nixpkgs/pkgs/servers
aszlig e1d63ada02
nginx: Fix ETag patch to ignore realpath(3) error
While our ETag patch works pretty fine if it comes to serving data off
store paths, it unfortunately broke something that might be a bit more
common, namely when using regexes to extract path components of
location directives for example.

Recently, @devhell has reported a bug with a nginx location directive
like this:

  location ~^/\~([a-z0-9_]+)(/.*)?$" {
    alias /home/$1/public_html$2;
  }

While this might look harmless at first glance, it does however cause
issues with our ETag patch. The alias directive gets broken up by nginx
like this:

  *2 http script copy: "/home/"
  *2 http script capture: "foo"
  *2 http script copy: "/public_html/"
  *2 http script capture: "bar.txt"

In our patch however, we use realpath(3) to get the canonicalised path
from ngx_http_core_loc_conf_s.root, which returns the *configured* value
from the root or alias directive. So in the example above, realpath(3)
boils down to the following syscalls:

  lstat("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
  lstat("/home/$1", 0x7ffd08da6f60) = -1 ENOENT (No such file or directory)

During my review[1] of the initial patch, I didn't actually notice that
what we're doing here is returning NGX_ERROR if the realpath(3) call
fails, which in turn causes an HTTP 500 error.

Since our patch actually made the canonicalisation (and thus additional
syscalls) necessary, we really shouldn't introduce an additional error
so let's - at least for now - silently skip return value if realpath(3)
has failed.

However since we're using the unaltered root from the config we have
another issue, consider this root:

  /nix/store/...-abcde/$1

Calling realpath(3) on this path will fail (except if there's a file
called "$1" of course), so even this fix is not enough because it
results in the ETag not being set to the store path hash.

While this is very ugly and we should fix this very soon, it's not as
serious as getting HTTP 500 errors for serving static files.

I added a small NixOS VM test, which uses the example above as a
regression test.

It seems that my memory is failing these days, since apparently I *knew*
about this issue since digging for existing issues in nixpkgs, I found
this similar pull request which I even reviewed:

https://github.com/NixOS/nixpkgs/pull/66532

However, since the comments weren't addressed and the author hasn't
responded to the pull request, I decided to keep this very commit and do
a follow-up pull request.

[1]: https://github.com/NixOS/nixpkgs/pull/48337

Signed-off-by: aszlig <aszlig@nix.build>
Reported-by: @devhell
Acked-by: @7c6f434c
Acked-by: @yorickvP
Merges: https://github.com/NixOS/nixpkgs/pull/80671
Fixes: https://github.com/NixOS/nixpkgs/pull/66532
2020-03-28 02:57:21 +01:00
..
adminer adminer: init at 4.7.6 2020-03-04 22:07:18 +01:00
amqp rabbitmq-server: add the VM test to passthru.tests 2020-03-10 17:25:03 +01:00
ankisyncd ankisyncd: init at 2.1.0 2020-03-10 20:37:51 +01:00
apache-kafka kafka: Add 2.4 2020-01-10 21:02:03 -05:00
apcupsd
asterisk treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
atlassian atlassian-jira: 8.7.0 -> 8.7.1 2020-03-12 23:54:52 +00:00
beanstalkd treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
bird bird: compile with libssh for rpki support 2019-11-17 00:47:45 +01:00
blockbook blockbook: 0.3.1 -> 0.3.2 2020-03-10 15:22:37 +01:00
brickd treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
caddy caddy2: fix build on darwin 2020-03-21 04:57:00 -05:00
cayley cayley: 0.6.1 -> 0.7.5 2019-08-31 18:33:57 -07:00
clickhouse clickhouse: 19.17.8.54 -> 19.17.9.60 2020-03-26 18:18:13 +00:00
cloud-print-connector cloud-print-connector: fix build against cups 2019-12-21 11:59:08 +00:00
computing SLURM: added rdma-core as a dependency 2020-02-21 11:32:48 +01:00
confluent-platform treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
consul consul: 1.6.1 -> 1.6.2 2019-11-20 15:44:24 -08:00
corosync net-snmp: rename from net_snmp 2019-12-21 22:56:08 +00:00
coturn treewide: remove redundant quotes 2019-09-08 23:38:31 +00:00
couchpotato couchpotato: pin python2 2019-11-13 16:27:38 +01:00
dante dante: fix package under Linux 2019-11-19 20:23:17 +11:00
demoit treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
dex dex-oidc: use buildGoPackage 2019-09-21 04:26:00 -05:00
dgraph dgraph: 0.8.2 -> 1.0.17 2019-08-31 19:15:52 -07:00
dico dico: 2.7 -> 2.9 2019-04-24 09:25:58 -05:00
dict Merge remote-tracking branch 'upstream/gcc-8' into staging-next 2019-09-08 20:44:26 +02:00
diod diod: fix build w/glibc-2.30 2020-01-23 00:21:22 +01:00
dns coredns: fix build on darwin 2020-03-21 04:46:00 -05:00
documize-community documize-community: fix build on darwin 2020-03-21 04:58:00 -05:00
echoip echoip: fix build on darwin 2020-03-21 04:55:00 -05:00
elasticmq
elasticmq-server-bin treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
endlessh endlessh: 1.0 -> 1.1 2020-01-31 12:00:00 -05:00
etcd treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
exhibitor treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
fcgiwrap treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
felix treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
fileshare treewide: replace make/build/configure/patchFlags with nix lists 2019-12-30 12:58:11 +01:00
fingerd/bsd-fingerd treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
firebird firebird: mark as broken 2020-01-28 19:52:18 +01:00
foundationdb Merge branch 'staging' into glibc230 2020-02-01 17:42:03 +01:00
freeradius freeradius: do not generate TLS stuff 2020-03-10 15:54:02 +01:00
ftp bftpd: 5.2 -> 5.4 2020-01-15 05:41:38 +00:00
gobetween gobetween: fix build on darwin 2020-03-21 05:13:00 -05:00
gopher/gofish treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
gortr gortr: fix build on darwin 2020-03-21 05:07:00 -05:00
gotify gotify-server: fix build on darwin 2020-03-21 06:11:00 -05:00
gotty gotty: 0.0.13 -> 2.0.0-alpha.3 2019-12-06 04:26:07 +01:00
gpm treewide: remove wkennington as maintainer 2019-01-26 10:05:32 +00:00
gpsd gpsd: fix build w/glibc-2.30 2020-01-30 15:24:04 +01:00
grocy grocy: 2.6.0 -> 2.6.1 2020-03-07 09:28:14 +01:00
h2 treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
hbase treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
headphones treewide: fix malformed homepage URLs 2019-07-01 21:12:25 -07:00
hitch hitch: 1.5.0 -> 1.5.2 (#75243) 2019-12-08 19:10:47 +01:00
holochain-go Add: GoEndian dependancy 2018-07-06 14:00:22 +01:00
home-assistant homeassistant: 0.106.1 -> 0.106.6 2020-03-11 11:02:57 +00:00
http nginx: Fix ETag patch to ignore realpath(3) error 2020-03-28 02:57:21 +01:00
hydron hydron: fix strict deps build 2020-03-23 08:14:47 +00:00
hylafaxplus hylafaxplus: 7.0.1 -> 7.0.2 2020-02-01 02:02:09 +00:00
