From da6a8406bd597edab5d91e5ed848673464b70fb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 28 Mar 2017 13:19:31 +0200
Subject: [PATCH 01/20] Resolves: #1434916 - httpd.service: Failed with result
 timeout

---
 httpd-2.4.25-r1787141.patch | 103 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 ++-
 2 files changed, 109 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.25-r1787141.patch

diff --git a/httpd-2.4.25-r1787141.patch b/httpd-2.4.25-r1787141.patch
new file mode 100644
index 0000000..012bc13
--- /dev/null
+++ b/httpd-2.4.25-r1787141.patch
@@ -0,0 +1,103 @@
+diff --git a/modules/http2/h2_workers.c b/modules/http2/h2_workers.c
+index 1dcfb2f..cbaf1bc 100644
+--- a/modules/http2/h2_workers.c
++++ b/modules/http2/h2_workers.c
+@@ -235,6 +235,28 @@ static apr_status_t h2_workers_start(h2_workers *workers)
+     return status;
+ }
+ 
++static apr_status_t workers_pool_cleanup(void *data)
++{
++    h2_workers *workers = data;
++    h2_worker *w;
++    
++    if (!workers->aborted) {
++        workers->aborted = 1;
++
++        /* before we go, cleanup any zombies and abort the rest */
++        cleanup_zombies(workers, 1);
++        w = H2_WORKER_LIST_FIRST(&workers->workers);
++        while (w != H2_WORKER_LIST_SENTINEL(&workers->workers)) {
++            h2_worker_abort(w);
++            w = H2_WORKER_NEXT(w);
++        }
++        apr_thread_mutex_lock(workers->lock);
++        apr_thread_cond_broadcast(workers->mplx_added);
++        apr_thread_mutex_unlock(workers->lock);
++    }
++    return APR_SUCCESS;
++}
++
+ h2_workers *h2_workers_create(server_rec *s, apr_pool_t *server_pool,
+                               int min_workers, int max_workers,
+                               apr_size_t max_tx_handles)
+@@ -283,50 +305,20 @@ h2_workers *h2_workers_create(server_rec *s, apr_pool_t *server_pool,
+         if (status == APR_SUCCESS) {
+             status = apr_thread_cond_create(&workers->mplx_added, workers->pool);
+         }
+-        
+         if (status == APR_SUCCESS) {
+             status = apr_thread_mutex_create(&workers->tx_lock,
+                                              APR_THREAD_MUTEX_DEFAULT,
+                                              workers->pool);
+         }
+-        
+         if (status == APR_SUCCESS) {
+             status = h2_workers_start(workers);
+         }
+-        
+-        if (status != APR_SUCCESS) {
+-            h2_workers_destroy(workers);
+-            workers = NULL;
++        if (status == APR_SUCCESS) {
++            apr_pool_pre_cleanup_register(pool, workers, workers_pool_cleanup);    
++            return workers;
+         }
+     }
+-    return workers;
+-}
+-
+-void h2_workers_destroy(h2_workers *workers)
+-{
+-    /* before we go, cleanup any zombie workers that may have accumulated */
+-    cleanup_zombies(workers, 1);
+-    
+-    if (workers->mplx_added) {
+-        apr_thread_cond_destroy(workers->mplx_added);
+-        workers->mplx_added = NULL;
+-    }
+-    if (workers->lock) {
+-        apr_thread_mutex_destroy(workers->lock);
+-        workers->lock = NULL;
+-    }
+-    while (!H2_MPLX_LIST_EMPTY(&workers->mplxs)) {
+-        h2_mplx *m = H2_MPLX_LIST_FIRST(&workers->mplxs);
+-        H2_MPLX_REMOVE(m);
+-    }
+-    while (!H2_WORKER_LIST_EMPTY(&workers->workers)) {
+-        h2_worker *w = H2_WORKER_LIST_FIRST(&workers->workers);
+-        H2_WORKER_REMOVE(w);
+-    }
+-    if (workers->pool) {
+-        apr_pool_destroy(workers->pool);
+-        /* workers is gone */
+-    }
++    return NULL;
+ }
+ 
+ apr_status_t h2_workers_register(h2_workers *workers, struct h2_mplx *m)
+diff --git a/modules/http2/h2_workers.h b/modules/http2/h2_workers.h
+index ae7b4d8..b96cff3 100644
+--- a/modules/http2/h2_workers.h
++++ b/modules/http2/h2_workers.h
+@@ -67,10 +67,6 @@ h2_workers *h2_workers_create(server_rec *s, apr_pool_t *pool,
+                               int min_size, int max_size, 
+                               apr_size_t max_tx_handles);
+ 
+-/* Destroy the worker pool and all its threads. 
+- */
+-void h2_workers_destroy(h2_workers *workers);
+-
+ /**
+  * Registers a h2_mplx for task scheduling. If this h2_mplx runs
+  * out of tasks, it will be automatically be unregistered. Should
diff --git a/httpd.spec b/httpd.spec
index 6d764c6..f7e5631 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.25
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -66,6 +66,7 @@ Patch35: httpd-2.4.17-sslciphdefault.patch
 Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 Patch58: httpd-2.4.25-r1778319+.patch
+Patch59: httpd-2.4.25-r1787141.patch
 # Security fixes
 
