tjh.dev
1{ fetchurl
2, fetchpatch
3, lib
4, stdenv
5, pkg-config
6, libdaemon
7, dbus
8, libpcap
9, expat
10, gettext
11, glib
12, libiconv
13, libevent
14, nixosTests
15, gtk3Support ? false
16, gtk3
17, qt5
18, qt5Support ? false
19, withLibdnssdCompat ? false
20, python ? null
21, withPython ? false
22}:
23
24stdenv.mkDerivation rec {
25 pname = "avahi${lib.optionalString withLibdnssdCompat "-compat"}";
26 version = "0.8";
27
28 src = fetchurl {
29 url = "https://github.com/lathiat/avahi/releases/download/v${version}/avahi-${version}.tar.gz";
30 sha256 = "1npdixwxxn3s9q1f365x9n9rc5xgfz39hxf23faqvlrklgbhj0q6";
31 };
32
33 outputs = [ "out" "dev" "man" ];
34
35 patches = [
36 # CVE-2021-36217 / CVE-2021-3502
37 (fetchpatch {
38 name = "CVE-2021-3502.patch";
39 url = "https://github.com/lathiat/avahi/commit/9d31939e55280a733d930b15ac9e4dda4497680c.patch";
40 sha256 = "sha256-BXWmrLWUvDxKPoIPRFBpMS3T4gijRw0J+rndp6iDybU=";
41 })
42 # CVE-2021-3468
43 (fetchpatch {
44 name = "CVE-2021-3468.patch";
45 url = "https://github.com/lathiat/avahi/commit/447affe29991ee99c6b9732fc5f2c1048a611d3b.patch";
46 sha256 = "sha256-qWaCU1ZkCg2PmijNto7t8E3pYRN/36/9FrG8okd6Gu8=";
47 })
48 (fetchpatch {
49 name = "CVE-2023-1981.patch";
50 url = "https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f.patch";
51 sha256 = "sha256-BEYFGCnQngp+OpiKIY/oaKygX7isAnxJpUPCUvg+efc=";
52 })
53 # CVE-2023-38470
54 # https://github.com/lathiat/avahi/pull/457 merged Sep 19
55 (fetchpatch {
56 name = "CVE-2023-38470.patch";
57 url = "https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c.patch";
58 sha256 = "sha256-Fanh9bvz+uknr5pAmltqijuUAZIG39JR2Lyq5zGKJ58=";
59 })
60 # https://github.com/avahi/avahi/pull/480 merged Sept 19
61 (fetchpatch {
62 name = "bail-out-unless-escaped-labels-fit.patch";
63 url = "https://github.com/avahi/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24.patch";
64 sha256 = "sha256-p/dOuQ/GInIcUwuFhQR3mGc5YBL5J8ho+1gvzcqEN0c=";
65 })
66 # CVE-2023-38473
67 # https://github.com/lathiat/avahi/pull/486 merged Oct 18
68 (fetchpatch {
69 name = "CVE-2023-38473.patch";
70 url = "https://github.com/lathiat/avahi/commit/b448c9f771bada14ae8de175695a9729f8646797.patch";
71 sha256 = "sha256-/ZVhsBkf70vjDWWG5KXxvGXIpLOZUXdRkn3413iSlnI=";
72 })
73 # CVE-2023-38472
74 # https://github.com/lathiat/avahi/pull/490 merged Oct 19
75 (fetchpatch {
76 name = "CVE-2023-38472.patch";
77 url = "https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40.patch";
78 sha256 = "sha256-FjR8fmhevgdxR9JQ5iBLFXK0ILp2OZQ8Oo9IKjefCqk=";
79 })
80 # CVE-2023-38471
81 # https://github.com/lathiat/avahi/pull/494 merged Oct 24
82 (fetchpatch {
83 name = "CVE-2023-38471.patch";
84 url = "https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09.patch";
85 sha256 = "sha256-4dG+5ZHDa+A4/CszYS8uXWlpmA89m7/jhbZ7rheMs7U=";
86 })
87 # https://github.com/lathiat/avahi/pull/499 merged Oct 25
88 (fetchpatch {
89 name = "CVE-2023-38471-2.patch";
90 url = "https://github.com/avahi/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460.patch";
91 sha256 = "sha256-uDtMPWuz1lsu7n0Co/Gpyh369miQ6GWGyC0UPQB/yI8=";
92 })
93 # CVE-2023-38469
94 # https://github.com/lathiat/avahi/pull/500 merged Oct 25
95 (fetchpatch {
96 name = "CVE-2023-38469.patch";
97 url = "https://github.com/avahi/avahi/commit/61b9874ff91dd20a12483db07df29fe7f35db77f.patch";
98 sha256 = "sha256-qR7scfQqhRGxg2n4HQsxVxCLkXbwZi+PlYxrOSEPsL0=";
99 excludes = [ ".github/workflows/smoke-tests.sh" ];
100 })