icecast icecast: 2.4.3 -> 2.4.4 2018-11-01 21:48:22 +01:00
icingaweb2 icingaweb2: 2.7.1 -> 2.7.3 2019-10-22 10:10:20 +02:00
identd Merge branch 'master' into staging-next 2019-08-24 08:55:37 +02:00
imgproxy imgproxy: fix build on darwin 2020-03-21 05:26:00 -05:00
interlock treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
irc Treewide: fix URL permanent redirects 2019-11-16 01:41:23 +01:00
irker treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
isso isso: 0.11.1 -> 0.12.2 2019-01-28 06:10:07 -08:00
jackett Merge pull request #81841 from r-ryantm/auto-update/jackett 2020-03-10 10:14:10 +01:00
jellyfin jellyfin: 10.4.3 -> 10.5.0 2020-03-10 00:54:59 +01:00
jetbrains treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
keycloak keycloak: init at 9.0.0 2020-02-26 23:33:04 +01:00
kippo treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
kwakd treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
ldap/389 net-snmp: rename from net_snmp 2019-12-21 22:56:08 +00:00
lidarr lidarr: Add missing dependency chromaprint 2019-10-22 17:39:09 +02:00
limesurvey limesurvey: 3.17.1+190408 -> 3.17.12+190823 2019-08-24 08:15:13 -04:00
livepeer livepeer: fix build with strict deps 2020-03-23 08:16:32 +00:00
ma1sd ma1sd: init at 2.1.1 2019-10-07 18:50:39 +02:00
mail Merge pull request #82463 from r-ryantm/auto-update/dovecot-pigeonhole 2020-03-20 06:13:55 -05:00
matrix-synapse matrix-synapse: 1.11.1 -> 1.12.0 2020-03-23 20:11:47 +01:00
matterbridge matterbridge: fix build on darwin 2020-03-21 05:43:00 -05:00
mattermost mattermost: 5.9.0 -> 5.15.0 2019-09-19 12:58:13 -07:00
mautrix-telegram mautrix-telegram: 0.7.0 -> 0.7.1 2020-02-04 22:28:15 +01:00
mautrix-whatsapp mautrix-whatsapp: 2020-02-09 -> 2020-03-26 2020-03-26 23:45:33 +01:00
mediatomb treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
meguca meguca: fix strict deps build 2020-03-23 08:14:49 +00:00
memcached memcached: 1.5.22 -> 1.6.2 2020-03-23 19:49:34 +01:00
mesos-dns treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
metabase metabase: 0.34.2 -> 0.34.3 2020-03-06 07:25:17 +01:00
meteor meteor: 1.8.2 -> 1.9.3 2020-03-24 11:14:44 -07:00
miniflux miniflux: 2.0.18 -> 2.0.19 2019-12-19 17:43:16 +01:00
minio minio: fix build on darwin 2020-03-21 05:45:00 -05:00
mirrorbits mirrorbits: Fix build with go 1.12 2019-09-11 14:33:13 +01:00
misc client-ip-echo: 0.1.0.4 -> 0.1.0.5 2020-03-14 03:27:54 +00:00
mlflow-server mlflow-server: init at 1.4.0 2020-02-15 22:11:25 -08:00
monitoring telegraf: 1.13.4 -> 1.14.0 2020-03-27 07:23:18 +00:00
mpd mpd: fix homepage 2020-03-02 18:44:17 +01:00
mqtt/mosquitto mosquitto: 1.6.7 -> 1.6.8 2020-01-22 03:55:00 +00:00
mtprotoproxy mtprotoproxy: 1.0.8 -> 1.0.9 2020-01-26 08:27:31 +00:00
mumsi treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
mxisd mxisd: use latest gradle 2020-01-10 04:21:18 +01:00
nas treewide/xorg: replace *proto with xorgproto 2019-01-04 14:38:57 +01:00
nats-server nats-server: rename (from gnatsd), 1.4.0 -> 2.1.0 2019-10-28 21:50:14 -05:00
nats-streaming-server nats-streaming-server: 0.11.2 -> 0.16.2 2019-10-28 21:50:14 -05:00
neard
news/leafnode treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
nextcloud nixos/nextcloud: implement a safe upgrade-path between 19.09 and 20.03 2020-03-25 22:07:29 +01:00
nginx-sso nginx-sso: 0.23.0 -> 0.24.0 2020-01-14 23:44:05 -05:00
nosql mongodb: builds on aarch64 as well 2020-03-26 14:02:49 +01:00
nsq treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
oauth2_proxy treewide: remove unused variables (#63177) 2019-06-16 19:59:05 +00:00
openafs openafs_1_8: 1.8.3 -> 1.8.5 (#75104) 2019-12-07 11:58:19 -05:00
openxpki openxpki: mark as broken 2019-08-21 21:36:39 +02:00
osrm-backend osrm-backend: fix build with gcc9 2019-11-03 14:43:38 +01:00
p910nd treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
pies Treewide: use HTTPS on GNU domains 2018-12-02 15:51:59 +01:00
plex plex: 1.18.7.2457 -> 1.18.8.2527 2020-03-17 18:33:59 +01:00
polipo treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
pounce pounce: 1.0p1 -> 1.1 2020-02-11 20:04:58 +00:00
prayer prayer: fix build w/glibc-2.30 2020-01-30 15:36:40 +01:00
ps3netsrv treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
pulseaudio qpaeq: init at 13.0 2020-01-21 09:57:06 +01:00
quagga net-snmp: rename from net_snmp 2019-12-21 22:56:08 +00:00
