diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index 19a3666..8df7f18 100644 --- a/.gitignore +++ b/.gitignore @@ -10,7 +10,7 @@ x86_64 /httpd-2.2.21.tar.bz2 /clog /httpd-2.2.22.tar.bz2 -/httpd-2.4.? +/httpd-2.4.??/ /httpd-2.4.2.tar.bz2 /httpd-2.4.3.tar.bz2 /httpd-2.4.4.tar.bz2 @@ -28,3 +28,31 @@ x86_64 /httpd.service.8 /httpd-2.4.26.tar.bz2 /httpd-2.4.27.tar.bz2 +/httpd-*.tar.bz2 +/httpd*.8 +/results_httpd +/htcacheclean.service.8 +/httpd.conf.5 +/httpd-2.4.41.tar.bz2.asc +/apachectl.8 +/httpd-2.4.43.tar.bz2.asc +/KEYS +/httpd-2.4.46.tar.bz2.asc +/httpd-2.4.48.tar.bz2.asc +/httpd-2.4.49.tar.bz2.asc +/httpd-2.4.50.tar.bz2.asc +/httpd-2.4.51.tar.bz2.asc +/httpd-2.4.52.tar.bz2.asc +/httpd-2.4.53.tar.bz2.asc +/httpd-2.4.54.tar.bz2.asc +/httpd-2.4.55.tar.bz2.asc +/httpd-2.4.56.tar.bz2.asc +/httpd-2.4.57.tar.bz2.asc +/httpd-2.4.58.tar.bz2.asc +/httpd-2.4.59.tar.bz2.asc +/httpd-2.4.61.tar.bz2.asc +/httpd-2.4.62.tar.bz2.asc +/httpd-2.4.63.tar.bz2.asc +/httpd-2.4.64.tar.bz2.asc +/httpd-2.4.65.tar.bz2.asc +/httpd-2.4.66.tar.bz2.asc diff --git a/00-base.conf b/00-base.conf index ec9acf1..bae2bf6 100644 --- a/00-base.conf +++ b/00-base.conf @@ -15,6 +15,7 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_socache_module modules/mod_authn_socache.so +LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule authz_dbd_module modules/mod_authz_dbd.so LoadModule authz_dbm_module modules/mod_authz_dbm.so @@ -54,6 +55,7 @@ LoadModule slotmem_plain_module modules/mod_slotmem_plain.so LoadModule slotmem_shm_module modules/mod_slotmem_shm.so LoadModule socache_dbm_module modules/mod_socache_dbm.so LoadModule socache_memcache_module modules/mod_socache_memcache.so +LoadModule socache_redis_module modules/mod_socache_redis.so LoadModule socache_shmcb_module modules/mod_socache_shmcb.so LoadModule status_module modules/mod_status.so LoadModule substitute_module modules/mod_substitute.so diff --git a/00-brotli.conf b/00-brotli.conf new file mode 100644 index 0000000..c2e0e9e --- /dev/null +++ b/00-brotli.conf @@ -0,0 +1 @@ +LoadModule brotli_module modules/mod_brotli.so diff --git a/00-mpm.conf b/00-mpm.conf index 7bfd1d4..a4a70b8 100644 --- a/00-mpm.conf +++ b/00-mpm.conf @@ -1,9 +1,14 @@ # Select the MPM module which should be used by uncommenting exactly -# one of the following LoadModule lines: +# one of the following LoadModule lines. See the httpd.conf(5) man +# page for more information on changing the MPM. # prefork MPM: Implements a non-threaded, pre-forking web server # See: http://httpd.apache.org/docs/2.4/mod/prefork.html -LoadModule mpm_prefork_module modules/mod_mpm_prefork.so +# +# NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux +# boolean should be enabled, to allow graceful stop/shutdown. +# +#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so # worker MPM: Multi-Processing Module implementing a hybrid # multi-threaded multi-process web server @@ -16,4 +21,3 @@ LoadModule mpm_prefork_module modules/mod_mpm_prefork.so # See: http://httpd.apache.org/docs/2.4/mod/event.html # #LoadModule mpm_event_module modules/mod_mpm_event.so - diff --git a/00-proxy.conf b/00-proxy.conf index 448eb63..f0f84c2 100644 --- a/00-proxy.conf +++ b/00-proxy.conf @@ -14,4 +14,5 @@ LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so LoadModule proxy_scgi_module modules/mod_proxy_scgi.so +LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so diff --git a/01-cgi.conf b/01-cgi.conf index 5b8b936..4b680cf 100644 --- a/01-cgi.conf +++ b/01-cgi.conf @@ -2,10 +2,7 @@ # which has been configured in 00-mpm.conf. mod_cgid should be used # with a threaded MPM; mod_cgi with the prefork MPM. - - LoadModule cgid_module modules/mod_cgid.so - - + LoadModule cgid_module modules/mod_cgid.so diff --git a/README.confd b/README.confd index f5e9661..6071deb 100644 --- a/README.confd +++ b/README.confd @@ -5,5 +5,5 @@ processed as httpd configuration files. The directory is used in addition to the directory /etc/httpd/conf.modules.d/, which contains configuration files necessary to load modules. -Files are processed in alphabetical order. - +Files are processed in sorted order. See httpd.conf(5) for more +information. diff --git a/README.confmod b/README.confmod index d33d1d4..f4b055d 100644 --- a/README.confmod +++ b/README.confmod @@ -6,4 +6,5 @@ configuration fragments necessary only to load modules. Administrators should use the directory "/etc/httpd/conf.d" to modify the configuration of httpd, or any modules. -Files are processed in alphanumeric order. +Files are processed in sorted order and should have a two digit +numeric prefix. See httpd.conf(5) for more information. diff --git a/action-configtest.sh b/action-configtest.sh index 6685b0a..711d9cd 100644 --- a/action-configtest.sh +++ b/action-configtest.sh @@ -1,2 +1,2 @@ #!/bin/sh -exec /sbin/apachectl configtest "$@" +exec /usr/sbin/httpd -t diff --git a/action-graceful.sh b/action-graceful.sh index dc68b2e..4976087 100644 --- a/action-graceful.sh +++ b/action-graceful.sh @@ -1,2 +1,2 @@ #!/bin/sh -exec /sbin/apachectl graceful "$@" +exec /sbin/apachectl graceful diff --git a/apache-poweredby.png b/apache-poweredby.png new file mode 100644 index 0000000..5663a23 Binary files /dev/null and b/apache-poweredby.png differ diff --git a/apachectl.sh b/apachectl.sh new file mode 100755 index 0000000..823db3b --- /dev/null +++ b/apachectl.sh @@ -0,0 +1,74 @@ +#!/usr/bin/sh +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +### +### NOTE: This is a replacement version of the "apachectl" script with +### some differences in behaviour to the version distributed with +### Apache httpd. Please read the apachectl(8) man page for more +### information. +### + +if [ "x$1" = "x-k" ]; then + shift +fi + +ACMD="$1" +ARGV="$@" +SVC='httpd.service' +HTTPD='@HTTPDBIN@' + +if [ "x$2" != "x" ] ; then + echo Passing arguments to httpd using apachectl is no longer supported. + echo You can only start/stop/restart httpd using this script. + echo To pass extra arguments to httpd, see the $SVC'(8)' + echo man page. + exit 1 +fi + +case $ACMD in +start|stop|restart|status) + /usr/bin/systemctl --no-pager $ACMD $SVC + ERROR=$? + ;; +graceful) + if /usr/bin/systemctl -q is-active $SVC; then + /usr/bin/systemctl kill --signal=SIGUSR1 --kill-who=main $SVC + else + /usr/bin/systemctl start $SVC + fi + ERROR=$? + ;; +graceful-stop) + /usr/bin/systemctl kill --signal=SIGWINCH --kill-who=main $SVC + ERROR=$? + ;; +configtest|-t) + $HTTPD -t + ERROR=$? + ;; +-v|-V) + $HTTPD $ACMD + ERROR=$? + ;; +*) + echo apachectl: The \"$ACMD\" option is not supported. 1>&2 + ERROR=2 + ;; +esac + +exit $ERROR + diff --git a/apachectl.xml b/apachectl.xml new file mode 100644 index 0000000..217fbda --- /dev/null +++ b/apachectl.xml @@ -0,0 +1,192 @@ + +[ + +]> + + + + apachectl + httpd + Apache man pageApache Software Foundation contributors + Fedora man pageDanaFrank + + + + apachectl + 8 + + + + apachectl + Server control interface for httpd + + + + + apachectl + command + + + + + + + Description + + apachectl is a front end to the Apache HyperText + Transfer Protocol (HTTP) server. It is designed to help the + administrator control the functioning of the Apache + httpd daemon. + + The apachectl script takes one-word arguments like + , + , and + , and translates them + into appropriate signals to httpd. + + The apachectl script returns a 0 exit value on + success, and >0 if an error occurs. + + + Compatibility + + The version of apachectl used on this + system is a replacement script intended to be mostly (but not + completely) compatible with the version provided with + Apache httpd. This + apachectl mostly acts as a wrapper around + systemctl and manipulates the + systemd service for httpd. + The interface to the Apache version of + apachectl is described at . + + The following differences are present in the version of + apachectl present on this system: + + + Option arguments passed when starting + httpd are not allowed. These should be + configured in the systemd service directly (see httpd.service8). + + The "fullstatus" option is + not available. + + The "status" option does + not use or rely on the running server's + server-status output. + + + + + + + + Options + + + + + Start the Apache httpd daemon. Gives an error if it + is already running. This is equivalent to systemctl start httpd.service. + + + + + + + Stops the Apache httpd daemon. This is equivalent to + systemctl stop httpd.service. + + + + + + + Restarts the Apache httpd daemon. If the daemon is + not running, it is started. This is equivalent + to systemctl restart httpd.service. + + + + + + + Displays a brief status report. This is equivalent to systemctl status httpd.service. + + + + + + + Gracefully restarts the Apache httpd daemon. If the + daemon is not running, it is started. This differs from a normal + restart in that currently open connections are not aborted. A side + effect is that old log files will not be closed immediately. This + means that if used in a log rotation script, a substantial delay may + be necessary to ensure that the old log files are closed before + processing them. This is equivalent to + systemctl kill --signal=SIGUSR1 --kill-who=main httpd.service. + + + + + + + Gracefully stops the Apache httpd daemon. + This differs from a normal stop in that currently open connections are not + aborted. A side effect is that old log files will not be closed immediately. + This is equivalent to + systemctl kill --signal=SIGWINCH --kill-who=main httpd.service. + + + + + | + + Run a configuration file syntax test. It parses the configuration + files and either reports Syntax OK + or detailed information about the particular syntax error. This is + equivalent to httpd -t. + + + + + + + Reporting Bugs + Please report bugs by filing an issue in @BUG_REPORT_URL@. + + + + See also + + + httpd8, + httpd.conf5, + systemd1, + systemctl1, + httpd.service8 + + + + diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/config.layout b/config.layout new file mode 100644 index 0000000..3a9f6c8 --- /dev/null +++ b/config.layout @@ -0,0 +1,24 @@ +# Layout used in Fedora httpd packaging. + + prefix: /etc/httpd + localstatedir: /var + exec_prefix: /usr + bindir: ${exec_prefix}/bin + sbindir: ${exec_prefix}/sbin + libdir: ${exec_prefix}/lib + libexecdir: ${exec_prefix}/libexec + mandir: ${exec_prefix}/man + sysconfdir: /etc/httpd/conf + datadir: ${exec_prefix}/share/httpd + installbuilddir: ${libdir}/httpd/build + errordir: ${datadir}/error + iconsdir: ${datadir}/icons + htdocsdir: ${localstatedir}/www/html + manualdir: ${datadir}/manual + cgidir: ${localstatedir}/www/cgi-bin + includedir: ${exec_prefix}/include/httpd + runtimedir: ${prefix}/run + logfiledir: ${localstatedir}/log/httpd + statedir: ${prefix}/state + proxycachedir: ${localstatedir}/cache/httpd/proxy + diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..fb11fa9 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,27 @@ +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_testing] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rawhide +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_stable] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} diff --git a/htcacheclean.service b/htcacheclean.service index 166067b..e3eeef9 100644 --- a/htcacheclean.service +++ b/htcacheclean.service @@ -1,10 +1,16 @@ [Unit] -Description=Disk Cache Cleaning Daemon for Apache HTTP Server +Description=Disk Cache Cleaning Daemon for the Apache HTTP Server After=httpd.service +Documentation=man:htcacheclean.service(8) [Service] Type=forking User=apache PIDFile=/run/httpd/htcacheclean/pid +Environment=LANG=C EnvironmentFile=/etc/sysconfig/htcacheclean ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS +PrivateTmp=true + +[Install] +WantedBy=multi-user.target diff --git a/htcacheclean.service.xml b/htcacheclean.service.xml new file mode 100644 index 0000000..c2a98d1 --- /dev/null +++ b/htcacheclean.service.xml @@ -0,0 +1,128 @@ + + + + + + htcacheclean systemd unit + httpd + AuthorOrtonJoejorton@redhat.com + + + + htcacheclean.service + 8 + + + + htcacheclean.service + htcacheclean unit file for systemd + + + + + /usr/lib/systemd/system/htcacheclean.service + + + + + Description + + This manual page describes the systemd + unit file for the htcacheclean daemon. This + unit file provides a service which runs + htcacheclean in daemon mode, + periodically cleaning the disk cache root to ensure disk space + usage is within configured limits. + + + + + Options + + The service is configured by configuration file + /etc/sysconfig/htcacheclean. The following + variables are used, following standard systemd + EnvironmentFile= syntax: + + + + INTERVAL= + + Sets the interval between cache clean runs, in + minutes. By default this is configured as + 15. + + + + CACHE_ROOT= + + Sets the directory name used for the cache + root. By default this is configured as + /var/cache/httpd/proxy. + + + + LIMIT= + + Sets the total disk cache space limit, in + bytes. Use a K or M + suffix to signify kilobytes or megabytes. By default this is + set to 100M. + + + + OPTIONS= + + Any other options to pass to + htcacheclean. + + + + + + Files + + /usr/lib/systemd/system/htcacheclean.service, + /etc/sysconfig/htcacheclean + + + + Reporting Bugs + Please report bugs by filing an issue in @BUG_REPORT_URL@. + + + + See also + + + htcacheclean8, + httpd8, + httpd.service8, + systemd.exec8 + + + + + + diff --git a/httpd-2.4.1-apctl.patch b/httpd-2.4.1-apctl.patch deleted file mode 100644 index b31c3c5..0000000 --- a/httpd-2.4.1-apctl.patch +++ /dev/null @@ -1,94 +0,0 @@ - -- fail gracefully if links is not installed on target system -- source sysconfig/httpd for custom env. vars etc. -- make httpd -t work even in SELinux -- pass $OPTIONS to all $HTTPD invocation - -Upstream-HEAD: vendor -Upstream-2.0: vendor -Upstream-Status: Vendor-specific changes for better initscript integration - ---- httpd-2.4.1/support/apachectl.in.apctl -+++ httpd-2.4.1/support/apachectl.in -@@ -44,19 +44,25 @@ ARGV="$@" - # the path to your httpd binary, including options if necessary - HTTPD='@exp_sbindir@/@progname@' - # --# pick up any necessary environment variables --if test -f @exp_sbindir@/envvars; then -- . @exp_sbindir@/envvars --fi - # - # a command that outputs a formatted text version of the HTML at the - # url given on the command line. Designed for lynx, however other - # programs may work. --LYNX="@LYNX_PATH@ -dump" -+if [ -x "@LYNX_PATH@" ]; then -+ LYNX="@LYNX_PATH@ -dump" -+else -+ LYNX=none -+fi - # - # the URL to your server's mod_status status page. If you do not - # have one, then status and fullstatus will not work. - STATUSURL="http://localhost:@PORT@/server-status" -+ -+# Source /etc/sysconfig/httpd for $HTTPD setting, etc. -+if [ -r /etc/sysconfig/httpd ]; then -+ . /etc/sysconfig/httpd -+fi -+ - # - # Set this variable to a command that increases the maximum - # number of file descriptors allowed per child process. This is -@@ -76,9 +82,27 @@ if [ "x$ARGV" = "x" ] ; then - ARGV="-h" - fi - -+function checklynx() { -+if [ "$LYNX" = "none" ]; then -+ echo "The 'links' package is required for this functionality." -+ exit 8 -+fi -+} -+ -+function testconfig() { -+# httpd is denied terminal access in SELinux, so run in the -+# current context to get stdout from $HTTPD -t. -+if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then -+ runcon -- `id -Z` $HTTPD $OPTIONS -t -+else -+ $HTTPD $OPTIONS -t -+fi -+ERROR=$? -+} -+ - case $ACMD in - start|stop|restart|graceful|graceful-stop) -- $HTTPD -k $ARGV -+ $HTTPD $OPTIONS -k $ARGV - ERROR=$? - ;; - startssl|sslstart|start-SSL) -@@ -88,17 +112,18 @@ startssl|sslstart|start-SSL) - ERROR=2 - ;; - configtest) -- $HTTPD -t -- ERROR=$? -+ testconfig - ;; - status) -+ checklynx - $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } ' - ;; - fullstatus) -+ checklynx - $LYNX $STATUSURL - ;; - *) -- $HTTPD "$@" -+ $HTTPD $OPTIONS "$@" - ERROR=$? - esac - diff --git a/httpd-2.4.10-mod_systemd.patch b/httpd-2.4.10-mod_systemd.patch deleted file mode 100644 index 88d76ac..0000000 --- a/httpd-2.4.10-mod_systemd.patch +++ /dev/null @@ -1,172 +0,0 @@ -diff --git a/modules/arch/unix/config5.m4 b/modules/arch/unix/config5.m4 -index 77027a8..7a13d5a 100644 ---- a/modules/arch/unix/config5.m4 -+++ b/modules/arch/unix/config5.m4 -@@ -18,6 +18,16 @@ APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for - fi - ]) - -+APACHE_MODULE(systemd, Systemd support, , , all, [ -+ if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then -+ AC_MSG_WARN([Your system does not support systemd.]) -+ enable_systemd="no" -+ else -+ APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS]) -+ enable_systemd="yes" -+ fi -+]) -+ - APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) - - APACHE_MODPATH_FINISH -diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c -new file mode 100644 -index 0000000..5381c98 ---- /dev/null -+++ b/modules/arch/unix/mod_systemd.c -@@ -0,0 +1,145 @@ -+/* Licensed to the Apache Software Foundation (ASF) under one or more -+ * contributor license agreements. See the NOTICE file distributed with -+ * this work for additional information regarding copyright ownership. -+ * The ASF licenses this file to You under the Apache License, Version 2.0 -+ * (the "License"); you may not use this file except in compliance with -+ * the License. You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ * -+ */ -+ -+#include -+#include -+#include "ap_mpm.h" -+#include -+#include -+#include -+#include -+#include -+#include -+#include "unixd.h" -+#include "scoreboard.h" -+#include "mpm_common.h" -+ -+#include "systemd/sd-daemon.h" -+ -+#if APR_HAVE_UNISTD_H -+#include -+#endif -+ -+static int shutdown_timer = 0; -+static int shutdown_counter = 0; -+static unsigned long bytes_served; -+static pid_t mainpid; -+ -+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type) -+{ -+ int rv; -+ -+ ap_extended_status = 1; -+ mainpid = getpid(); -+ -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Processing requests...\n" -+ "MAINPID=%" APR_PID_T_FMT, mainpid); -+ if (rv < 0) { -+ ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395) -+ "sd_notifyf returned an error %d", rv); -+ } -+ -+ return OK; -+} -+ -+static int systemd_monitor(apr_pool_t *p, server_rec *s) -+{ -+ ap_sload_t sload; -+ apr_interval_time_t up_time; -+ char bps[5]; -+ int rv; -+ -+ ap_get_sload(&sload); -+ /* up_time in seconds */ -+ up_time = (apr_uint32_t) apr_time_sec(apr_time_now() - -+ ap_scoreboard_image->global->restart_time); -+ -+ apr_strfsize((unsigned long)((float) (sload.bytes_served) -+ / (float) up_time), bps); -+ -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;" -+ "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n", -+ sload.access_count, sload.idle, sload.busy, -+ ((float) sload.access_count) / (float) up_time, bps); -+ -+ if (rv < 0) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396) -+ "sd_notifyf returned an error %d", rv); -+ } -+ -+ /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */ -+ if (sload.bytes_served == bytes_served) { -+ /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */ -+ shutdown_counter += 10; -+ if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) { -+ rv = sd_notifyf(0, "READY=1\n" -+ "STATUS=Stopped as result of IdleShutdown " -+ "timeout."); -+ if (rv < 0) { -+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804) -+ "sd_notifyf returned an error %d", rv); -+ } -+ kill(mainpid, AP_SIG_GRACEFUL); -+ } -+ } -+ else { -+ shutdown_counter = 0; -+ } -+ -+ bytes_served = sload.bytes_served; -+ -+ return DECLINED; -+} -+ -+static void systemd_register_hooks(apr_pool_t *p) -+{ -+ /* We know the PID in this hook ... */ -+ ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST); -+ /* Used to update httpd's status line using sd_notifyf */ -+ ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE); -+} -+ -+static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy, -+ const char *arg) -+{ -+ const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); -+ if (err != NULL) { -+ return err; -+ } -+ -+ shutdown_timer = atoi(arg); -+ return NULL; -+} -+ -+static const command_rec systemd_cmds[] = -+{ -+AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF, -+ "Number of seconds in idle-state after which httpd is shutdown"), -+ {NULL} -+}; -+ -+AP_DECLARE_MODULE(systemd) = { -+ STANDARD20_MODULE_STUFF, -+ NULL, -+ NULL, -+ NULL, -+ NULL, -+ systemd_cmds, -+ systemd_register_hooks, -+}; diff --git a/httpd-2.4.10-sigint.patch b/httpd-2.4.10-sigint.patch deleted file mode 100644 index ecdd82e..0000000 --- a/httpd-2.4.10-sigint.patch +++ /dev/null @@ -1,28 +0,0 @@ -diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c -index 559f90a..a386a75 100644 ---- a/server/mpm/prefork/prefork.c -+++ b/server/mpm/prefork/prefork.c -@@ -220,6 +220,9 @@ static void clean_child_exit(int code) - { - retained->mpm->mpm_state = AP_MPMQ_STOPPING; - -+ apr_signal(SIGHUP, SIG_IGN); -+ apr_signal(SIGTERM, SIG_IGN); -+ - if (pchild) { - apr_pool_destroy(pchild); - } -@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket) - */ - apr_signal(SIGHUP, just_die); - apr_signal(SIGTERM, just_die); -+ /* Ignore SIGINT in child. This fixes race-condition in signals -+ * handling when httpd is runnning on foreground and user hits ctrl+c. -+ * In this case, SIGINT is sent to all children followed by SIGTERM -+ * from the main process, which interrupts the SIGINT handler and -+ * leads to inconsistency. -+ */ -+ apr_signal(SIGINT, SIG_IGN); - /* The child process just closes listeners on AP_SIG_GRACEFUL. - * The pod is used for signalling the graceful restart. - */ diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.17-socket-activation.patch deleted file mode 100644 index d5cbdf2..0000000 --- a/httpd-2.4.17-socket-activation.patch +++ /dev/null @@ -1,301 +0,0 @@ -diff --git a/server/listen.c b/server/listen.c -index 1d9be83..f5f7754 100644 ---- a/server/listen.c -+++ b/server/listen.c -@@ -34,6 +34,10 @@ - #include - #endif - -+#ifdef HAVE_SYSTEMD -+#include -+#endif -+ - /* we know core's module_index is 0 */ - #undef APLOG_MODULE_INDEX - #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX -@@ -59,9 +63,12 @@ static int ap_listenbacklog; - static int ap_listencbratio; - static int send_buffer_size; - static int receive_buffer_size; -+#ifdef HAVE_SYSTEMD -+static int use_systemd = -1; -+#endif - - /* TODO: make_sock is just begging and screaming for APR abstraction */ --static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) -+static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen) - { - apr_socket_t *s = server->sd; - int one = 1; -@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) - return stat; - } - --#if APR_HAVE_IPV6 -- if (server->bind_addr->family == APR_INET6) { -- stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting); -- if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) { -- ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069) -- "make_sock: for address %pI, apr_socket_opt_set: " -- "(IPV6_V6ONLY)", -- server->bind_addr); -- apr_socket_close(s); -- return stat; -- } -- } --#endif -- - /* - * To send data over high bandwidth-delay connections at full - * speed we must force the TCP window to open wide enough to keep the -@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server) - } - #endif - -- if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) { -- ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072) -- "make_sock: could not bind to address %pI", -- server->bind_addr); -- apr_socket_close(s); -- return stat; -- } -+ if (do_bind_listen) { -+#if APR_HAVE_IPV6 -+ if (server->bind_addr->family == APR_INET6) { -+ stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting); -+ if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) { -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069) -+ "make_sock: for address %pI, apr_socket_opt_set: " -+ "(IPV6_V6ONLY)", -+ server->bind_addr); -+ apr_socket_close(s); -+ return stat; -+ } -+ } -+#endif - -- if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) { -- ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073) -- "make_sock: unable to listen for connections " -- "on address %pI", -- server->bind_addr); -- apr_socket_close(s); -- return stat; -+ if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) { -+ ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072) -+ "make_sock: could not bind to address %pI", -+ server->bind_addr); -+ apr_socket_close(s); -+ return stat; -+ } -+ -+ if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) { -+ ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073) -+ "make_sock: unable to listen for connections " -+ "on address %pI", -+ server->bind_addr); -+ apr_socket_close(s); -+ return stat; -+ } - } - - #ifdef WIN32 -@@ -277,6 +286,124 @@ static apr_status_t close_listeners_on_exec(void *v) - return APR_SUCCESS; - } - -+ -+#ifdef HAVE_SYSTEMD -+ -+static int find_systemd_socket(process_rec * process, apr_port_t port) { -+ int fdcount, fd; -+ int sdc = sd_listen_fds(0); -+ -+ if (sdc < 0) { -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) -+ "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", -+ sdc); -+ return -1; -+ } -+ -+ if (sdc == 0) { -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) -+ "find_systemd_socket: At least one socket must be set."); -+ return -1; -+ } -+ -+ fdcount = atoi(getenv("LISTEN_FDS")); -+ for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { -+ if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { -+ return fd; -+ } -+ } -+ -+ return -1; -+} -+ -+static apr_status_t alloc_systemd_listener(process_rec * process, -+ int fd, const char *proto, -+ ap_listen_rec **out_rec) -+{ -+ apr_status_t rv; -+ struct sockaddr sa; -+ socklen_t len = sizeof(struct sockaddr); -+ apr_os_sock_info_t si; -+ ap_listen_rec *rec; -+ *out_rec = NULL; -+ -+ memset(&si, 0, sizeof(si)); -+ -+ rv = getsockname(fd, &sa, &len); -+ -+ if (rv != 0) { -+ rv = apr_get_netos_error(); -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489) -+ "getsockname on %d failed.", fd); -+ return rv; -+ } -+ -+ si.os_sock = &fd; -+ si.family = sa.sa_family; -+ si.local = &sa; -+ si.type = SOCK_STREAM; -+ si.protocol = APR_PROTO_TCP; -+ -+ rec = apr_palloc(process->pool, sizeof(ap_listen_rec)); -+ rec->active = 0; -+ rec->next = 0; -+ -+ -+ rv = apr_os_sock_make(&rec->sd, &si, process->pool); -+ if (rv != APR_SUCCESS) { -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490) -+ "apr_os_sock_make on %d failed.", fd); -+ return rv; -+ } -+ -+ rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd); -+ if (rv != APR_SUCCESS) { -+ ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491) -+ "apr_socket_addr_get on %d failed.", fd); -+ return rv; -+ } -+ -+ rec->protocol = apr_pstrdup(process->pool, proto); -+ -+ *out_rec = rec; -+ -+ return make_sock(process->pool, rec, 0); -+} -+ -+static const char *set_systemd_listener(process_rec *process, apr_port_t port, -+ const char *proto) -+{ -+ ap_listen_rec *last, *new; -+ apr_status_t rv; -+ int fd = find_systemd_socket(process, port); -+ if (fd < 0) { -+ return "Systemd socket activation is used, but this port is not " -+ "configured in systemd"; -+ } -+ -+ last = ap_listeners; -+ while (last && last->next) { -+ last = last->next; -+ } -+ -+ rv = alloc_systemd_listener(process, fd, proto, &new); -+ if (rv != APR_SUCCESS) { -+ return "Failed to setup socket passed by systemd using socket activation"; -+ } -+ -+ if (last == NULL) { -+ ap_listeners = last = new; -+ } -+ else { -+ last->next = new; -+ last = new; -+ } -+ -+ return NULL; -+} -+ -+#endif /* HAVE_SYSTEMD */ -+ - static const char *alloc_listener(process_rec *process, char *addr, - apr_port_t port, const char* proto, - void *slave) -@@ -479,7 +606,7 @@ static int open_listeners(apr_pool_t *pool) - } - } - #endif -- if (make_sock(pool, lr) == APR_SUCCESS) { -+ if (make_sock(pool, lr, 1) == APR_SUCCESS) { - ++num_open; - } - else { -@@ -591,8 +718,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) - } - } - -- if (open_listeners(s->process->pool)) { -- return 0; -+#ifdef HAVE_SYSTEMD -+ if (use_systemd) { -+ const char *userdata_key = "ap_open_systemd_listeners"; -+ void *data; -+ /* clear the enviroment on our second run -+ * so that none of our future children get confused. -+ */ -+ apr_pool_userdata_get(&data, userdata_key, s->process->pool); -+ if (!data) { -+ apr_pool_userdata_set((const void *)1, userdata_key, -+ apr_pool_cleanup_null, s->process->pool); -+ } -+ else { -+ sd_listen_fds(1); -+ } -+ } -+ else -+#endif -+ { -+ if (open_listeners(s->process->pool)) { -+ return 0; -+ } - } - - for (lr = ap_listeners; lr; lr = lr->next) { -@@ -682,7 +829,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s, - duplr->bind_addr); - return stat; - } -- make_sock(p, duplr); -+ make_sock(p, duplr, 1); - #if AP_NONBLOCK_WHEN_MULTI_LISTEN - use_nonblock = (ap_listeners && ap_listeners->next); - stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock); -@@ -809,6 +956,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, - if (argc < 1 || argc > 2) { - return "Listen requires 1 or 2 arguments."; - } -+#ifdef HAVE_SYSTEMD -+ if (use_systemd == -1) { -+ use_systemd = sd_listen_fds(0) > 0; -+ } -+#endif - - rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool); - if (rv != APR_SUCCESS) { -@@ -840,6 +992,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, - ap_str_tolower(proto); - } - -+#ifdef HAVE_SYSTEMD -+ if (use_systemd) { -+ return set_systemd_listener(cmd->server->process, port, proto); -+ } -+#endif -+ - return alloc_listener(cmd->server->process, host, port, proto, NULL); - } - diff --git a/httpd-2.4.17-sslciphdefault.patch b/httpd-2.4.17-sslciphdefault.patch deleted file mode 100644 index 8efc461..0000000 --- a/httpd-2.4.17-sslciphdefault.patch +++ /dev/null @@ -1,33 +0,0 @@ - -https://bugzilla.redhat.com/show_bug.cgi?id=1109119 - -Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite. - ---- httpd-2.4.17/modules/ssl/ssl_engine_config.c.sslciphdefault -+++ httpd-2.4.17/modules/ssl/ssl_engine_config.c -@@ -708,8 +708,10 @@ const char *ssl_cmd_SSLCipherSuite(cmd_p - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; - -- /* always disable null and export ciphers */ -- arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); -+ /* Disable null and export ciphers by default, except for PROFILE= -+ * configs where the parser doesn't cope. */ -+ if (strncmp(arg, "PROFILE=", 8) != 0) -+ arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); - - if (cmd->path) { - dc->szCipherSuite = arg; -@@ -1428,8 +1430,10 @@ const char *ssl_cmd_SSLProxyCipherSuite( - { - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - -- /* always disable null and export ciphers */ -- arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); -+ /* Disable null and export ciphers by default, except for PROFILE= -+ * configs where the parser doesn't cope. */ -+ if (strncmp(arg, "PROFILE=", 8) != 0) -+ arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); - - sc->proxy->auth.cipher_suite = arg; - diff --git a/httpd-2.4.18-sslmultiproxy.patch b/httpd-2.4.18-sslmultiproxy.patch deleted file mode 100644 index 3f00f3f..0000000 --- a/httpd-2.4.18-sslmultiproxy.patch +++ /dev/null @@ -1,98 +0,0 @@ -diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c -index 717a694..a3ce718 100644 ---- a/modules/ssl/mod_ssl.c -+++ b/modules/ssl/mod_ssl.c -@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c) - return sslconn; - } - -+static typeof(ssl_proxy_enable) *othermod_proxy_enable; -+static typeof(ssl_engine_disable) *othermod_engine_disable; -+ - int ssl_proxy_enable(conn_rec *c) - { - SSLSrvConfigRec *sc; -@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c) - sc = mySrvConfig(sslconn->server); - - if (!sc->proxy_enabled) { -+ if (othermod_proxy_enable) { -+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, -+ "mod_ssl proxy not configured, passing through to other module."); -+ return othermod_proxy_enable(c); -+ } -+ - ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961) - "SSL Proxy requested for %s but not enabled " - "[Hint: SSLProxyEngine]", sc->vhost_id); -@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c) - - SSLConnRec *sslconn = myConnConfig(c); - -+ if (othermod_engine_disable) { -+ othermod_engine_disable(c); -+ } -+ - if (sslconn) { - sc = mySrvConfig(sslconn->server); - } -@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p) - ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE); - - ssl_var_register(p); -+ -+ othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable); -+ othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable); - - APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); - APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); -diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c -index a6b0d0d..24fd8c7 100644 ---- a/modules/ssl/ssl_engine_vars.c -+++ b/modules/ssl/ssl_engine_vars.c -@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char - static void ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize); - static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var); - static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl); -+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https; -+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup; - - static SSLConnRec *ssl_get_effective_config(conn_rec *c) - { -@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c) - static int ssl_is_https(conn_rec *c) - { - SSLConnRec *sslconn = ssl_get_effective_config(c); -- return sslconn && sslconn->ssl; -+ -+ return (sslconn && sslconn->ssl) -+ || (othermod_is_https && othermod_is_https(c)); - } - - static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION; -@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p) - { - char *cp, *cp2; - -+ othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https); -+ othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup); -+ - APR_REGISTER_OPTIONAL_FN(ssl_is_https); - APR_REGISTER_OPTIONAL_FN(ssl_var_lookup); - APR_REGISTER_OPTIONAL_FN(ssl_ext_list); -@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, - */ - if (result == NULL && c != NULL) { - SSLConnRec *sslconn = ssl_get_effective_config(c); -+ -+ if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) -+ && (!sslconn || !sslconn->ssl) && othermod_var_lookup) { -+ /* For an SSL_* variable, if mod_ssl is not enabled for -+ * this connection and another SSL module is present, pass -+ * through to that module. */ -+ return othermod_var_lookup(p, s, c, r, var); -+ } -+ - if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) - && sslconn && sslconn->ssl) - result = ssl_var_lookup_ssl(p, sslconn, r, var+4); diff --git a/httpd-2.4.2-icons.patch b/httpd-2.4.2-icons.patch deleted file mode 100644 index 1341999..0000000 --- a/httpd-2.4.2-icons.patch +++ /dev/null @@ -1,26 +0,0 @@ - -- Fix config for /icons/ dir to allow symlink to poweredby.png. -- Avoid using coredump GIF for a directory called "core" - -Upstream-Status: vendor specific patch - ---- httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in.icons -+++ httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in -@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable Ver - Alias /icons/ "@exp_iconsdir@/" - - -- Options Indexes MultiViews -+ Options Indexes MultiViews FollowSymlinks - AllowOverride None - Require all granted - -@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi - AddIcon /icons/uuencoded.gif .uu - AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl - AddIcon /icons/tex.gif .tex --AddIcon /icons/bomb.gif core -+AddIcon /icons/bomb.gif core. - - AddIcon /icons/back.gif .. - AddIcon /icons/hand.right.gif README diff --git a/httpd-2.4.25-detect-systemd.patch b/httpd-2.4.25-detect-systemd.patch deleted file mode 100644 index f8e302b..0000000 --- a/httpd-2.4.25-detect-systemd.patch +++ /dev/null @@ -1,75 +0,0 @@ -diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4 -diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4 -diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4 ---- httpd-2.4.25/acinclude.m4.detectsystemd -+++ httpd-2.4.25/acinclude.m4 -@@ -604,6 +604,30 @@ - fi - ]) - -+AC_DEFUN(APACHE_CHECK_SYSTEMD, [ -+dnl Check for systemd support for listen.c's socket activation. -+case $host in -+*-linux-*) -+ if test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd; then -+ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd` -+ elif test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd-daemon; then -+ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd-daemon` -+ else -+ AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon") -+ fi -+ if test -n "$SYSTEMD_LIBS"; then -+ AC_CHECK_HEADERS(systemd/sd-daemon.h) -+ if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then -+ AC_MSG_WARN([Your system does not support systemd.]) -+ else -+ APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) -+ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) -+ fi -+ fi -+ ;; -+esac -+]) -+ - dnl - dnl APACHE_EXPORT_ARGUMENTS - dnl Export (via APACHE_SUBST) the various path-related variables that -diff -uap httpd-2.4.25/configure.in.detectsystemd httpd-2.4.25/configure.in ---- httpd-2.4.25/configure.in.detectsystemd -+++ httpd-2.4.25/configure.in -@@ -234,6 +234,7 @@ - AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) - APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) - APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`]) -+ APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) - else - AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/]) - fi -@@ -504,6 +510,8 @@ - AC_DEFINE(HAVE_GMTOFF, 1, [Define if struct tm has a tm_gmtoff field]) - fi - -+APACHE_CHECK_SYSTEMD -+ - dnl ## Set up any appropriate OS-specific environment variables for apachectl - - case $host in -@@ -668,6 +676,7 @@ - APACHE_SUBST(BUILTIN_LIBS) - APACHE_SUBST(SHLIBPATH_VAR) - APACHE_SUBST(OS_SPECIFIC_VARS) -+APACHE_SUBST(HTTPD_LIBS) - - PRE_SHARED_CMDS='echo ""' - POST_SHARED_CMDS='echo ""' ---- httpd-2.4.25/Makefile.in.detectsystemd -+++ httpd-2.4.25/Makefile.in -@@ -4,7 +4,7 @@ - - PROGRAM_NAME = $(progname) - PROGRAM_SOURCES = modules.c --PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) -+PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) - PROGRAM_PRELINK = $(COMPILE) -c $(top_srcdir)/server/buildmark.c - PROGRAM_DEPENDENCIES = \ - server/libmain.la \ diff --git a/httpd-2.4.25-r1738878.patch b/httpd-2.4.25-r1738878.patch deleted file mode 100644 index e4b46cc..0000000 --- a/httpd-2.4.25-r1738878.patch +++ /dev/null @@ -1,140 +0,0 @@ -diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h -index c119a7e..267150a 100644 ---- a/modules/proxy/ajp.h -+++ b/modules/proxy/ajp.h -@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg); - * @param sock backend socket - * @param r current request - * @param buffsize max size of the AJP packet. -+ * @param secret authentication secret - * @param uri requested uri - * @return APR_SUCCESS or error - */ - apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r, - apr_size_t buffsize, -- apr_uri_t *uri); -+ apr_uri_t *uri, -+ const char *secret); - - /** - * Read the ajp message and return the type of the message. -diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c -index 67353a7..680a8f3 100644 ---- a/modules/proxy/ajp_header.c -+++ b/modules/proxy/ajp_header.c -@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST= - - static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg, - request_rec *r, -- apr_uri_t *uri) -+ apr_uri_t *uri, -+ const char *secret) - { - int method; - apr_uint32_t i, num_headers = 0; -@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg, - i, elts[i].key, elts[i].val); - } - --/* XXXX need to figure out how to do this -- if (s->secret) { -+ if (secret) { - if (ajp_msg_append_uint8(msg, SC_A_SECRET) || -- ajp_msg_append_string(msg, s->secret)) { -+ ajp_msg_append_string(msg, secret)) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(03228) -- "Error ajp_marshal_into_msgb - " -+ "ajp_marshal_into_msgb: " - "Error appending secret"); - return APR_EGENERAL; - } - } -- */ - - if (r->user) { - if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) || -@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg, - apr_status_t ajp_send_header(apr_socket_t *sock, - request_rec *r, - apr_size_t buffsize, -- apr_uri_t *uri) -+ apr_uri_t *uri, -+ const char *secret) - { - ajp_msg_t *msg; - apr_status_t rc; -@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock, - return rc; - } - -- rc = ajp_marshal_into_msgb(msg, r, uri); -+ rc = ajp_marshal_into_msgb(msg, r, uri, secret); - if (rc != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988) - "ajp_send_header: ajp_marshal_into_msgb failed"); -diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c -index f6fb473..f693f63 100644 ---- a/modules/proxy/mod_proxy.c -+++ b/modules/proxy/mod_proxy.c -@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p, - (int)sizeof(worker->s->upgrade)); - } - } -+ else if (!strcasecmp(key, "secret")) { -+ if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) { -+ return apr_psprintf(p, "Secret length must be < %d characters", -+ (int)sizeof(worker->s->secret)); -+ } -+ } - else { - if (set_worker_hc_param_f) { - return set_worker_hc_param_f(p, s, worker, key, val, NULL); -diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h -index 8a0ad10..f92c185 100644 ---- a/modules/proxy/mod_proxy.h -+++ b/modules/proxy/mod_proxy.h -@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL ) - #define PROXY_WORKER_MAX_HOSTNAME_SIZE 64 - #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE - #define PROXY_BALANCER_MAX_STICKY_SIZE 64 -+#define PROXY_WORKER_MAX_SECRET_SIZE 64 - - /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names, - * dotted together(?) this would fit the below size (+ trailing NUL). -@@ -443,6 +444,7 @@ typedef struct { - hcmethod_t method; /* method to use for health check */ - apr_interval_time_t interval; - char upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */ -+ char secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */ - } proxy_worker_shared; - - #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared))) -diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c -index 051724e..e706518 100644 ---- a/modules/proxy/mod_proxy_ajp.c -+++ b/modules/proxy/mod_proxy_ajp.c -@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, - apr_off_t content_length = 0; - int original_status = r->status; - const char *original_status_line = r->status_line; -+ const char *secret = NULL; - - if (psf->io_buffer_size_set) - maxsize = psf->io_buffer_size; -@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r, - maxsize = AJP_MSG_BUFFER_SZ; - maxsize = APR_ALIGN(maxsize, 1024); - -+ if (*conn->worker->s->secret) -+ secret = conn->worker->s->secret; -+ - /* - * Send the AJP request to the remote server - */ - - /* send request headers */ -- status = ajp_send_header(conn->sock, r, maxsize, uri); -+ status = ajp_send_header(conn->sock, r, maxsize, uri, secret); - if (status != APR_SUCCESS) { - conn->close = 1; - ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868) diff --git a/httpd-2.4.25-selinux.patch b/httpd-2.4.25-selinux.patch deleted file mode 100644 index fa4614a..0000000 --- a/httpd-2.4.25-selinux.patch +++ /dev/null @@ -1,61 +0,0 @@ - -Log the SELinux context at startup. - -Upstream-Status: unlikely to be any interest in this upstream - ---- httpd-2.4.1/configure.in.selinux -+++ httpd-2.4.1/configure.in -@@ -458,6 +458,11 @@ fopen64 - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - -+AC_CHECK_LIB(selinux, is_selinux_enabled, [ -+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) -+ APR_ADDTO(HTTPD_LIBS, [-lselinux]) -+]) -+ - AC_CACHE_CHECK([for gettid()], ac_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include ---- httpd-2.4.1/server/core.c.selinux -+++ httpd-2.4.1/server/core.c -@@ -58,6 +58,10 @@ - #include - #endif - -+#ifdef HAVE_SELINUX -+#include -+#endif -+ - /* LimitRequestBody handling */ - #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) - #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 0) -@@ -4452,6 +4456,28 @@ static int core_post_config(apr_pool_t * - } - #endif - -+#ifdef HAVE_SELINUX -+ { -+ static int already_warned = 0; -+ int is_enabled = is_selinux_enabled() > 0; -+ -+ if (is_enabled && !already_warned) { -+ security_context_t con; -+ -+ if (getcon(&con) == 0) { -+ -+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, -+ "SELinux policy enabled; " -+ "httpd running as context %s", con); -+ -+ already_warned = 1; -+ -+ freecon(con); -+ } -+ } -+ } -+#endif -+ - return OK; - } - diff --git a/httpd-2.4.26-r1800306.patch b/httpd-2.4.26-r1800306.patch deleted file mode 100644 index 4a8bc2d..0000000 --- a/httpd-2.4.26-r1800306.patch +++ /dev/null @@ -1,86 +0,0 @@ -# ./pullrev.sh 1800306 - -http://svn.apache.org/viewvc?view=revision&revision=1800306 - -diff -uap httpd-2.4.26/modules/mappers/mod_actions.c.r1800306 httpd-2.4.26/modules/mappers/mod_actions.c ---- httpd-2.4.26/modules/mappers/mod_actions.c.r1800306 -+++ httpd-2.4.26/modules/mappers/mod_actions.c -@@ -186,8 +186,7 @@ - ap_field_noparam(r->pool, r->content_type); - - if (action && (t = apr_table_get(conf->action_types, action))) { -- int virtual = (*t++ == '0' ? 0 : 1); -- if (!virtual && r->finfo.filetype == APR_NOFILE) { -+ if (*t++ == '0' && r->finfo.filetype == APR_NOFILE) { - ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00652) - "File does not exist: %s", r->filename); - return HTTP_NOT_FOUND; -@@ -198,9 +197,6 @@ - * (will be REDIRECT_HANDLER there) - */ - apr_table_setn(r->subprocess_env, "HANDLER", action); -- if (virtual) { -- apr_table_setn(r->notes, "virtual_script", "1"); -- } - } - - if (script == NULL) -diff -uap httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306 httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c ---- httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306 -+++ httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c -@@ -321,7 +321,6 @@ - apr_status_t rv; - apr_size_t avail_len, len, required_len; - int next_elem, starting_elem; -- int fpm = 0; - fcgi_req_config_t *rconf = ap_get_module_config(r->request_config, &proxy_fcgi_module); - fcgi_dirconf_t *dconf = ap_get_module_config(r->per_dir_config, &proxy_fcgi_module); - -@@ -354,8 +353,6 @@ - *qs = '\0'; - } - } -- } else { -- fpm = 1; - } - - if (newfname) { -@@ -364,38 +361,9 @@ - } - } - --#if 0 -- ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999) -- "r->filename: %s", (r->filename ? r->filename : "nil")); -- ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999) -- "r->uri: %s", (r->uri ? r->uri : "nil")); -- ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999) -- "r->path_info: %s", (r->path_info ? r->path_info : "nil")); --#endif -- - ap_add_common_vars(r); - ap_add_cgi_vars(r); - -- if (fpm || apr_table_get(r->notes, "virtual_script")) { -- /* -- * Adjust SCRIPT_NAME, PATH_INFO and PATH_TRANSLATED for PHP-FPM -- * TODO: Right now, PATH_INFO and PATH_TRANSLATED look OK... -- */ -- const char *pend; -- const char *script_name = apr_table_get(r->subprocess_env, "SCRIPT_NAME"); -- pend = script_name + strlen(script_name); -- if (r->path_info && *r->path_info) { -- pend = script_name + ap_find_path_info(script_name, r->path_info) - 1; -- } -- while (pend != script_name && *pend != '/') { -- pend--; -- } -- apr_table_setn(r->subprocess_env, "SCRIPT_NAME", pend); -- ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r, -- "fpm:virtual_script: Modified SCRIPT_NAME to: %s", -- pend); -- } -- - /* XXX are there any FastCGI specific env vars we need to send? */ - - /* Give admins final option to fine-tune env vars */ diff --git a/httpd-2.4.3-apctl-systemd.patch b/httpd-2.4.3-apctl-systemd.patch deleted file mode 100644 index c6bf5da..0000000 --- a/httpd-2.4.3-apctl-systemd.patch +++ /dev/null @@ -1,51 +0,0 @@ - -Make apachectl run via systemctl. - -Note: "apachectl graceful" is documented to start httpd if not running. - -Upstream-Status: vendor specific patch - ---- httpd-2.4.18/support/apachectl.in.apctlsystemd -+++ httpd-2.4.18/support/apachectl.in -@@ -100,9 +100,28 @@ fi - ERROR=$? - } - -+if [ "x$2" != "x" ] ; then -+ echo Passing arguments to httpd using apachectl is no longer supported. -+ echo You can only start/stop/restart httpd using this script. -+ echo If you want to pass extra arguments to httpd, edit the -+ echo /etc/sysconfig/httpd config file. -+fi -+ - case $ACMD in --start|stop|restart|graceful|graceful-stop) -- $HTTPD $OPTIONS -k $ARGV -+start|stop|restart|status) -+ /usr/bin/systemctl $ACMD httpd.service -+ ERROR=$? -+ ;; -+graceful) -+ if /usr/bin/systemctl -q is-active httpd.service; then -+ /usr/bin/systemctl reload httpd.service -+ else -+ /usr/bin/systemctl start httpd.service -+ fi -+ ERROR=$? -+ ;; -+graceful-stop) -+ /usr/bin/systemctl stop httpd.service - ERROR=$? - ;; - startssl|sslstart|start-SSL) -@@ -114,10 +133,6 @@ startssl|sslstart|start-SSL) - configtest) - testconfig - ;; --status) -- checklynx -- $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } ' -- ;; - fullstatus) - checklynx - $LYNX $STATUSURL diff --git a/httpd-2.4.3-layout.patch b/httpd-2.4.3-layout.patch deleted file mode 100644 index 163c66b..0000000 --- a/httpd-2.4.3-layout.patch +++ /dev/null @@ -1,33 +0,0 @@ - -Add layout for Fedora. - ---- httpd-2.4.3/config.layout.layout -+++ httpd-2.4.3/config.layout -@@ -370,3 +370,27 @@ - logfiledir: ${localstatedir}/log/httpd - proxycachedir: ${localstatedir}/cache/httpd - -+ -+# Fedora/RHEL layout -+ -+ prefix: /usr -+ exec_prefix: ${prefix} -+ bindir: ${prefix}/bin -+ sbindir: ${prefix}/sbin -+ libdir: ${prefix}/lib -+ libexecdir: ${prefix}/libexec -+ mandir: ${prefix}/man -+ sysconfdir: /etc/httpd/conf -+ datadir: ${prefix}/share/httpd -+ installbuilddir: ${libdir}/httpd/build -+ errordir: ${datadir}/error -+ iconsdir: ${datadir}/icons -+ htdocsdir: /var/www/html -+ manualdir: ${datadir}/manual -+ cgidir: /var/www/cgi-bin -+ includedir: ${prefix}/include/httpd -+ localstatedir: /var -+ runtimedir: /run/httpd -+ logfiledir: ${localstatedir}/log/httpd -+ proxycachedir: ${localstatedir}/cache/httpd/proxy -+ diff --git a/httpd-2.4.4-export.patch b/httpd-2.4.4-export.patch deleted file mode 100644 index eb670c6..0000000 --- a/httpd-2.4.4-export.patch +++ /dev/null @@ -1,20 +0,0 @@ - -There is no need to "suck in" the apr/apr-util symbols when using -a shared libapr{,util}, it just bloats the symbol table; so don't. - -Upstream-HEAD: needed -Upstream-2.0: omit -Upstream-Status: EXPORT_DIRS change is conditional on using shared apr - ---- httpd-2.4.4/server/Makefile.in.export -+++ httpd-2.4.4/server/Makefile.in -@@ -57,9 +57,6 @@ export_files: - ( for dir in $(EXPORT_DIRS); do \ - ls $$dir/*.h ; \ - done; \ -- for dir in $(EXPORT_DIRS_APR); do \ -- ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \ -- done; \ - ) | sed -e s,//,/,g | sort -u > $@ - - exports.c: export_files diff --git a/httpd-2.4.4-mod_unique_id.patch b/httpd-2.4.4-mod_unique_id.patch deleted file mode 100644 index 30bdfe0..0000000 --- a/httpd-2.4.4-mod_unique_id.patch +++ /dev/null @@ -1,239 +0,0 @@ ---- trunk/modules/metadata/mod_unique_id.c 2011/12/02 23:02:04 1209766 -+++ trunk/modules/metadata/mod_unique_id.c 2013/07/10 16:20:31 1501827 -@@ -31,14 +31,11 @@ - #include "http_log.h" - #include "http_protocol.h" /* for ap_hook_post_read_request */ - --#if APR_HAVE_UNISTD_H --#include /* for getpid() */ --#endif -+#define ROOT_SIZE 10 - - typedef struct { - unsigned int stamp; -- unsigned int in_addr; -- unsigned int pid; -+ char root[ROOT_SIZE]; - unsigned short counter; - unsigned int thread_index; - } unique_id_rec; -@@ -64,20 +61,15 @@ - * gethostbyname (gethostname()) is unique across all the machines at the - * "site". - * -- * We also further assume that pids fit in 32-bits. If something uses more -- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding -- * loop to be extended. * A similar fix is needed to support multithreaded -- * servers, using a pid/tid combo. -- * -- * Together, the in_addr and pid are assumed to absolutely uniquely identify -- * this one child from all other currently running children on all servers -- * (including this physical server if it is running multiple httpds) from each -+ * The root is assumed to absolutely uniquely identify this one child -+ * from all other currently running children on all servers (including -+ * this physical server if it is running multiple httpds) from each - * other. - * -- * The stamp and counter are used to distinguish all hits for a particular -- * (in_addr,pid) pair. The stamp is updated using r->request_time, -- * saving cpu cycles. The counter is never reset, and is used to permit up to -- * 64k requests in a single second by a single child. -+ * The stamp and counter are used to distinguish all hits for a -+ * particular root. The stamp is updated using r->request_time, -+ * saving cpu cycles. The counter is never reset, and is used to -+ * permit up to 64k requests in a single second by a single child. - * - * The 144-bits of unique_id_rec are encoded using the alphabet - * [A-Za-z0-9@-], resulting in 24 bytes of printable characters. That is then -@@ -92,7 +84,7 @@ - * module change. - * - * It is highly desirable that identifiers exist for "eternity". But future -- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a -+ * needs (such as much faster webservers, or moving to a - * multithreaded server) may dictate a need to change the contents of - * unique_id_rec. Such a future implementation should ensure that the first - * field is still a time_t stamp. By doing that, it is possible for a site to -@@ -100,7 +92,15 @@ - * wait one entire second, and then start all of their new-servers. This - * procedure will ensure that the new space of identifiers is completely unique - * from the old space. (Since the first four unencoded bytes always differ.) -+ * -+ * Note: previous implementations used 32-bits of IP address plus pid -+ * in place of the PRNG output in the "root" field. This was -+ * insufficient for IPv6-only hosts, required working DNS to determine -+ * a unique IP address (fragile), and needed a [0, 1) second sleep -+ * call at startup to avoid pid reuse. Use of the PRNG avoids all -+ * these issues. - */ -+ - /* - * Sun Jun 7 05:43:49 CEST 1998 -- Alvaro - * More comments: -@@ -116,8 +116,6 @@ - * htonl/ntohl. Well, this shouldn't be a problem till year 2106. - */ - --static unsigned global_in_addr; -- - /* - * XXX: We should have a per-thread counter and not use cur_unique_id.counter - * XXX: in all threads, because this is bad for performance on multi-processor -@@ -129,7 +127,7 @@ - /* - * Number of elements in the structure unique_id_rec. - */ --#define UNIQUE_ID_REC_MAX 5 -+#define UNIQUE_ID_REC_MAX 4 - - static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX], - unique_id_rec_size[UNIQUE_ID_REC_MAX], -@@ -138,113 +136,32 @@ - - static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server) - { -- char str[APRMAXHOSTLEN + 1]; -- apr_status_t rv; -- char *ipaddrstr; -- apr_sockaddr_t *sockaddr; -- - /* - * Calculate the sizes and offsets in cur_unique_id. - */ - unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp); - unique_id_rec_size[0] = sizeof(cur_unique_id.stamp); -- unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr); -- unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr); -- unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid); -- unique_id_rec_size[2] = sizeof(cur_unique_id.pid); -- unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter); -- unique_id_rec_size[3] = sizeof(cur_unique_id.counter); -- unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index); -- unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index); -+ unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root); -+ unique_id_rec_size[1] = sizeof(cur_unique_id.root); -+ unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter); -+ unique_id_rec_size[2] = sizeof(cur_unique_id.counter); -+ unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index); -+ unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index); - unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] + -- unique_id_rec_size[2] + unique_id_rec_size[3] + -- unique_id_rec_size[4]; -+ unique_id_rec_size[2] + unique_id_rec_size[3]; - - /* - * Calculate the size of the structure when encoded. - */ - unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6; - -- /* -- * Now get the global in_addr. Note that it is not sufficient to use one -- * of the addresses from the main_server, since those aren't as likely to -- * be unique as the physical address of the machine -- */ -- if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) { -- ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563) -- "unable to find hostname of the server"); -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- -- if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) { -- global_in_addr = sockaddr->sa.sin.sin_addr.s_addr; -- } -- else { -- ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564) -- "unable to find IPv4 address of \"%s\"", str); --#if APR_HAVE_IPV6 -- if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) { -- memcpy(&global_in_addr, -- (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr), -- sizeof(global_in_addr)); -- ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565) -- "using low-order bits of IPv6 address " -- "as if they were unique"); -- } -- else --#endif -- return HTTP_INTERNAL_SERVER_ERROR; -- } -- -- apr_sockaddr_ip_get(&ipaddrstr, sockaddr); -- ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s", -- ipaddrstr); -- -- /* -- * If the server is pummelled with restart requests we could possibly end -- * up in a situation where we're starting again during the same second -- * that has been used in previous identifiers. Avoid that situation. -- * -- * In truth, for this to actually happen not only would it have to restart -- * in the same second, but it would have to somehow get the same pids as -- * one of the other servers that was running in that second. Which would -- * mean a 64k wraparound on pids ... not very likely at all. -- * -- * But protecting against it is relatively cheap. We just sleep into the -- * next second. -- */ -- apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now())); - return OK; - } - - static void unique_id_child_init(apr_pool_t *p, server_rec *s) - { -- pid_t pid; -- -- /* -- * Note that we use the pid because it's possible that on the same -- * physical machine there are multiple servers (i.e. using Listen). But -- * it's guaranteed that none of them will share the same pids between -- * children. -- * -- * XXX: for multithread this needs to use a pid/tid combo and probably -- * needs to be expanded to 32 bits -- */ -- pid = getpid(); -- cur_unique_id.pid = pid; -- -- /* -- * Test our assumption that the pid is 32-bits. It's possible that -- * 64-bit machines will declare pid_t to be 64 bits but only use 32 -- * of them. It would have been really nice to test this during -- * global_init ... but oh well. -- */ -- if ((pid_t)cur_unique_id.pid != pid) { -- ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, APLOGNO(01567) -- "oh no! pids are greater than 32-bits! I'm broken!"); -- } -- -- cur_unique_id.in_addr = global_in_addr; -+ ap_random_insecure_bytes(&cur_unique_id.root, -+ sizeof(cur_unique_id.root)); - - /* - * If we use 0 as the initial counter we have a little less protection -@@ -253,13 +170,6 @@ - */ - ap_random_insecure_bytes(&cur_unique_id.counter, - sizeof(cur_unique_id.counter)); -- -- /* -- * We must always use network ordering for these bytes, so that -- * identifiers are comparable between machines of different byte -- * orderings. Note in_addr is already in network order. -- */ -- cur_unique_id.pid = htonl(cur_unique_id.pid); - } - - /* NOTE: This is *NOT* the same encoding used by base64encode ... the last two -@@ -291,10 +201,8 @@ - unsigned short counter; - int i,j,k; - -- new_unique_id.in_addr = cur_unique_id.in_addr; -- new_unique_id.pid = cur_unique_id.pid; -+ memcpy(&new_unique_id.root, &cur_unique_id.root, ROOT_SIZE); - new_unique_id.counter = cur_unique_id.counter; -- - new_unique_id.stamp = htonl((unsigned int)apr_time_sec(r->request_time)); - new_unique_id.thread_index = htonl((unsigned int)r->connection->id); - diff --git a/httpd-2.4.4-r1337344+.patch b/httpd-2.4.4-r1337344+.patch deleted file mode 100644 index 6e5c3e7..0000000 --- a/httpd-2.4.4-r1337344+.patch +++ /dev/null @@ -1,250 +0,0 @@ -# ./pullrev.sh 1337344 1341905 1342065 1341930 - -suexec enhancements: - -1) use syslog for logging -2) use capabilities not setuid/setgid root binary - -http://svn.apache.org/viewvc?view=revision&revision=1337344 -http://svn.apache.org/viewvc?view=revision&revision=1341905 -http://svn.apache.org/viewvc?view=revision&revision=1342065 -http://svn.apache.org/viewvc?view=revision&revision=1341930 - ---- httpd-2.4.4/configure.in.r1337344+ -+++ httpd-2.4.4/configure.in -@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin, - - AC_ARG_WITH(suexec-logfile, - APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[ -- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] ) -+ if test "x$withval" = "xyes"; then -+ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file]) -+ fi -+]) -+ -+AC_ARG_WITH(suexec-syslog, -+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[ -+ if test $withval = "yes"; then -+ if test "x${with_suexec_logfile}" != "xno"; then -+ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"]) -+ AC_MSG_ERROR([suexec does not support both logging to file and syslog]) -+ fi -+ AC_CHECK_FUNCS([vsyslog], [], [ -+ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])]) -+ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog]) -+ fi -+]) -+ - - AC_ARG_WITH(suexec-safepath, - APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[ -@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask, - APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[ - AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] ) - -+INSTALL_SUEXEC=setuid -+AC_ARG_ENABLE([suexec-capabilities], -+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [ -+INSTALL_SUEXEC=caps -+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, -+ [Enable if suexec is installed with Linux capabilities, not setuid]) -+]) -+APACHE_SUBST(INSTALL_SUEXEC) -+ - dnl APR should go after the other libs, so the right symbols can be picked up - if test x${apu_found} != xobsolete; then - AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`" ---- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+ -+++ httpd-2.4.4/docs/manual/suexec.html.en -@@ -372,6 +372,21 @@ - together with the --enable-suexec option to let - APACI accept your request for using the suEXEC feature. - -+
--enable-suexec-capabilities
-+ -+
Linux specific: Normally, -+ the suexec binary is installed "setuid/setgid -+ root", which allows it to run with the full privileges of the -+ root user. If this option is used, the suexec -+ binary will instead be installed with only the setuid/setgid -+ "capability" bits set, which is the subset of full root -+ priviliges required for suexec operation. Note that -+ the suexec binary may not be able to write to a log -+ file in this mode; it is recommended that the -+ --with-suexec-syslog --without-suexec-logfile -+ options are used in conjunction with this mode, so that syslog -+ logging is used instead.
-+ -
--with-suexec-bin=PATH
- -
The path to the suexec binary must be hard-coded -@@ -433,6 +448,12 @@ - "suexec_log" and located in your standard logfile - directory (--logfiledir).
- -+
--with-suexec-syslog
-+ -+
If defined, suexec will log notices and errors to syslog -+ instead of a logfile. This option must be combined -+ with --without-suexec-logfile.
-+ -
--with-suexec-safepath=PATH
- -
Define a safe PATH environment to pass to CGI -@@ -550,9 +571,12 @@ Group webgroup - -

