nextcloud25: use openssl 1.1 as a PHP extension to fix RC4 encryption #198470
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| args@{ pkgs, nextcloudVersion ? 25, ... }: | ||
|
|
||
| (import ../make-test-python.nix ({ pkgs, ...}: let | ||
| adminuser = "root"; | ||
| adminpass = "notproduction"; | ||
| nextcloudBase = { | ||
| networking.firewall.allowedTCPPorts = [ 80 ]; | ||
| system.stateVersion = "22.05"; # stateVersions <22.11 use openssl 1.1 by default | ||
| services.nextcloud = { | ||
| enable = true; | ||
| config.adminpassFile = "${pkgs.writeText "adminpass" adminpass}"; | ||
| package = pkgs.${"nextcloud" + (toString nextcloudVersion)}; | ||
| }; | ||
| }; | ||
| in { | ||
| name = "nextcloud-openssl"; | ||
| meta = with pkgs.lib.maintainers; { | ||
| maintainers = [ ma27 ]; | ||
| }; | ||
| nodes.nextcloudwithopenssl1 = { | ||
| imports = [ nextcloudBase ]; | ||
| services.nextcloud.hostName = "nextcloudwithopenssl1"; | ||
| }; | ||
| nodes.nextcloudwithopenssl3 = { | ||
| imports = [ nextcloudBase ]; | ||
| services.nextcloud = { | ||
| hostName = "nextcloudwithopenssl3"; | ||
| enableBrokenCiphersForSSE = false; | ||
| }; | ||
| }; | ||
| testScript = { nodes, ... }: let | ||
| withRcloneEnv = host: pkgs.writeScript "with-rclone-env" '' | ||
| #!${pkgs.runtimeShell} | ||
| export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav | ||
| export RCLONE_CONFIG_NEXTCLOUD_URL="http://${host}/remote.php/webdav/" | ||
| export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud" | ||
| export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}" | ||
| export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})" | ||
| "''${@}" | ||
| ''; | ||
| withRcloneEnv1 = withRcloneEnv "nextcloudwithopenssl1"; | ||
| withRcloneEnv3 = withRcloneEnv "nextcloudwithopenssl3"; | ||
| copySharedFile1 = pkgs.writeScript "copy-shared-file" '' | ||
| #!${pkgs.runtimeShell} | ||
| echo 'hi' | ${withRcloneEnv1} ${pkgs.rclone}/bin/rclone rcat nextcloud:test-shared-file | ||
| ''; | ||
| copySharedFile3 = pkgs.writeScript "copy-shared-file" '' | ||
| #!${pkgs.runtimeShell} | ||
| echo 'bye' | ${withRcloneEnv3} ${pkgs.rclone}/bin/rclone rcat nextcloud:test-shared-file2 | ||
| ''; | ||
| openssl1-node = nodes.nextcloudwithopenssl1.config.system.build.toplevel; | ||
| openssl3-node = nodes.nextcloudwithopenssl3.config.system.build.toplevel; | ||
| in '' | ||
| nextcloudwithopenssl1.start() | ||
| nextcloudwithopenssl1.wait_for_unit("multi-user.target") | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ status") | ||
| nextcloudwithopenssl1.succeed("curl -sSf http://nextcloudwithopenssl1/login") | ||
|
|
||
| with subtest("With OpenSSL 1 SSE can be enabled and used"): | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ app:enable encryption") | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ encryption:enable") | ||
|
|
||
| with subtest("Upload file and ensure it's encrypted"): | ||
| nextcloudwithopenssl1.succeed("${copySharedFile1}") | ||
| nextcloudwithopenssl1.succeed("grep -E '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") | ||
|
|
||
| with subtest("Switch to OpenSSL 3"): | ||
| nextcloudwithopenssl1.succeed("${openssl3-node}/bin/switch-to-configuration test") | ||
| nextcloudwithopenssl1.wait_for_open_port(80) | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ status") | ||
|
|
||
| with subtest("Existing encrypted files cannot be read, but new files can be added"): | ||
| nextcloudwithopenssl1.fail("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file >&2") | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ encryption:disable") | ||
| nextcloudwithopenssl1.succeed("${copySharedFile3}") | ||
| nextcloudwithopenssl1.succeed("grep bye /var/lib/nextcloud/data/root/files/test-shared-file2") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") | ||
|
|
||
| with subtest("Switch back to OpenSSL 1.1 and ensure that encrypted files are readable again"): | ||
| nextcloudwithopenssl1.succeed("${openssl1-node}/bin/switch-to-configuration test") | ||
| nextcloudwithopenssl1.wait_for_open_port(80) | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ status") | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ encryption:enable") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") | ||
| nextcloudwithopenssl1.succeed("grep -E '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file") | ||
| nextcloudwithopenssl1.succeed("grep bye /var/lib/nextcloud/data/root/files/test-shared-file2") | ||
|
|
||
| with subtest("Ensure that everything can be decrypted"): | ||
| nextcloudwithopenssl1.succeed("echo y | nextcloud-occ encryption:decrypt-all >&2") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") | ||
| nextcloudwithopenssl1.succeed("grep -vE '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file") | ||
|
|
||
| with subtest("Switch to OpenSSL 3 ensure that all files are usable now"): | ||
| nextcloudwithopenssl1.succeed("${openssl3-node}/bin/switch-to-configuration test") | ||
| nextcloudwithopenssl1.wait_for_open_port(80) | ||
| nextcloudwithopenssl1.succeed("nextcloud-occ status") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") | ||
| nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") | ||
|
|
||
| nextcloudwithopenssl1.shutdown() | ||
| ''; | ||
| })) args |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -71,16 +71,17 @@ lib.makeScope pkgs.newScope (self: with self; { | |
| # will mark the extension as a zend extension or not. | ||
| mkExtension = lib.makeOverridable | ||
| ({ name | ||
| , configureFlags ? [ "--enable-${extName}" ] | ||
| , internalDeps ? [ ] | ||
| , postPhpize ? "" | ||
| , buildInputs ? [ ] | ||
| , zendExtension ? false | ||
| , doCheck ? true | ||
| , extName ? name | ||
| , ... | ||
| }@args: stdenv.mkDerivation ((builtins.removeAttrs args [ "name" ]) // { | ||
| pname = "php-${name}"; | ||
| extensionName = extName; | ||
|
|
||
| outputs = [ "out" "dev" ]; | ||
|
|
||
|
|
@@ -103,7 +104,7 @@ lib.makeScope pkgs.newScope (self: with self; { | |
|
|
||
| cdToExtensionRootPhase = '' | ||
| # Go to extension source root. | ||
| cd "ext/${extName}" | ||
| ''; | ||
|
|
||
| preConfigure = '' | ||
|
|
@@ -139,7 +140,7 @@ lib.makeScope pkgs.newScope (self: with self; { | |
| runHook preInstall | ||
|
|
||
| mkdir -p $out/lib/php/extensions | ||
| cp modules/${extName}.so $out/lib/php/extensions/${extName}.so | ||
| mkdir -p $dev/include | ||
| ${rsync}/bin/rsync -r --filter="+ */" \ | ||
| --filter="+ *.h" \ | ||
|
|
@@ -414,6 +415,16 @@ lib.makeScope pkgs.newScope (self: with self; { | |
| configureFlags = [ "--with-openssl" ]; | ||
| doCheck = false; | ||
| } | ||
| # This provides a legacy OpenSSL PHP extension | ||
| # For situations where OpenSSL 3 do not support a set of features | ||
| # without a specific openssl.cnf file | ||
| { | ||
| name = "openssl-legacy"; | ||
| extName = "openssl"; | ||
| buildInputs = [ openssl_1_1 ]; | ||
|
Member
There was a problem hiding this comment. With #202126, this can probably be replaced with |
||
| configureFlags = [ "--with-openssl" ]; | ||
| doCheck = false; | ||
| } | ||
| { name = "pcntl"; } | ||
| { name = "pdo"; doCheck = false; } | ||
| { | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.