101 # https://github.com/avahi/avahi/pull/515 merged Nov 3
102 (fetchpatch {
103 name = "fix-compare-rrs-with-zero-length-rdata.patch";
104 url = "https://github.com/avahi/avahi/commit/177d75e8c43be45a8383d794ce4084dd5d600a9e.patch";
105 sha256 = "sha256-uwIyruAWgiWt0yakRrvMdYjjhEhUk5cIGKt6twyXbHw=";
106 })
107 # https://github.com/avahi/avahi/pull/519 merged Nov 8
108 (fetchpatch {
109 name = "reject-non-utf-8-service-names.patch";
110 url = "https://github.com/avahi/avahi/commit/2b6d3e99579e3b6e9619708fad8ad8e07ada8218.patch";
111 sha256 = "sha256-lwSA3eEQgH0g51r0i9/HJMJPRXrhQnTIEDxcYqUuLdI=";
112 excludes = [ "fuzz/fuzz-domain.c" ];
113 })
114 # https://github.com/avahi/avahi/pull/523 merged Nov 12
115 (fetchpatch {
116 name = "core-no-longer-supply-bogus-services-to-callbacks.patch";
117 url = "https://github.com/avahi/avahi/commit/93b14365c1c1e04efd1a890e8caa01a2a514bfd8.patch";
118 sha256 = "sha256-VBm8vsBZkTbbWAK8FI71SL89lZuYd1yFNoB5o+FvlEU=";
119 excludes = [ ".github/workflows/smoke-tests.sh" "fuzz/fuzz-packet.c" ];
120 })
121 ];
122
123 depsBuildBuild = [
124 pkg-config
125 ];
126
127 nativeBuildInputs = [
128 pkg-config
129 gettext
130 glib
131 ];
132
133 buildInputs = [
134 libdaemon
135 dbus
136 glib
137 expat
138 libiconv
139 libevent
140 ] ++ lib.optionals stdenv.isFreeBSD [
141 libpcap
142 ] ++ lib.optionals gtk3Support [
143 gtk3
144 ] ++ lib.optionals qt5Support [
145 qt5
146 ];
147
148 propagatedBuildInputs = lib.optionals withPython (with python.pkgs; [
149 python
150 pygobject3
151 dbus-python
152 ]);
153
154 configureFlags = [
155 "--disable-gdbm"
156 "--disable-mono"
157 # Use non-deprecated path https://github.com/lathiat/avahi/pull/376
158 "--with-dbus-sys=${placeholder "out"}/share/dbus-1/system.d"
159 (lib.enableFeature gtk3Support "gtk3")
160 (lib.enableFeature qt5Support "qt5")
161 (lib.enableFeature withPython "python")
162 "--localstatedir=/var"
163 "--runstatedir=/run"
164 "--sysconfdir=/etc"
165 "--with-distro=${with stdenv.hostPlatform; if isBSD then parsed.kernel.name else "none"}"
166 # A systemd unit is provided by the avahi-daemon NixOS module
167 "--with-systemdsystemunitdir=no"
168 ] ++ lib.optionals withLibdnssdCompat [
169 "--enable-compat-libdns_sd"
170 ] ++ lib.optionals stdenv.isDarwin [
171 # autoipd won't build on darwin
172 "--disable-autoipd"
173 ];
174
175 installFlags = [
176 # Override directories to install into the package.
177 # Replace with runstatedir once is merged https://github.com/lathiat/avahi/pull/377
178 "avahi_runtime_dir=${placeholder "out"}/run"
179 "sysconfdir=${placeholder "out"}/etc"
180 ];
181
182 preBuild = lib.optionalString stdenv.isDarwin ''
183 sed -i '20 i\
184 #define __APPLE_USE_RFC_2292' \
185 avahi-core/socket.c
186 '';
187
188 postInstall =
189 # Maintain compat for mdnsresponder
190 lib.optionalString withLibdnssdCompat ''
191 ln -s avahi-compat-libdns_sd/dns_sd.h "$dev/include/dns_sd.h"
192 '';
193
194 passthru.tests = {
195 smoke-test = nixosTests.avahi;
196 smoke-test-resolved = nixosTests.avahi-with-resolved;
197 };
198
199 meta = with lib; {
200 description = "mDNS/DNS-SD implementation";
201 homepage = "http://avahi.org";
202 license = licenses.lgpl2Plus;
203 platforms = platforms.unix;
204 maintainers = with maintainers; [ lovek323 globin ];
205
206 longDescription = ''
207 Avahi is a system which facilitates service discovery on a local
208 network. It is an implementation of the mDNS (for "Multicast
209 DNS") and DNS-SD (for "DNS-Based Service Discovery")
210 protocols.
211 '';
212 };
213}