 License: ASL 2.0
@@ -213,6 +214,7 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1778319+
+%patch59 -p1 -b .r1787141
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -684,6 +686,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Mar 28 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.25-5
+- Resolves: #1434916 - httpd.service: Failed with result timeout
+
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.25-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 

From 8953e641574976a5050d7da5ee3c88fb2c78ec21 Mon Sep 17 00:00:00 2001
From: "Jeroen van Meeuwen (Ergo Project)"
 <jeroen.van.meeuwen@ergo-project.org>
Date: Thu, 21 Sep 2017 19:28:15 +0200
Subject: [PATCH 02/20] Address CVE-2017-9798 by applying upstream patch

Reference RHBZ #1490344
---
 httpd-2.4.27-CVE-2017-9798.patch | 15 +++++++++++++++
 httpd.spec                       |  7 ++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
new file mode 100644
index 0000000..be590f2
--- /dev/null
+++ b/httpd-2.4.27-CVE-2017-9798.patch
@@ -0,0 +1,15 @@
+--- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
++++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
+@@ -2266,6 +2266,12 @@
+             /* method has not been registered yet, but resource restriction
+              * is always checked before method handling, so register it.
+              */
++            if (cmd->pool == cmd->temp_pool) {
++                /* In .htaccess, we can't globally register new methods. */
++                return apr_psprintf(cmd->pool, "Could not register method '%s' "
++                                   "for %s from .htaccess configuration",
++                                    method, cmd->cmd->name);
++            }
+             methnum = ap_method_register(cmd->pool,
+                                          apr_pstrdup(cmd->pool, method));
+         }
diff --git a/httpd.spec b/httpd.spec
index 81f556e..29805bc 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: http://httpd.apache.org/
 Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -67,6 +67,7 @@ Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
+Patch59: httpd-2.4.27-CVE-2017-9798.patch
 # Security fixes
 
 License: ASL 2.0
@@ -213,6 +214,7 @@ interface for storing and accessing per-user session data.
 %patch56 -p1 -b .uniqueid
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
+%patch59 -p4 -b .cve-2017-9798
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -692,6 +694,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
+- Address CVE-2017-9798 by applying patch from upstream (#1490344)
+
 * Wed Jul 12 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.27-2
 - Resolves: #1469959 - httpd update cleaned out /etc/sysconfig
 

From 0cea9da48f64d0ee51f5f90e9b7f9ad008964ab7 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:02:32 +0100
Subject: [PATCH 03/20] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 29805bc..c9792bb 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -631,8 +631,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_unitdir}/*.service
 %{_unitdir}/*.socket
-%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
-%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files filesystem
 %dir %{_sysconfdir}/httpd
@@ -694,6 +692,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
+- move httpd.service.d, httpd.socket.d dirs to -filesystem
+
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
 

From 0c9804fc74c9c8df33af1f18f16d50d1a5c2484d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 10:08:07 +0100
Subject: [PATCH 04/20] move httpd.service.d, httpd.socket.d dirs to
 -filesystem

---
 httpd.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/httpd.spec b/httpd.spec
index c9792bb..f6da380 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -641,6 +641,8 @@ rm -rf $RPM_BUILD_ROOT
 %dir %{docroot}/html
 %dir %{contentdir}
 %dir %{contentdir}/icons
+%attr(755,root,root) %dir %{_unitdir}/httpd.service.d
+%attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
 
 %files tools
 %defattr(-,root,root)

From 1557b7a661f55b2522a5edae8bb91d7dd910dbe9 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 4 Aug 2017 13:19:55 +0100
Subject: [PATCH 05/20] Switch to https:// URLs.

