followers */
if(data->set.http_auto_referer) {
+ CURLU *u;
+ char *referer;
+
/* We are asked to automatically set the previous URL as the referer
when we get the next URL. We pick the ->url field, which may or may
not be 100% correct */
@@ -1590,9 +1593,27 @@ CURLcode Curl_follow(struct Curl_easy *data,
data->change.referer_alloc = FALSE;
}
- data->change.referer = strdup(data->change.url);
- if(!data->change.referer)
+ /* Make a copy of the URL without crenditals and fragment */
+ u = curl_url();
+ if(!u)
+ return CURLE_OUT_OF_MEMORY;
+
+ uc = curl_url_set(u, CURLUPART_URL, data->change.url, 0);
+ if(!uc)
+ uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0);
+ if(!uc)
+ uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
+ if(!uc)
+ uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
+ if(!uc)
+ uc = curl_url_get(u, CURLUPART_URL, &referer, 0);
+
+ curl_url_cleanup(u);
+
+ if(uc || referer == NULL)
return CURLE_OUT_OF_MEMORY;
+
+ data->change.referer = referer;
data->change.referer_alloc = TRUE; /* yes, free this later */
}
}
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index 2c7a0ca89fd8..ea52683d2254 100644
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -225,7 +225,7 @@ test2064 test2065 test2066 test2067 test2068 test2069 \
test2064 test2065 test2066 test2067 test2068 test2069 test2070 \
test2071 test2072 test2073 test2074 test2075 test2076 test2077 \
test2078 \
-test2080 \
+test2080 test2081 \
test2100 \
\
test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
diff --git a/tests/data/test2081 b/tests/data/test2081
new file mode 100644
index 000000000000..a6733e737beb
--- /dev/null
+++ b/tests/data/test2081
@@ -0,0 +1,66 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+referer
+followlocation
+--write-out
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 This is a weirdo text message swsclose
+Location: data/%TESTNUMBER0002.txt?coolsite=yes
+Content-Length: 62
+Connection: close
+
+This server reply is for testing a simple Location: following
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+ <name>
+Automatic referrer credential and anchor stripping check
+ </name>
+ <command>
+http://user:pass@%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER#anchor --location --referer ';auto' --write-out '%{referer}\n'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+52
+</errorcode>
+<protocol>
+GET /we/want/our/%TESTNUMBER HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Basic dXNlcjpwYXNz
+User-Agent: curl/%VERSION
+Accept: */*
+
+GET /we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Authorization: Basic dXNlcjpwYXNz
+User-Agent: curl/%VERSION
+Accept: */*
+Referer: http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER
+
+</protocol>
+<stdout>
+HTTP/1.1 301 This is a weirdo text message swsclose
+Location: data/%TESTNUMBER0002.txt?coolsite=yes
+Content-Length: 62
+Connection: close
+
+http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER
+</stdout>
+</verify>
+</testcase>
pkgs/tools/networking/curl/7.74.0-CVE-2021-22890.patch
-473
View File
@@ -1,473 +0,0 @@
Based on upstream b09c8ee15771c614c4bf3ddac893cdb12187c844, adapted by ris mostly to
compensate for lack of bbe3aa9f881fa27fe828e3c9a36d6831f254a3ee
diff --git a/lib/vtls/bearssl.c b/lib/vtls/bearssl.c
index 36c32d8d55be..39fc1a29209c 100644
--- a/lib/vtls/bearssl.c
+++ b/lib/vtls/bearssl.c
@@ -375,7 +375,8 @@ static CURLcode bearssl_connect_step1(struct Curl_easy *data,
void *session;
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &session, NULL, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn, SSL_IS_PROXY() ? TRUE : FALSE,
+ &session, NULL, sockindex)) {
br_ssl_engine_set_session_parameters(&backend->ctx.eng, session);
infof(data, "BearSSL: re-using session ID\n");
}
@@ -571,9 +572,13 @@ static CURLcode bearssl_connect_step3(struct Curl_easy *data,
br_ssl_engine_get_session_parameters(&backend->ctx.eng, session);
