Closed jeremyjpj0916 closed 5 years ago
Dockerfile code involved:
#CONFIG ENV
ENV RESTY_VERSION=1.15.8.1
#Pull Openresty and patch
RUN wget https://openresty.org/download/openresty-$RESTY_VERSION.tar.gz \
&& tar -zxvf openresty-$RESTY_VERSION.tar.gz -C /tmp \
&& wget https://github.com/Kong/openresty-patches/archive/master.tar.gz \
&& tar -zxvf master.tar.gz -C /tmp \
&& cd /tmp/openresty-$RESTY_VERSION/bundle \
&& wget https://github.company.com/raw/Repo/optum-kong-docker/dev/patches/ngx/nginx-1.15.8-cve_2019_9511_cve_2019_9513_cve_2019_9516.patch -P /tmp/openresty-patches-master/patches/$RESTY_VERSION/ \
&& cd /tmp/openresty-$RESTY_VERSION/bundle && for i in /tmp/openresty-patches-master/patches/$RESTY_VERSION/*.patch; do patch -p1 < $i; done
Also took a bit to clean up the two and check the diff online:
Just my patch output portion from the failed statements in the build:
patching file LuaJIT-2.1-20190507/src/lj_tab.c
patching file LuaJIT-2.1-20190507/src/lj_asm_arm.h
patching file LuaJIT-2.1-20190507/src/lj_api.c
patching file LuaJIT-2.1-20190507/src/lj_arch.h
patching file LuaJIT-2.1-20190507/src/lj_cconv.c
patching file LuaJIT-2.1-20190507/src/lj_obj.h
patching file LuaJIT-2.1-20190507/src/lj_state.c
patching file lua-resty-core-0.1.17/lib/ngx/balancer.lua
patching file lua-resty-core-0.1.17/lib/ngx/ssl.lua
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.h
patching file nginx-1.15.8/src/http/v2/ngx_http_v2_filter_module.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.h
patching file nginx-1.15.8/src/http/ngx_http_upstream.c
patching file nginx-1.15.8/src/stream/ngx_stream.h
patching file nginx-1.15.8/src/stream/ngx_stream_proxy_module.c
patching file nginx-1.15.8/src/core/ngx_connection.c
Hunk 1 FAILED 732/732.
continue;
}
+ if (ngx_strcmp(value[i].data, "transparent") == 0) { +#if (NGX_HAVE_TRANSPARENT_PROXY)
+ ls->transparent = 1;
+ continue; +#else
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+ "transparent is not supported "
+ "on this platform"); + return NGX_CONF_ERROR;
+#endif + } + if (ngx_strcmp(value[i].data, "ssl") == 0) {
#if (NGX_STREAM_SSL) ls->ssl = 1;
patching file nginx-1.15.8/src/core/ngx_connection.h
patching file nginx-1.15.8/src/event/ngx_event_accept.c
patching file nginx-1.15.8/src/http/ngx_http.c
patching file nginx-1.15.8/src/http/ngx_http_core_module.c
patching file nginx-1.15.8/src/http/ngx_http_core_module.h
patching file nginx-1.15.8/src/http/ngx_http_request.c
patching file nginx-1.15.8/src/stream/ngx_stream.c
patching file nginx-1.15.8/src/stream/ngx_stream_core_module.c
patching file nginx-1.15.8/src/stream/ngx_stream.h
patching file nginx-1.15.8/src/stream/ngx_stream_handler.c
patching file nginx-1.15.8/auto/os/linux
patching file nginx-1.15.8/src/os/unix/ngx_linux_config.h
patching file nginx-1.15.8/src/event/ngx_event_openssl.c
patching file nginx-1.15.8/src/event/ngx_event_openssl.c
patching file nginx-1.15.8/src/event/ngx_event_openssl.h
patching file nginx-1.15.8/src/http/ngx_http_special_response.c
patching file ngx_lua-0.10.15/src/ngx_http_lua_balancer.c
patching file ngx_lua-0.10.15/src/ngx_http_lua_balancer.c
patching file ngx_lua-0.10.15/src/ngx_http_lua_ssl_certby.c
patching file ngx_lua-0.10.15/t/140-ssl-c-api.t
patching file ngx_lua-0.10.15/src/ngx_http_lua_util.c
Hunk 1 FAILED 4129/4129.