The suEXEC wrapper will write log information - to the file defined with the --with-suexec-logfile -- option as indicated above. If you feel you have configured and -- installed the wrapper properly, have a look at this log and the -- error_log for the server to see where you may have gone astray.

-+ option as indicated above, or to syslog if --with-suexec-syslog -+ is used. If you feel you have configured and -+ installed the wrapper properly, have a look at the log and the -+ error_log for the server to see where you may have gone astray. -+ The output of "suexec -V" will show the options -+ used to compile suexec, if using a binary distribution.

- -
top
-
-@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined') - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ ---- httpd-2.4.4/Makefile.in.r1337344+ -+++ httpd-2.4.4/Makefile.in -@@ -238,11 +238,22 @@ install-man: - cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \ - fi - --install-suexec: -+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC) -+ -+install-suexec-binary: - @if test -f $(builddir)/support/suexec; then \ - test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \ - $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \ -- chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-setuid: -+ @if test -f $(builddir)/support/suexec; then \ -+ chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-caps: -+ @if test -f $(builddir)/support/suexec; then \ -+ setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \ - fi - - suexec: ---- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+ -+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c -@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d - return NULL; - } - -+#ifdef AP_SUEXEC_CAPABILITIES -+/* If suexec is using capabilities, don't test for the setuid bit. */ -+#define SETUID_TEST(finfo) (1) -+#else -+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID) -+#endif -+ - static int - unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, - apr_pool_t *ptemp) -@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_ - ap_unixd_config.suexec_enabled = 0; - if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp)) - == APR_SUCCESS) { -- if ((wrapper.protection & APR_USETID) && wrapper.user == 0 -+ if (SETUID_TEST(wrapper) && wrapper.user == 0 - && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) { - ap_unixd_config.suexec_enabled = 1; - ap_unixd_config.suexec_disabled_reason = ""; ---- httpd-2.4.4/support/suexec.c.r1337344+ -+++ httpd-2.4.4/support/suexec.c -@@ -58,6 +58,10 @@ - #include - #endif - -+#ifdef AP_LOG_SYSLOG -+#include -+#endif -+ - #if defined(PATH_MAX) - #define AP_MAXPATH PATH_MAX - #elif defined(MAXPATHLEN) -@@ -69,7 +73,20 @@ - #define AP_ENVBUF 256 - - extern char **environ; -+ -+#ifdef AP_LOG_SYSLOG -+/* Syslog support. */ -+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV) -+#define AP_LOG_FACILITY LOG_AUTHPRIV -+#elif !defined(AP_LOG_FACILITY) -+#define AP_LOG_FACILITY LOG_AUTH -+#endif -+ -+static int log_open; -+#else -+/* Non-syslog support. */ - static FILE *log = NULL; -+#endif - - static const char *const safe_env_lst[] = - { -@@ -137,7 +154,14 @@ static void err_output(int is_error, con - - static void err_output(int is_error, const char *fmt, va_list ap) - { --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ if (!log_open) { -+ openlog("suexec", LOG_PID, AP_LOG_FACILITY); -+ log_open = 1; -+ } -+ -+ vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap); -+#elif defined(AP_LOG_EXEC) - time_t timevar; - struct tm *lt; - -@@ -295,7 +319,9 @@ int main(int argc, char *argv[]) - #ifdef AP_HTTPD_USER - fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER); - #endif --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ fprintf(stderr, " -D AP_LOG_SYSLOG\n"); -+#elif defined(AP_LOG_EXEC) - fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC); - #endif - #ifdef AP_SAFE_PATH -@@ -591,6 +617,12 @@ int main(int argc, char *argv[]) - #endif /* AP_SUEXEC_UMASK */ - - /* Be sure to close the log file so the CGI can't mess with it. */ -+#ifdef AP_LOG_SYSLOG -+ if (log_open) { -+ closelog(); -+ log_open = 0; -+ } -+#else - if (log != NULL) { - #if APR_HAVE_FCNTL_H - /* -@@ -612,6 +644,7 @@ int main(int argc, char *argv[]) - log = NULL; - #endif - } -+#endif - - /* - * Execute the command, replacing our image with its own. diff --git a/httpd-2.4.9-apxs.patch b/httpd-2.4.43-apxs.patch similarity index 84% rename from httpd-2.4.9-apxs.patch rename to httpd-2.4.43-apxs.patch index 7016dec..808d6a8 100644 --- a/httpd-2.4.9-apxs.patch +++ b/httpd-2.4.43-apxs.patch @@ -1,8 +1,11 @@ + +Upstream-Status: local customisation + diff --git a/support/apxs.in b/support/apxs.in -index ad1287f..efcfcf6 100644 +index b2705fa..c331631 100644 --- a/support/apxs.in +++ b/support/apxs.in -@@ -25,7 +25,18 @@ package apxs; +@@ -35,7 +35,18 @@ if ($ddi >= 0) { my %config_vars = (); @@ -19,10 +22,10 @@ index ad1287f..efcfcf6 100644 + +my $installbuilddir = $libdir . "/httpd/build"; + - get_config_vars("$installbuilddir/config_vars.mk",\%config_vars); + get_config_vars($destdir . "$installbuilddir/config_vars.mk",\%config_vars); # read the configuration variables once -@@ -275,7 +286,7 @@ if ($opt_g) { +@@ -285,7 +296,7 @@ if ($opt_g) { $data =~ s|%NAME%|$name|sg; $data =~ s|%TARGET%|$CFG_TARGET|sg; $data =~ s|%PREFIX%|$prefix|sg; @@ -31,7 +34,7 @@ index ad1287f..efcfcf6 100644 my ($mkf, $mods, $src) = ($data =~ m|^(.+)-=#=-\n(.+)-=#=-\n(.+)|s); -@@ -453,11 +464,11 @@ if ($opt_c) { +@@ -463,11 +474,11 @@ if ($opt_c) { my $ldflags = "$CFG_LDFLAGS"; if ($opt_p == 1) { @@ -45,7 +48,7 @@ index ad1287f..efcfcf6 100644 chomp($apu_libs); } -@@ -672,8 +683,8 @@ __DATA__ +@@ -682,8 +693,8 @@ __DATA__ builddir=. top_srcdir=%PREFIX% diff --git a/httpd-2.4.4-cachehardmax.patch b/httpd-2.4.43-cachehardmax.patch similarity index 86% rename from httpd-2.4.4-cachehardmax.patch rename to httpd-2.4.43-cachehardmax.patch index de360ce..755f822 100644 --- a/httpd-2.4.4-cachehardmax.patch +++ b/httpd-2.4.43-cachehardmax.patch @@ -1,8 +1,8 @@ diff --git a/modules/cache/cache_util.h b/modules/cache/cache_util.h -index eec38f3..1a2d5ee 100644 +index 6b92151..4c42a8e 100644 --- a/modules/cache/cache_util.h +++ b/modules/cache/cache_util.h -@@ -194,6 +194,9 @@ typedef struct { +@@ -195,6 +195,9 @@ typedef struct { unsigned int store_nostore_set:1; unsigned int enable_set:1; unsigned int disable_set:1; @@ -13,10 +13,10 @@ index eec38f3..1a2d5ee 100644 /* A linked-list of authn providers. */ diff --git a/modules/cache/mod_cache.c b/modules/cache/mod_cache.c -index 4f2d3e0..30c88f4 100644 +index 3b9aa4f..8268503 100644 --- a/modules/cache/mod_cache.c +++ b/modules/cache/mod_cache.c -@@ -1299,6 +1299,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in) +@@ -1455,6 +1455,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in) exp = date + dconf->defex; } } @@ -28,7 +28,7 @@ index 4f2d3e0..30c88f4 100644 info->expire = exp; /* We found a stale entry which wasn't really stale. */ -@@ -1717,7 +1722,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy) +@@ -1954,7 +1959,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy) /* array of providers for this URL space */ dconf->cacheenable = apr_array_make(p, 10, sizeof(struct cache_enable)); @@ -39,7 +39,7 @@ index 4f2d3e0..30c88f4 100644 return dconf; } -@@ -1767,7 +1774,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) { +@@ -2004,7 +2011,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) { new->enable_set = add->enable_set || base->enable_set; new->disable = (add->disable_set == 0) ? base->disable : add->disable; new->disable_set = add->disable_set || base->disable_set; @@ -51,7 +51,7 @@ index 4f2d3e0..30c88f4 100644 return new; } -@@ -2096,12 +2106,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy, +@@ -2332,12 +2342,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy, } static const char *set_cache_maxex(cmd_parms *parms, void *dummy, @@ -71,7 +71,7 @@ index 4f2d3e0..30c88f4 100644 return NULL; } -@@ -2309,7 +2325,7 @@ static const command_rec cache_cmds[] = +@@ -2545,7 +2561,7 @@ static const command_rec cache_cmds[] = "caching is enabled"), AP_INIT_TAKE1("CacheDisable", add_cache_disable, NULL, RSRC_CONF|ACCESS_CONF, "A partial URL prefix below which caching is disabled"), diff --git a/httpd-2.4.1-corelimit.patch b/httpd-2.4.43-corelimit.patch similarity index 72% rename from httpd-2.4.1-corelimit.patch rename to httpd-2.4.43-corelimit.patch index 96f8486..8c9899c 100644 --- a/httpd-2.4.1-corelimit.patch +++ b/httpd-2.4.43-corelimit.patch @@ -1,13 +1,11 @@ -Bump up the core size limit if CoreDumpDirectory is -configured. +Upstream-Status: local customisation -Upstream-Status: Was discussed but there are competing desires; - there are portability oddities here too. - ---- httpd-2.4.1/server/core.c.corelimit -+++ httpd-2.4.1/server/core.c -@@ -4433,6 +4433,25 @@ static int core_post_config(apr_pool_t * +diff --git a/server/core.c b/server/core.c +index 79b2a82..dc0f17a 100644 +--- a/server/core.c ++++ b/server/core.c +@@ -4996,6 +4996,25 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte } apr_pool_cleanup_register(pconf, NULL, ap_mpm_end_gen_helper, apr_pool_cleanup_null); diff --git a/httpd-2.4.1-deplibs.patch b/httpd-2.4.43-deplibs.patch similarity index 68% rename from httpd-2.4.1-deplibs.patch rename to httpd-2.4.43-deplibs.patch index b73c21d..85b65dc 100644 --- a/httpd-2.4.1-deplibs.patch +++ b/httpd-2.4.43-deplibs.patch @@ -1,11 +1,11 @@ -Link straight against .la files. +Upstream-Status: local customisation, not needed upstream -Upstream-Status: vendor specific - ---- httpd-2.4.1/configure.in.deplibs -+++ httpd-2.4.1/configure.in -@@ -707,9 +707,9 @@ APACHE_HELP_STRING(--with-suexec-umask,u +diff --git a/configure.in b/configure.in +index f8f9442..f276550 100644 +--- a/configure.in ++++ b/configure.in +@@ -786,9 +786,9 @@ APACHE_SUBST(INSTALL_SUEXEC) dnl APR should go after the other libs, so the right symbols can be picked up if test x${apu_found} != xobsolete; then diff --git a/httpd-2.4.43-enable-sslv3.patch b/httpd-2.4.43-enable-sslv3.patch new file mode 100644 index 0000000..2861605 --- /dev/null +++ b/httpd-2.4.43-enable-sslv3.patch @@ -0,0 +1,62 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 979489c..3d6443b 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -1485,6 +1485,10 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms, + #endif + else if (strcEQ(w, "all")) { + thisopt = SSL_PROTOCOL_ALL; ++#ifndef OPENSSL_NO_SSL3 ++ /* by default, ALL kw doesn't turn on SSLv3 */ ++ thisopt &= ~SSL_PROTOCOL_SSLV3; ++#endif + } + else { + return apr_pstrcat(parms->temp_pool, +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index b0fcf81..ab6f263 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -568,6 +568,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, + } + #endif + ++/* ++ * Enable/disable SSLProtocol. If the mod_ssl enables protocol ++ * which is disabled by default by OpenSSL, show a warning. ++ * "option" is for example SSL_OP_NO_SSLv3. ++ */ ++static void ssl_set_ctx_protocol_option(server_rec *s, ++ SSL_CTX *ctx, ++ long option, ++ int enabled, ++ const char *name) ++{ ++ if (!enabled) { ++ SSL_CTX_set_options(ctx, option); ++ } ++ else if (SSL_CTX_get_options(ctx) & option) { ++ SSL_CTX_clear_options(ctx, option); ++ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904) ++ "Allowing SSLProtocol %s even though it is disabled " ++ "by OpenSSL by default on this system", name); ++ } ++} ++ + static apr_status_t ssl_init_ctx_protocol(server_rec *s, + apr_pool_t *p, + apr_pool_t *ptemp, +@@ -735,9 +757,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + } + if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) { + prot = TLS1_VERSION; ++ ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1, ++ protocol & SSL_PROTOCOL_TLSV1, "TLSv1"); + } + #ifndef OPENSSL_NO_SSL3 + if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) { ++ ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3, ++ protocol & SSL_PROTOCOL_SSLV3, "SSLv3"); + prot = SSL3_VERSION; + } + #endif diff --git a/httpd-2.4.43-logjournal.patch b/httpd-2.4.43-logjournal.patch new file mode 100644 index 0000000..cfbd9dc --- /dev/null +++ b/httpd-2.4.43-logjournal.patch @@ -0,0 +1,87 @@ +diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 +index 762e773..0848d2e 100644 +--- a/modules/loggers/config.m4 ++++ b/modules/loggers/config.m4 +@@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) + APACHE_MODPATH_INIT(loggers) + + APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes) ++APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS]) ++ + APACHE_MODULE(log_debug, configurable debug logging, , , most) + APACHE_MODULE(log_forensic, forensic logging) + +diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c +index 996c09c..50a056a 100644 +--- a/modules/loggers/mod_log_config.c ++++ b/modules/loggers/mod_log_config.c +@@ -172,6 +172,10 @@ + #include + #endif + ++#ifdef HAVE_SYSTEMD ++#include ++#endif ++ + #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" + + module AP_MODULE_DECLARE_DATA log_config_module; +@@ -1638,6 +1642,25 @@ static apr_status_t ap_default_log_writer( request_rec *r, + + return rv; + } ++ ++static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, ++ int priority) ++{ ++#ifdef HAVE_SYSTEMD ++ int fd; ++ ++ fd = sd_journal_stream_fd("httpd", priority, 0); ++ if (fd < 0) return fd; ++ ++ /* This is an AF_UNIX socket fd so is more pipe-like than ++ * file-like (the fd is neither seekable or readable), and use of ++ * apr_os_pipe_put_ex() allows cleanup registration. */ ++ return apr_os_pipe_put_ex(outfd, &fd, 1, p); ++#else ++ return APR_ENOTIMPL; ++#endif ++} ++ + static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s, + const char* name) + { +@@ -1650,6 +1673,32 @@ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s, + } + return ap_piped_log_write_fd(pl); + } ++ else if (strncasecmp(name, "journald:", 9) == 0) { ++ int priority; ++ const char *err = ap_parse_log_level(name + 9, &priority); ++ apr_status_t rv; ++ apr_file_t *fd; ++ ++ if (err == NULL && priority > LOG_DEBUG) { ++ err = "TRACE level debugging not supported with journald"; ++ } ++ ++ if (err) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, APR_EBADPATH, s, ++ "invalid journald log priority name %s: %s", ++ name, err); ++ return NULL; ++ } ++ ++ rv = wrap_journal_stream(p, &fd, priority); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, ++ "could not open journald log stream"); ++ return NULL; ++ } ++ ++ return fd; ++ } + else { + const char *fname = ap_server_root_relative(p, name); + apr_file_t *fd; diff --git a/httpd-2.4.43-sslciphdefault.patch b/httpd-2.4.43-sslciphdefault.patch new file mode 100644 index 0000000..85ae568 --- /dev/null +++ b/httpd-2.4.43-sslciphdefault.patch @@ -0,0 +1,31 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 97778a8..27e7a53 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -778,9 +778,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd, + } + + if (!strcmp("SSL", arg1)) { +- /* always disable null and export ciphers */ +- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + if (cmd->path) { ++ /* Disable null and export ciphers by default, except for PROFILE= ++ * configs where the parser doesn't cope. */ ++ if (strncmp(arg2, "PROFILE=", 8) != 0) ++ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + dc->szCipherSuite = arg2; + } + else { +@@ -1544,8 +1546,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd, + } + + if (!strcmp("SSL", arg1)) { +- /* always disable null and export ciphers */ +- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); ++ /* Disable null and export ciphers by default, except for PROFILE= ++ * configs where the parser doesn't cope. */ ++ if (strncmp(arg2, "PROFILE=", 8) != 0) ++ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + dc->proxy->auth.cipher_suite = arg2; + return NULL; + } diff --git a/httpd-2.4.48-r1842929+.patch b/httpd-2.4.48-r1842929+.patch new file mode 100644 index 0000000..c1837e7 --- /dev/null +++ b/httpd-2.4.48-r1842929+.patch @@ -0,0 +1,232 @@ + +Upstream-Status: in trunk, not proposed for 2.4.x + +diff --git a/Makefile.in b/Makefile.in +index 6747aea..40c7076 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -233,6 +233,7 @@ install-cgi: + install-other: + @test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir) + @test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir) ++ @test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir) + @for ext in dll x; do \ + file=apachecore.$$ext; \ + if test -f $$file; then \ +diff --git a/acinclude.m4 b/acinclude.m4 +index b6ef442..98f1441 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[ + APACHE_SUBST(installbuilddir) + APACHE_SUBST(runtimedir) + APACHE_SUBST(proxycachedir) ++ APACHE_SUBST(statedir) + APACHE_SUBST(other_targets) + APACHE_SUBST(progname) + APACHE_SUBST(prefix) +@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ + APACHE_SUBST_EXPANDED_ARG(runtimedir) + APACHE_SUBST_EXPANDED_ARG(logfiledir) + APACHE_SUBST_EXPANDED_ARG(proxycachedir) ++ APACHE_SUBST_EXPANDED_ARG(statedir) + ]) + + dnl +diff --git a/configure.in b/configure.in +index 37346b2..f303784 100644 +--- a/configure.in ++++ b/configure.in +@@ -41,7 +41,7 @@ dnl Something seems broken here. + AC_PREFIX_DEFAULT(/usr/local/apache2) + + dnl Get the layout here, so we can pass the required variables to apr +-APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir]) ++APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir statedir]) + + dnl reparse the configure arguments. + APR_PARSE_ARGUMENTS +diff --git a/include/ap_config_layout.h.in b/include/ap_config_layout.h.in +index 2b4a70c..e076f41 100644 +--- a/include/ap_config_layout.h.in ++++ b/include/ap_config_layout.h.in +@@ -60,5 +60,7 @@ + #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@" + #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@" + #define DEFAULT_REL_PROXYCACHEDIR "@rel_proxycachedir@" ++#define DEFAULT_EXP_STATEDIR "@exp_statedir@" ++#define DEFAULT_REL_STATEDIR "@rel_statedir@" + + #endif /* AP_CONFIG_LAYOUT_H */ +diff --git a/include/http_config.h b/include/http_config.h +index 77657ae..384a90f 100644 +--- a/include/http_config.h ++++ b/include/http_config.h +@@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname); + */ + AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname); + ++/** ++ * Compute the name of a persistent state file (e.g. a database or ++ * long-lived cache) relative to the appropriate state directory. ++ * Absolute paths are returned as-is. The state directory is ++ * configured via the DefaultStateDir directive or at build time. ++ */ ++AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *fname); ++ + /* Finally, the hook for dynamically loading modules in... */ + + /** +diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c +index addfd7e..2389f8f 100644 +--- a/modules/dav/fs/mod_dav_fs.c ++++ b/modules/dav/fs/mod_dav_fs.c +@@ -29,6 +29,10 @@ typedef struct { + + extern module AP_MODULE_DECLARE_DATA dav_fs_module; + ++#ifndef DEFAULT_DAV_LOCKDB ++#define DEFAULT_DAV_LOCKDB "davlockdb" ++#endif ++ + const char *dav_get_lockdb_path(const request_rec *r) + { + dav_fs_server_conf *conf; +@@ -57,6 +61,24 @@ static void *dav_fs_merge_server_config(apr_pool_t *p, + return newconf; + } + ++static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog, ++ apr_pool_t *ptemp, server_rec *base_server) ++{ ++ server_rec *s; ++ ++ for (s = base_server; s; s = s->next) { ++ dav_fs_server_conf *conf; ++ ++ conf = ap_get_module_config(s->module_config, &dav_fs_module); ++ ++ if (!conf->lockdb_path) { ++ conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB); ++ } ++ } ++ ++ return OK; ++} ++ + /* + * Command handler for the DAVLockDB directive, which is TAKE1 + */ +@@ -87,6 +109,8 @@ static const command_rec dav_fs_cmds[] = + + static void register_hooks(apr_pool_t *p) + { ++ ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE); ++ + dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL, + APR_HOOK_MIDDLE); + dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); +diff --git a/server/core.c b/server/core.c +index d135764..c2176b9 100644 +--- a/server/core.c ++++ b/server/core.c +@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; + AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN; + AP_DECLARE_DATA int ap_config_generation = 0; + ++static const char *core_state_dir; ++ + static void *create_core_dir_config(apr_pool_t *a, char *dir) + { + core_dir_config *conf; +@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) + return res_buf; + } + +-static int reset_config_defines(void *dummy) ++/* pconf cleanup - clear global variables set from config here. */ ++static apr_status_t reset_config(void *dummy) + { + ap_server_config_defines = saved_server_config_defines; + saved_server_config_defines = NULL; + server_config_defined_vars = NULL; + ap_runtime_dir = NULL; +- return OK; ++ core_state_dir = NULL; ++ ++ return APR_SUCCESS; + } + + /* +@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) + return NULL; + } + ++static const char *set_state_dir(cmd_parms *cmd, void *dummy, const char *arg) ++{ ++ const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); ++ ++ if (err != NULL) { ++ return err; ++ } ++ ++ if ((apr_filepath_merge((char**)&core_state_dir, NULL, ++ ap_server_root_relative(cmd->temp_pool, arg), ++ APR_FILEPATH_TRUENAME, cmd->pool) != APR_SUCCESS) ++ || !ap_is_directory(cmd->temp_pool, core_state_dir)) { ++ return "DefaultStateDir must be a valid directory, absolute or relative to ServerRoot"; ++ } ++ ++ return NULL; ++} ++ + static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg) + { + const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT); +@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, + "Common directory of server-related files (logs, confs, etc.)"), + AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ, + "Common directory for run-time files (shared memory, locks, etc.)"), ++AP_INIT_TAKE1("DefaultStateDir", set_state_dir, NULL, RSRC_CONF | EXEC_ON_READ, ++ "Common directory for persistent state (databases, long-lived caches, etc.)"), + AP_INIT_TAKE1("ErrorLog", set_server_string_slot, + (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF, + "The filename of the error log"), +@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem + + if (!saved_server_config_defines) + init_config_defines(pconf); +- apr_pool_cleanup_register(pconf, NULL, reset_config_defines, +- apr_pool_cleanup_null); ++ apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null); + + ap_regcomp_set_default_cflags(AP_REG_DEFAULT); + +@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query) + } + } + ++AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *file) ++{ ++ char *newpath = NULL; ++ apr_status_t rv; ++ const char *state_dir; ++ ++ state_dir = core_state_dir ++ ? core_state_dir ++ : ap_server_root_relative(p, DEFAULT_REL_STATEDIR); ++ ++ rv = apr_filepath_merge(&newpath, state_dir, file, APR_FILEPATH_TRUENAME, p); ++ if (newpath && (rv == APR_SUCCESS || APR_STATUS_IS_EPATHWILD(rv) ++ || APR_STATUS_IS_ENOENT(rv) ++ || APR_STATUS_IS_ENOTDIR(rv))) { ++ return newpath; ++ } ++ else { ++ return NULL; ++ } ++} ++ + static apr_random_t *rng = NULL; + #if APR_HAS_THREADS + static apr_thread_mutex_t *rng_mutex = NULL; diff --git a/httpd-2.4.53-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch new file mode 100644 index 0000000..d501b06 --- /dev/null +++ b/httpd-2.4.53-detect-systemd.patch @@ -0,0 +1,45 @@ +diff --git a/Makefile.in b/Makefile.in +index a2e9c82..bd8045c 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test + + PROGRAM_NAME = $(progname) + PROGRAM_SOURCES = modules.c +-PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) ++PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) + PROGRAM_PRELINK = $(COMPILE) -c $(top_srcdir)/server/buildmark.c + PROGRAM_DEPENDENCIES = \ + server/libmain.la \ +diff --git a/acinclude.m4 b/acinclude.m4 +index 97484c9..05abe18 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -631,6 +631,7 @@ case $host in + if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then + AC_MSG_WARN([Your system does not support systemd.]) + else ++ APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) + fi + fi +diff --git a/configure.in b/configure.in +index cf437fe..521fc45 100644 +--- a/configure.in ++++ b/configure.in +@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then + AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) + APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) + APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`]) ++ APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) + else + AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/]) + fi +@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR) + APACHE_SUBST(BUILTIN_LIBS) + APACHE_SUBST(SHLIBPATH_VAR) + APACHE_SUBST(OS_SPECIFIC_VARS) ++APACHE_SUBST(HTTPD_LIBS) + + PRE_SHARED_CMDS='echo ""' + POST_SHARED_CMDS='echo ""' diff --git a/httpd-2.4.53-export.patch b/httpd-2.4.53-export.patch new file mode 100644 index 0000000..db5606e --- /dev/null +++ b/httpd-2.4.53-export.patch @@ -0,0 +1,59 @@ + +Upstream-Status: r1861685 in trunk, not proposed for 2.4.x + +diff --git a/Makefile.in b/Makefile.in +index bd8045c..d6733a5 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test + + PROGRAM_NAME = $(progname) + PROGRAM_SOURCES = modules.c +-PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) ++PROGRAM_LDADD = buildmark.o $(HTTPD_LDFLAGS) \ ++ $(PROGRAM_LDDEPS) \ ++ $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS) + PROGRAM_PRELINK = $(COMPILE) -c $(top_srcdir)/server/buildmark.c ++PROGRAM_LDDEPS = \ ++ $(BUILTIN_LIBS) \ ++ $(MPM_LIB) \ ++ -Wl,--whole-archive,server/.libs/libmain.a,--no-whole-archive \ ++ os/$(OS_DIR)/libos.la + PROGRAM_DEPENDENCIES = \ + server/libmain.la \ + $(BUILTIN_LIBS) \ +diff --git a/server/Makefile.in b/server/Makefile.in +index 8111877..f00bb3f 100644 +--- a/server/Makefile.in ++++ b/server/Makefile.in +@@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \ + connection.c listen.c util_mutex.c \ + mpm_common.c mpm_unix.c mpm_fdqueue.c \ + util_charset.c util_cookies.c util_debug.c util_xml.c \ +- util_filter.c util_pcre.c util_regex.c exports.c \ ++ util_filter.c util_pcre.c util_regex.c \ + scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \ + eoc_bucket.c eor_bucket.c core_filters.c \ + util_expr_parse.c util_expr_scan.c util_expr_eval.c +diff --git a/server/main.c b/server/main.c +index 7da7aa2..e63d2eb 100644 +--- a/server/main.c ++++ b/server/main.c +@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[]) + return !OK; + } + +-#ifdef AP_USING_AUTOCONF +-/* This ugly little hack pulls any function referenced in exports.c into +- * the web server. exports.c is generated during the build, and it +- * has all of the APR functions specified by the apr/apr.exports and +- * apr-util/aprutil.exports files. +- */ +-const void *ap_suck_in_APR(void); +-const void *ap_suck_in_APR(void) +-{ +- extern const void *ap_ugly_hack; +- +- return ap_ugly_hack; +-} +-#endif diff --git a/httpd-2.4.54-icons.patch b/httpd-2.4.54-icons.patch new file mode 100644 index 0000000..efc0c4d --- /dev/null +++ b/httpd-2.4.54-icons.patch @@ -0,0 +1,49 @@ +diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in +index 51b02ed..93a2b87 100644 +--- a/docs/conf/extra/httpd-autoindex.conf.in ++++ b/docs/conf/extra/httpd-autoindex.conf.in +@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort + Alias /icons/ "@exp_iconsdir@/" + + +- Options Indexes MultiViews ++ Options Indexes MultiViews FollowSymlinks + AllowOverride None + Require all granted + +@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/* + AddIconByType (IMG,/icons/image2.gif) image/* + AddIconByType (SND,/icons/sound2.gif) audio/* + AddIconByType (VID,/icons/movie.gif) video/* ++AddIconByType /icons/bomb.gif application/x-coredump + + AddIcon /icons/binary.gif .bin .exe + AddIcon /icons/binhex.gif .hqx +@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi + AddIcon /icons/uuencoded.gif .uu + AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl + AddIcon /icons/tex.gif .tex +-AddIcon /icons/bomb.gif core + + AddIcon /icons/back.gif .. + AddIcon /icons/hand.right.gif README +diff --git a/docs/conf/magic b/docs/conf/magic +index bc891d9..9a41b44 100644 +--- a/docs/conf/magic ++++ b/docs/conf/magic +@@ -383,3 +383,15 @@ + 4 string moov video/quicktime + 4 string mdat video/quicktime + ++ ++#------------------------------------------------------------------------------ ++# application/x-coredump for LE/BE ELF ++# ++0 string \177ELF ++>5 byte 1 ++>16 leshort 4 application/x-coredump ++ ++0 string \177ELF ++>5 byte 2 ++>16 beshort 4 application/x-coredump ++ diff --git a/httpd-2.4.63-r1912477+.patch b/httpd-2.4.63-r1912477+.patch new file mode 100644 index 0000000..35e5866 --- /dev/null +++ b/httpd-2.4.63-r1912477+.patch @@ -0,0 +1,383 @@ +# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438 +http://svn.apache.org/viewvc?view=revision&revision=1912477 +http://svn.apache.org/viewvc?view=revision&revision=1912571 +http://svn.apache.org/viewvc?view=revision&revision=1912718 +http://svn.apache.org/viewvc?view=revision&revision=1913654 +http://svn.apache.org/viewvc?view=revision&revision=1914438 + +Upstream-Status: in trunk, not proposed for 2.4.x + +diff --git a/modules/dav/fs/config6.m4 b/modules/dav/fs/config6.m4 +index dd26ec8..72fff9a 100644 +--- a/modules/dav/fs/config6.m4 ++++ b/modules/dav/fs/config6.m4 +@@ -20,4 +20,10 @@ esac + + APACHE_MODULE(dav_fs, DAV provider for the filesystem. --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav) + ++if test "x$enable_dav_fs" = "xshared"; then ++ # The only symbol which needs to be exported is the module ++ # structure, so ask libtool to hide everything else: ++ APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module]) ++fi ++ + APACHE_MODPATH_FINISH +diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c +index 39ab4ad..4551f70 100644 +--- a/modules/dav/fs/dbm.c ++++ b/modules/dav/fs/dbm.c +@@ -47,6 +47,10 @@ + #include "http_log.h" + #include "http_main.h" /* for ap_server_conf */ + ++#ifndef DEFAULT_PROPDB_DBM_TYPE ++#define DEFAULT_PROPDB_DBM_TYPE "default" ++#endif ++ + APLOG_USE_MODULE(dav_fs); + + struct dav_db { +@@ -129,10 +133,10 @@ void dav_fs_ensure_state_dir(apr_pool_t * p, const char *dirname) + /* dav_dbm_open_direct: Opens a *dbm database specified by path. + * ro = boolean read-only flag. + */ +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb) ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb) + { +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) + const apr_dbm_driver_t *driver; + const apu_err_t *err; + #endif +@@ -141,11 +145,12 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, + + *pdb = NULL; + +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) +- if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) { ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++ if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) { ++ + ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289) +- "mod_dav_fs: The DBM library '%s' could not be loaded: %s", +- err->reason, err->msg); ++ "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s", ++ err->reason, dbmtype, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, + "Could not load library for database."); + } +@@ -156,7 +161,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, + return dav_fs_dbm_error(NULL, p, status); + } + #else +- if ((status = apr_dbm_open(&file, pathname, ++ if ((status = apr_dbm_open_ex(&file, dbmtype, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, + APR_OS_DEFAULT, p)) + != APR_SUCCESS +@@ -206,7 +211,7 @@ static dav_error * dav_dbm_open(apr_pool_t * p, const dav_resource *resource, + + /* ### do we need to deal with the umask? */ + +- return dav_dbm_open_direct(p, pathname, ro, pdb); ++ return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb); + } + + void dav_dbm_close(dav_db *db) +diff --git a/modules/dav/fs/lock.c b/modules/dav/fs/lock.c +index ef18c4a..29d167d 100644 +--- a/modules/dav/fs/lock.c ++++ b/modules/dav/fs/lock.c +@@ -181,8 +181,7 @@ struct dav_lockdb_private + { + request_rec *r; /* for accessing the uuid state */ + apr_pool_t *pool; /* a pool to use */ +- const char *lockdb_path; /* where is the lock database? */ +- ++ const dav_fs_server_conf *conf; /* lock database config & metadata */ + int opened; /* we opened the database */ + dav_db *db; /* if non-NULL, the lock database */ + }; +@@ -292,6 +291,19 @@ static int dav_fs_compare_locktoken( + return dav_compare_locktoken(lt1, lt2); + } + ++static apr_status_t dav_fs_lockdb_cleanup(void *data) ++{ ++ dav_lockdb *lockdb = data; ++ ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ ++ if (lockdb->info->db) { ++ dav_dbm_close(lockdb->info->db); ++ } ++ ++ return APR_SUCCESS; ++} ++ + /* + ** dav_fs_really_open_lockdb: + ** +@@ -300,15 +312,27 @@ static int dav_fs_compare_locktoken( + static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb) + { + dav_error *err; ++ apr_status_t rv; + + if (lockdb->info->opened) + return NULL; + ++ rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex); ++ if (rv) { ++ return dav_new_error(lockdb->info->pool, ++ HTTP_INTERNAL_SERVER_ERROR, ++ DAV_ERR_LOCK_OPENDB, rv, ++ "Could not lock mutex for lock database."); ++ } ++ + err = dav_dbm_open_direct(lockdb->info->pool, +- lockdb->info->lockdb_path, ++ lockdb->info->conf->lockdb_path, ++ lockdb->info->conf->lockdb_type, + lockdb->ro, + &lockdb->info->db); + if (err != NULL) { ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ + return dav_push_error(lockdb->info->pool, + HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_OPENDB, +@@ -316,6 +340,10 @@ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb) + err); + } + ++ apr_pool_cleanup_register(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup, ++ dav_fs_lockdb_cleanup); ++ + /* all right. it is opened now. */ + lockdb->info->opened = 1; + +@@ -341,9 +369,9 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force, + comb->pub.info = &comb->priv; + comb->priv.r = r; + comb->priv.pool = r->pool; +- +- comb->priv.lockdb_path = dav_get_lockdb_path(r); +- if (comb->priv.lockdb_path == NULL) { ++ comb->priv.conf = dav_fs_get_server_conf(r); ++ ++ if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) { + return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_NO_DB, 0, + "A lock database was not specified with the " +@@ -369,8 +397,8 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force, + */ + static void dav_fs_close_lockdb(dav_lockdb *lockdb) + { +- if (lockdb->info->db != NULL) +- dav_dbm_close(lockdb->info->db); ++ apr_pool_cleanup_run(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup); + } + + /* +diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c +index 2389f8f..4bf6c51 100644 +--- a/modules/dav/fs/mod_dav_fs.c ++++ b/modules/dav/fs/mod_dav_fs.c +@@ -14,31 +14,35 @@ + * limitations under the License. + */ + ++#if !defined(_MSC_VER) && !defined(NETWARE) ++#include "ap_config_auto.h" ++#endif ++ + #include "httpd.h" + #include "http_config.h" ++#include "http_core.h" ++#include "http_log.h" + #include "apr_strings.h" + + #include "mod_dav.h" + #include "repos.h" + +-/* per-server configuration */ +-typedef struct { +- const char *lockdb_path; +- +-} dav_fs_server_conf; +- + extern module AP_MODULE_DECLARE_DATA dav_fs_module; + + #ifndef DEFAULT_DAV_LOCKDB + #define DEFAULT_DAV_LOCKDB "davlockdb" + #endif ++#ifndef DEFAULT_DAV_LOCKDB_TYPE ++#define DEFAULT_DAV_LOCKDB_TYPE "default" ++#endif + +-const char *dav_get_lockdb_path(const request_rec *r) +-{ +- dav_fs_server_conf *conf; ++static const char dav_fs_mutexid[] = "dav_fs-lockdb"; + +- conf = ap_get_module_config(r->server->module_config, &dav_fs_module); +- return conf->lockdb_path; ++static apr_global_mutex_t *dav_fs_lockdb_mutex; ++ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r) ++{ ++ return ap_get_module_config(r->server->module_config, &dav_fs_module); + } + + static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s) +@@ -57,15 +61,50 @@ static void *dav_fs_merge_server_config(apr_pool_t *p, + + newconf->lockdb_path = + child->lockdb_path ? child->lockdb_path : parent->lockdb_path; ++ newconf->lockdb_type = ++ child->lockdb_type ? child->lockdb_type : parent->lockdb_type; + + return newconf; + } + ++static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp) ++{ ++ if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0)) ++ return !OK; ++ return OK; ++} ++ ++static void dav_fs_child_init(apr_pool_t *p, server_rec *s) ++{ ++ apr_status_t rv; ++ ++ rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex, ++ apr_global_mutex_lockfile(dav_fs_lockdb_mutex), ++ p); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, ++ APLOGNO(10488) "child init failed for mutex"); ++ } ++} ++ + static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *base_server) + { + server_rec *s; +- ++ apr_status_t rv; ++ ++ /* Ignore first pass through the config. */ ++ if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) ++ return OK; ++ ++ rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL, ++ base_server, p, 0); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server, ++ APLOGNO(10489) "could not create lock mutex"); ++ return !OK; ++ } ++ + for (s = base_server; s; s = s->next) { + dav_fs_server_conf *conf; + +@@ -74,6 +113,13 @@ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog, + if (!conf->lockdb_path) { + conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB); + } ++ if (!conf->lockdb_type) { ++ conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE; ++ } ++ ++ /* Mutex is common across all vhosts, but could have one per ++ * vhost if required. */ ++ conf->lockdb_mutex = dav_fs_lockdb_mutex; + } + + return OK; +@@ -98,19 +144,36 @@ static const char *dav_fs_cmd_davlockdb(cmd_parms *cmd, void *config, + return NULL; + } + ++/* ++ * Command handler for the DAVLockDBType directive, which is TAKE1 ++ */ ++static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config, ++ const char *arg1) ++{ ++ dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config, ++ &dav_fs_module); ++ conf->lockdb_type = arg1; ++ ++ return NULL; ++} ++ + static const command_rec dav_fs_cmds[] = + { + /* per server */ + AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF, + "specify a lock database"), ++ AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF, ++ "specify a lock database DBM type"), + + { NULL } + }; + + static void register_hooks(apr_pool_t *p) + { ++ ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE); +- ++ ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE); ++ + dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL, + APR_HOOK_MIDDLE); + dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); +diff --git a/modules/dav/fs/repos.h b/modules/dav/fs/repos.h +index b164611..d3a55a5 100644 +--- a/modules/dav/fs/repos.h ++++ b/modules/dav/fs/repos.h +@@ -25,6 +25,8 @@ + #ifndef _DAV_FS_REPOS_H_ + #define _DAV_FS_REPOS_H_ + ++#include "util_mutex.h" ++ + /* the subdirectory to hold all DAV-related information for a directory */ + #define DAV_FS_STATE_DIR ".DAV" + #define DAV_FS_STATE_FILE_FOR_DIR ".state_for_dir" +@@ -53,8 +55,8 @@ dav_error * dav_fs_get_locknull_members(const dav_resource *resource, + /* DBM functions used by the repository and locking providers */ + extern const dav_hooks_db dav_hooks_db_dbm; + +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb); ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb); + void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname, + const char **state1, const char **state2); + dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key); +@@ -64,8 +66,15 @@ void dav_dbm_freedatum(dav_db *db, apr_datum_t data); + int dav_dbm_exists(dav_db *db, apr_datum_t key); + void dav_dbm_close(dav_db *db); + +-/* where is the lock database located? */ +-const char *dav_get_lockdb_path(const request_rec *r); ++/* Per-server configuration. */ ++typedef struct { ++ const char *lockdb_path; ++ const char *lockdb_type; ++ apr_global_mutex_t *lockdb_mutex; ++} dav_fs_server_conf; ++ ++/* Returns server configuration for the request. */ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r); + + const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r); + const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r); diff --git a/httpd-2.4.64-mod_systemd.patch b/httpd-2.4.64-mod_systemd.patch new file mode 100644 index 0000000..cad4a01 --- /dev/null +++ b/httpd-2.4.64-mod_systemd.patch @@ -0,0 +1,98 @@ + +More verbose startup logging for mod_systemd. + +diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c +index 22482fd..b46d3ef 100644 +--- a/modules/arch/unix/mod_systemd.c ++++ b/modules/arch/unix/mod_systemd.c +@@ -34,11 +34,14 @@ + #endif + + #include "systemd/sd-daemon.h" ++#include "systemd/sd-journal.h" + + #if APR_HAVE_UNISTD_H + #include + #endif + ++static char describe_listeners[30]; ++ + static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, + apr_pool_t *ptemp) + { +@@ -63,6 +66,20 @@ static void log_selinux_context(void) + } + #endif + ++static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p) ++{ ++ apr_sockaddr_t *sa = lr->bind_addr; ++ char addr[128]; ++ ++ if (apr_sockaddr_is_wildcard(sa)) { ++ return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL); ++ } ++ ++ apr_sockaddr_ip_getbuf(addr, sizeof addr, sa); ++ ++ return apr_psprintf(p, "%s port %u", addr, sa->port); ++} ++ + /* Report the service is ready in post_config, which could be during + * startup or after a reload. The server could still hit a fatal + * startup error after this point during ap_run_mpm(), so this is +@@ -73,23 +90,52 @@ static void log_selinux_context(void) + static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *main_server) + { ++ ap_listen_rec *lr; ++ apr_size_t plen = sizeof describe_listeners; ++ char *p = describe_listeners; ++ + if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) + return OK; + ++ for (lr = ap_listeners; lr; lr = lr->next) { ++ char *s = dump_listener(lr, ptemp); ++ ++ if (strlen(s) + 3 < plen) { ++ char *newp = apr_cpystrn(p, s, plen); ++ if (lr->next) ++ newp = apr_cpystrn(newp, ", ", 3); ++ plen -= newp - p; ++ p = newp; ++ } ++ else { ++ if (plen < 4) { ++ p = describe_listeners + sizeof describe_listeners - 4; ++ plen = 4; ++ } ++ apr_cpystrn(p, "...", plen); ++ break; ++ } ++ } ++ + #ifdef HAVE_SELINUX + log_selinux_context(); + #endif + + sd_notify(0, "READY=1\n" + "STATUS=Configuration loaded.\n"); ++ ++ sd_journal_print(LOG_INFO, "Server configured, listening on: %s", ++ describe_listeners); ++ + return OK; + } + + static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type) + { + sd_notifyf(0, "READY=1\n" +- "STATUS=Processing requests...\n" +- "MAINPID=%" APR_PID_T_FMT, getpid()); ++ "STATUS=Started, listening on: %s\n" ++ "MAINPID=%" APR_PID_T_FMT, ++ describe_listeners, getpid()); + + return OK; + } diff --git a/httpd-2.4.64-separate-systemd-fns.patch b/httpd-2.4.64-separate-systemd-fns.patch new file mode 100644 index 0000000..6947ee6 --- /dev/null +++ b/httpd-2.4.64-separate-systemd-fns.patch @@ -0,0 +1,101 @@ +diff --git a/acinclude.m4 b/acinclude.m4 +index 05abe18..97484c9 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -631,7 +631,6 @@ case $host in + if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then + AC_MSG_WARN([Your system does not support systemd.]) + else +- APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) + fi + fi +diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c +index af68249..7232a45 100644 +--- a/modules/arch/unix/mod_systemd.c ++++ b/modules/arch/unix/mod_systemd.c +@@ -40,6 +40,9 @@ + #include + #endif + ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_journal_stream_fd, (const char *, int, int)); ++ + static char describe_listeners[30]; + + static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, +@@ -217,10 +220,15 @@ static int ap_systemd_listen_fds(int unset_environment){ + return sd_listen_fds(unset_environment); + } + ++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){ ++ return sd_journal_stream_fd("httpd", priority, 0); ++} ++ + static void systemd_register_hooks(apr_pool_t *p) + { + APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds); + APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket); ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd); + + /* Enable ap_extended_status. */ + ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST); +diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 +index 0848d2e..8af2299 100644 +--- a/modules/loggers/config.m4 ++++ b/modules/loggers/config.m4 +@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) + APACHE_MODPATH_INIT(loggers) + + APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes) +-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS]) + + APACHE_MODULE(log_debug, configurable debug logging, , , most) + APACHE_MODULE(log_forensic, forensic logging) +diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c +index 694f447..a65b982 100644 +--- a/modules/loggers/mod_log_config.c ++++ b/modules/loggers/mod_log_config.c +@@ -172,10 +172,6 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" + + module AP_MODULE_DECLARE_DATA log_config_module; +@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, + { + #ifdef HAVE_SYSTEMD + int fd; ++ APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd; ++ ++ systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ if (systemd_journal_stream_fd == NULL) { ++ return APR_ENOTIMPL; ++ } + +- fd = sd_journal_stream_fd("httpd", priority, 0); ++ fd = systemd_journal_stream_fd("httpd", priority, 0); ++ + if (fd < 0) return fd; + + /* This is an AF_UNIX socket fd so is more pipe-like than +diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h +index 877a593..bd52a98 100644 +--- a/modules/loggers/mod_log_config.h ++++ b/modules/loggers/mod_log_config.h +@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ + */ + APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func)); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int)); ++#endif ++ + #endif /* MOD_LOG_CONFIG */ + /** @} */ + diff --git a/httpd-2.4.64-sslprotdefault.patch b/httpd-2.4.64-sslprotdefault.patch new file mode 100644 index 0000000..6d97935 --- /dev/null +++ b/httpd-2.4.64-sslprotdefault.patch @@ -0,0 +1,98 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 8fae1f8..c5dce7f 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -127,7 +127,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) + mctx->ticket_key = NULL; + #endif + +- mctx->protocol = SSL_PROTOCOL_DEFAULT; ++ mctx->protocol = SSL_PROTOCOL_NONE; + mctx->protocol_set = 0; + + mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; +@@ -268,6 +268,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, + if (add->protocol_set) { + mrg->protocol_set = 1; + mrg->protocol = add->protocol; ++ mrg->protocol_set = 1; + } + else { + mrg->protocol_set = base->protocol_set; +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index 4e265b3..2fbd076 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -638,6 +638,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL; + char *cp; + int protocol = mctx->protocol; ++ int protocol_set = mctx->protocol_set; + SSLSrvConfigRec *sc = mySrvConfig(s); + #if OPENSSL_VERSION_NUMBER >= 0x10100000L + /* default is highest supported version, will be overridden below */ +@@ -652,12 +653,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + * Create the new per-server SSL context + */ + if (protocol == SSL_PROTOCOL_NONE) { +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); +- } ++ if (protocol_set) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) ++ "No SSL protocols available [hint: SSLProtocol]"); ++ return ssl_die(s); ++ } + +- cp = apr_pstrcat(p, ++ ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, ++ "Using OpenSSL/system default SSL/TLS protocols"); ++ cp = "default"; ++ } ++ else { ++ cp = apr_pstrcat(p, + #ifndef OPENSSL_NO_SSL3 + (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""), + #endif +@@ -670,7 +677,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + #endif + #endif + NULL); +- cp[strlen(cp)-2] = NUL; ++ cp[strlen(cp)-2] = NUL; ++ } + + ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, + "Creating new SSL context (protocols: %s)", cp); +@@ -776,13 +784,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + prot = SSL3_VERSION; + #endif + } else { +- SSL_CTX_free(ctx); +- mctx->ssl_ctx = NULL; +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); ++ if (protocol_set) { ++ SSL_CTX_free(ctx); ++ mctx->ssl_ctx = NULL; ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) ++ "No SSL protocols available [hint: SSLProtocol]"); ++ return ssl_die(s); ++ } + } +- SSL_CTX_set_max_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot); + + /* Next we scan for the minimal protocol version we should provide, + * but we do not allow holes between max and min */ +@@ -806,7 +816,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + prot = SSL3_VERSION; + } + #endif +- SSL_CTX_set_min_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot); + #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */ + + #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch new file mode 100644 index 0000000..315b9c2 --- /dev/null +++ b/httpd-2.4.65-hcheck-stuck.patch @@ -0,0 +1,66 @@ +--- a/modules/proxy/mod_proxy_hcheck.c ++++ b/modules/proxy/mod_proxy_hcheck.c +@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state + sctx_t *ctx = (sctx_t *)data; + server_rec *s = ctx->s; + proxy_server_conf *conf; ++ proxy_worker **workers; ++ proxy_worker *worker; ++ apr_time_t now; ++ int i, n; + ++ conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); ++ balancer = (proxy_balancer *)conf->balancers->elts; ++ + switch (state) { + case AP_WATCHDOG_STATE_STARTING: + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258) + "%s watchdog started.", + HCHECK_WATHCHDOG_NAME); ++ /* set last update time for all workers */ ++ now = apr_time_now(); ++ for (i = 0; i < conf->balancers->nelts; i++, balancer++) { ++ workers = (proxy_worker **)balancer->workers->elts; ++ for (n = 0; n < balancer->workers->nelts; n++, ++workers) { ++ worker = *workers; ++ if (worker->s->updated == 0) { ++ worker->s->updated = now; ++ } ++ } ++ } + #if HC_USE_THREADS + if (tpsize && hctp == NULL) { + rv = apr_thread_pool_create(&hctp, tpsize, +@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state + + case AP_WATCHDOG_STATE_RUNNING: + /* loop thru all workers */ +- if (s) { +- int i; +- conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); +- balancer = (proxy_balancer *)conf->balancers->elts; +- ctx->s = s; ++ { ++ now = apr_time_now(); + for (i = 0; i < conf->balancers->nelts; i++, balancer++) { +- int n; +- apr_time_t now; +- proxy_worker **workers; +- proxy_worker *worker; + /* Have any new balancers or workers been added dynamically? */ + ap_proxy_sync_balancer(balancer, s, conf); + workers = (proxy_worker **)balancer->workers->elts; +- now = apr_time_now(); +- for (n = 0; n < balancer->workers->nelts; n++) { ++ for (n = 0; n < balancer->workers->nelts; n++, workers++) { + worker = *workers; + if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) && + (worker->s->method != NONE) && +@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state + hc_check(NULL, baton); + } + } +- workers++; + } + } + } diff --git a/httpd-init.service b/httpd-init.service new file mode 100644 index 0000000..704c314 --- /dev/null +++ b/httpd-init.service @@ -0,0 +1,13 @@ +[Unit] +Description=One-time temporary TLS key generation for httpd.service +Documentation=man:httpd-init.service(8) + +ConditionPathExists=|!/etc/pki/tls/certs/localhost.crt +ConditionPathExists=|!/etc/pki/tls/private/localhost.key + +[Service] +Type=oneshot +RemainAfterExit=no +PrivateTmp=true + +ExecStart=/usr/libexec/httpd-ssl-gencerts diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts new file mode 100755 index 0000000..5a3d8ed --- /dev/null +++ b/httpd-ssl-gencerts @@ -0,0 +1,40 @@ +#!/usr/bin/bash + +set -e + +FQDN=`hostname` +ssldotconf=/etc/httpd/conf.d/ssl.conf + +if test -f /etc/pki/tls/certs/localhost.crt -a \ + -f /etc/pki/tls/private/localhost.key; then + exit 0 +fi + +if test -f /etc/pki/tls/certs/localhost.crt -a \ + ! -f /etc/pki/tls/private/localhost.key; then + echo "Missing certificate key!" + exit 1 +fi + +if test ! -f /etc/pki/tls/certs/localhost.crt -a \ + -f /etc/pki/tls/private/localhost.key; then + echo "Missing certificate, but key is present!" + exit 1 +fi + +if ! test -f ${ssldotconf} || \ + ! grep -q '^SSLCertificateFile /etc/pki/tls/certs/localhost.crt' ${ssldotconf} || \ + ! grep -q '^SSLCertificateKeyFile /etc/pki/tls/private/localhost.key' ${ssldotconf}; then + # Non-default configuration, do nothing. + exit 0 +fi + +sscg -q \ + --cert-file /etc/pki/tls/certs/localhost.crt \ + --cert-key-file /etc/pki/tls/private/localhost.key \ + --ca-file /etc/pki/tls/certs/localhost.crt \ + --no-dhparams-file \ + --lifetime 365 \ + --hostname $FQDN \ + --email root@$FQDN + diff --git a/httpd-ssl-pass-dialog b/httpd-ssl-pass-dialog index 1e850cd..79318a6 100755 --- a/httpd-ssl-pass-dialog +++ b/httpd-ssl-pass-dialog @@ -1,3 +1,3 @@ #!/bin/sh -exec /bin/systemd-ask-password "Enter SSL pass phrase for $1 ($2) : " +exec /bin/systemd-ask-password "Enter TLS private key passphrase for $1 ($2) : " diff --git a/httpd.conf b/httpd.conf index a7af0dc..ad5c7ee 100644 --- a/httpd.conf +++ b/httpd.conf @@ -6,6 +6,9 @@ # # for a discussion of each configuration directive. # +# See the httpd.conf(5) man page for more information on this configuration, +# and httpd.service(8) on using and configuring the httpd service. +# # Do NOT simply read the instructions in here without understanding # what they do. They're here only as hints or reminders. If you are unsure # consult the online docs. You have been warned. @@ -35,8 +38,10 @@ ServerRoot "/etc/httpd" # ports, instead of the default. See also the # directive. # -# Change this to Listen on specific IP addresses as shown below to -# prevent Apache from glomming onto all bound IP addresses. +# Change this to Listen on a specific IP address, but note that if +# httpd.service is enabled to run at boot time, the address may not be +# available when the service starts. See the httpd.service(8) man +# page for more information. # #Listen 12.34.56.78:80 Listen 80 @@ -146,7 +151,7 @@ DocumentRoot "/var/www/html" # # AllowOverride controls what directives may be placed in .htaccess files. # It can be "All", "None", or any combination of the keywords: - # Options FileInfo AuthConfig Limit + # AllowOverride FileInfo AuthConfig Limit # AllowOverride None @@ -194,6 +199,7 @@ LogLevel warn # a CustomLog directive (see below). # LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext LogFormat "%h %l %u %t \"%r\" %>s %b" common @@ -211,10 +217,11 @@ LogLevel warn #CustomLog "logs/access_log" common # - # If you prefer a logfile with access, agent, and referer information - # (Combined Logfile Format) you can use the following directive. + # If you prefer a logfile with access, agent, referer, and process/thread + # information (an extended Combined Logfile Format), you can use the + # following directive. # - CustomLog "logs/access_log" combined + CustomLog "logs/access_log" combined_ext @@ -258,6 +265,15 @@ LogLevel warn Require all granted + + # + # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied + # backend servers which have lingering "httpoxy" defects. + # 'Proxy' request header is undefined by the IETF, not listed by IANA + # + RequestHeader unset Proxy early + + # # TypesConfig points to the file containing the list of mappings from @@ -335,6 +351,13 @@ AddDefaultCharset UTF-8 #ErrorDocument 402 http://www.example.com/subscription_info.html # +# +# MaxRanges: Maximum number of Ranges in a request before +# returning the entire resource, or one of the special +# values 'default', 'none' or 'unlimited'. +# Default setting is to accept 200 Ranges. +#MaxRanges unlimited + # # EnableMMAP and EnableSendfile: On systems that support it, # memory-mapping or the sendfile syscall may be used to deliver diff --git a/httpd.conf.xml b/httpd.conf.xml new file mode 100644 index 0000000..5405017 --- /dev/null +++ b/httpd.conf.xml @@ -0,0 +1,264 @@ + + + + + + + httpd.conf + httpd + AuthorOrtonJoejorton@redhat.com + + + + httpd.conf + 5 + + + + httpd.conf + Configuration files for httpd + + + + + /etc/httpd/conf/httpd.conf, + /etc/httpd/conf.modules.d, + /etc/httpd/conf.d + + + + + Description + + The main configuration file for the httpd daemon is + /etc/httpd/conf/httpd.conf. The syntax of + this file is described at , and + the full set of available directives is listed at . + + + + Configuration structure + + The main configuration file + (httpd.conf) sets up various defaults and + includes configuration files from two directories - + /etc/httpd/conf.modules.d and + /etc/httpd/conf.d. Packages containing + loadable modules (like ) place files + in the conf.modules.d directory with the + appropriate directive so that module + is loaded by default. + + Some notable configured defaults are: + + + + + The default document root from which content + is served. + + + + The daemon listens on TCP port 80. + + + + Error messages are logged to + @LOGDIR@/error_log. + + + + CGI scripts are served via the URL-path . + + + + + To remove any of the default configuration provided in + separate files covered below, replace that file with an empty + file rather than removing it from the filesystem, otherwise it + may be restored to the original when the package which provides + it is upgraded. + + + + + MPM configuration + + The configuration file at + /etc/httpd/conf.modules.d/00-mpm.conf is + used to select the multi-processing module (MPM), which governs + how httpd divides work between processes + and/or threads at run-time. Exactly one + directive must be uncommented in + this file; by default the MPM is enabled. + For more information on MPMs, see . + + If using the prefork MPM, the + "httpd_graceful_shutdown" SELinux boolean should also be + enabled, since with this MPM, httpd needs to establish TCP + connections to local ports to successfully complete a graceful + restart or shutdown. This boolean can be enabled by running the + command: semanage boolean -m --on + httpd_graceful_shutdown + + + + Module configuration files + + Module configuration files are provided in the + /etc/httpd/conf.modules.d/ directory. + Filenames in this directory are by convention prefixed with two + digit numeric prefix to ensure they are processed in the desired + order. Core modules provided with the httpd + package are loaded by files with a prefix + to ensure these load first. Only filenames with a + suffix in this directory will be + processed. + + Other provided configuration files are listed below. + + + + /etc/httpd/conf.modules.d/00-base.conf + The set of core modules included with + httpd which are all loaded by + default. + + + + /etc/httpd/conf.modules.d/00-optional.conf + The set of non-core modules included with + httpd which are not + loaded by default. + + + + + /etc/httpd/conf.modules.d/00-systemd.conf + This file loads + which is necessary for the correct operation of the + httpd.service systemd unit, and should + not be removed or disabled. + + + + + + + Other configuration files + + Default module configuration files and site-specific + configuration files are loaded from the + /etc/httpd/conf.d/ directory. Only files + with a suffix will be loaded. The + following files are provided: + + + + /etc/httpd/conf.d/userdir.conf + This file gives an example configuration for + to map URLs such as + to + /home/jim/public_html/. Userdir mapping + is disabled by default. + + + + /etc/httpd/conf.d/autoindex.conf + This file provides the default configuration + for which generates HTML + directory listings when enabled. It also makes file icon + image files available at the + URL-path. + + + + /etc/httpd/conf.d/welcome.conf + This file enables a "welcome page" at + if no content is present + in the default documentation root + /var/www/html. + + + + /etc/httpd/conf.d/ssl.conf (present only if is installed) + This file configures a TLS + listening on port + . If the default configuration is used, + the referenced test certificate and private key are + generated the first time httpd.service is + started; see + httpd-init.service8 + for more information. + + + + + + + Instantiated services + + As an alternative to (or in addition to) the + httpd.service unit, the instantiated template + service httpd@.service unit file can be used, + which starts httpd using a different + configuration file to the default. For example, + systemctl start httpd@foobar.service will + start httpd using the configuration file + /etc/httpd/conf/foobar.conf. See httpd@.service8 for more information. + + + + + Files + + + /etc/httpd/conf/httpd.conf, + /etc/httpd/conf.d, + /etc/httpd/conf.modules.d + + + + + Reporting Bugs + Please report bugs by filing an issue in @BUG_REPORT_URL@. + + + + See also + + + httpd8, + httpd.service8, + , + + + + + + + diff --git a/httpd.logrotate b/httpd.logrotate index 28c9730..c5a008c 100644 --- a/httpd.logrotate +++ b/httpd.logrotate @@ -1,3 +1,5 @@ +# Note that logs are not compressed unless "compress" is configured, +# which can be done either here or globally in /etc/logrotate.conf. /var/log/httpd/*log { missingok notifempty diff --git a/httpd.service b/httpd.service index 1f707e8..b75e28c 100644 --- a/httpd.service +++ b/httpd.service @@ -1,9 +1,8 @@ # See httpd.service(8) for more information on using the httpd service. # Modifying this file in-place is not recommended, because changes -# will be overwritten during package upgrades. If you want to -# customize the behaviour, the best way is to use "systemctl edit" -# command to create an override unit. +# will be overwritten during package upgrades. To customize the +# behaviour, run "systemctl edit httpd" to create an override unit. # For example, to pass additional options (such as -D definitions) to # the httpd binary at startup, create an override unit (as is done by @@ -14,7 +13,8 @@ [Unit] Description=The Apache HTTP Server -After=network.target remote-fs.target nss-lookup.target +Wants=httpd-init.service +After=network.target remote-fs.target nss-lookup.target httpd-init.service Documentation=man:httpd.service(8) [Service] @@ -26,7 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes +OOMPolicy=continue +PrivateDevices=yes PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/httpd.service.xml b/httpd.service.xml index d03e133..610b34c 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -4,7 +4,7 @@ ]> diff --git a/httpd.spec b/httpd.spec index 81f556e..45f21c9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -3,138 +3,203 @@ %define suexec_caller apache %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} -%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT}) +%define vstring %(source /etc/os-release; echo ${NAME}) +%define bugurl %(source /etc/os-release; echo ${BUG_REPORT_URL}) +%if 0%{?fedora} > 26 || 0%{?rhel} > 7 +%global mpm event +%else +%global mpm prefork +%endif + +%if 0%{?fedora} > 35 || 0%{?rhel} > 9 +%bcond_without pcre2 +%bcond_with pcre +%else +%bcond_with pcre2 +%bcond_without pcre +%endif + +%if 0%{?fedora} > 40 || 0%{?rhel} > 9 +%bcond_with engine +%else +%bcond_without engine +%endif + +# Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092 +%undefine _package_note_flags Summary: Apache HTTP Server Name: httpd -Version: 2.4.27 -Release: 2%{?dist} -URL: http://httpd.apache.org/ -Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 -Source1: index.html -Source2: httpd.logrotate -Source4: httpd-ssl-pass-dialog -Source5: httpd.tmpfiles -Source6: httpd.service -Source7: action-graceful.sh -Source8: action-configtest.sh -Source10: httpd.conf -Source11: 00-base.conf -Source12: 00-mpm.conf -Source13: 00-lua.conf -Source14: 01-cgi.conf -Source15: 00-dav.conf -Source16: 00-proxy.conf -Source17: 00-ssl.conf -Source18: 01-ldap.conf -Source19: 00-proxyhtml.conf -Source20: userdir.conf -Source21: ssl.conf -Source22: welcome.conf -Source23: manual.conf -Source24: 00-systemd.conf -Source25: 01-session.conf -Source26: 10-listen443.conf -Source27: httpd.socket -Source28: 00-optional.conf -# Documentation +Version: 2.4.66 +Release: 1%{?dist} +URL: https://httpd.apache.org/ +Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 +Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc +# gpg key file downloaded and verified by luhliarik +# https://httpd.apache.org/dev/verification.html +Source2: https://dist.apache.org/repos/dist/release/httpd/KEYS +Source3: httpd.logrotate +Source4: instance.conf +Source5: httpd-ssl-pass-dialog +Source6: httpd.tmpfiles +Source7: httpd.service +Source8: action-graceful.sh +Source9: action-configtest.sh +Source10: server-status.conf +Source11: httpd.conf +Source12: 00-base.conf +Source13: 00-mpm.conf +Source14: 00-lua.conf +Source15: 01-cgi.conf +Source16: 00-dav.conf +Source17: 00-proxy.conf +Source18: 00-ssl.conf +Source19: 01-ldap.conf +Source20: 00-proxyhtml.conf +Source21: userdir.conf +Source22: ssl.conf +Source23: welcome.conf +Source24: manual.conf +Source25: 00-systemd.conf +Source26: 01-session.conf +Source27: 10-listen443.conf +Source28: httpd.socket +Source29: 00-optional.conf Source30: README.confd Source31: README.confmod Source32: httpd.service.xml +Source33: htcacheclean.service.xml +Source34: httpd.conf.xml +Source35: 00-brotli.conf Source40: htcacheclean.service Source41: htcacheclean.sysconf -# build/scripts patches -Patch1: httpd-2.4.1-apctl.patch -Patch2: httpd-2.4.9-apxs.patch -Patch3: httpd-2.4.1-deplibs.patch -Patch5: httpd-2.4.3-layout.patch -Patch6: httpd-2.4.3-apctl-systemd.patch -# Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.25-detect-systemd.patch -# Features/functional changes -Patch23: httpd-2.4.4-export.patch -Patch24: httpd-2.4.1-corelimit.patch -Patch25: httpd-2.4.25-selinux.patch -Patch26: httpd-2.4.4-r1337344+.patch -Patch27: httpd-2.4.2-icons.patch -Patch29: httpd-2.4.10-mod_systemd.patch -Patch30: httpd-2.4.4-cachehardmax.patch -Patch31: httpd-2.4.18-sslmultiproxy.patch -Patch34: httpd-2.4.17-socket-activation.patch -Patch35: httpd-2.4.17-sslciphdefault.patch -# Bug fixes -Patch56: httpd-2.4.4-mod_unique_id.patch -Patch57: httpd-2.4.10-sigint.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1397243 -Patch58: httpd-2.4.25-r1738878.patch -# Security fixes +Source42: httpd-init.service +Source43: httpd-ssl-gencerts +Source44: httpd@.service +Source45: config.layout +Source46: apachectl.sh +Source47: apachectl.xml +Source48: apache-poweredby.png +Source49: httpd.sysusers -License: ASL 2.0 -Group: System Environment/Daemons -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root -BuildRequires: autoconf, perl, perl-generators, pkgconfig, findutils, xmlto -BuildRequires: zlib-devel, libselinux-devel, lua-devel -BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 -BuildRequires: systemd-devel -Requires: /etc/mime.types, system-logos-httpd -Obsoletes: httpd-suexec +# build/scripts patches +Patch2: httpd-2.4.43-apxs.patch +Patch3: httpd-2.4.43-deplibs.patch +# Needed for socket activation and mod_systemd patch +Patch19: httpd-2.4.53-detect-systemd.patch +# Features/functional changes +Patch20: httpd-2.4.48-r1842929+.patch +Patch21: httpd-2.4.64-mod_systemd.patch +Patch22: httpd-2.4.53-export.patch +Patch23: httpd-2.4.43-corelimit.patch +Patch24: httpd-2.4.54-icons.patch +Patch25: httpd-2.4.43-cachehardmax.patch +Patch26: httpd-2.4.43-sslciphdefault.patch +Patch27: httpd-2.4.64-sslprotdefault.patch +Patch28: httpd-2.4.43-logjournal.patch +Patch29: httpd-2.4.63-r1912477+.patch +Patch30: httpd-2.4.64-separate-systemd-fns.patch + +# Bug fixes +# https://bugzilla.redhat.com/show_bug.cgi?id=1397243 +Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.65-hcheck-stuck.patch + +# Security fixes +# Patch200: ... + +# Apache-2.0: everything +# BSD-3-Clause: util_pcre.c, ap_regex.h +# metamail AND HPND-sell-variant:: server/util_md5.c: +# Spencer-94: modules/metadata/mod_mime_magic.c +License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94) + +BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto +BuildRequires: perl-interpreter, perl-generators, systemd-devel +BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel +BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0 +BuildRequires: openldap-devel +BuildRequires: systemd-rpm-macros +BuildRequires: libxcrypt-devel +%if %{with pcre2} +BuildRequires: pcre2-devel +%endif +%if %{with pcre} +BuildRequires: pcre-devel > 5.0 +%endif +BuildRequires: gnupg2 +Requires: system-logos(httpd-logo-ng) Provides: webserver -Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} -Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} -Requires: httpd-tools = %{version}-%{release} -Requires: httpd-filesystem = %{version}-%{release} -Requires: mod_http2 -Requires(pre): httpd-filesystem -Requires(preun): systemd-units -Requires(postun): systemd-units -Requires(post): systemd-units -Conflicts: apr < 1.5.0-1 +Requires: httpd-core = 0:%{version}-%{release} +Recommends: mod_http2, mod_lua +%{?systemd_requires} %description The Apache HTTP Server is a powerful, efficient, and extensible web server. +%package core +Summary: httpd minimal core +Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} +Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} +Provides: mod_proxy_uwsgi = %{version}-%{release} +Requires: /etc/mime.types +Requires: httpd-tools = %{version}-%{release} +Requires: httpd-filesystem = %{version}-%{release} +%if 0%{?fedora} > 39 || 0%{?rhel} > 9 +Requires: apr-util-1(dbm)%{_isa} +%endif +Requires(pre): httpd-filesystem +Conflicts: apr < 1.5.0-1 +Conflicts: httpd < 2.4.53-2 +Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 + +# Compat symlinks for Requires in other packages. +%if "%{_sbindir}" == "%{_bindir}" +# We rely on filesystem to create the symlink for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/apachectl +Provides: /usr/sbin/httpd +%endif + +%description core +The httpd-core package contains essential httpd binaries. + %package devel -Group: Development/Libraries -Summary: Development interfaces for the Apache HTTP server -Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel -Requires: apr-devel, apr-util-devel, pkgconfig -Requires: httpd = %{version}-%{release} +Summary: Development interfaces for the Apache HTTP Server +Requires: apr-devel, apr-util-devel, pkgconfig, libtool +Requires: httpd-core = 0:%{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files that you need to build Dynamic Shared Objects (DSOs) for the Apache HTTP Server. -If you are installing the Apache HTTP server and you want to be +If you are installing the Apache HTTP Server and you want to be able to compile or develop additional modules for Apache, you need to install this package. %package manual -Group: Documentation -Summary: Documentation for the Apache HTTP server -Requires: httpd = %{version}-%{release} -Obsoletes: secureweb-manual, apache-manual +Summary: Documentation for the Apache HTTP Server +Requires: httpd-core = 0:%{version}-%{release} BuildArch: noarch %description manual The httpd-manual package contains the complete manual and -reference guide for the Apache HTTP server. The information can -also be found at http://httpd.apache.org/docs/2.2/. +reference guide for the Apache HTTP Server. The information can +also be found at https://httpd.apache.org/docs/2.4/. %package filesystem -Group: System Environment/Daemons -Summary: The basic directory layout for the Apache HTTP server +Summary: The basic directory layout for the Apache HTTP Server BuildArch: noarch -Requires(pre): /usr/sbin/useradd +%{?sysusers_requires_compat} %description filesystem The httpd-filesystem package contains the basic directory layout -for the Apache HTTP server including the correct permissions +for the Apache HTTP Server including the correct permissions for the directories. %package tools -Group: System Environment/Daemons Summary: Tools for use with the Apache HTTP Server %description tools @@ -142,27 +207,27 @@ The httpd-tools package contains tools which can be used with the Apache HTTP Server. %package -n mod_ssl -Group: System Environment/Daemons Summary: SSL/TLS module for the Apache HTTP Server Epoch: 1 BuildRequires: openssl-devel -Requires(post): openssl, /bin/cat, hostname Requires(pre): httpd-filesystem -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Obsoletes: stronghold-mod_ssl +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: sscg >= 3.0.3, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 +# mod_ssl/mod_nss cannot both be loaded simultaneously +Conflicts: mod_nss %description -n mod_ssl -The mod_ssl module provides strong cryptography for the Apache Web +The mod_ssl module provides strong cryptography for the Apache HTTP server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. %package -n mod_proxy_html -Group: System Environment/Daemons Summary: HTML and XML content filters for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} BuildRequires: libxml2-devel +BuildRequires: make Epoch: 1 Obsoletes: mod_proxy_html < 1:2.4.1-2 @@ -171,9 +236,8 @@ The mod_proxy_html and mod_xml2enc modules provide filters which can transform and modify HTML and XML content. %package -n mod_ldap -Group: System Environment/Daemons Summary: LDAP authentication modules for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: apr-util-ldap %description -n mod_ldap @@ -181,38 +245,24 @@ The mod_ldap and mod_authnz_ldap modules add support for LDAP authentication to the Apache HTTP Server. %package -n mod_session -Group: System Environment/Daemons Summary: Session interface for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_session The mod_session module and associated backends provide an abstract interface for storing and accessing per-user session data. +%package -n mod_lua +Summary: Lua scripting support for the Apache HTTP Server +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} + +%description -n mod_lua +The mod_lua module allows the server to be extended with scripts +written in the Lua programming language. + %prep -%setup -q -%patch1 -p1 -b .apctl -%patch2 -p1 -b .apxs -%patch3 -p1 -b .deplibs -%patch5 -p1 -b .layout -%patch6 -p1 -b .apctlsystemd - -%patch19 -p1 -b .detectsystemd - -%patch23 -p1 -b .export -%patch24 -p1 -b .corelimit -%patch25 -p1 -b .selinux -%patch26 -p1 -b .r1337344+ -%patch27 -p1 -b .icons -%patch29 -p1 -b .systemd -%patch30 -p1 -b .cachehardmax -%patch31 -p1 -b .sslmultiproxy -%patch34 -p1 -b .socketactivation -%patch35 -p1 -b .sslciphdefault - -%patch56 -p1 -b .uniqueid -%patch57 -p1 -b .sigint -%patch58 -p1 -b .r1738878 +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' +%autosetup -p1 -S gendiff # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -220,6 +270,23 @@ sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h # Prevent use of setcap in "install-suexec-caps" target. sed -i '/suexec/s,setcap ,echo Skipping setcap for ,' Makefile.in +%if %{without engine} +: Forcibly disable ENGINE support in mod_ssl +sed -i.engine '/^#define MODSSL_HAVE_ENGINE_API/{s/1/0/}' modules/ssl/ssl_private.h +! diff -u modules/ssl/ssl_private.h{.engine,} +%endif + +# Example conf for instances +cp $RPM_SOURCE_DIR/instance.conf . +sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf ' +0,/^ServerRoot/d; +/# Supplemental configuration/,$d +/^ *CustomLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_, +/^ *ErrorLog .logs/s,logs/,logs/${HTTPD_INSTANCE}_, +' +touch -r $RPM_SOURCE_DIR/instance.conf instance.conf +cp -p $RPM_SOURCE_DIR/server-status.conf server-status.conf + # Safety check: prevent build if defined MMN does not equal upstream MMN. vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'` if test "x${vmmn}" != "x%{mmn}"; then @@ -228,9 +295,26 @@ if test "x${vmmn}" != "x%{mmn}"; then exit 1 fi -xmlto man $RPM_SOURCE_DIR/httpd.service.xml +# A new logo which comes together with a new test page +cp %{SOURCE48} ./docs/icons/apache_pb3.png -: Building with MMN %{mmn}, MMN-ISA %{mmnisa} and vendor string '%{vstring}' +# Provide default layout +cp $RPM_SOURCE_DIR/config.layout . + +for f in httpd.conf htcacheclean.service httpd.service apachectl; do + sed ' +s,@MPM@,%{mpm},g +s,@DOCROOT@,%{docroot},g +s,@LOGDIR@,%{_localstatedir}/log/httpd,g +s|@BUG_REPORT_URL@|%{bugurl}|g +' < $RPM_SOURCE_DIR/${f}.xml > ${f}.xml + xmlto man ${f}.xml +done + +: Building with MMN %{mmn}, MMN-ISA %{mmnisa} +: Default MPM is %{mpm}, vendor string is '%{vstring}' +: Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2} +: mod_ssl ENGINE support: %{with engine} %build # forcibly prevent use of bundled apr, apr-util, pcre @@ -241,61 +325,74 @@ autoheader && autoconf || exit 1 # Before configure; fix location of build dir in generated apxs %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \ - support/apxs.in + support/apxs.in -export CFLAGS=$RPM_OPT_FLAGS -export LDFLAGS="-Wl,-z,relro,-z,now" - -# Hard-code path to links to avoid unnecessary builddep -export LYNX_PATH=/usr/bin/links +%set_build_flags # Build the daemon ./configure \ - --prefix=%{_sysconfdir}/httpd \ - --exec-prefix=%{_prefix} \ - --bindir=%{_bindir} \ - --sbindir=%{_sbindir} \ - --mandir=%{_mandir} \ - --libdir=%{_libdir} \ - --sysconfdir=%{_sysconfdir}/httpd/conf \ - --includedir=%{_includedir}/httpd \ - --libexecdir=%{_libdir}/httpd/modules \ - --datadir=%{contentdir} \ + --prefix=%{_sysconfdir}/httpd \ + --exec-prefix=%{_prefix} \ + --bindir=%{_bindir} \ + --sbindir=%{_sbindir} \ + --mandir=%{_mandir} \ + --libdir=%{_libdir} \ + --sysconfdir=%{_sysconfdir}/httpd/conf \ + --includedir=%{_includedir}/httpd \ + --libexecdir=%{_libdir}/httpd/modules \ + --datadir=%{contentdir} \ --enable-layout=Fedora \ --with-installbuilddir=%{_libdir}/httpd/build \ --enable-mpms-shared=all \ --with-apr=%{_prefix} --with-apr-util=%{_prefix} \ - --enable-suexec --with-suexec \ + --enable-suexec --with-suexec \ --enable-suexec-capabilities \ - --with-suexec-caller=%{suexec_caller} \ - --with-suexec-docroot=%{docroot} \ - --without-suexec-logfile \ + --with-suexec-caller=%{suexec_caller} \ + --with-suexec-docroot=%{docroot} \ + --without-suexec-logfile \ --with-suexec-syslog \ - --with-suexec-bin=%{_sbindir}/suexec \ - --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \ + --with-suexec-bin=%{_sbindir}/suexec \ + --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \ + --with-brotli \ --enable-pie \ - --with-pcre \ +%if %{with pcre2} + --with-pcre2=%{_bindir}/pcre2-config \ +%endif +%if %{with pcre} + --with-pcre=%{_bindir}/pcre-config \ +%endif --enable-mods-shared=all \ - --enable-ssl --with-ssl --disable-distcache \ - --enable-proxy --enable-proxy-fdpass \ + --enable-ssl --with-ssl --disable-distcache \ + --enable-proxy --enable-proxy-fdpass \ --enable-cache \ --enable-disk-cache \ --enable-ldap --enable-authnz-ldap \ - --enable-cgid --enable-cgi \ + --enable-cgid --enable-cgi --enable-authnz-fcgi \ + --enable-cgid-fdpassing \ --enable-authn-anon --enable-authn-alias \ + --enable-systemd \ --disable-imagemap --disable-file-cache \ --disable-http2 \ - $* -make %{?_smp_mflags} + --disable-md \ + $* + +if grep -q ac_cv_have_threadsafe_pollset=no config.log; then + cat config.log + : Failed to find thread-safe APR. + exit 1 +fi + +%make_build %install rm -rf $RPM_BUILD_ROOT -make DESTDIR=$RPM_BUILD_ROOT install +%make_install # Install systemd service files mkdir -p $RPM_BUILD_ROOT%{_unitdir} -for s in httpd.service htcacheclean.service httpd.socket; do +for s in httpd.service htcacheclean.service httpd.socket \ + httpd@.service httpd-init.service; do install -p -m 644 $RPM_SOURCE_DIR/${s} \ $RPM_BUILD_ROOT%{_unitdir}/${s} done @@ -309,16 +406,23 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \ 00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \ - 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do + 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \ + 00-brotli.conf; do install -m 644 -p $RPM_SOURCE_DIR/$f \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f done +sed -i '/^#LoadModule mpm_%{mpm}_module /s/^#//' \ + $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf +touch -r $RPM_SOURCE_DIR/00-mpm.conf \ + $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/00-mpm.conf + # install systemd override drop directory # Web application packages can drop snippets into this location if # they need ExecStart[pre|post]. -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \ + $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf @@ -351,18 +455,22 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \ $RPM_BUILD_ROOT%{_prefix}/lib/tmpfiles.d/httpd.conf # Other directories -mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \ +mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \ $RPM_BUILD_ROOT/run/httpd/htcacheclean # Substitute in defaults which are usually done (badly) by "make install" sed -i \ - "s,@@ServerRoot@@/var,%{_localstatedir}/lib/dav,; + "/^DavLockDB/d; s,@@ServerRoot@@/user.passwd,/etc/httpd/conf/user.passwd,; s,@@ServerRoot@@/docs,%{docroot},; s,@@ServerRoot@@,%{docroot},; s,@@Port@@,80,;" \ docs/conf/extra/*.conf +# Set correct path for httpd binary in apachectl script +sed 's,@HTTPDBIN@,%{_sbindir}/httpd,g' $RPM_SOURCE_DIR/apachectl.sh \ + > apachectl.sh + # Create cache directory mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd \ $RPM_BUILD_ROOT%{_localstatedir}/cache/httpd/proxy \ @@ -373,17 +481,22 @@ echo %{mmnisa} > $RPM_BUILD_ROOT%{_includedir}/httpd/.mmn mkdir -p $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd <= 9 +ln -s ../../pixmaps/system-noindex-logo.png \ + $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png +%endif + # symlinks for /etc/httpd +rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs +ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules # install http-ssl-pass-dialog mkdir -p $RPM_BUILD_ROOT%{_libexecdir} install -m755 $RPM_SOURCE_DIR/httpd-ssl-pass-dialog \ - $RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-pass-dialog + $RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-pass-dialog -# Install action scripts +# install http-ssl-gencerts +install -m755 $RPM_SOURCE_DIR/httpd-ssl-gencerts \ + $RPM_BUILD_ROOT%{_libexecdir}/httpd-ssl-gencerts + +# Install scripts +install -m 755 apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl +touch -r $RPM_SOURCE_DIR/apachectl.sh $RPM_BUILD_ROOT%{_sbindir}/apachectl mkdir -p $RPM_BUILD_ROOT%{_libexecdir}/initscripts/legacy-actions/httpd for f in graceful configtest; do install -p -m 755 $RPM_SOURCE_DIR/action-${f}.sh \ @@ -429,11 +556,15 @@ done # Install logrotate config mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d install -m 644 -p $RPM_SOURCE_DIR/httpd.logrotate \ - $RPM_BUILD_ROOT/etc/logrotate.d/httpd + $RPM_BUILD_ROOT/etc/logrotate.d/httpd -# Install systemd service man pages -install -m 644 -p httpd.service.8 httpd.socket.8 \ +# Install man pages +install -d $RPM_BUILD_ROOT%{_mandir}/man8 $RPM_BUILD_ROOT%{_mandir}/man5 +install -m 644 -p httpd.service.8 httpd-init.service.8 httpd.socket.8 \ + httpd@.service.8 htcacheclean.service.8 apachectl.8 \ $RPM_BUILD_ROOT%{_mandir}/man8 +install -m 644 -p httpd.conf.5 \ + $RPM_BUILD_ROOT%{_mandir}/man5 # fix man page paths sed -e "s|/usr/local/apache2/conf/httpd.conf|/etc/httpd/conf/httpd.conf|" \ @@ -453,6 +584,29 @@ sed -i '/.*DEFAULT_..._LIBEXECDIR/d;/DEFAULT_..._INSTALLBUILDDIR/d' \ sed -i '/instdso/s,top_srcdir,top_builddir,' \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/special.mk +# vendor-apxs uses an unsanitized config_vars.mk which may +# have dependencies on redhat-rpm-config. apxs uses the +# config_vars.mk with a sanitized config_vars.mk +cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk + +# Sanitize CFLAGS & LIBTOOL in standard config_vars.mk +sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \ + -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \ + -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk +diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk || true + +sed 's/config_vars.mk/vendor_config_vars.mk/' \ + $RPM_BUILD_ROOT%{_bindir}/apxs \ + > $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs + +# Fix content dir in sysusers file and install it +install -p -D -m 0644 %{SOURCE49} %{buildroot}%{_sysusersdir}/httpd.conf + # Remove unpackaged files rm -vf \ $RPM_BUILD_ROOT%{_libdir}/*.exp \ @@ -468,11 +622,7 @@ rm -vf \ rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra} %pre filesystem -getent group apache >/dev/null || groupadd -g 48 -r apache -getent passwd apache >/dev/null || \ - useradd -r -u 48 -g apache -s /sbin/nologin \ - -d %{contentdir} -c "Apache" apache -exit 0 +%sysusers_create_compat %{SOURCE49} %post %systemd_post httpd.service htcacheclean.service httpd.socket @@ -481,67 +631,43 @@ exit 0 %systemd_preun httpd.service htcacheclean.service httpd.socket %postun -%systemd_postun - -# Trigger for conversion from SysV, per guidelines at: -# https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd -%triggerun -- httpd < 2.2.21-5 -# Save the current service runlevel info -# User must manually run systemd-sysv-convert --apply httpd -# to migrate them to systemd targets -/usr/bin/systemd-sysv-convert --save httpd.service >/dev/null 2>&1 ||: - -# Run these because the SysV package being removed won't do them -/sbin/chkconfig --del httpd >/dev/null 2>&1 || : +%systemd_postun httpd.service htcacheclean.service httpd.socket %posttrans test -f /etc/sysconfig/httpd-disable-posttrans || \ - /bin/systemctl try-restart httpd.service htcacheclean.service >/dev/null 2>&1 || : - -%define sslcert %{_sysconfdir}/pki/tls/certs/localhost.crt -%define sslkey %{_sysconfdir}/pki/tls/private/localhost.key - -%post -n mod_ssl -umask 077 - -if [ -f %{sslkey} -o -f %{sslcert} ]; then - exit 0 -fi - -%{_bindir}/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 2048 > %{sslkey} 2> /dev/null - -FQDN=`hostname` -# A >59 char FQDN means "root@FQDN" exceeds 64-char max length for emailAddress -if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then - FQDN=localhost.localdomain -fi - -cat << EOF | %{_bindir}/openssl req -new -key %{sslkey} \ - -x509 -sha256 -days 365 -set_serial $RANDOM -extensions v3_req \ - -out %{sslcert} 2>/dev/null --- -SomeState -SomeCity -SomeOrganization -SomeOrganizationalUnit -${FQDN} -root@${FQDN} -EOF + /bin/systemctl try-restart --no-block httpd.service htcacheclean.service >/dev/null 2>&1 || : %check -# Check the built modules are all PIC -if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then - : modules contain non-relocatable code - exit 1 -fi +make -C server exports.o +nm --defined httpd > exports-actual.list set +x rv=0 +nm --defined-only server/exports.o | \ + sed -n '/ap_hack_/{s/.* ap_hack_//;/^ap[ru]/d;p;}' | \ + while read sym; do + if ! grep -q " "$sym\$ exports-actual.list; then + echo ERROR: Symbol $sym missing in httpd exports + rv=1 + fi + done +if [ $rv -eq 0 ]; then + echo PASS: Symbol export list verified. +fi +# Check the built modules are all PIC +if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then + echo FAIL: Modules contain non-relocatable code + rv=1 +else + echo PASS: No non-relocatable code in module builds +fi # Ensure every mod_* that's built is loaded. for f in $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so; do m=${f##*/} if ! grep -q $m $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/*.conf; then - echo ERROR: Module $m not configured. Disable it, or load it. + echo FAIL: Module $m not configured. Disable it, or load it. rv=1 + else + echo PASS: Module $m is configured and loaded. fi done # Ensure every loaded mod_* is actually built @@ -549,26 +675,41 @@ mods=`grep -h ^LoadModule $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/*.c for m in $mods; do f=$RPM_BUILD_ROOT%{_libdir}/httpd/modules/${m} if ! test -x $f; then - echo ERROR: Module $m is configured but not built. + echo FAIL: Module $m is configured but not built. rv=1 + else + echo PASS: Loaded module $m is installed. fi done set -x exit $rv -%clean -rm -rf $RPM_BUILD_ROOT - %files -%defattr(-,root,root) +%{_mandir}/man8/* +%{_mandir}/man5/* +%exclude %{_mandir}/man8/httpd-init.* +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf +%{_libdir}/httpd/modules/mod_brotli.so +%{_libdir}/httpd/modules/mod_systemd.so + +%{_unitdir}/httpd.service +%{_unitdir}/httpd@.service +%{_unitdir}/htcacheclean.service +%{_unitdir}/*.socket + +%files core %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE %doc docs/conf/extra/*.conf +%doc instance.conf server-status.conf %{_sysconfdir}/httpd/modules %{_sysconfdir}/httpd/logs +%{_sysconfdir}/httpd/state %{_sysconfdir}/httpd/run %dir %{_sysconfdir}/httpd/conf + %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf %config(noreplace) %{_sysconfdir}/httpd/conf/magic @@ -580,20 +721,24 @@ rm -rf $RPM_BUILD_ROOT %dir %{_sysconfdir}/httpd/conf.modules.d %{_sysconfdir}/httpd/conf.modules.d/README + %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean -%ghost %{_sysconfdir}/sysconfig/httpd %{_prefix}/lib/tmpfiles.d/httpd.conf %dir %{_libexecdir}/initscripts/legacy-actions/httpd %{_libexecdir}/initscripts/legacy-actions/httpd/* -%{_sbindir}/ht* +%{_sbindir}/httpd +%{_sbindir}/htcacheclean %{_sbindir}/fcgistarter %{_sbindir}/apachectl %{_sbindir}/rotatelogs @@ -602,35 +747,34 @@ rm -rf $RPM_BUILD_ROOT %dir %{_libdir}/httpd %dir %{_libdir}/httpd/modules %{_libdir}/httpd/modules/mod*.so +%exclude %{_libdir}/httpd/modules/mod_brotli.so +%exclude %{_libdir}/httpd/modules/mod_systemd.so %exclude %{_libdir}/httpd/modules/mod_auth_form.so %exclude %{_libdir}/httpd/modules/mod_ssl.so %exclude %{_libdir}/httpd/modules/mod_*ldap.so %exclude %{_libdir}/httpd/modules/mod_proxy_html.so %exclude %{_libdir}/httpd/modules/mod_xml2enc.so %exclude %{_libdir}/httpd/modules/mod_session*.so +%exclude %{_libdir}/httpd/modules/mod_lua.so %dir %{contentdir}/error %dir %{contentdir}/error/include %dir %{contentdir}/noindex +%dir %{contentdir}/server-status %{contentdir}/icons/* %{contentdir}/error/README %{contentdir}/error/*.var %{contentdir}/error/include/*.html %{contentdir}/noindex/index.html +%{contentdir}/server-status/* %attr(0710,root,apache) %dir /run/httpd %attr(0700,apache,apache) %dir /run/httpd/htcacheclean %attr(0700,root,root) %dir %{_localstatedir}/log/httpd -%attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav +%attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy -%{_mandir}/man8/* - -%{_unitdir}/*.service -%{_unitdir}/*.socket -%attr(755,root,root) %dir %{_unitdir}/httpd.service.d -%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d %files filesystem %dir %{_sysconfdir}/httpd @@ -641,57 +785,644 @@ rm -rf $RPM_BUILD_ROOT %dir %{docroot}/html %dir %{contentdir} %dir %{contentdir}/icons +%attr(755,root,root) %dir %{_unitdir}/httpd.service.d +%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d +%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d +%{_sysusersdir}/httpd.conf %files tools -%defattr(-,root,root) -%{_bindir}/* +%{_bindir}/ab +%{_bindir}/htdbm +%{_bindir}/htdigest +%{_bindir}/httxt2dbm +%{_bindir}/htpasswd +%{_bindir}/logresolve %{_mandir}/man1/* %doc LICENSE NOTICE %exclude %{_bindir}/apxs %exclude %{_mandir}/man1/apxs.1* %files manual -%defattr(-,root,root) %{contentdir}/manual %config(noreplace) %{_sysconfdir}/httpd/conf.d/manual.conf %files -n mod_ssl -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_ssl.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf %attr(0700,apache,root) %dir %{_localstatedir}/cache/httpd/ssl +%{_unitdir}/httpd-init.service %{_libexecdir}/httpd-ssl-pass-dialog +%{_libexecdir}/httpd-ssl-gencerts %{_unitdir}/httpd.socket.d/10-listen443.conf +%{_mandir}/man8/httpd-init.* %files -n mod_proxy_html -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_proxy_html.so %{_libdir}/httpd/modules/mod_xml2enc.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf %files -n mod_ldap -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_*ldap.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf %files -n mod_session -%defattr(-,root,root) %{_libdir}/httpd/modules/mod_session*.so %{_libdir}/httpd/modules/mod_auth_form.