Curl_ssl_sessionid_lock(conn);
- incache = !(Curl_ssl_getsessionid(conn, &oldsession, NULL, sockindex));
+ incache = !(Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ &oldsession, NULL, sockindex));
if(incache)
Curl_ssl_delsessionid(conn, oldsession);
- ret = Curl_ssl_addsessionid(conn, session, 0, sockindex);
+ ret = Curl_ssl_addsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ session, 0, sockindex);
Curl_ssl_sessionid_unlock(conn);
if(ret) {
free(session);
diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
index a75937b4646c..3b0d940a60e1 100644
--- a/lib/vtls/gtls.c
+++ b/lib/vtls/gtls.c
@@ -727,5 +727,7 @@ gtls_connect_step1(struct Curl_easy *data,
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, &ssl_idsize, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ &ssl_sessionid, &ssl_idsize, sockindex)) {
/* we got a session id, use it! */
gnutls_session_set_data(session, ssl_sessionid, ssl_idsize);
@@ -1286,8 +1287,9 @@ gtls_connect_step3(struct Curl_easy *data,
gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
Curl_ssl_sessionid_lock(conn);
- incache = !(Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL,
- sockindex));
+ incache = !(Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ &ssl_sessionid, NULL, sockindex));
if(incache) {
/* there was one before in the cache, so instead of risking that the
previous one was rejected, we just kill that and store the new */
@@ -1295,8 +1297,10 @@ gtls_connect_step3(struct Curl_easy *data,
}
/* store this session id */
- result = Curl_ssl_addsessionid(conn, connect_sessionid, connect_idsize,
- sockindex);
+ result = Curl_ssl_addsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ connect_sessionid, connect_idsize,
+ sockindex);
Curl_ssl_sessionid_unlock(conn);
if(result) {
free(connect_sessionid);
diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
index 95cd4d99b665..93a7ac1fd87d 100644
--- a/lib/vtls/mbedtls.c
+++ b/lib/vtls/mbedtls.c
@@ -463,7 +463,9 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
void *old_session = NULL;
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &old_session, NULL, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ &old_session, NULL, sockindex)) {
ret = mbedtls_ssl_set_session(&backend->ssl, old_session);
if(ret) {
Curl_ssl_sessionid_unlock(conn);
@@ -724,6 +726,7 @@ mbed_connect_step3(struct Curl_easy *data, struct connectdata *conn,
int ret;
mbedtls_ssl_session *our_ssl_sessionid;
void *old_ssl_sessionid = NULL;
+ bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
our_ssl_sessionid = malloc(sizeof(mbedtls_ssl_session));
if(!our_ssl_sessionid)
@@ -742,10 +745,12 @@ mbed_connect_step3(struct Curl_easy *data, struct connectdata *conn,
/* If there's already a matching session in the cache, delete it */
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, sockindex))
+ if(!Curl_ssl_getsessionid(conn, isproxy, &old_ssl_sessionid, NULL,
+ sockindex))
Curl_ssl_delsessionid(conn, old_ssl_sessionid);
- retcode = Curl_ssl_addsessionid(conn, our_ssl_sessionid, 0, sockindex);
+ retcode = Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid,
+ 0, sockindex);
Curl_ssl_sessionid_unlock(conn);
if(retcode) {
mbedtls_ssl_session_free(our_ssl_sessionid);
diff --git a/lib/vtls/mesalink.c b/lib/vtls/mesalink.c
index 4f1ab8627f49..5d6a1495d790 100644
--- a/lib/vtls/mesalink.c
+++ b/lib/vtls/mesalink.c
@@ -261,7 +261,9 @@ mesalink_connect_step1(struct Curl_easy *data,
void *ssl_sessionid = NULL;
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ &ssl_sessionid, NULL, sockindex)) {
/* we got a session id, use it! */
if(!SSL_set_session(BACKEND->handle, ssl_sessionid)) {
Curl_ssl_sessionid_unlock(conn);
@@ -345,12 +347,14 @@ mesalink_connect_step3(struct connectdata *conn, int sockindex)
bool incache;
SSL_SESSION *our_ssl_sessionid;
void *old_ssl_sessionid = NULL;
+ bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
our_ssl_sessionid = SSL_get_session(BACKEND->handle);
Curl_ssl_sessionid_lock(conn);
incache =
- !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL, sockindex));
+ !(Curl_ssl_getsessionid(conn, isproxy, &old_ssl_sessionid, NULL,
+ sockindex));
if(incache) {
if(old_ssl_sessionid != our_ssl_sessionid) {
infof(data, "old SSL session ID is stale, removing\n");
@@ -361,8 +364,9 @@ mesalink_connect_step3(struct connectdata *conn, int sockindex)
}
if(!incache) {
- result = Curl_ssl_addsessionid(
- conn, our_ssl_sessionid, 0 /* unknown size */, sockindex);
+ result =
+ Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid, 0,
+ sockindex);
if(result) {
Curl_ssl_sessionid_unlock(conn);
failf(data, "failed to store ssl session");
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 498f8b9d1d08..68b98984b460 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -393,12 +393,23 @@ static int ossl_get_ssl_conn_index(void)
*/
static int ossl_get_ssl_sockindex_index(void)
{
- static int ssl_ex_data_sockindex_index = -1;
- if(ssl_ex_data_sockindex_index < 0) {
- ssl_ex_data_sockindex_index = SSL_get_ex_new_index(0, NULL, NULL, NULL,
- NULL);
+ static int sockindex_index = -1;
+ if(sockindex_index < 0) {
+ sockindex_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
}
- return ssl_ex_data_sockindex_index;
+ return sockindex_index;
+}
+
+/* Return an extra data index for proxy boolean.
+ * This index can be used with SSL_get_ex_data() and SSL_set_ex_data().
+ */
+static int ossl_get_proxy_index(void)
+{
+ static int proxy_index = -1;
+ if(proxy_index < 0) {
+ proxy_index = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
+ }
+ return proxy_index;
}
static int passwd_callback(char *buf, int num, int encrypting,
@@ -1174,6 +1185,7 @@ static int ossl_init(void)
/* Initialize the extra data indexes */
- if(ossl_get_ssl_conn_index() < 0 || ossl_get_ssl_sockindex_index() < 0)
+ if(ossl_get_ssl_conn_index() < 0 ||
+ ossl_get_ssl_sockindex_index() < 0 || ossl_get_proxy_index() < 0)
return 0;
return 1;
@@ -2432,8 +2443,10 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
curl_socket_t *sockindex_ptr;
int connectdata_idx = ossl_get_ssl_conn_index();
int sockindex_idx = ossl_get_ssl_sockindex_index();
+ int proxy_idx = ossl_get_proxy_index();
+ bool isproxy;
- if(connectdata_idx < 0 || sockindex_idx < 0)
+ if(connectdata_idx < 0 || sockindex_idx < 0 || proxy_idx < 0)
return 0;
conn = (struct connectdata*) SSL_get_ex_data(ssl, connectdata_idx);
@@ -2446,13 +2459,18 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
sockindex_ptr = (curl_socket_t*) SSL_get_ex_data(ssl, sockindex_idx);
sockindex = (int)(sockindex_ptr - conn->sock);
+ isproxy = SSL_get_ex_data(ssl, proxy_idx) ? TRUE : FALSE;
+
if(SSL_SET_OPTION(primary.sessionid)) {
bool incache;
void *old_ssl_sessionid = NULL;
Curl_ssl_sessionid_lock(conn);
- incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
- sockindex));
+ if(isproxy)
+ incache = FALSE;
+ else
+ incache = !(Curl_ssl_getsessionid(conn, isproxy,
+ &old_ssl_sessionid, NULL, sockindex));
if(incache) {
if(old_ssl_sessionid != ssl_sessionid) {
infof(data, "old SSL session ID is stale, removing\n");
@@ -2462,8 +2480,8 @@ static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
}
if(!incache) {
- if(!Curl_ssl_addsessionid(conn, ssl_sessionid,
- 0 /* unknown size */, sockindex)) {
+ if(!Curl_ssl_addsessionid(conn, isproxy, ssl_sessionid,
+ 0 /* unknown size */, sockindex)) {
/* the session has been put into the session cache */
res = 1;
}
@@ -3193,16 +3211,26 @@ static CURLcode ossl_connect_step1(struct Curl_easy *data,
void *ssl_sessionid = NULL;
int connectdata_idx = ossl_get_ssl_conn_index();
int sockindex_idx = ossl_get_ssl_sockindex_index();
+ int proxy_idx = ossl_get_proxy_index();
- if(connectdata_idx >= 0 && sockindex_idx >= 0) {
+ if(connectdata_idx >= 0 && sockindex_idx >= 0 &&
+ proxy_idx >= 0) {
/* Store the data needed for the "new session" callback.