---
 httpd.spec | 6 +++---
 index.html | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index f6da380..f3c95f0 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,9 +8,9 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 3%{?dist}
-URL: http://httpd.apache.org/
-Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
+Release: 6%{?dist}
+URL: https://httpd.apache.org/
+Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
 Source4: httpd-ssl-pass-dialog
diff --git a/index.html b/index.html
index 7eff881..943f060 100644
--- a/index.html
+++ b/index.html
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="http://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From ed8864968f14b8ec60f6e97db3ecb03f605ea0ae Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 13 Sep 2017 14:21:17 +0100
Subject: [PATCH 06/20] add new content-length filter (upstream PR 61222)

---
 .gitignore                  |   2 +-
 httpd-2.4.27-r1808230.patch | 131 ++++++++++++++++++++++++++++++++++++
 httpd.spec                  |   7 +-
 pullrev.sh                  |   4 +-
 4 files changed, 139 insertions(+), 5 deletions(-)
 create mode 100644 httpd-2.4.27-r1808230.patch

diff --git a/.gitignore b/.gitignore
index 19a3666..e364382 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,7 +10,7 @@ x86_64
 /httpd-2.2.21.tar.bz2
 /clog
 /httpd-2.2.22.tar.bz2
-/httpd-2.4.?
+/httpd-2.4.??/
 /httpd-2.4.2.tar.bz2
 /httpd-2.4.3.tar.bz2
 /httpd-2.4.4.tar.bz2
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
new file mode 100644
index 0000000..e4062ea
--- /dev/null
+++ b/httpd-2.4.27-r1808230.patch
@@ -0,0 +1,131 @@
+# ./pullrev.sh 1808230
+http://svn.apache.org/viewvc?view=revision&revision=1808230
+
+--- httpd-2.4.27/server/protocol.c
++++ httpd-2.4.27/server/protocol.c
+@@ -1708,62 +1708,88 @@
+         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+     }
+ 
+-    /* Loop through this set of buckets to compute their length
+-     */
++    /* Loop through the brigade to count the length. To avoid
++     * arbitrary memory consumption with morphing bucket types, this
++     * loop will stop and pass on the brigade when necessary. */
+     e = APR_BRIGADE_FIRST(b);
+     while (e != APR_BRIGADE_SENTINEL(b)) {
++        apr_status_t rv;
++
+         if (APR_BUCKET_IS_EOS(e)) {
+             eos = 1;
+             break;
+         }
+-        if (e->length == (apr_size_t)-1) {
++        /* For a flush bucket, fall through to pass the brigade and
++         * flush now. */
++        else if (APR_BUCKET_IS_FLUSH(e)) {
++            e = APR_BUCKET_NEXT(e);
++        }
++        /* For metadata bucket types other than FLUSH, loop. */
++        else if (APR_BUCKET_IS_METADATA(e)) {
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For determinate length data buckets, count the length and
++         * continue. */
++        else if (e->length != (apr_size_t)-1) {
++            r->bytes_sent += e->length;
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For indeterminate length data buckets, perform one read. */
++        else /* e->length == (apr_size_t)-1 */ {
+             apr_size_t len;
+             const char *ignored;
+-            apr_status_t rv;
+-
+-            /* This is probably a pipe bucket.  Send everything
+-             * prior to this, and then read the data for this bucket.
+-             */
++        
+             rv = apr_bucket_read(e, &ignored, &len, eblock);
++            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
++                              "ap_content_length_filter: "
++                              "apr_bucket_read() failed");
++                return rv;
++            }
+             if (rv == APR_SUCCESS) {
+-                /* Attempt a nonblocking read next time through */
+                 eblock = APR_NONBLOCK_READ;
++                e = APR_BUCKET_NEXT(e);
+                 r->bytes_sent += len;
+             }
+             else if (APR_STATUS_IS_EAGAIN(rv)) {
+-                /* Output everything prior to this bucket, and then
+-                 * do a blocking read on the next batch.
+-                 */
+-                if (e != APR_BRIGADE_FIRST(b)) {
+-                    apr_bucket *flush;
+-                    apr_brigade_split_ex(b, e, ctx->tmpbb);
+-                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
++                apr_bucket *flush;
+ 
+-                    APR_BRIGADE_INSERT_TAIL(b, flush);
+-                    rv = ap_pass_brigade(f->next, b);
+-                    if (rv != APR_SUCCESS || f->c->aborted) {
+-                        return rv;
+-                    }
+-                    apr_brigade_cleanup(b);
+-                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
+-                    e = APR_BRIGADE_FIRST(b);
++                /* Next read must block. */
++                eblock = APR_BLOCK_READ;
+ 
+-                    ctx->data_sent = 1;
+-                }
+-                eblock = APR_BLOCK_READ;
+-                continue;
++                /* Ensure the last bucket to pass down is a flush if
++                 * the next read will block. */
++                flush = apr_bucket_flush_create(f->c->bucket_alloc);
++                APR_BUCKET_INSERT_BEFORE(e, flush);
+             }
+-            else {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
+-                              "ap_content_length_filter: "
+-                              "apr_bucket_read() failed");
+-                return rv;
+-            }
+         }
+-        else {
+-            r->bytes_sent += e->length;
++
++        /* Optimization: if the next bucket is EOS (directly after a
++         * bucket morphed to the heap, or a flush), short-cut to
++         * handle EOS straight away - allowing C-L to be determined
++         * for content which is already entirely in memory. */
++        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
++            continue;
+         }
+-        e = APR_BUCKET_NEXT(e);
++
++        /* On reaching here, pass on everything in the brigade up to
++         * this point. */
++        apr_brigade_split_ex(b, e, ctx->tmpbb);
++        
++        rv = ap_pass_brigade(f->next, b);
++        if (rv != APR_SUCCESS) {
++            return rv;
++        }
++        else if (f->c->aborted) {
++            return APR_ECONNABORTED;
++        }
++        apr_brigade_cleanup(b);
++        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
++        e = APR_BRIGADE_FIRST(b);
++        
++        ctx->data_sent = 1;
+     }
+ 
+     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd.spec b/httpd.spec
index f3c95f0..86bad76 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 6%{?dist}
+Release: 7%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -68,6 +68,7 @@ Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
 Patch59: httpd-2.4.27-CVE-2017-9798.patch
+Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
 License: ASL 2.0
@@ -215,6 +216,7 @@ interface for storing and accessing per-user session data.
 %patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
 %patch59 -p4 -b .cve-2017-9798
+%patch60 -p1 -b .r1808230
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -694,8 +696,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-8.1
+* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3.1
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
+- add new content-length filter (upstream PR 61222)
 