}
+ngx_http_core_srv_conf_t* +ngx_http_lua_get_server_block(ngx_uint_t i)
+{
+ ngx_http_core_main_conf_t *cmcf;
+
+ cmcf = ngx_http_cycle_get_module_main_conf(ngx_cycle, ngx_http_core_module);
+
+ if (i >= cmcf->servers.nelts)
+ return NULL;
+
+ return ((ngx_http_core_srv_conf_t**)cmcf->servers.elts)[i];
+}
+
+
+ngx_str_t*
+ngx_http_lua_server_block_server_name(ngx_http_core_srv_conf_t* http_srv_conf)
+{
+ return &http_srv_conf->server_name; +}
+
+
+#if (NGX_HTTP_SSL)
+SSL_CTX*
+ngx_http_lua_ssl_get_SSL_CTX(ngx_http_core_srv_conf_t* http_srv_conf) +{
+ ngx_http_ssl_srv_conf_t *ssl_srv_conf;
+
+ ssl_srv_conf = ngx_http_conf_get_module_srv_conf(http_srv_conf, ngx_http_ssl_module);
+
+ return ssl_srv_conf->ssl.ctx;
+} +#endif /* NGX_HTTP_SSL */
+
+
/* vi:set ft=c ts=4 sw=4 et fdm=marker: */
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_balancer.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_util.h
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_control.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_variable.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_common.h
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_util.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_ssl.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_ssl.h
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_util.c
What the documentation README has:
patching file LuaJIT-2.1-20190507/src/lj_tab.c
patching file LuaJIT-2.1-20190507/src/lj_asm_arm.h
patching file lua-resty-core-0.1.17/lib/ngx/balancer.lua
patching file lua-resty-core-0.1.17/lib/ngx/ssl.lua
patching file nginx-1.15.8/src/stream/ngx_stream.h
patching file nginx-1.15.8/src/stream/ngx_stream_proxy_module.c
patching file nginx-1.15.8/src/core/ngx_connection.c
patching file nginx-1.15.8/src/core/ngx_connection.h
patching file nginx-1.15.8/src/event/ngx_event_accept.c
patching file nginx-1.15.8/src/http/ngx_http.c
patching file nginx-1.15.8/src/http/ngx_http_core_module.c
patching file nginx-1.15.8/src/http/ngx_http_core_module.h
patching file nginx-1.15.8/src/http/ngx_http_request.c
patching file nginx-1.15.8/src/stream/ngx_stream.c
patching file nginx-1.15.8/src/stream/ngx_stream_core_module.c
patching file nginx-1.15.8/src/stream/ngx_stream.h
patching file nginx-1.15.8/src/stream/ngx_stream_handler.c
patching file nginx-1.15.8/auto/os/linux
patching file nginx-1.15.8/src/os/unix/ngx_linux_config.h
patching file nginx-1.15.8/src/event/ngx_event_openssl.c
patching file nginx-1.15.8/src/event/ngx_event_openssl.c
patching file nginx-1.15.8/src/event/ngx_event_openssl.h
patching file ngx_lua-0.10.15/src/ngx_http_lua_balancer.c
patching file ngx_lua-0.10.15/src/ngx_http_lua_balancer.c
patching file ngx_lua-0.10.15/src/ngx_http_lua_ssl_certby.c
patching file ngx_lua-0.10.15/t/140-ssl-c-api.t
patching file ngx_lua-0.10.15/src/ngx_http_lua_util.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_balancer.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_util.h
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_control.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_variable.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_common.h
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_util.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_ssl.c
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_ssl.h
patching file ngx_stream_lua-0.0.7/src/ngx_stream_lua_util.c
A few major differences are I added the http v2 CVE to the patch process here, then near the top, hence this output:
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.h
patching file nginx-1.15.8/src/http/v2/ngx_http_v2_filter_module.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.c
patching file nginx-1.15.8/src/http/v2/ngx_http_v2.h
But these files are shown early on as patched but not in the readme:
patching file LuaJIT-2.1-20190507/src/lj_api.c
patching file LuaJIT-2.1-20190507/src/lj_arch.h
patching file LuaJIT-2.1-20190507/src/lj_cconv.c
patching file LuaJIT-2.1-20190507/src/lj_obj.h
patching file LuaJIT-2.1-20190507/src/lj_state.c
And another diff is this patch file not mentioned in the readme:
patching file nginx-1.15.8/src/http/ngx_http_special_response.c
But that likely because Mr. Bungle recently added it in the http_special_response
patchwork but didn't revise the README output. As for the rest of the broken output, not sure why so hence the issue raised 👍 .
Closing this as I think the bungle PR fixes these patch diff issues.
Logs are fully detailed as follows during the build: