trafficserver: 9.2.5 -> 9.2.6

[Scrumplex]

Fixes:

• CVE-2024-38479 - Cache key plugin is vulnerable to cache poisoning attack
• CVE-2024-50305 - Valid Host field value can cause crashes
• CVE-2024-50306 - Server process can fail to drop privilege

See https://www.openwall.com/lists/oss-security/2024/11/13/1

apache/trafficserver@9.2.5-rc0...9.2.6
apache/trafficserver@9.2.6...9.2.7

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[midchildan]

I was working on this on too and the configure script for this release was broken on Darwin, leading to linker errors. Using autoreconfHook fixed it.

Browsing past upstream issues, it appears that this has happened several times in the past. So maybe it's a good idea to always use autoreconfHook.

apache/trafficserver#8556 (comment)

This might eliminate the need to patch the configure script, but I haven't gotten around to confirming that yet.

[Scrumplex]

I am (still) running nixpkgs-review on this. I will go to bed soon, so you can take this PR over if you want to get this merged quickly

[Scrumplex]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 355733

---

x86_64-linux

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

aarch64-linux

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

x86_64-darwin

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

aarch64-darwin

❌ 2 packages failed to build:

• trafficserver
• trafficserver.man

[Scrumplex]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 355733

---

x86_64-linux

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

aarch64-linux

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

x86_64-darwin

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

aarch64-darwin

✅ 2 packages built:

• trafficserver
• trafficserver.man

[Scrumplex]

I have also removed an unneeded instance of substituteInPlace as well as replacing --replace with --replace-fail to catch these in the future

[midchildan]

Looking at the NixOS tests, it's crashing right after launch. There may be issues with the 9.2.6 release.

https://logs.ofborg.org/?key=nixos/nixpkgs.355733&attempt_id=4cfb93a5-4b23-4568-a0bd-39f7ff2672b6

[Scrumplex]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 355733

---

x86_64-linux

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

x86_64-darwin

✅ 2 packages built:

• trafficserver
• trafficserver.man

---

aarch64-darwin

✅ 2 packages built:

• trafficserver
• trafficserver.man

[Scrumplex]

@ofborg test trafficserver

[getchoo]

I'm inclined to merge this soon, as 3 weeks is quite a while for us to have these vulns. Feel free to give another review ofc

[midchildan]

Sorry for the delay. 9.2.7 appears to have fixed the crash issue.

[nixpkgs-ci]

Backport failed for release-24.05, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release-24.05
git worktree add -d .worktree/backport-355733-to-release-24.05 origin/release-24.05
cd .worktree/backport-355733-to-release-24.05
git switch --create backport-355733-to-release-24.05
git cherry-pick -x a65078f73bca61e78878302c61364061fb16b15f

[nixpkgs-ci]

Successfully created backport PR for release-24.11:

• [Backport release-24.11] trafficserver: 9.2.5 -> 9.2.7 #363086