From f435685046fc6816cdfc169212c6af441b9db8da Mon Sep 17 00:00:00 2001
From: Vladimír Čunát <vladimir.cunat@nic.cz>
Date: Fri, 26 Aug 2022 11:23:57 +0200
Subject: ngtcp2-gnutls: init at 0.7.0

---
 pkgs/development/libraries/ngtcp2/gnutls.nix | 51 ++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix              |  1 +
 2 files changed, 52 insertions(+)
 create mode 100644 pkgs/development/libraries/ngtcp2/gnutls.nix

diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
new file mode 100644
index 000000000000..c2b928e851c8
--- /dev/null
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -0,0 +1,51 @@
+{ lib, stdenv, fetchFromGitHub
+, autoreconfHook, pkg-config
+, gnutls
+, cunit, ncurses
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ngtcp2";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "ngtcp2";
+    repo = "ngtcp2";
+    rev = "v${version}";
+    sha256 = "sha256-REAN5TW0miWXI3HFxtW3znTKTrhsBbNqu1VfjC2w0no=";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ gnutls ];
+
+  configureFlags = [ "--with-gnutls=yes" ];
+  enableParallelBuilding = true;
+
+  doCheck = true;
+  checkInputs = [ cunit ]
+    ++ lib.optional stdenv.isDarwin ncurses;
+
+  meta = with lib; {
+    homepage = "https://github.com/ngtcp2/ngtcp2";
+    description = "an effort to implement RFC9000 QUIC protocol.";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ vcunat/* for knot-dns */ ];
+  };
+}
+
+/*
+  Why split from ./default.nix?
+
+  ngtcp2 libs contain helpers to plug into various crypto libs (gnutls, patched openssl, ...).
+  Building multiple of them while keeping closures separable would be relatively complicated.
+  Separating the builds is easier for now; the missed opportunity to share the 0.3--0.4 MB
+  library isn't such a big deal.
+
+  Moreover upstream still commonly does incompatible changes, so agreeing
+  on a single version might be hard sometimes.  That's why it seemed simpler
+  to completely separate the nix expressions, too.
+*/
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fdb78390032d..f854c723af72 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20533,6 +20533,7 @@ with pkgs;
   nghttp3 = callPackage ../development/libraries/nghttp3 { };
 
   ngtcp2 = callPackage ../development/libraries/ngtcp2 { };
+  ngtcp2-gnutls = callPackage ../development/libraries/ngtcp2/gnutls.nix { };
 
   nix-plugins = callPackage ../development/libraries/nix-plugins { };
 
-- 
cgit 1.4.1


From b17757e458b878b987d9aaddf8a48b0595e01d90 Mon Sep 17 00:00:00 2001
From: Vladimír Čunát <vladimir.cunat@nic.cz>
Date: Fri, 26 Aug 2022 11:31:37 +0200
Subject: knot-dns: add QUIC support

It's not that useful for now, but it only adds about 0.4 MB in closure.
$ kdig @ns1.xdp.cz +quic news.xdp.cz TXT
---
 pkgs/servers/dns/knot-dns/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 427bdb597aa9..fc4efcfe56a1 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, gnutls, liburcu, lmdb, libcap_ng, libidn2, libunistring
 , systemd, nettle, libedit, zlib, libiconv, libintl, libmaxminddb, libbpf, nghttp2, libmnl
+, ngtcp2-gnutls
 , autoreconfHook, nixosTests, knot-resolver
 , fetchpatch
 }:
@@ -39,6 +40,7 @@ stdenv.mkDerivation rec {
     nettle libedit
     libiconv lmdb libintl
     nghttp2 # DoH support in kdig
+    ngtcp2-gnutls  # DoQ support in kdig (and elsewhere but not much use there yet)
     libmaxminddb # optional for geoip module (it's tiny)
     # without sphinx &al. for developer documentation
     # TODO: add dnstap support?
-- 
cgit 1.4.1