* The sockindex is stored as a pointer to an array element. */
SSL_set_ex_data(backend->handle, connectdata_idx, conn);
SSL_set_ex_data(backend->handle, sockindex_idx, conn->sock + sockindex);
+#ifndef CURL_DISABLE_PROXY
+ SSL_set_ex_data(backend->handle, proxy_idx, SSL_IS_PROXY() ? (void *) 1:
+ NULL);
+#else
+ SSL_set_ex_data(backend->handle, proxy_idx, NULL);
+#endif
+
}
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn, SSL_IS_PROXY() ? TRUE : FALSE,
+ &ssl_sessionid, NULL, sockindex)) {
/* we got a session id, use it! */
if(!SSL_set_session(backend->handle, ssl_sessionid)) {
Curl_ssl_sessionid_unlock(conn);
diff --git a/lib/vtls/schannel.c b/lib/vtls/schannel.c
index d7b89d43f892..931bd853eb8e 100644
--- a/lib/vtls/schannel.c
+++ b/lib/vtls/schannel.c
@@ -496,5 +496,7 @@ schannel_connect_step1(struct Curl_easy *data, struct connectdata *conn,
if(SSL_SET_OPTION(primary.sessionid)) {
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ (void **)&old_cred, NULL, sockindex)) {
BACKEND->cred = old_cred;
DEBUGF(infof(data, "schannel: re-using existing credential handle\n"));
@@ -1337,8 +1338,9 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
SECURITY_STATUS sspi_status = SEC_E_OK;
CERT_CONTEXT *ccert_context = NULL;
+ bool isproxy = SSL_IS_PROXY();
#ifdef DEBUGBUILD
- const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
+ const char * const hostname = isproxy ? conn->http_proxy.host.name :
conn->host.name;
#endif
#ifdef HAS_ALPN
@@ -1414,8 +1416,8 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
struct Curl_schannel_cred *old_cred = NULL;
Curl_ssl_sessionid_lock(conn);
- incache = !(Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL,
- sockindex));
+ incache = !(Curl_ssl_getsessionid(conn, isproxy, (void **)&old_cred,
+ NULL, sockindex));
if(incache) {
if(old_cred != BACKEND->cred) {
DEBUGF(infof(data,
@@ -1426,7 +1428,7 @@ schannel_connect_step3(struct Curl_easy *data, struct connectdata *conn,
}
}
if(!incache) {
- result = Curl_ssl_addsessionid(conn, (void *)BACKEND->cred,
+ result = Curl_ssl_addsessionid(conn, isproxy, BACKEND->cred,
sizeof(struct Curl_schannel_cred),
sockindex);
if(result) {
diff --git a/lib/vtls/sectransp.c b/lib/vtls/sectransp.c
index 05b57dfaad91..e69b99b72cd6 100644
--- a/lib/vtls/sectransp.c
+++ b/lib/vtls/sectransp.c
@@ -1400,10 +1400,12 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
const struct curl_blob *ssl_cert_blob = SSL_SET_OPTION(primary.cert_blob);
#ifndef CURL_DISABLE_PROXY
- const char * const hostname = SSL_IS_PROXY() ? conn->http_proxy.host.name :
+ bool isproxy = SSL_IS_PROXY();
+ const char * const hostname = isproxy ? conn->http_proxy.host.name :
conn->host.name;
const long int port = SSL_IS_PROXY() ? conn->port : conn->remote_port;
