NixOS · Jun 30, 2019 · Jun 30, 2019 · Jun 30, 2019 · Jul 4, 2019 · Jul 4, 2019
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
@@ -1570,6 +1570,11 @@
     github = "endgame";
     name = "Jack Kelly";
   };
+  enorris = {
+      name = "Eric Norris";
+      email = "erictnorris@gmail.com";
+      github = "ericnorris";
+  };
   enzime = {
     email = "enzime@users.noreply.github.com";
     github = "enzime";

diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml
@@ -28,6 +28,11 @@
      PHP now defaults to PHP 7.3, updated from 7.2.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     PHP 7.1 is no longer supported due to upstream not supporting this version for the entire lifecycle of the 19.09 release.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -285,6 +290,12 @@
       <literal>buildRustPackage</literal> may have to be updated as well.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The <literal>consul</literal> package was upgraded past version <literal>1.5</literal>,
+      so its deprecated legacy UI is no longer available.
+    </para>
+   </listitem>
    <listitem>
     <para>
       The default resample-method for PulseAudio has been changed from the upstream default <literal>speex-float-1</literal>

diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix
@@ -79,19 +79,13 @@ in
         and/or service failure.
         </para>
         </warning>
-
-        <note>
-        <para>
-        Changing this option does not affect the current session.
-        </para>
-        </note>
       '';
     };
   };
 
   config = mkIf (cfg.provider != "libc") {
-    environment.variables.LD_PRELOAD = providerLibPath;
-    systemd.extraConfig = "DefaultEnvironment=\"LD_PRELOAD=${providerLibPath}\"";
-    systemd.user.extraConfig = "DefaultEnvironment=\"LD_PRELOAD=${providerLibPath}\"";
+    environment.etc."ld-nix.so.preload".text = ''
+      ${providerLibPath}
+    '';
   };
 }
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
@@ -89,4 +89,37 @@ with lib;
   #
   # The value is taken from the KSPP recommendations (Debian uses 4096).
   boot.kernel.sysctl."vm.mmap_min_addr" = mkDefault 65536;
+
+  # Disable ftrace debugging
+  boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
+
+  # Enable reverse path filtering (that is, do not attempt to route packets
+  # that "obviously" do not belong to the iface's network; dropped packets are
+  # logged as martians).
+  boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;
+  boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault true;
+  boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;
+  boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault true;
+
+  # Ignore broadcast ICMP (mitigate SMURF)
+  boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;
+
+  # Ignore route information from sender
+  boot.kernel.sysctl."net.ipv4.conf.all.accept_source_route" = mkDefault false;
+  boot.kernel.sysctl."net.ipv4.conf.default.accept_source_route" = mkDefault false;
+  boot.kernel.sysctl."net.ipv6.conf.all.accept_source_route" = mkDefault false;
+  boot.kernel.sysctl."net.ipv6.conf.default.accept_source_route" = mkDefault false;
+
+  # Ignore incoming ICMP redirects (note: default is needed to ensure that the
+  # setting is applied to interfaces added after the sysctls are set)
+  boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;
+  boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false;
+  boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false;
+  boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false;
+  boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false;
+  boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false;
+
+  # Ignore outgoing ICMP redirects (this is ipv4 only)
+  boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
+  boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
 }
diff --git a/nixos/modules/services/networking/iperf3.nix b/nixos/modules/services/networking/iperf3.nix
@@ -19,6 +19,11 @@ let
       default     = null;
       description = "Bind to the specific interface associated with the given address.";
     };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open ports in the firewall for iperf3.";
+    };
     verbose = mkOption {
       type        = types.bool;
       default     = false;
@@ -52,6 +57,11 @@ let
   };
 
   imp = {
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
     systemd.services.iperf3 = {
       description = "iperf3 daemon";
       unitConfig.Documentation = "man:iperf3(1) https://iperf.fr/iperf-doc.php";

diff --git a/pkgs/development/interpreters/hy/default.nix b/pkgs/development/interpreters/hy/default.nix
@@ -1,23 +1,14 @@
-{ stdenv, fetchurl, fetchpatch, pythonPackages }:
+{ stdenv, fetchurl, pythonPackages }:
 
 pythonPackages.buildPythonApplication rec {
-  name = "hy-${version}";
-  version = "0.16.0";
+  pname = "hy";
+  version = "0.17.0";
 
