ngx-build

#!/usr/bin/env perl

use strict;
use warnings;

use File::Spec ();
use Getopt::Std;
use Cwd ();

my $cc = $ENV{NGX_BUILD_CC};
my $optimize = $ENV{NGX_BUILD_OPT};
my $jobs = $ENV{NGX_BUILD_JOBS} || 1;
my $disable_no_pool = $ENV{NGX_BUILD_DISABLE_NO_POOL};
my $no_debug = $ENV{NGX_BUILD_NO_DEBUG};
my $cc_opts = $ENV{NGX_BUILD_CC_OPTS};
my $ld_opts = $ENV{NGX_BUILD_LD_OPTS};
my $extra_config_opts = $ENV{NGX_BUILD_EXTRA_CONFIG_OPTS};
my $build_asan = $ENV{NGX_BUILD_ASAN} ? "-fsanitize=address" : undef;

my %opts;
getopts("fp:", \%opts) or usage();

if (@ARGV == 0) {
    usage();
}

my $force = $opts{f};
my $patch = $opts{p};
if ($patch) {
    $patch = File::Spec->rel2abs($patch);
}

my $version = shift or
    usage();

if ($version !~ /^(\d+)\.(\d+)\.(\d+)$/) {
    warn "bad nginx version number: $version\n";
    usage();
}

my @ver = ($2, $2, $3);
my $ver = sprintf("%03d%03d%03d", $1, $2, $3);

my @opts;
if (($1 == 1 && $2 == 1 && $3 >= 4)
    || ($1 == 1 && $2 > 1)
    || ($1 > 1))
{
    for my $arg (@ARGV) {
        if ($arg =~ /^--add-module=.*?ngx_http_upstream_keepalive/) {
            next;
        }
        push @opts, $arg;
    }

} else {
    @opts = @ARGV;
}

if (defined $extra_config_opts) {
    push @opts, split /\s+/, $extra_config_opts;
}

for (@opts) {
    # TODO: we can process paths in other options as well
    s/^(--add-module=)(\S+)/$1 . Cwd::realpath($2)/ge;
    s/^(--add-dynamic-module=)(\S+)/$1 . Cwd::realpath($2)/ge;
}

push @opts, '--with-poll_module';

my ($found_cc_opt, $found_ld_opt);
my @new_opts;
for my $opt (@opts) {
    if ($no_debug && $opt eq '--with-debug') {
        next;
    }

    if (defined $cc) {
        if ($opt =~ /^--with-cc=/) {
            next;
        }
    }

    if (defined $optimize) {
        if ($opt =~ /^--with-cc-opt=/) {
            if ($opt =~ s/-O\d?\b/$optimize/g) {

            } else {
                $opt .= " $optimize";
            }
        }

        $found_cc_opt = 1;
    }

    if (defined $build_asan) {
        if ($opt =~ /^--with-cc-opt=/) {
            if ($opt =~ s/-fsanitize=\w+\b/$build_asan/g ) {

            } else {
                # prepend asan opt
                $opt =~ s/^(--with-cc-opt=)(.*?)/${1}$build_asan $2/;
            }

            if ($opt =~ s/-f(no-)?omit-frame-pointer/-fno-omit-frame-pointer/g) {

            } else {
                $opt =~ s/^(--with-cc-opt=)(.*?)/${1}-fno-omit-frame-pointer $2/;
            }

            $found_cc_opt = 1;
        }

        if ($opt =~ /^--with-ld-opt=/) {
            if ($opt =~ s/-fsanitize=\w+\b/$build_asan/g) {

            } else {
                # prepend asan opt
                $opt =~ s/^(--with-ld-opt=)(.*?)/${1}$build_asan $2/;
            }

            $found_ld_opt = 1;
        }
    }

    if (defined $cc_opts) {
        if ($opt =~ s/^--with-cc-opt=/$&$cc_opts /) {
            undef $cc_opts;
        }
    }

    if (defined $ld_opts) {
        if ($opt =~ s/^--with-ld-opt=/$&$ld_opts /) {
            undef $ld_opts;
        }
    }

    push @new_opts, $opt;
}

@opts = @new_opts;

#die "options: @opts\n";

if (defined $cc) {
    push @opts, "--with-cc=$cc";
}

if (!$found_cc_opt) {
    if ($optimize) {
        if (defined $cc_opts) {
            $cc_opts .= " $optimize";

        } else {
            $cc_opts = $optimize;
        }
    }

    if ($build_asan) {
        if (defined $cc_opts) {
            $cc_opts .= "$build_asan -fno-omit-frame-pointer $cc_opts";

        } else {
            $cc_opts = "$build_asan -fno-omit-frame-pointer";
        }
    }
}

if (!$found_ld_opt && defined $build_asan) {
    if (defined $ld_opts) {
        $ld_opts .= "$build_asan $ld_opts";

    } else {
        $ld_opts = $build_asan;
    }
}

if (defined $cc_opts) {
    push @opts, "--with-cc-opt=$cc_opts";
    undef $cc_opts;
}

if (defined $ld_opts) {
    push @opts, "--with-ld-opt=$ld_opts";
    undef $ld_opts;
}

my $root = `pwd`;
chomp $root;
my $target = "$root/work/nginx";

my $home = `cd ~ && pwd`;
chomp $home;

my $build_root = "buildroot";
if (! -d $build_root) {
    mkdir $build_root or
        die "failed to create directory $build_root.\n";
}

chdir $build_root or
    die "failed to switch to directory $build_root\n";

my $tarball = "nginx-$version.tar.gz";
if ($force || ! -f $tarball || ! -d "nginx-$version") {
    if (!-d "$home/work") {
        mkdir "$home/work" or
            die "failed to create directory ~/work\n";
    }

    if (-f "$home/work/$tarball") {
        shell("cp $home/work/$tarball ./");

    } else {
        shell("axel -n2 -o $home/work/$tarball http://nginx.org/download/$tarball");
        shell("cp $home/work/$tarball ./");
    }

    shell("tar -xzvf $tarball");

    apply_patches();
}

chdir "nginx-$version" or die "cannot switch to nginx-$version\n";

if ($force || ! -f "Makefile" || -M "$root/config" < -M "Makefile"
    || (-f "$root/util/build.sh"
        && -M "$root/util/build.sh" < -M "Makefile")
    || (-f "$root/util/build2.sh"
        && -M "$root/util/build2.sh" < -M "Makefile"))
{
    configure_nginx();
}

if (-f "$target/logs/nginx.pid") {
    system("kill -QUIT `cat $target/logs/nginx.pid") == 0 or
        warn "failed to quit existing nginx.\n";
}

my $make = 'make';
if ($^O eq 'solaris') {
    $make = 'gmake';
}

shell("$make -j$jobs");
shell("$make install");

sub configure_nginx {
    warn "./configure --prefix=$target @opts\n";
    system("./configure", "--prefix=$target",
        @opts) == 0 or
            die "failed to configure nginx.\n";
}

sub apply_patches {
    if ($patch) {
        shell("patch -p0 < $patch");
    }

    unless ($disable_no_pool) {
        warn "applying no-pool patch...\n";
        shell("patch -p0 < $root/../no-pool-nginx/nginx-$version-no_pool.patch");
    }

    unless ($ver lt '001009003') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-always_enable_cc_feature_tests.patch");
    }

    if ($ver lt '001000014' || ($ver ge '001001000' && $ver lt '001001017')) {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying the null char fixes security patch";
        shell("patch -p0 -l < $root/../openresty/patches/nginx-$version-null_character_fixes.patch");
        chdir "..";
    }

    unless ($ver ge '001005012') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying patch for the SPDY security vulnerability (CVE-2014-0133)";
        shell("patch -p0 -l < $root/../openresty/patches/patch.2014.spdy2.txt");
        chdir "..";
    }

    unless ($ver ge '001010001') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying patch for the security vulnerability (CVE-2016-4450)";
        shell("patch -p0 -l < $root/../openresty/patches/patch.2016.write.txt");
        chdir "..";
    }

    unless ($ver ge '001001015') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying subrequest cycle protection patch";
        shell("patch -p1 -l < $root/../openresty/patches/nginx-$version-subrequest_loop.patch");
        chdir "..";
    }

    warn "applying the upstream_pipelining patch...\n";
    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-upstream_pipelining.patch");
    chdir "..";

    warn "applying no-error-page patch...\n";
    shell("patch -p0 < $root/../openresty/patches/nginx-$version-no_error_pages.patch");

    unless ($ver ge '001001016') {
        warn "applying the max_subrequests patch... ($ver)\n";
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-max_subrequests.patch");
    }

    unless ($ver ge '001001011' or ($ver ge '001000012' and $ver le '001001000')) {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-variable_header_ignore_no_hash.patch");
    }

    unless ($ver ge '001002001') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-reset_wev_handler_in_named_locations.patch");

        unless ($ver lt '1009002') {
            shell("patch -p0 < $root/../openresty/patches/nginx-$version-filter_finalize_hang.patch");
        }
    }

    unless ($ver ge '001002003') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-add_core_vars_polluting_globals.patch");

        shell("patch -p0 < $root/../openresty/patches/nginx-$version-resolver_debug_log_overflow.patch");

        shell("patch -p0 < $root/../openresty/patches/nginx-$version-poll_del_event_at_exit.patch");
    }

    unless ($ver ge '001007009') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-location_if_inherits_proxy.patch");
    }

    unless ($ver ge '001001006') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-named_location_clear_mods_ctx.patch");
    }

    #shell("patch -p0 < $root/../openresty/patches/nginx-$version-allow_request_body_updating.patch");

    unless ($ver ge '001001009' or ($ver ge '001000012' and $ver le '001001000')) {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-epoll_check_stale_wev.patch");
    }
    #shell("patch -p0 < $root/../openresty/patches/nginx-$version-gzip_ok_invalid_read_fix.patch");

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-log_escape_non_ascii.patch");
    chdir ".." or die "cannot switch to ..\n";

    unless ($ver ge '001005003') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-upstream_truncation.patch");
    }

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-ssl_cert_cb_yield.patch");
    chdir ".." or die "cannot switch to ..\n";

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    if ($ver ge '001017001') {
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-ssl_sess_cb_yield.patch");

    } else {
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-ssl_pending_session.patch");
    }

    chdir ".." or die "cannot switch to ..\n";

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    if ($ver ge '001019009') {
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-ssl_client_hello_cb_yield.patch");
    }
    chdir ".." or die "cannot switch to ..\n";

    if ($ver ge '001017008' && $ver lt '001021000') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-static_mod_escape_loc_hdr.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001005003') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-channel-uninit-params.patch");
    }

    unless ($ver ge '001002006') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-upstream_test_connect_kqueue.patch");
    }

    unless ($ver ge '001005013') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-slab_alloc_no_memory_as_info.patch");
    }

    unless ($ver ge '001000008') {
        warn "applying request-body-preread patch...\n";
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-request_body_preread_fix.patch");

        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying request-body-in-single-buf patch...\n";
        shell("patch -p1 -l < $root/../openresty/patches/nginx-$version-request_body_in_single_buf.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001002007') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-resolver_wev_handler_segfault_with_poll.patch");
    }

    unless ($ver ge '001002008') {
        warn "applying the run_posted_requests_in_resolver patch...\n";
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-run_posted_requests_in_resolver.patch");
    }

    unless ($ver ge '001002009' || $ver ge '001003000') {
        warn "applying the cve-2013-2070 patch...\n";
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-cve-2013-2070.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    #warn "applying the invalid_referer_hash patch...\n";
    unless ($ver ge '001005003') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-invalid_referer_hash.patch");
    }

    unless ($ver ge '001005003') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-gzip_buffered_bug.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001005003') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-unix_socket_accept_over_read.patch");
    }

    unless ($ver ge '001005007') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-gzip_flush_bug.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001007008') {
        shell("patch -p0 < $root/../openresty/patches/nginx-$version-cache_lock_hang_in_subreq.patch");
    }

    shell("patch -p0 < $root/../openresty/patches/nginx-$version-proxy_host_port_vars.patch");

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-cache_manager_exit.patch");
    chdir ".." or die "cannot switch to ..\n";

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-larger_max_error_str.patch");
    chdir ".." or die "cannot switch to ..\n";

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-pcre_conf_opt.patch");
    chdir ".." or die "cannot switch to ..\n";

    unless ($ver ge '0010070010') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-upstream_filter_finalize.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001004004') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p0 < $root/../openresty/patches/patch.2013.space.txt");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001005009') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-resolve-names-with-a-trailing-dot.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001007001') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-setting_args_invalidates_uri.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001007002') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-slab_defrag.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001007004') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-proxy_ssl_handshake_timer.patch");
        chdir ".." or die "cannot switch to ..\n";

        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-geoip_init_var_fields.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver le '001007004' or $ver ge '001007008') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-resolver_del_event_invalid_read.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver le '001007004' || $ver ge '001007007') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-hash_overflow.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver eq '001009007') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-resolver_security_fixes.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
    shell("patch -p1 < $root/../openresty/patches/nginx-$version-upstream_timeout_fields.patch");
    chdir ".." or die "cannot switch to ..\n";

    if ($ver ge '001011002') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-privileged_agent_process.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-balancer_status_code.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-builtin_error_page_footer.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-delayed_posted_events.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-single_process_graceful_exit.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-intercept_error_log.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-safe_resolver_ipv6_option.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    unless ($ver ge '001013003') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p0 < $root/../openresty/patches/patch.2017.ranges.txt");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001013006') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-init_cycle_pool_release.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-stream_ssl_preread_no_skip.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-resolver_conf_parsing.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-socket_cloexec.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-daemon_destroy_pool.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001013003') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-stream_balancer_export.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-stream_proxy_get_next_upstream_tries.patch");
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-stream_proxy_timeout_fields.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001015000' && $ver lt '001015006') {
        # 1.9.5 to 1.14.0 (included) are alro vulnerable, but this patch does not apply
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p0 < $root/../openresty/patches/patch.2018.h2.txt");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001017001') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-reuseport_close_unused_fds.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001015006' && $ver lt '001016001'
        || $ver ge '001017000' && $ver lt '001017003')
    {
        # 1.9.5 to 1.16.0 (included) are alro vulnerable, but this patch only
        # applies to 1.15.6+
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p0 < $root/../openresty/patches/patch.2019.h2.txt");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '000006018' && $ver le '001020000') {
        # 0.6.18 to 1.20.0 (included) are vulnerable
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying patch for the NGINX resolver security vulnerability (CVE-2021-23017)";
        shell("patch -p0 < $root/../openresty/patches/patch.2021.resolver.txt");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001019003') {
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-privileged_agent_process_connections.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001021004'){
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-privileged_agent_process_thread_pool.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001009005' && $ver le '001025002') {
        # 1.9.5 to 1.25.2 (included) are vulnerable
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        warn "applying the patch for NGINX security vulnerability (CVE-2023-44487)";
        shell("patch -p1 < $root/../openresty/patches/patch.2023.h2.txt");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001019001'){
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-balancer_pool_max_retry.patch");
        chdir ".." or die "cannot switch to ..\n";
    }

    if ($ver ge '001027000'){
        chdir "nginx-$version" or die "cannot switch to nginx-$version\n";
        shell("patch -p1 < $root/../openresty/patches/nginx-$version-initialize_quic_transport_id_variable.patch");
        chdir ".." or die "cannot switch to ..\n";
    }
}

sub usage {
    die "Usage: $0 <nginx-version> <options>\n";
}

sub shell {
    my $cmd = shift;
    warn "$cmd\n";
    system($cmd) == 0 or
        die "failed to run command \"$cmd\"\n";
}