#else
+ const isproxy = FALSE;
const char * const hostname = conn->host.name;
const long int port = conn->remote_port;
#endif
@@ -1613,7 +1615,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
#ifdef USE_NGHTTP2
if(data->state.httpversion >= CURL_HTTP_VERSION_2
#ifndef CURL_DISABLE_PROXY
- && (!SSL_IS_PROXY() || !conn->bits.tunnel_proxy)
+ && (!isproxy || !conn->bits.tunnel_proxy)
#endif
) {
CFArrayAppendValue(alpnArr, CFSTR(NGHTTP2_PROTO_VERSION_ID));
@@ -1953,7 +1955,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
size_t ssl_sessionid_len;
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, (void **)&ssl_sessionid,
+ if(!Curl_ssl_getsessionid(conn, isproxy, (void **)&ssl_sessionid,
&ssl_sessionid_len, sockindex)) {
/* we got a session id, use it! */
err = SSLSetPeerID(backend->ssl_ctx, ssl_sessionid, ssl_sessionid_len);
@@ -1981,7 +1983,7 @@ static CURLcode sectransp_connect_step1(struct Curl_easy *data,
return CURLE_SSL_CONNECT_ERROR;
}
- result = Curl_ssl_addsessionid(conn, ssl_sessionid, ssl_sessionid_len,
+ result = Curl_ssl_addsessionid(conn, isproxy, ssl_sessionid, ssl_sessionid_len,
sockindex);
Curl_ssl_sessionid_unlock(conn);
if(result) {
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 6a0069237fdb..95fd6356285f 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -367,5 +367,6 @@ void Curl_ssl_sessionid_unlock(struct Curl_easy *data)
*/
bool Curl_ssl_getsessionid(struct connectdata *conn,
+ const bool isProxy,
void **ssl_sessionid,
size_t *idsize, /* set 0 if unknown */
int sockindex)
@@ -377,7 +378,6 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
bool no_match = TRUE;
#ifndef CURL_DISABLE_PROXY
- const bool isProxy = CONNECT_PROXY_SSL();
struct ssl_primary_config * const ssl_config = isProxy ?
&conn->proxy_ssl_config :
&conn->ssl_config;
@@ -389,10 +389,15 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
struct ssl_primary_config * const ssl_config = &conn->ssl_config;
const char * const name = conn->host.name;
int port = conn->remote_port;
- (void)sockindex;
#endif
+ (void)sockindex;
*ssl_sessionid = NULL;
+#ifdef CURL_DISABLE_PROXY
+ if(isProxy)
+ return TRUE;
+#endif
+
DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
if(!SSL_SET_OPTION(primary.sessionid))
@@ -480,5 +485,6 @@ void Curl_ssl_delsessionid(struct Curl_easy *data, void *ssl_sessionid)
*/
CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
+ bool isProxy,
void *ssl_sessionid,
size_t idsize,
int sockindex)
@@ -492,7 +498,6 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
int conn_to_port;
long *general_age;
#ifndef CURL_DISABLE_PROXY
- const bool isProxy = CONNECT_PROXY_SSL();
struct ssl_primary_config * const ssl_config = isProxy ?
