Enable NginxHttpSecureLinkModule (bug #269810), enable ipv6 support in nginx (bug #274614).

Package-Manager: portage-2.2_rc33/cvs/Linux x86_64

5 files changed, 263 insertions, 13 deletions

diff --git a/www-servers/nginx/ChangeLog b/www-servers/nginx/ChangeLog
index 95013ef5c188..6eb0f5caf713 100644
--- a/www-servers/nginx/ChangeLog
+++ b/www-servers/nginx/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for www-servers/nginx
 # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-servers/nginx/ChangeLog,v 1.219 2009/07/09 13:44:57 voxus Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-servers/nginx/ChangeLog,v 1.220 2009/07/19 14:56:33 cla Exp $
+
+*nginx-0.8.4-r1 (19 Jul 2009)
+
+  19 Jul 2009; Dawid Węgliński <cla@gentoo.org>
+  +files/nginx-secure-link-timeout.patch, metadata.xml,
+  +nginx-0.8.4-r1.ebuild:
+  Enable NginxHttpSecureLinkModule (bug #269810)
+  Enable ipv6 support in nginx (bug #274614).
+  Bug me for problems with those changes.
 
   09 Jul 2009; Konstantin V. Arkhipov <voxus@gentoo.org>
   -nginx-0.6.32.ebuild, nginx-0.6.38.ebuild, nginx-0.7.61.ebuild:
diff --git a/www-servers/nginx/Manifest b/www-servers/nginx/Manifest
index 76de3349f940..43ac94098d35 100644
--- a/www-servers/nginx/Manifest
+++ b/www-servers/nginx/Manifest
@@ -1,8 +1,6 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
 AUX nginx 994 RMD160 4b36e15714c84f8e8228d0ca6790c545736d74bb SHA1 de0a11802cc6f4a1111652416bce131a07ae008c SHA256 17a32f38e066ecc91ad91496e0ab8f0885e5550d42bf62dbecfdf2747a0fb1cd
 AUX nginx-r1 1645 RMD160 d032feec43e4ba31ac5b6fffec478ebbeb49db60 SHA1 49f0db3efaccd3cef545b8c68cfa557ca829352f SHA256 b263a663399d2897dfdf53226d45fc3707bc9230bd687b8003d075a48f60ecaf
+AUX nginx-secure-link-timeout.patch 3105 RMD160 1942d5683c383435ab4f22f9e2d241e40c1c32b3 SHA1 e2348c293fa3bde1fc034bd9142d21776fe1a428 SHA256 4c4d37f60e1d294b87dfbd5322f10db9fe706c3033fe9e16dceca4e5c1a00dbd
 AUX nginx.conf 1400 RMD160 d982c853d9145643c4a885012a41fc4acd39080f SHA1 6974ab2214a11ad3e828861b47f9499c9481520d SHA256 11adbf9f0903f473b98474d460e41ec1161daa58d37e5c05019b03eae4d944f7
 AUX nginx.conf-r1 966 RMD160 b4b9e54860f14a106b186cfc02dbb00e15df694d SHA1 0bc417a8b7f736bcfba5330a48b7915ef344a7a2 SHA256 ef34ceb24bdd8aebf144b9583f457e3bfbbd96286acc4394c159a886990c29bf
 AUX nginx.conf-r2 1044 RMD160 5ddc034f31a54da00b57503cfc5a7e0be2189cef SHA1 988e59f8aeabb8b4b1e412f4dfc8ddfa96ee5da4 SHA256 722b5588c975c523caea14bd90866be5d260f7d0fcdf1af90d2110b2db7ee448
@@ -23,13 +21,7 @@ EBUILD nginx-0.4.14.ebuild 2293 RMD160 5acc8d582dbf5a6da3b8e92f25b127d99e163703
 EBUILD nginx-0.5.37.ebuild 2948 RMD160 78f82e5df19b6f087b004d4d67f8c45e6c2c7d1c SHA1 d2e73605cb7fe74858ee5a82e7bc3f43a28a7ccb SHA256 fb1f1a0d10d1f2ae43f57ec1182c54c2b9c356c145666b19a28cbd1c28ee3a4e
 EBUILD nginx-0.6.38.ebuild 3060 RMD160 56a00c95e0b45093147d11e188fdc0c16b2f1ff2 SHA1 4b0dfd4f51969e48a6f93d8f9752e1a5e89aec52 SHA256 60d1d3188a3e2c508211bfe4fe34cc8f44e543e845fe1e6f481cc6051c9c54aa
 EBUILD nginx-0.7.61.ebuild 3261 RMD160 b12e46480f3a1fe714db5270a2a95376cb0684c3 SHA1 da46085272c864c2c23b7fda160033ddd4208d77 SHA256 429de38daad8cfcc32662e4737a481975ada406d8e628194e9f975ad4174b98e