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf +%files -n mod_lua +%{_libdir}/httpd/modules/mod_lua.so +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf + %files devel -%defattr(-,root,root) %{_includedir}/httpd %{_bindir}/apxs %{_mandir}/man1/apxs.1* %dir %{_libdir}/httpd/build %{_libdir}/httpd/build/*.mk %{_libdir}/httpd/build/*.sh +%{_libdir}/httpd/build/vendor-apxs %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Dec 09 2025 Luboš Uhliarik - 2.4.66-1 +- new version 2.4.66 + +* Thu Nov 27 2025 Luboš Uhliarik - 2.4.65-5 +- Improve default httpd LogFormats for better support diagnostics + +* Wed Nov 12 2025 Luboš Uhliarik - 2.4.65-3 +- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode + +* Tue Nov 04 2025 Luboš Uhliarik - 2.4.65-2 +- mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level + required for VirtualHost matching. + +* Sat Oct 18 2025 Luboš Uhliarik - 2.4.65-1 +- new version 2.4.65 +- mod_proxy_hcheck: reschedule health checks after child process restart + +* Mon Sep 08 2025 Luboš Uhliarik - 2.4.64-4 +- Add tmpfiles.d rules for /var directories (bootc compatibility) + +* Thu Jul 24 2025 Fedora Release Engineering - 2.4.64-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Jul 17 2025 Luboš Uhliarik - 2.4.64-2 +- Fix RewriteRule with inverted pattern and RewriteCond regression + +* Fri Jul 11 2025 Luboš Uhliarik - 2.4.64-1 +- new version 2.4.64 + +* Tue Jun 24 2025 Joe Orton - 2.4.63-4 +- mod_dav: add dav_get_base_path() API + +* Mon Feb 10 2025 Joe Orton - 2.4.63-3 +- sync default httpd.conf with upstream + +* Sat Feb 01 2025 Björn Esser - 2.4.63-2 +- Add explicit BR: libxcrypt-devel + +* Fri Jan 24 2025 Luboš Uhliarik - 2.4.63-1 +- new version 2.4.63 + +* Fri Jan 17 2025 Fedora Release Engineering - 2.4.62-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 2.4.62-5 +- Rebuilt for the bin-sbin merge (2nd attempt) + +* Fri Oct 11 2024 Luboš Uhliarik - 2.4.62-4 +- mod_rewrite: regression fixes + +* Thu Aug 01 2024 Luboš Uhliarik - 2.4.62-3 +- Fix regression introduced by CVE-2024-38474 fix +- added openldap-devel build dependency + +* Fri Jul 19 2024 Luboš Uhliarik - 2.4.62-1 +- new version 2.4.62 + +* Thu Jul 18 2024 Fedora Release Engineering - 2.4.61-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 2.4.61-2 +- Rebuilt for the bin-sbin merge + +* Wed Jul 03 2024 Luboš Uhliarik - 2.4.61-1 +- new version 2.4.61 + +* Thu May 23 2024 Joe Orton - 2.4.59-4 +- mod_ssl: add engine bcond, disable ENGINE support by default for F41+ +- mod_ssl: enable SSL_OP_NO_RENEGOTIATION (upstream PR#426) + +* Fri May 3 2024 Joe Orton - 2.4.59-3 +- apachectl(8): use BUG_REPORT_URL from /etc/os-release +- apachectl(8): fix grammar (#2278748) +- httpd.service.xml(8): mention ProtectSystem= setting + +* Mon Apr 15 2024 Joe Orton - 2.4.59-2 +- mod_ssl: add DH param handling fix (r1916863) + +* Fri Apr 5 2024 Joe Orton - 2.4.59-1 +- update to 2.4.59 + +* Thu Mar 28 2024 Joe Orton - 2.4.58-8 +- rebuild to fix changelog ordering + +* Thu Mar 7 2024 Rahul Sundaram - 2.4.58-7 +- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening +- updated httpd.service(5) (Joe Orton) + +* Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Fri Jan 5 2024 Joe Orton - 2.4.58-4 +- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) +- mod_ssl: move to provider API for pkcs11 support (#2253014) + +* Fri Dec 8 2023 Joe Orton - 2.4.58-3 +- mod_dav_fs: add DAVLockDBType, use global lock around lockdb +- fix build with libxml2 2.12 + +* Thu Nov 2 2023 Joe Orton - 2.4.58-2 +- add dependency on apr-util-1(dbm) so a DBM provider is present + +* Fri Oct 20 2023 Luboš Uhliarik - 2.4.58-1 +- new version 2.4.58 + +* Fri Oct 06 2023 Luboš Uhliarik - 2.4.57-4 +- SPDX migration + +* Thu Jul 20 2023 Fedora Release Engineering - 2.4.57-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jul 5 2023 Joe Orton - 2.4.57-2 +- package /etc/systemd/httpd/httpd.service.d +- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk + +* Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 +- new version 2.4.57 + +* Thu Mar 09 2023 Luboš Uhliarik - 2.4.56-1 +- new version 2.4.56 + +* Tue Mar 7 2023 Joe Orton - 2.4.55-3 +- build and load mod_authnz_fcgi + +* Fri Feb 03 2023 Luboš Uhliarik - 2.4.55-2 +- rebuilt with new apr/apr-util + +* Wed Jan 25 2023 Luboš Uhliarik - 2.4.55-1 +- new version 2.4.55 + +* Tue Jan 24 2023 Luboš Uhliarik - 2.4.54-12 +- prevent sscg writing /dhparams.pem + +* Thu Jan 19 2023 Fedora Release Engineering - 2.4.54-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Dec 20 2022 Joe Orton - 2.4.54-10 +- htcacheclean.service: add [Install] section, PrivateTmp=yes, + Environment=LANG=C (#2149714) + +* Mon Dec 19 2022 Joe Orton - 2.4.54-9 +- move SELinux context logging to mod_systemd + +* Mon Dec 19 2022 Joe Orton - 2.4.54-8 +- define _httpd_statedir macro + +* Wed Nov 30 2022 Luboš Uhliarik - 2.4.54-7 +- reduce AH03408 level to INFO in proxy_util.c + +* Thu Oct 13 2022 Luboš Uhliarik - 2.4.54-6 +- Provide a sysusers.d file to get user() and group() provides (#2134430) + +* Thu Jul 21 2022 Fedora Release Engineering - 2.4.54-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Fri Jun 24 2022 Luboš Uhliarik - 2.4.54-4 +- fix downgrade/upgrade issues +- mod_ssl and other modules should depend only on httpd-core package + +* Fri Jun 17 2022 Joe Orton - 2.4.54-3 +- update PCRE config selection + +* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-2 +- new version 2.4.54 + +* Mon May 16 2022 Joe Orton - 2.4.53-7 +- disable package notes + +* Fri May 13 2022 Joe Orton - 2.4.53-6 +- use %%set_build_flags macro + +* Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 +- don't use bomb.gif icon for all files/dirs ending with core + +* Wed Apr 20 2022 Joe Orton - 2.4.53-4 +- switch to PCRE2 for new releases + +* Thu Apr 07 2022 Luboš Uhliarik - 2.4.53-3 +- Related: #2070517 - fix issue when mod_systemd is not loaded + +* Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 +- Resolves: #2070517 - Allow install httpd with smaller footprint +- try to minimize httpd dependencies (new httpd-core package) +- mod_systemd and mod_brotli are now in the main httpd package + +* Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 +- new version 2.4.53 +- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 + +* Tue Feb 1 2022 Joe Orton - 2.4.52-5 +- rebuild for new OpenLDAP (#2032699) + +* Mon Jan 31 2022 Joe Orton - 2.4.52-4 +- add libtool to Requires: for httpd-devel (#2048281) + +* Fri Jan 28 2022 Joe Orton - 2.4.52-3 +- use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk + +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.52-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Dec 22 2021 Joe Orton - 2.4.52-1 +- update to 2.4.52 + +* Mon Dec 06 2021 Neal Gompa - 2.4.51-3 +- Use NAME from os-release(5) for vendor string + Related: #2029071 - httpd on CentOS identifies as RHEL + +* Tue Oct 12 2021 Joe Orton - 2.4.51-2 +- mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) +- mod_deflate/core: add two brigade handling correctness fixes + +* Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 +- new version 2.4.51 + +* Tue Oct 05 2021 Luboš Uhliarik - 2.4.50-1 +- new version 2.4.50 + +* Wed Sep 22 2021 Luboš Uhliarik - 2.4.49-3 +- Rebuilt for CI testing + +* Thu Sep 16 2021 Luboš Uhliarik - 2.4.49-1 +- new version 2.4.49 (#2004776) + +* Tue Sep 14 2021 Sahana Prasad - 2.4.48-8 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-7 +- add symlink to system logo for noindex test page + +* Fri Aug 6 2021 Joe Orton - 2.4.48-4 +- add OpenSSL 3.x compatibility patch + +* Thu Jul 22 2021 Fedora Release Engineering - 2.4.48-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jul 16 2021 Joe Orton - 2.4.48-2 +- mod_cgi/mod_cgid: update to unification from trunk +- httpd.conf: add note on care with Listen and starting at boot + +* Wed Jun 02 2021 Luboš Uhliarik - 2.4.48-1 +- new version 2.4.48 +- Resolves: #1964746 - httpd-2.4.48 is available + +* Mon May 03 2021 Lubos Uhliarik - 2.4.46-13 +- Related: #1934739 - Apache trademark update - new logo + +* Fri Apr 9 2021 Joe Orton - 2.4.46-12 +- use OOMPolicy=continue in httpd.service, httpd@.service (#1947475) + +* Wed Mar 31 2021 Lubos Uhliarik - 2.4.46-11 +- Resolves: #1934739 - Apache trademark update - new logo + +* Tue Feb 23 2021 Joe Orton - 2.4.46-10 +- add Conflicts: with mod_nss +- drop use of apr_ldap_rebind (r1878890, #1847585) + +* Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 +- Resolves: #1914182 - RFE: CustomLog should be able to use journald + +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.46-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jan 20 2021 Artem Egorenkov - 2.4.46-7 +- prevent htcacheclean from while break when first file processed + +* Thu Dec 17 2020 Joe Orton - 2.4.46-6 +- move mod_lua to a subpackage +- Recommends: both mod_lua and mod_http2 + +* Fri Nov 6 2020 Joe Orton - 2.4.46-5 +- add %%_httpd_requires to macros + +* Thu Aug 27 2020 Joe Orton - 2.4.46-4 +- use make macros (Tom Stellard) + +* Thu Aug 27 2020 Joe Orton - 2.4.46-3 +- strip /usr/bin/apxs CFLAGS further + +* Thu Aug 27 2020 Joe Orton - 2.4.46-2 +- sanitize CFLAGS used by /usr/bin/apxs by default (#1873020) +- add $libdir/httpd/build/vendor-apxs which exposes full CFLAGS +- redefine _httpd_apxs RPM macro to use vendor-apxs + +* Tue Aug 25 2020 Lubos Uhliarik - 2.4.46-1 +- new version 2.4.46 +- remove obsolete parts of this spec file +- fix systemd detection patch + +* Tue Jul 28 2020 Fedora Release Engineering - 2.4.43-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Thu Jul 09 2020 Lubos Uhliarik - 2.4.43-6 +- fix macro in mod_lua for lua 4.5 + +* Thu Jul 09 2020 Lubos Uhliarik - 2.4.43-5 +- Remove %ghosted /etc/sysconfig/httpd file (#1850082) + +* Tue Jul 7 2020 Joe Orton - 2.4.43-4 +- use gettid() directly and use it for built-in ErrorLogFormat + +* Fri Apr 17 2020 Joe Orton - 2.4.43-3 +- mod_ssl: updated coalescing filter to improve TLS efficiency + +* Fri Apr 17 2020 Joe Orton - 2.4.43-2 +- mod_ssl: fix leak in OCSP stapling code (PR 63687, r1876548) +- mod_systemd: restore descriptive startup logging + +* Tue Mar 31 2020 Lubos Uhliarik - 2.4.43-1 +- new version 2.4.43 (#1819023) + +* Wed Jan 29 2020 Fedora Release Engineering - 2.4.41-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Jan 20 2020 Joe Orton - 2.4.41-12 +- mod_systemd: fix timeouts on reload w/ExtendedStatus off (#1590877) + +* Mon Jan 6 2020 Joe Orton - 2.4.41-11 +- apachectl(8): update authors + +* Sat Dec 7 2019 FeRD (Frank Dana) - 2.4.41-10 +- apachectl: Add man page for Fedora version + +* Thu Nov 21 2019 Joe Orton - 2.4.41-9 +- mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146) + +* Wed Nov 13 2019 Joe Orton - 2.4.41-8 +- apachectl: in graceful/graceful-stop, only signal main process (#1758798) + +* Mon Nov 11 2019 Lubos Uhliarik - 2.4.41-7 +- add automatic source tarball signature verification in %prep section + +* Fri Oct 4 2019 Joe Orton - 2.4.41-6 +- mod_cgid/mod_cgi: further upstream consolidation patches + +* Thu Oct 3 2019 Joe Orton - 2.4.41-5 +- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) + +* Wed Oct 2 2019 Joe Orton - 2.4.41-4 +- mod_cgid: possible stdout timeout handling fix (#1757683) + +* Wed Sep 25 2019 Joe Orton - 2.4.41-3 +- mod_ssl: restore dependency on /usr/bin/hostname (#1135118) + +* Thu Sep 19 2019 Stephen Gallagher - 2.4.41-2 +- Use testpage from system-logos-httpd for proper branding + +* Thu Aug 15 2019 Joe Orton - 2.4.41-1 +- update to 2.4.41 + +* Thu Jul 25 2019 Fedora Release Engineering - 2.4.39-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Jul 23 2019 Joe Orton - 2.4.39-12 +- drop /var/lib/dav directory, since mod_dav_fs uses statedir + +* Wed Jul 17 2019 Joe Orton - 2.4.39-11 +- mod_cgid: use fd passing to fix script stderr handling (#1591157) + +* Mon Jul 8 2019 Joe Orton - 2.4.39-10 +- htpasswd: add SHA-256/512 support +- apachectl: restore -V/-v/-t support (#1727434) + +* Fri Jun 21 2019 Joe Orton - 2.4.39-9 +- create instance-specific StateDir in httpd@.service, instance.conf + +* Thu Jun 20 2019 Joe Orton - 2.4.39-8 +- remove superfluous ap_hack_ symbols from httpd binary +- more verbose %%check section + +* Thu Jun 13 2019 Lubos Uhliarik - 2.4.39-7 +- remove bundled mod_md module + +* Thu Jun 13 2019 Joe Orton - 2.4.39-6 +- mod_ssl: fix "httpd -L" (etc) before httpd-init.service runs + +* Wed Jun 12 2019 Joe Orton - 2.4.39-5 +- fixes for StateDir directive (upstream r1857731, r1857731) + +* Thu May 02 2019 Lubos Uhliarik - 2.4.39-4 +- httpd dependency on initscripts is unspecified (#1705188) + +* Tue Apr 9 2019 Joe Orton - 2.4.39-3 +- fix statedir symlink to point to /var/lib/httpd (#1697662) +- mod_reqtimeout: fix default values regression (PR 63325) + +* Tue Apr 02 2019 Lubos Uhliarik - 2.4.39-2 +- update to 2.4.39 + +* Thu Feb 28 2019 Joe Orton - 2.4.38-6 +- apachectl: cleanup and replace script wholesale (#1641237) + * drop "apachectl fullstatus" support + * run systemctl with --no-pager option + * implement graceful&graceful-stop by signal directly +- run "httpd -t" from legacy action script + +* Tue Feb 05 2019 Lubos Uhliarik - 2.4.38-5 +- segmentation fault fix (FIPS) + +* Tue Feb 5 2019 Joe Orton - 2.4.38-4 +- use serverroot-relative statedir, rundir by default + +* Fri Feb 01 2019 Fedora Release Engineering - 2.4.38-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Jan 23 2019 Lubos Uhliarik - 2.4.38-2 +- new version 2.4.38 (#1668125) + +* Mon Jan 14 2019 Björn Esser - 2.4.37-6 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Thu Nov 22 2018 Luboš Uhliarik - 2.4.37-5 +- Resolves: #1652678 - TLS connection allowed while all protocols are forbidden + +* Thu Nov 8 2018 Joe Orton - 2.4.37-4 +- add httpd.conf(5) (#1611361) + +* Wed Nov 07 2018 Luboš Uhliarik - 2.4.37-3 +- Resolves: #1647241 - fix apachectl script + +* Wed Oct 31 2018 Joe Orton - 2.4.37-2 +- add DefaultStateDir/ap_state_dir_relative() +- mod_dav_fs: use state dir for default DAVLockDB +- mod_md: use state dir for default MDStoreDir + +* Wed Oct 31 2018 Joe Orton - 2.4.37-1 +- update to 2.4.37 + +* Wed Oct 31 2018 Joe Orton - 2.4.34-11 +- add htcacheclean.service(8) man page + +* Fri Sep 28 2018 Joe Orton - 2.4.34-10 +- apachectl: don't read /etc/sysconfig/httpd + +* Tue Sep 25 2018 Joe Orton - 2.4.34-9 +- fix build if OpenSSL built w/o SSLv3 support + +* Fri Sep 21 2018 Joe Orton - 2.4.34-8 +- comment-out SSLProtocol, SSLProxyProtocol from ssl.conf in + default configuration; now follow OpenSSL system default (#1468322) + +* Fri Sep 21 2018 Joe Orton - 2.4.34-7 +- mod_ssl: follow OpenSSL protocol defaults if SSLProtocol + is not configured (Rob Crittenden, #1618371) + +* Tue Aug 28 2018 Luboš Uhliarik - 2.4.34-6 +- mod_ssl: enable SSLv3 and change behavior of "SSLProtocol All" + configuration (#1624777) + +* Tue Aug 21 2018 Joe Orton - 2.4.34-5 +- mod_ssl: further TLSv1.3 fix (#1619389) + +* Mon Aug 13 2018 Joe Orton - 2.4.34-4 +- mod_ssl: backport TLSv1.3 support changes from upstream (#1615059) + +* Fri Jul 20 2018 Joe Orton - 2.4.34-3 +- mod_ssl: fix OCSP regression (upstream r1555631) + +* Wed Jul 18 2018 Joe Orton - 2.4.34-2 +- update Obsoletes for mod_proxy_uswgi (#1599113) + +* Wed Jul 18 2018 Joe Orton - 2.4.34-1 +- update to 2.4.34 (#1601160) + +* Mon Jul 16 2018 Joe Orton - 2.4.33-10 +- don't block on service try-restart in posttrans scriptlet +- add Lua-based /server-status example page to docs +- obsoletes: and provides: for mod_proxy_uswgi (#1599113) + +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.33-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jul 6 2018 Joe Orton - 2.4.33-8 +- add per-request memory leak fix (upstream r1833014) + +* Fri Jul 6 2018 Joe Orton - 2.4.33-7 +- mod_ssl: add PKCS#11 cert/key support (Anderson Sasaki) + +* Tue Jun 12 2018 Joe Orton - 2.4.33-6 +- mod_systemd: show bound ports in status and log to journal + at startup. + +* Thu Apr 19 2018 Joe Orton - 2.4.33-5 +- add httpd@.service; update httpd.service(8) and add new stub + +* Mon Apr 16 2018 Joe Orton - 2.4.33-4 +- mod_md: change hard-coded default MdStoreDir to state/md (#1563846) + +* Thu Apr 12 2018 Joe Orton - 2.4.33-3 +- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537) + +* Fri Mar 30 2018 Adam Williamson - 2.4.33-2 +- Exclude mod_md config file from main package (#1562413) + +* Wed Mar 28 2018 Joe Orton - 2.4.33-1 +- rebase to 2.4.33 (#1560174) +- add mod_md subpackage; load mod_proxy_uwsgi by default + +* Mon Mar 05 2018 Jitka Plesnikova - 2.4.29-8 +- Rebuilt with brotli 1.0.3 + +* Mon Feb 26 2018 Joe Orton - 2.4.29-7 +- simplify liblua detection in configure + +* Wed Feb 07 2018 Fedora Release Engineering - 2.4.29-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sat Jan 27 2018 Joe Orton - 2.4.29-5 +- link mod_lua against -lcrypt (#1538992) + +* Fri Jan 26 2018 Paul Howarth - 2.4.29-4 +- Rebuild with updated flags to work around compiler issues on i686 + (#1538648, #1538693) + +* Sat Jan 20 2018 Björn Esser - 2.4.29-3 +- Rebuilt for switch to libxcrypt + +* Thu Nov 23 2017 Joe Orton - 2.4.29-2 +- build and load mod_brotli + +* Wed Oct 25 2017 Luboš Uhliarik - 2.4.29-1 +- new version 2.4.29 + +* Tue Oct 10 2017 Joe Orton - 2.4.28-3 +- drop obsolete Obsoletes +- update docs, Summary +- trim %%changelog + +* Tue Oct 10 2017 Patrick Uiterwijk - 2.4.28-2 +- Backport patch for fixing ticket key usage + +* Fri Oct 06 2017 Luboš Uhliarik - 2.4.28-1 +- new version 2.4.28 + +* Tue Oct 3 2017 Joe Orton - 2.4.27-14 +- add notes on enabling httpd_graceful_shutdown boolean for prefork + +* Fri Sep 22 2017 Joe Orton - 2.4.27-13 +- drop Requires(post) for mod_ssl + +* Fri Sep 22 2017 Joe Orton - 2.4.27-12 +- better error handling in httpd-ssl-gencerts (#1494556) + +* Thu Sep 21 2017 Stephen Gallagher - 2.4.27-11 +- Require sscg 2.2.0 for creating service and CA certificates together + +* Thu Sep 21 2017 Jeroen van Meeuwen - 2.4.27-10 +- Address CVE-2017-9798 by applying patch from upstream (#1490344) + +* Thu Sep 21 2017 Joe Orton - 2.4.27-9 +- use sscg defaults; append CA cert to generated cert +- document httpd-init.service in httpd-init.service(8) + +* Wed Sep 20 2017 Stephen Gallagher - 2.4.27-8.1 +- Generate SSL certificates on service start, not %%posttrans + +* Tue Sep 19 2017 Joe Orton - 2.4.27-8 +- move httpd.service.d, httpd.socket.d dirs to -filesystem + +* Wed Sep 13 2017 Joe Orton - 2.4.27-7 +- add new content-length filter (upstream PR 61222) + +* Wed Aug 02 2017 Fedora Release Engineering - 2.4.27-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 2.4.27-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Tue Jul 18 2017 Joe Orton - 2.4.27-4 +- update mod_systemd (r1802251) + +* Mon Jul 17 2017 Joe Orton - 2.4.27-3 +- switch to event by default for Fedora 27 and later (#1471708) + * Wed Jul 12 2017 Luboš Uhliarik - 2.4.27-2 - Resolves: #1469959 - httpd update cleaned out /etc/sysconfig @@ -1157,124 +1888,3 @@ rm -rf $RPM_BUILD_ROOT - split all LoadModules to conf.modules.d/*.conf - include conf.d/*.conf at end of httpd.conf - trim %%changelog - -* Mon Feb 13 2012 Joe Orton - 2.2.22-2 -- fix build against PCRE 8.30 - -* Mon Feb 13 2012 Joe Orton - 2.2.22-1 -- update to 2.2.22 - -* Fri Feb 10 2012 Petr Pisar - 2.2.21-8 -- Rebuild against PCRE 8.30 - -* Mon Jan 23 2012 Jan Kaluza - 2.2.21-7 -- fix #783629 - start httpd after named - -* Mon Jan 16 2012 Joe Orton - 2.2.21-6 -- complete conversion to systemd, drop init script (#770311) -- fix comments in /etc/sysconfig/httpd (#771024) -- enable PrivateTmp in service file (#781440) -- set LANG=C in /etc/sysconfig/httpd - -* Fri Jan 13 2012 Fedora Release Engineering - 2.2.21-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Tue Dec 06 2011 Jan Kaluza - 2.2.21-4 -- fix #751591 - start httpd after remote-fs - -* Mon Oct 24 2011 Jan Kaluza - 2.2.21-3 -- allow change state of BalancerMember in mod_proxy_balancer web interface - -* Thu Sep 22 2011 Ville Skyttä - 2.2.21-2 -- Make mmn available as %%{_httpd_mmn}. -- Add .svgz to AddEncoding x-gzip example in httpd.conf. - -* Tue Sep 13 2011 Joe Orton - 2.2.21-1 -- update to 2.2.21 - -* Mon Sep 5 2011 Joe Orton - 2.2.20-1 -- update to 2.2.20 -- fix MPM stub man page generation - -* Wed Aug 10 2011 Jan Kaluza - 2.2.19-5 -- fix #707917 - add httpd-ssl-pass-dialog to ask for SSL password using systemd - -* Fri Jul 22 2011 Iain Arnell 1:2.2.19-4 -- rebuild while rpm-4.9.1 is untagged to remove trailing slash in provided - directory names - -* Wed Jul 20 2011 Jan Kaluza - 2.2.19-3 -- fix #716621 - suexec now works without setuid bit - -* Thu Jul 14 2011 Jan Kaluza - 2.2.19-2 -- fix #689091 - backported patch from 2.3 branch to support IPv6 in logresolve - -* Fri Jul 1 2011 Joe Orton - 2.2.19-1 -- update to 2.2.19 -- enable dbd, authn_dbd in default config - -* Thu Apr 14 2011 Joe Orton - 2.2.17-13 -- fix path expansion in service files - -* Tue Apr 12 2011 Joe Orton - 2.2.17-12 -- add systemd service files (#684175, thanks to Jóhann B. Guðmundsson) - -* Wed Mar 23 2011 Joe Orton - 2.2.17-11 -- minor updates to httpd.conf -- drop old patches - -* Wed Mar 2 2011 Joe Orton - 2.2.17-10 -- rebuild - -* Wed Feb 23 2011 Joe Orton - 2.2.17-9 -- use arch-specific mmn - -* Wed Feb 09 2011 Fedora Release Engineering - 2.2.17-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Mon Jan 31 2011 Joe Orton - 2.2.17-7 -- generate dummy mod_ssl cert with CA:FALSE constraint (#667841) -- add man page stubs for httpd.event, httpd.worker -- drop distcache support -- add STOP_TIMEOUT support to init script - -* Sat Jan 8 2011 Joe Orton - 2.2.17-6 -- update default SSLCipherSuite per upstream trunk - -* Wed Jan 5 2011 Joe Orton - 2.2.17-5 -- fix requires (#667397) - -* Wed Jan 5 2011 Joe Orton - 2.2.17-4 -- de-ghost /var/run/httpd - -* Tue Jan 4 2011 Joe Orton - 2.2.17-3 -- add tmpfiles.d configuration, ghost /var/run/httpd (#656600) - -* Sat Nov 20 2010 Joe Orton - 2.2.17-2 -- drop setuid bit, use capabilities for suexec binary - -* Wed Oct 27 2010 Joe Orton - 2.2.17-1 -- update to 2.2.17 - -* Fri Sep 10 2010 Joe Orton - 2.2.16-2 -- link everything using -z relro and -z now - -* Mon Jul 26 2010 Joe Orton - 2.2.16-1 -- update to 2.2.16 - -* Fri Jul 9 2010 Joe Orton - 2.2.15-3 -- default config tweaks: - * harden httpd.conf w.r.t. .htaccess restriction (#591293) - * load mod_substitute, mod_version by default - * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf - * add commented list of shipped-but-unloaded modules - * bump up worker defaults a little - * drop KeepAliveTimeout to 5 secs per upstream -- fix LSB compliance in init script (#522074) -- bundle NOTICE in -tools -- use init script in logrotate postrotate to pick up PIDFILE -- drop some old Obsoletes/Conflicts - -* Sun Apr 04 2010 Robert Scheck - 2.2.15-1 -- update to 2.2.15 (#572404, #579311) - diff --git a/httpd.sysusers b/httpd.sysusers new file mode 100644 index 0000000..26fe0e4 --- /dev/null +++ b/httpd.sysusers @@ -0,0 +1,2 @@ +g apache 48 +u apache 48 "Apache" /usr/share/httpd /sbin/nologin diff --git a/httpd.tmpfiles b/httpd.tmpfiles index f148886..a845ab5 100644 --- a/httpd.tmpfiles +++ b/httpd.tmpfiles @@ -1,2 +1,9 @@ d /run/httpd 710 root apache d /run/httpd/htcacheclean 700 apache apache +d /var/log/httpd 700 root root - +d /var/www 755 root root - +d /var/www/html 755 root root - +d /var/www/cgi-bin 755 root root - +d /var/lib/httpd 700 apache apache - +d /var/cache/httpd 700 apache apache - +d /var/cache/httpd/proxy 700 apache apache - diff --git a/httpd@.service b/httpd@.service new file mode 100644 index 0000000..8b20b90 --- /dev/null +++ b/httpd@.service @@ -0,0 +1,43 @@ +# This is a template for httpd instances. +# See httpd@.service(8) for more information. + +[Unit] +Description=The Apache HTTP Server +After=network.target remote-fs.target nss-lookup.target +Documentation=man:httpd@.service(8) + +[Service] +Type=notify +Environment=LANG=C +Environment=HTTPD_INSTANCE=%i +ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i +ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i +ExecStartPre=/bin/mkdir -m 700 -p /var/lib/httpd/instance-%i +ExecStartPre=/bin/chown apache.apache /var/lib/httpd/instance-%i +ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf +ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf +# Send SIGWINCH for graceful stop +KillSignal=SIGWINCH +KillMode=mixed +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes +OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native + +[Install] +WantedBy=multi-user.target diff --git a/index.html b/index.html deleted file mode 100644 index 7eff881..0000000 --- a/index.html +++ /dev/null @@ -1,132 +0,0 @@ - - - - - Test Page for the Apache HTTP Server on Fedora - - - - - -