&conn->proxy_ssl_config :
&conn->ssl_config;
@@ -505,6 +510,7 @@ CURLcode Curl_ssl_addsessionid(struct Curl_easy *data,
const char *hostname = conn->host.name;
(void)sockindex;
#endif
+ (void)sockindex;
DEBUGASSERT(SSL_SET_OPTION(primary.sessionid));
clone_host = strdup(hostname);
diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
index 273184f1894a..2b43e7744b19 100644
--- a/lib/vtls/vtls.h
+++ b/lib/vtls/vtls.h
@@ -235,5 +235,6 @@ void Curl_ssl_sessionid_unlock(struct Curl_easy *data);
*/
bool Curl_ssl_getsessionid(struct connectdata *conn,
+ const bool isproxy,
void **ssl_sessionid,
size_t *idsize, /* set 0 if unknown */
int sockindex);
@@ -245,5 +246,6 @@ bool Curl_ssl_getsessionid(struct Curl_easy *data,
*/
CURLcode Curl_ssl_addsessionid(struct connectdata *conn,
+ const bool isProxy,
void *ssl_sessionid,
size_t idsize,
int sockindex);
diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
index 7159ac9d5e64..8fb2ea7acf31 100644
--- a/lib/vtls/wolfssl.c
+++ b/lib/vtls/wolfssl.c
@@ -516,7 +516,9 @@ wolfssl_connect_step1(struct Curl_easy *data, struct connectdata *conn,
void *ssl_sessionid = NULL;
Curl_ssl_sessionid_lock(conn);
- if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
+ if(!Curl_ssl_getsessionid(conn,
+ SSL_IS_PROXY() ? TRUE : FALSE,
+ &ssl_sessionid, NULL, sockindex)) {
/* we got a session id, use it! */
if(!SSL_set_session(backend->handle, ssl_sessionid)) {
char error_buffer[WOLFSSL_MAX_ERROR_SZ];
@@ -772,10 +774,11 @@ wolfssl_connect_step3(struct Curl_easy *data, struct connectdata *conn,
void *old_ssl_sessionid = NULL;
our_ssl_sessionid = SSL_get_session(backend->handle);
+ bool isproxy = SSL_IS_PROXY() ? TRUE : FALSE;
Curl_ssl_sessionid_lock(conn);
- incache = !(Curl_ssl_getsessionid(conn, &old_ssl_sessionid, NULL,
- sockindex));
+ incache = !(Curl_ssl_getsessionid(conn, isproxy,
+ &old_ssl_sessionid, NULL, sockindex));
if(incache) {
if(old_ssl_sessionid != our_ssl_sessionid) {
infof(data, "old SSL session ID is stale, removing\n");
@@ -786,8 +789,8 @@ wolfssl_connect_step3(struct Curl_easy *data, struct connectdata *conn,
}
if(!incache) {
- result = Curl_ssl_addsessionid(conn, our_ssl_sessionid,
- 0 /* unknown size */, sockindex);
+ result = Curl_ssl_addsessionid(conn, isproxy, our_ssl_sessionid,
+ 0, sockindex);
if(result) {
Curl_ssl_sessionid_unlock(conn);
failf(data, "failed to store ssl session");
pkgs/tools/networking/curl/default.nix
+2 -7
View File
@@ -35,21 +35,16 @@ assert gssSupport -> libkrb5 != null;
stdenv.mkDerivation rec {
pname = "curl";
version = "7.74.0";
version = "7.76.1";
src = fetchurl {
urls = [
"https://curl.haxx.se/download/${pname}-${version}.tar.bz2"
"https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] pname}-${version}/${pname}-${version}.tar.bz2"
];
sha256 = "19bp3d91xq9vqwlbzq261j23mk9lz4lyka4gr2fm6dhnd3k66k8g";
sha256 = "1scmfrp0c27pkd7yva9k50miprjpsyfbb33apx72qc9igm6ii3ks";
};
patches = [
./7.74.0-CVE-2021-22876.patch
./7.74.0-CVE-2021-22890.patch
];
outputs = [ "bin" "dev" "out" "man" "devdoc" ];
separateDebugInfo = stdenv.isLinux;
pkgs/tools/networking/dnsmasq/default.nix
+4 -4
View File
@@ -13,11 +13,11 @@ let
in
stdenv.mkDerivation rec {
pname = "dnsmasq";
version = "2.84";
version = "2.85";
src = fetchurl {
url = "http://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
sha256 = "sha256-YDGVxktzE3YJsH4QJK4LN/ZSsvX+Rn3OZphbPRhQBQw=";
url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
sha256 = "sha256-rZjTgD32h+W5OAgPPSXGKP5ByHh1LQP7xhmXh/7jEvo=";
};
postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
meta = {
description = "An integrated DNS, DHCP and TFTP server for small networks";
homepage = "http://www.thekelleys.org.uk/dnsmasq/doc.html";
homepage = "https://www.thekelleys.org.uk/dnsmasq/doc.html";
license = licenses.gpl2;
platforms = with platforms; linux ++ darwin;
maintainers = with maintainers; [ eelco fpletz globin ];
pkgs/tools/networking/haproxy/default.nix
+1
View File
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
"USE_PCRE_JIT=yes"
] ++ lib.optionals useLua [
"USE_LUA=yes"
"LUA_LIB_NAME=lua"
"LUA_LIB=${lua5_3}/lib"
"LUA_INC=${lua5_3}/include"
] ++ lib.optionals stdenv.isLinux [
pkgs/tools/networking/inetutils/default.nix
+22 -1
View File
@@ -1,4 +1,6 @@
{ stdenv, lib, fetchurl, ncurses, perl, help2man }:
{ stdenv, lib, fetchurl, ncurses, perl, help2man
, apparmorRulesFromClosure
}:
stdenv.mkDerivation rec {
name = "inetutils-1.9.4";
@@ -8,6 +10,8 @@ stdenv.mkDerivation rec {
sha256 = "05n65k4ixl85dc6rxc51b1b732gnmm8xnqi424dy9f1nz7ppb3xy";
};
outputs = ["out" "apparmor"];
patches = [
./whois-Update-Canadian-TLD-server.patch
./service-name.patch
@@ -41,6 +45,23 @@ stdenv.mkDerivation rec {
installFlags = [ "SUIDMODE=" ];
postInstall = ''
mkdir $apparmor
cat >$apparmor/bin.ping <<EOF
$out/bin/ping {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice>
include "${apparmorRulesFromClosure { name = "ping"; } [stdenv.cc.libc]}"
include <local/bin.ping>
capability net_raw,
network inet raw,
network inet6 raw,
mr $out/bin/ping,
}
EOF
'';
meta = with lib; {
description = "Collection of common network programs";
pkgs/tools/networking/innernet/default.nix
+1 -1
View File
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
];
buildInputs = [ sqlite ] ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
postInstall = ''
installManPage doc/innernet-server.8.gz
pkgs/tools/networking/networkmanager/default.nix
+2 -2
View File
@@ -10,11 +10,11 @@ let
pythonForDocs = python3.withPackages (pkgs: with pkgs; [ pygobject3 ]);
in stdenv.mkDerivation rec {
pname = "networkmanager";
version = "1.30.2";
version = "1.30.4";
src = fetchurl {
url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
sha256 = "sha256-DI6A53h3hg5KTmq0oPfNwRhuNWtlsEKnUYlxiLiJRNI=";
sha256 = "sha256-YFC3JCEuo85zhhEzWb6pr6H2eaVPYNmZpZmYkuZywZA=";
};
outputs = [ "out" "dev" "devdoc" "man" "doc" ];
pkgs/tools/networking/openssh/default.nix
+2 -2
View File
@@ -5,11 +5,11 @@ in {
openssh = common rec {
pname = "openssh";
version = "8.5p1";
version = "8.6p1";
src = fetchurl {
url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
sha256 = "09gc8rv7728chxraab85dzkdikaw4aph1wlcwcc9kai9si0kybzm";
sha256 = "1bnpivgk98h2f9afpp88jv6g9ps83vnpxd031n2jqxi12vdf9rn3";
};
extraPatches = [ ./ssh-keysign-8.5.patch ];
pkgs/tools/networking/unbound/default.nix
+5
View File
@@ -7,6 +7,7 @@
, libevent
, dns-root-data
, pkg-config
, makeWrapper
#
# By default unbound will not be built with systemd support. Unbound is a very
# commmon dependency. The transitive dependency closure of systemd also
@@ -34,6 +35,8 @@ stdenv.mkDerivation rec {
outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
nativeBuildInputs = [ makeWrapper ];
buildInputs = [ openssl nettle expat libevent ]
++ lib.optionals withSystemd [ pkg-config systemd ]
++ lib.optionals withDoH [ libnghttp2 ];
@@ -60,6 +63,8 @@ stdenv.mkDerivation rec {
postInstall = ''
make unbound-event-install
wrapProgram $out/bin/unbound-control-setup \
--prefix PATH : ${lib.makeBinPath [ openssl ]}
'';
preFixup = lib.optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) # XXX: revisit
pkgs/tools/package-management/dpkg/default.nix
+2 -2
View File
@@ -2,11 +2,11 @@
stdenv.mkDerivation rec {
pname = "dpkg";
version = "1.20.7.1";
version = "1.20.9";
src = fetchurl {
url = "mirror://debian/pool/main/d/dpkg/dpkg_${version}.tar.xz";
sha256 = "sha256-Cq0t5of3l++OvavHuv0W3BSX8c4jvZFG+apz85alY28=";
sha256 = "sha256-XOJCgw8hO1Yg8I5sQYOtse9Nydoo0xmIonyHxx/lNM4=";
};