-  src = fetchurl {
-    url = "mirror://pypi/h/hy/${name}.tar.gz";
-    sha256 = "00lq38ppikrpyw38fn5iy9iwrsamsv22507cp146dsjbzkwjpzrd";
+  src = pythonPackages.fetchPypi {
+    inherit pname version;
+    sha256 = "1gdbqsirsdxj320wnp7my5awzs1kfs6m4fqmkzbd1zd47qzj0zfi";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "bytecode-error-handling.patch";
-      url = "https://github.com/hylang/hy/commit/57326785b97b7b0a89f6258fe3d04dccdc06cfc0.patch";
-      sha256 = "1lxxs7mxbh0kaaa25b1pbqs9d8asyjnlf2n86qg8hzsv32jfcq92";
-      excludes = [ "AUTHORS" "NEWS.rst" ];
-    })
-  ];
-
   propagatedBuildInputs = with pythonPackages; [
     appdirs
     astor
@@ -27,11 +18,11 @@ pythonPackages.buildPythonApplication rec {
     rply
   ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A LISP dialect embedded in Python";
-    homepage = http://hylang.org/;
-    license = stdenv.lib.licenses.mit;
-    maintainers = [ stdenv.lib.maintainers.nixy ];
-    platforms = stdenv.lib.platforms.all;
+    homepage = "http://hylang.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nixy ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
@@ -253,14 +253,6 @@ let
     };
 
 in {
-  php71 = generic {
-    version = "7.1.30";
-    sha256 = "1czcf5qwk727sdzx5n4wvsxvl50jx6d5x8ws1dqx46fa9xvm0j36";
-
-    # https://bugs.php.net/bug.php?id=76826
-    extraPatches = optional stdenv.isDarwin ./php71-darwin-isfinite.patch;
-  };
-
   php72 = generic {
     version = "7.2.19";
     sha256 = "16d0j0d4563bcrxlw5yysldscxpgyp917hmc4m4ys1zyfprv3l7b";

diff --git a/pkgs/development/interpreters/php/php71-darwin-isfinite.patch b/pkgs/development/interpreters/php/php71-darwin-isfinite.patch
diff --git a/pkgs/development/python-modules/astor/default.nix b/pkgs/development/python-modules/astor/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "astor";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "95c30d87a6c2cf89aa628b87398466840f0ad8652f88eb173125a6df8533fb8d";
+    sha256 = "0qkq5bf13fqcwablg0nk7rx83izxdizysd42n26j5wbingcfx9ip";
   };
 
   # disable tests broken with python3.6: https://github.com/berkerpeksag/astor/issues/89

diff --git a/pkgs/development/python-modules/praw/default.nix b/pkgs/development/python-modules/praw/default.nix
@@ -1,47 +1,53 @@
 { stdenv, buildPythonPackage, fetchFromGitHub
-, requests, decorator, flake8, mock, six, update_checker, pytestrunner, prawcore
-, pytest_3, betamax, betamax-serializers, betamax-matchers, requests_toolbelt
+, betamax
+, betamax-serializers
+, betamax-matchers
+, mock
+, six
+, pytestrunner
+, prawcore
+, pytest
+, requests-toolbelt
+, update_checker
+, websocket_client
 }:
 
 buildPythonPackage rec {
   pname = "praw";
-  version = "6.0.0";
+  version = "6.3.1";
 
   src = fetchFromGitHub {
     owner = "praw-dev";
     repo = "praw";
     rev = "v${version}";
-    sha256 = "0y6nyz8vf98gl1qfmnznv3dbvlbzdl6mz99vk673nyfn3hbs451i";
+    sha256 = "0by89aw7m803dvjcc33m9390msjm6v5v8g3k8ink9gfm421lw8ky";
   };
 
-  postPatch = ''
-    # drop upper bound of prawcore requirement
-    sed -ri "s/'(prawcore >=.+), <.+'/'\1'/" setup.py
-  '';
+  nativeBuildInputs = [
+    pytestrunner
+  ];
 
   propagatedBuildInputs = [
-    requests
-    decorator
-    flake8
     mock
-    six
-    update_checker
-    pytestrunner
     prawcore
+    update_checker
+    websocket_client
   ];
 
   checkInputs = [
-    pytest_3
     betamax
     betamax-serializers
     betamax-matchers
-    requests_toolbelt
+    mock
+    pytest
+    requests-toolbelt
+    six
   ];
 
   meta = with stdenv.lib; {
     description = "Python Reddit API wrapper";
-    homepage = https://praw.readthedocs.org/;
-    license = licenses.gpl3;
+    homepage = "https://praw.readthedocs.org/";
+    license = licenses.bsd2;
     platforms = platforms.all;
     maintainers = with maintainers; [ ];
   };

diff --git a/pkgs/development/python-modules/websocket_client/default.nix b/pkgs/development/python-modules/websocket_client/default.nix
@@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchPypi, isPy27
+, six
+, backports_ssl_match_hostname
+}:
+
+buildPythonPackage rec {
+  version = "0.56.0";
+  pname = "websocket_client";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0fpxjyr74klnyis3yf6m54askl0h5dchxcwbfjsq92xng0455m8z";
+  };
+
+  propagatedBuildInputs = [
+    six
+  ] ++ lib.optional isPy27 backports_ssl_match_hostname;
+
+  meta = with lib; {
+    description = "Websocket client for python";
+    homepage = "https://github.com/websocket-client/websocket-client";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/websockets_client/default.nix b/pkgs/development/python-modules/websockets_client/default.nix