radarr radarr: 0.2.0.1450 -> 0.2.0.1480 2020-03-03 15:04:32 +00:00
radicale radicale 1.x: remove aneeshusa as maintainer 2020-03-24 01:21:33 -04:00
rainloop rainloop: 1.13.0 -> 1.14.0 2020-03-25 08:25:11 +00:00
rippled rippled: 1.2.1 -> 1.4.0 2020-01-12 19:23:31 +00:00
roon-server roon-server: init at 100600401 2019-06-25 09:34:07 -04:00
roundcube roundcube: 1.4.2 -> 1.4.3 2020-02-19 23:57:37 +01:00
routinator routinator: upgrade cargo fetcher and cargoSha256 2020-02-29 10:51:30 -05:00
rpcbind treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
rt rt: fix build error 2020-03-19 18:13:20 -07:00
sabnzbd treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
samba samba: 4.11.5 -> 4.12.0 2020-03-07 22:57:16 +01:00
scylladb scylladb: don't build on Hydra; /cc PR #70576 2019-10-12 09:46:56 +02:00
search sphinxsearch: add workaround for darwin build failures 2020-02-27 17:24:49 +01:00
ser2net ser2net: init at 4.1.1 2020-01-22 16:42:27 +01:00
serf treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
serviio treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
shairplay treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
shairport-sync shairport-sync: 3.3.5 -> 3.3.6 2020-02-23 13:58:19 -08:00
shellinabox shellinabox: fix CVE-2018-16789 2019-11-03 16:44:17 +01:00
shishi treewide: remove wkennington as maintainer 2019-01-26 10:05:32 +00:00
sickbeard sickgear: 0.21.5 -> 0.21.17 2020-03-14 14:28:08 +01:00
silc-server
simplehttp2server treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
sip freeswitch: include configuration templates, enable parallel building 2020-01-07 16:52:57 +02:00
sks treewide: remove redundant quotes 2019-09-08 23:38:31 +00:00
skydns treewide: remove redundant quotes 2019-09-08 23:38:31 +00:00
slimserver buildPerlPackage: name -> (pname, version) 2019-06-20 15:56:50 +00:00
smcroute treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
softether treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
sonarr sonarr: 2.0.0.5338 -> 2.0.0.5344 2020-03-20 14:06:19 +00:00
sql dolt: fix build on darwin 2020-03-21 04:38:00 -05:00
squid squid: 4.9 -> 4.10 2020-01-30 13:59:46 +00:00
sslh treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
syncserver pythonPackages.syncserver: move to all-packages.nix and fix dependencies 2019-01-30 15:59:00 +01:00
tacacsplus tacacs+: tacacs+ -> tacacsplus 2019-09-03 21:27:40 +00:00
tailscale tailscale: switch version and git ref to use a tag. 2020-03-23 12:11:14 -07:00
tang tang: init at 7 2020-02-17 15:14:28 +01:00
tautulli tautulli: 2.1.44 -> 2.2.0 2020-03-14 21:10:15 +00:00
tegola treewide: name -> pname (easy cases) (#66585) 2019-08-15 13:41:18 +01:00
teleport teleport: fix build with strict deps 2020-03-18 11:29:40 +00:00
tmate-ssh-server tmate-ssh-server: init at 2.3.0 2019-10-04 15:01:38 +02:00
traefik traefik: fix build with strict deps 2020-03-23 08:15:02 +00:00
trezord trezord-go: 2.0.28 -> 2.0.29 2020-03-09 19:28:24 +01:00
trickster nixos/trickster: add test 2019-11-01 14:10:53 +01:00
tt-rss tt-rss-theme-feedly: 2.0.0 -> 2.3.1 2020-01-17 11:54:21 +00:00
ttyd ttyd: 1.4.2_pre* -> 1.5.2 2019-08-19 19:30:44 -05:00
tvheadend tvheadend: fix build with gcc9 2019-11-03 14:43:40 +01:00
u9fs treewide: Change URLs to HTTPS 2019-04-22 10:19:54 +02:00
udpt treewide: remove redundant rec 2019-08-28 11:07:32 +00:00
uftp uftp: 4.10 -> 4.10.1 2020-01-30 15:59:11 +00:00
uhub uhub: *Flags are lists 2019-12-30 12:15:29 +01:00
ums ums: 6.2.2 -> 9.1.0 2020-03-13 04:03:35 +00:00
unfs3
unifi unifiStable: 5.12.22 -> 5.12.35 2019-11-25 13:27:09 +01:00
unpfs unpfs: upgrade cargo fetcher and cargoSha256 2020-03-08 23:09:16 -04:00
uwsgi treewide: NIX_*_COMPILE -> string 2019-12-31 00:13:29 +01:00
varnish treewide: replace make/build/configure/patchFlags with nix lists 2019-12-30 12:58:11 +01:00
web-apps shiori: fix build on darwin 2020-03-21 05:59:00 -05:00
webmetro webmetro: upgrade cargo fetcher and cargoSha256 2020-02-29 10:44:54 -05:00
x11 Merge pull request #75163 from rnhmjoj/gohu 2020-02-14 00:46:05 +01:00
xandikos xandikos: init at 0.1.0 2019-12-16 18:02:27 +01:00
xinetd
xmpp ejabberd: 19.09.1 -> 20.01 2020-01-26 21:37:14 +00:00
zoneminder zoneminder: add patch to fix improper caching 2020-03-07 12:59:39 -05:00
zookeeper zookeeper: Fix wrong paths in startup script 2019-10-17 02:59:10 -07:00