+EBUILD nginx-0.8.4-r1.ebuild 3647 RMD160 c612f9fbbed9fd8402d95ba4a36d1b40f6eb31f4 SHA1 d7b6f7ede7cb6a9086d147f92e4ceaac75688a8c SHA256 7b3ae9527f2875b1e70ce7d7bcde2fa853aa3bdf90d541e67b39032a2dce2971
 EBUILD nginx-0.8.4.ebuild 3262 RMD160 28ea88d2decadf55ffb12bf0a6688788f666dec4 SHA1 e9f51f17b406e3ae41cdae698c16b0a479071c77 SHA256 1efb4f0aa40c6d7c5b26efe165d16ff39f4692e7b762125375c8011211d8cf33
-MISC ChangeLog 35355 RMD160 4220bf5670543c533a767e76702bca36a7e61b15 SHA1 8da09d2b941e3f8018cfc7794c576d7d12634af8 SHA256 fbf3f1e77544974a12474ad4b5a1f782b56600673b2d1319d9e58d545f5de226
-MISC metadata.xml 595 RMD160 e06fbe391f9ab0805dbe68043559994afd17ec97 SHA1 5c4b053e47410ee159081ace8ca01952a2c23b95 SHA256 f957e3933c4e5b8fb9c97519c4a0d6d30063c076051e285640a24a3d8512dfe6
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.12 (GNU/Linux)
-
-iEYEARECAAYFAkpV9GMACgkQbwxeDFj+ScrMOQCfZHAEOBE1J/rIHV/3SQHar4FV
-MoAAn0AIOS9ktjdUj7V6BjjA6Lj0TrXw
-=SoWC
------END PGP SIGNATURE-----
+MISC ChangeLog 35654 RMD160 85e685074a7005c25cba66cf994819be75cc6edf SHA1 80e5a9f431e0720ac337e1f004cfd993cd2ec103 SHA256 b0acb346b147027a4707fe707b747b3cbd8e384a2feeb5d409eeb5421b41c53a
+MISC metadata.xml 658 RMD160 7294560d00411e37fcc73d1d93f0582f7991b380 SHA1 85d04bdf906447f68042f21c12b18016059c0371 SHA256 e73d513e05935ab2dceb674477ff4ff70e39e48171782e0882a2a44993f01ce8
diff --git a/www-servers/nginx/files/nginx-secure-link-timeout.patch b/www-servers/nginx/files/nginx-secure-link-timeout.patch
new file mode 100644
index 000000000000..039e25063806
--- /dev/null
+++ b/www-servers/nginx/files/nginx-secure-link-timeout.patch
@@ -0,0 +1,131 @@
+diff -Naur nginx-0.7.55.org/src/http/modules/ngx_http_secure_link_module.c nginx-0.7.55/src/http/modules/ngx_http_secure_link_module.c
+--- nginx-0.7.55.org/src/http/modules/ngx_http_secure_link_module.c	2009-05-13 14:44:15.000000000 +0200
++++ nginx-0.7.55/src/http/modules/ngx_http_secure_link_module.c	2009-05-13 15:00:49.000000000 +0200
+@@ -12,6 +12,7 @@
+ 
+ typedef struct {
+     ngx_str_t  secret;
++		time_t timeout;
+ } ngx_http_secure_link_conf_t;
+ 
+ 
+@@ -30,6 +31,12 @@
+       offsetof(ngx_http_secure_link_conf_t, secret),
+       NULL },
+ 
++			{ ngx_string("secure_link_timeout"),
++			NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
++			ngx_conf_set_sec_slot,
++			NGX_HTTP_LOC_CONF_OFFSET,
++			offsetof(ngx_http_secure_link_conf_t, timeout),
++			NULL },
+       ngx_null_command
+ };
+ 
+@@ -67,22 +74,36 @@
+ 
+ static ngx_str_t  ngx_http_secure_link = ngx_string("secure_link");
+ 
++static u_char
++ngx_hex2int(u_char hex)
++{
++	hex = hex - '0';
++	if (hex > 9) {
++	hex = (hex + '0' - 1) | 0x20;
++	hex = hex - 'a' + 11;
++	}
++	if (hex > 15)
++	hex = 0xFF;
++
++	return hex;
++}
+ 
+ static ngx_int_t
+ ngx_http_secure_link_variable(ngx_http_request_t *r,
+      ngx_http_variable_value_t *v, uintptr_t data)
+ {
+-    u_char                        *p, *start, *end, *last;
+-    size_t                         len;
++		u_char *p, *start, *end, *last, *tss, *tse;
++		size_t                         len, tslen;
+     ngx_int_t                      n;
+     ngx_uint_t                     i;
+     ngx_md5_t                      md5;
++		time_t 												 ts;
+     ngx_http_secure_link_conf_t  *conf;
+     u_char                         hash[16];
+ 
+     conf = ngx_http_get_module_loc_conf(r, ngx_http_secure_link_module);
+ 
+-    if (conf->secret.len == 0) {
++		if (conf->secret.len == 0 || conf->timeout == 0) {
+         goto not_found;
+     }
+ 
+@@ -103,22 +124,46 @@
+     while (p < last) {
+         if (*p++ == '/') {
+             end = p - 1;
+-            goto url_start;
++						goto tstamp_start;
+         }
+     }
+ 
+     goto not_found;
+ 
++		tstamp_start:
++
++		tss = p;
++
++		while (p < last) {
++			if (*p++ == '/') {
++			tse = p - 1;
++			goto url_start;
++		}
++	}
++
++	goto not_found;
++
+ url_start:
+ 
++		tslen = tse - tss;
+     len = last - p;
+ 
+-    if (end - start != 32 || len == 0) {
++		if (end - start != 32 || len == 0 || tslen != 8) {
+         goto not_found;
+     }
+ 
++		ts = 0;
++		for (i = 0; i < 8; i++) {
++		ts = (ts << 4) + ngx_hex2int(tss[i]);
++		}
++
++		if (ts < r->start_sec - conf->timeout) {
++			goto not_found;
++		}
++
+     ngx_md5_init(&md5);
+     ngx_md5_update(&md5, p, len);
++		ngx_md5_update(&md5, tss, tslen);
+     ngx_md5_update(&md5, conf->secret.data, conf->secret.len);
+     ngx_md5_final(hash, &md5);
+ 
+@@ -160,7 +205,8 @@
+      *
+      *     conf->secret = { 0, NULL }
+      */
+-
++		
++		conf->timeout = NGX_CONF_UNSET;
+     return conf;
+ }
+ 
+@@ -172,6 +218,7 @@
+     ngx_http_secure_link_conf_t *conf = child;
+ 
+     ngx_conf_merge_str_value(conf->secret, prev->secret, "");
++		ngx_conf_merge_sec_value(conf->timeout, prev->timeout, 3600);
+ 
+     return NGX_CONF_OK;
+ }
diff --git a/www-servers/nginx/metadata.xml b/www-servers/nginx/metadata.xml
index f569eff41901..a211b0313cf2 100644
--- a/www-servers/nginx/metadata.xml
+++ b/www-servers/nginx/metadata.xml
@@ -9,6 +9,7 @@
 	<flag name='addition'>Enables HTTP addition filter module</flag>
 	<flag name='flv'>Enables special processing module for flv files</flag>
 	<flag name='random-index'>Enables HTTP random index module</flag>
+	<flag name='securelink'>Enable HTTP secure link module</flag>
 	<flag name='status'>Enables stub_status module</flag>
 	<flag name='sub'>Enables sub_filter module</flag>
 	<flag name='webdav'>Enable webdav support</flag>
diff --git a/www-servers/nginx/nginx-0.8.4-r1.ebuild b/www-servers/nginx/nginx-0.8.4-r1.ebuild
new file mode 100644
index 000000000000..1d89f2b9c268
--- /dev/null
+++ b/www-servers/nginx/nginx-0.8.4-r1.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/www-servers/nginx/nginx-0.8.4-r1.ebuild,v 1.1 2009/07/19 14:56:33 cla Exp $
+
+inherit eutils ssl-cert toolchain-funcs
+
+DESCRIPTION="Robust, small and high performance http and reverse proxy server"
+
+HOMEPAGE="http://nginx.net/"
+SRC_URI="http://sysoev.ru/nginx/${P}.tar.gz"
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86 ~x86-fbsd"
+IUSE="addition debug fastcgi flv imap ipv6 pcre perl random-index securelink ssl status sub webdav zlib"
+
+DEPEND="dev-lang/perl
+	pcre? ( >=dev-libs/libpcre-4.2 )
+	ssl? ( dev-libs/openssl )
+	zlib? ( sys-libs/zlib )
+	perl? ( >=dev-lang/perl-5.8 )"
+
+pkg_setup() {
+	ebegin "Creating nginx user and group"
+	enewgroup ${PN}
+	enewuser ${PN} -1 -1 -1 ${PN}
+	eend ${?}
+	if use ipv6; then
+		ewarn "Note that ipv6 support in nginx is still experimental."
+		ewarn "Be sure to read comments on gentoo bug #274614"
+		ewarn "http://bugs.gentoo.org/show_bug.cgi?id=274614"
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+	sed -i 's/ make/ \\$(MAKE)/' "${S}"/auto/lib/perl/make || die
+	epatch "${FILESDIR}"/${PN}-secure-link-timeout.patch
+}
+
+src_compile() {
+	local myconf
+
+	# threads support is broken atm.
+	#
+	# if use threads; then
+	# 	einfo
+	# 	ewarn "threads support is experimental at the moment"
+	# 	ewarn "do not use it on production systems - you've been warned"
+	# 	einfo
+	# 	myconf="${myconf} --with-threads"
+	# fi
+
+	use addition && myconf="${myconf} --with-http_addition_module"
+	use ipv6	&& myconf="${myconf} --with-ipv6"
+	use fastcgi	|| myconf="${myconf} --without-http_fastcgi_module"
+	use fastcgi	&& myconf="${myconf} --with-http_realip_module"
+	use flv		&& myconf="${myconf} --with-http_flv_module"
+	use zlib	|| myconf="${myconf} --without-http_gzip_module"
+	use pcre	|| {
+		myconf="${myconf} --without-pcre --without-http_rewrite_module"
+	}
+	use debug	&& myconf="${myconf} --with-debug"
+	use ssl		&& myconf="${myconf} --with-http_ssl_module"
+	use imap	&& myconf="${myconf} --with-imap" # pop3/imap4 proxy support
+	use perl	&& myconf="${myconf} --with-http_perl_module"
+	use status	&& myconf="${myconf} --with-http_stub_status_module"
+	use webdav	&& myconf="${myconf} --with-http_dav_module"
+	use sub		&& myconf="${myconf} --with-http_sub_module"
+	use random-index	&& myconf="${myconf} --with-http_random_index_module"
+	use securelink && myconf="${myconf} --with-http_secure_link_module"
+
+	tc-export CC
+	./configure \
+		--prefix=/usr \
+		--conf-path=/etc/${PN}/${PN}.conf \
+		--http-log-path=/var/log/${PN}/access_log \
+		--error-log-path=/var/log/${PN}/error_log \
+		--pid-path=/var/run/${PN}.pid \
+		--http-client-body-temp-path=/var/tmp/${PN}/client \
+		--http-proxy-temp-path=/var/tmp/${PN}/proxy \
+		--http-fastcgi-temp-path=/var/tmp/${PN}/fastcgi \
+		--with-md5-asm --with-md5=/usr/include \
+		--with-sha1-asm --with-sha1=/usr/include \
+		${myconf} || die "configure failed"
+
+	emake LINK="${CC} ${LDFLAGS}" OTHERLDFLAGS="${LDFLAGS}" || die "failed to compile"
+}
+
+src_install() {
+	keepdir /var/log/${PN} /var/tmp/${PN}/{client,proxy,fastcgi}
+
+	dosbin objs/nginx
+	cp "${FILESDIR}"/nginx-r1 "${T}"/nginx
+	doinitd "${T}"/nginx
+
+	cp "${FILESDIR}"/nginx.conf-r4 conf/nginx.conf
+
+	dodir /etc/${PN}
+	insinto /etc/${PN}
+	doins conf/*
+
+	dodoc CHANGES{,.ru} README
+
+	use perl && {
+		cd "${S}"/objs/src/http/modules/perl/
+		einstall DESTDIR="${D}"|| die "failed to install perl stuff"
+	}
+}
+
+pkg_postinst() {
+	use ssl && {
+		if [ ! -f "${ROOT}"/etc/ssl/${PN}/${PN}.key ]; then
+			install_cert /etc/ssl/${PN}/${PN}
+			chown ${PN}:${PN} "${ROOT}"/etc/ssl/${PN}/${PN}.{crt,csr,key,pem}
+		fi
+	}
+}