Fedora Test Page

- -
-
-

This page is used to test the proper operation of the Apache HTTP server after it has been installed. If you can read this page, it means that the web server installed at this site is working properly, but has not yet been configured.

-
-
- -
-
-

If you are a member of the general public:

- -

The fact that you are seeing this page indicates that the website you just visited is either experiencing problems, or is undergoing routine maintenance.

- -

If you would like to let the administrators of this website know that you've seen this page instead of the page you expected, you should send them e-mail. In general, mail sent to the name "webmaster" and directed to the website's domain should reach the appropriate person.

- -

For example, if you experienced problems while visiting www.example.com, you should send e-mail to "webmaster@example.com".

- -

Fedora is a distribution of Linux, a popular computer operating system. It is commonly used by hosting companies because it is free, and includes free web server software. Many times, they do not set up their web server correctly, and it displays this "test page" instead of the expected website.

- -

Accordingly, please keep these facts in mind:

-
    -
  • Neither the Fedora Project or Red Hat has any affiliation with any website or content hosted from this server (unless otherwise explicitly stated).
    • -
  • Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.
    • -
- -

For more information about Fedora, please visit the Fedora Project website.

-
-
- -
-

If you are the website administrator:

- -

You may now add content to the directory /var/www/html/. Note that until you do so, people visiting your website will see this page, and not your content. To prevent this page from ever being used, follow the instructions in the file /etc/httpd/conf.d/welcome.conf.

- -
-

You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!

- -

[ Powered by Apache ] [ Powered by Fedora ]

-
-
-
-
- - diff --git a/instance.conf b/instance.conf new file mode 100644 index 0000000..074fb66 --- /dev/null +++ b/instance.conf @@ -0,0 +1,24 @@ +# +# This is an example instance-specific configuration file. See the +# httpd@.service(8) man page for detailed information on using the +# the httpd@.service with instances. +# +# To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf +# This config will then used as the default configuration when +# running: +# +# # systemctl start httpd@foobar.service +# +# The changes compared to the default are: +# - DefaultRuntime, DefaultStateDir and Pidfile renamed to instance-specific +# - default logfile names are prefixed with the instance name +# - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is) +# +# Further customisations will be required for an instance to run +# simultaneously to httpd.service under the default configuration, +# e.g. changing the port used with Listen. +# + +DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE} +DefaultStateDir /var/lib/httpd/instance-${HTTPD_INSTANCE} +PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid diff --git a/plans/all.fmf b/plans/all.fmf new file mode 100644 index 0000000..e98ae64 --- /dev/null +++ b/plans/all.fmf @@ -0,0 +1,6 @@ +summary: Test plan with all beakerlib tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/httpd.git +execute: + how: tmt diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf new file mode 100644 index 0000000..c181caa --- /dev/null +++ b/plans/tier1-public.fmf @@ -0,0 +1,7 @@ +summary: Public (Fedora) Tier1 beakerlib tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/httpd.git + filter: 'tier: 1' +execute: + how: tmt diff --git a/pullrev.sh b/pullrev.sh index d106968..a87d0dc 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,9 +7,9 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.26 +ver=$(rpm -q --specfile httpd.spec --qf '%{VERSION}\n' | sed 1q) prefix="httpd-${ver}" -suffix="r$1${2:++}" +suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" vcurl="http://svn.apache.org/viewvc?view=revision&revision=" @@ -23,8 +23,12 @@ fi new=0 for r in $*; do - if ! grep -q "${vcurl}${r}" ${fn}; then - echo "${vcurl}${r}" + case $r in + http*) url=$r ;; + *) url=${vcurl}${r} ;; + esac + if ! grep -q "^${url}" ${fn}; then + echo "${url}" new=1 fi done >> ${fn} @@ -35,10 +39,19 @@ prev=/dev/null for r in $*; do echo "+ fetching ${r}" this=`mktemp /tmp/pullrevXXXXXX` - svn diff -c ${r} ${repo} | filterdiff --remove-timestamps -x 'CHANGES' -x 'next-number' -x 'STATUS' \ - --addprefix="${prefix}/" > ${this} + case $r in + http*) curl -s "$r" | filterdiff --strip=3 ;; + *) svn diff -c ${r} ${repo} ;; + esac | filterdiff --remove-timestamps --clean \ + -x 'CHANGES' -x 'changes-entries/*.txt' \ + -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x '.github/*' \ + --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` - combinediff --quiet ${prev} ${this} > ${next} + if ! combinediff -w ${prev} ${this} > ${next}; then + echo "Failed combining previous ${prev} with ${this}"; + exit 1 + fi rm -f "${this}" [ "${prev}" = "/dev/null" ] || rm -f "${prev}" prev=${next} @@ -51,4 +64,3 @@ echo "+ git add ${fn}" git add "${fn}" echo "+ spec template:" echo "PatchN: ${fn}" -echo "%patchN -p1 -b .${suffix}" diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..7696d42 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,22 @@ +--- +badfuncs: + # mod_proxy uses inet_ntoa (safely) for IPv4 address matching, + # and APR interfaces for IPv6 addresses. + allowed: + /usr/lib*/httpd/modules/mod_proxy.so: + - inet_ntoa +upstream: + ignore: + - '*.xml' + - '*.service' + - '*.socket' + - '*.conf' + - '*.sysconf' + - '*.tmpfiles' + - 'README.*' + - '*.sysusers' + - '*.png' + - 'httpd-ssl-*' + - config.layout + - 'action*.sh' + - 'apachectl.*' diff --git a/server-status.conf b/server-status.conf new file mode 100644 index 0000000..be98f1b --- /dev/null +++ b/server-status.conf @@ -0,0 +1,10 @@ +# +# Lua-based server-status page; requires mod_lua to be loaded +# as per default configuration. +# +LuaMapHandler ^/server-status$ /usr/share/httpd/server-status/server-status.lua + + + AllowOverride None + Require local + diff --git a/sources b/sources index dafe33c..d84ddb9 100644 --- a/sources +++ b/sources @@ -1 +1,3 @@ -SHA512 (httpd-2.4.27.tar.bz2) = 7e7e8070715b74cb6890096a74e194f4c6a49c14bda685b1ad832e84312f1ac4316ea03a430e679502bfd8e1853aefa544ee002a20d0f7e994b9a590c74bc42c +SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b +SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd +SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 diff --git a/ssl.conf b/ssl.conf index a07bd8f..373b9e5 100644 --- a/ssl.conf +++ b/ssl.conf @@ -70,11 +70,10 @@ LogLevel warn SSLEngine on # List the protocol versions which clients are allowed to connect with. -# Disable SSLv3 by default (cf. RFC 7525 3.1.1). TLSv1 (1.0) should be -# disabled as quickly as practical. By the end of 2016, only the TLSv1.2 -# protocol or later should remain in use. -SSLProtocol all -SSLv3 -SSLProxyProtocol all -SSLv3 +# The OpenSSL system profile is configured by default. See +# update-crypto-policies(8) for more details. +#SSLProtocol all -SSLv3 +#SSLProxyProtocol all -SSLv3 # User agents such as web browsers are not configured for the user's # own preference of either security or performance, therefore this @@ -83,10 +82,10 @@ SSLProxyProtocol all -SSLv3 SSLHonorCipherOrder on # SSL Cipher Suite: -# List the ciphers that the client is permitted to negotiate. -# See the mod_ssl documentation for a complete list. -# The OpenSSL system profile is configured by default. See -# update-crypto-policies(8) for more details. +# List the ciphers that the client is permitted to negotiate. +# See the mod_ssl documentation for a complete list. +# The OpenSSL system profile is configured by default. See +# update-crypto-policies(8) for more details. SSLCipherSuite PROFILE=SYSTEM SSLProxyCipherSuite PROFILE=SYSTEM diff --git a/tests/ignore_tests.yml b/tests/ignore_tests.yml new file mode 100644 index 0000000..802bea0 --- /dev/null +++ b/tests/ignore_tests.yml @@ -0,0 +1,12 @@ +--- +# Tests that run in all contexts +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - smoke + required_packages: + - findutils # beakerlib needs find command + - which # smoke requires which command diff --git a/tests/smoke/Makefile b/tests/smoke/Makefile new file mode 100644 index 0000000..6abde94 --- /dev/null +++ b/tests/smoke/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/httpd/Sanity/smoke +# Description: Simple check of httpd test page +# Author: Branislav Nater +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/httpd/Sanity/smoke +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Branislav Nater " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Simple check of httpd test page" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: httpd" >> $(METADATA) + @echo "Requires: httpd mod_ssl" >> $(METADATA) + @echo "RhtsRequires: library(httpd/http)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/smoke/PURPOSE b/tests/smoke/PURPOSE new file mode 100644 index 0000000..510e749 --- /dev/null +++ b/tests/smoke/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/httpd/Sanity/smoke +Description: Simple check of httpd +Author: Branislav Nater diff --git a/tests/smoke/runtest.sh b/tests/smoke/runtest.sh new file mode 100755 index 0000000..f65c8ba --- /dev/null +++ b/tests/smoke/runtest.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Sanity/smoke +# Description: Simple check of httpd test page +# Author: Branislav Nater +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-httpd}" +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie + rlAssertRpm --all + rlFileBackup --clean ${httpCONFDIR}/conf/ + rlFileBackup --clean ${httpCONFDIR}/conf.d/ + rlFileBackup --clean ${httpCONFDIR}/conf.modules.d/ + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun "httpStart" 0 "Start httpd" + rlRun "httpStatus" 0 "Check status" + rlRun "httpStop" 0 "Stop httpd" + + rlRun "httpSecureStart" 0 "Start httpd with ssl" + rlRun "httpInstallCa $(hostname)" 0 "Install CA" + rlRun "httpSecureStatus" 0 "Check status" + rlRun "httpRemoveCa" 0 "Remove CA" + rlRun "httpSecureStop" 0 "Stop httpd with ssl" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rlFileRestore" 0 "Restoring original configuration" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalEnd +rlJournalPrintText diff --git a/welcome.conf b/welcome.conf index 5d1e452..232c251 100644 --- a/welcome.conf +++ b/welcome.conf @@ -16,3 +16,5 @@ Alias /.noindex.html /usr/share/httpd/noindex/index.html +Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png +Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png