configureFlags = [
pkgs/tools/security/afl/default.nix
+1 -1
View File
@@ -21,7 +21,7 @@ let
# Note: libcgroup isn't needed for building, just for the afl-cgroup
# script.
nativeBuildInputs = [ makeWrapper which ];
nativeBuildInputs = [ makeWrapper which llvm.dev ];
buildInputs = [ llvm ];
makeFlags = [ "PREFIX=$(out)" ];
pkgs/tools/security/fido2luks/default.nix
+1 -1
View File
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
nativeBuildInputs = [ pkg-config clang ];
configurePhase = ''
export LIBCLANG_PATH="${llvmPackages.libclang}/lib"
export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib"
'';
cargoSha256 = "sha256-4VuM1bPkl9XCI9XsZIJvw3kHSKgT4P7x6I83F2KCFD0=";
pkgs/tools/security/sequoia/default.nix
+1 -1
View File
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage rec {
"build-release"
];
LIBCLANG_PATH = "${llvmPackages_10.libclang}/lib";
LIBCLANG_PATH = "${llvmPackages_10.libclang.lib}/lib";
# Sometimes, tests fail on CI (ofborg) & hydra without this
CARGO_TEST_ARGS = "--workspace --exclude sequoia-store";
pkgs/tools/text/diffutils/default.nix
+3 -2
View File
@@ -6,10 +6,11 @@
# files.
stdenv.mkDerivation rec {
name = "diffutils-3.7";
pname = "diffutils";
version = "3.7";
src = fetchurl {
url = "mirror://gnu/diffutils/${name}.tar.xz";
url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
sha256 = "09isrg0isjinv8c535nxsi1s86wfdfzml80dbw41dj9x3hiad9xk";
};
pkgs/tools/video/swftools/default.nix
+21 -5
View File
@@ -1,6 +1,5 @@
{ lib, stdenv, fetchurl, freetype, libjpeg, libungif, zlib }:
{ lib, stdenv, fetchurl, freetype, libjpeg, zlib }:
with lib;
stdenv.mkDerivation rec {
pname = "swftools";
version = "0.9.2";
@@ -12,13 +11,30 @@ stdenv.mkDerivation rec {
patches = [ ./swftools.patch ];
buildInputs = [ freetype libjpeg libungif zlib ];
buildInputs = [ freetype libjpeg zlib ];
meta = {
meta = with lib; {
description = "Collection of SWF manipulation and creation utilities";
homepage = "http://www.swftools.org/about.html";
license = licenses.gpl2;
license = licenses.gpl2Only;
maintainers = [ maintainers.koral ];
platforms = lib.platforms.unix;
broken = true;
knownVulnerabilities = [
"CVE-2017-10976"
"CVE-2017-11096"
"CVE-2017-11097"
"CVE-2017-11098"
"CVE-2017-11099"
"CVE-2017-11100"
"CVE-2017-11101"
"CVE-2017-16711"
"CVE-2017-16793"
"CVE-2017-16794"
"CVE-2017-16796"
"CVE-2017-16797"
"CVE-2017-16868"
"CVE-2017-16890"
];
};
}