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)
diff --git a/pullrev.sh b/pullrev.sh
index d106968..c366613 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.26
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.27
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"

From 129d56ab3fc4e6b1a8e93737dfae52e05f913974 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:36:38 +0100
Subject: [PATCH 07/20] Update links to Fedora home page.

---
 index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 943f060..1b7ea03 100644
--- a/index.html
+++ b/index.html
@@ -111,7 +111,7 @@
 					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
 					</ul>
 
-					<p>For more information about Fedora, please visit the <a href="http://fedoraproject.org/">Fedora Project website</a>.</p>
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
 					<hr />
 				</div>
 
@@ -123,7 +123,7 @@
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

From 35f1318a481b6e353f1749fa72df84ce5e408f73 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 19 Sep 2017 12:46:35 +0100
Subject: [PATCH 08/20] httpd.service(5) update: show how to ungracefully
 stop/restart

---
 httpd.service.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/httpd.service.xml b/httpd.service.xml
index d03e133..8f82e59 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -143,6 +143,11 @@ Wants=network-online.target</programlisting>
       which terminates the server only once active connections have
       been processed.</para>
 
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
     </refsect2>
 
     <refsect2>

From e0e3d5e91caf82d9893aeefd732aac21e92f55c2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 18 Jul 2017 09:25:14 +0100
Subject: [PATCH 09/20] update mod_systemd (r1802251)

---
 httpd-2.4.26-r1800306.patch                   | 86 -------------------
 ...ystemd.patch => httpd-2.4.27-systemd.patch | 40 ++++++---
 httpd.spec                                    |  3 +-
 3 files changed, 30 insertions(+), 99 deletions(-)
 delete mode 100644 httpd-2.4.26-r1800306.patch
 rename httpd-2.4.10-mod_systemd.patch => httpd-2.4.27-systemd.patch (79%)

diff --git a/httpd-2.4.26-r1800306.patch b/httpd-2.4.26-r1800306.patch
deleted file mode 100644
index 4a8bc2d..0000000
--- a/httpd-2.4.26-r1800306.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-# ./pullrev.sh 1800306
-
-http://svn.apache.org/viewvc?view=revision&revision=1800306
-
-diff -uap httpd-2.4.26/modules/mappers/mod_actions.c.r1800306 httpd-2.4.26/modules/mappers/mod_actions.c
---- httpd-2.4.26/modules/mappers/mod_actions.c.r1800306
-+++ httpd-2.4.26/modules/mappers/mod_actions.c
-@@ -186,8 +186,7 @@
-         ap_field_noparam(r->pool, r->content_type);
- 
-     if (action && (t = apr_table_get(conf->action_types, action))) {
--        int virtual = (*t++ == '0' ? 0 : 1);
--        if (!virtual && r->finfo.filetype == APR_NOFILE) {
-+        if (*t++ == '0' && r->finfo.filetype == APR_NOFILE) {
-             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00652)
-                           "File does not exist: %s", r->filename);
-             return HTTP_NOT_FOUND;
-@@ -198,9 +197,6 @@
-          * (will be REDIRECT_HANDLER there)
-          */
-         apr_table_setn(r->subprocess_env, "HANDLER", action);
--        if (virtual) {
--            apr_table_setn(r->notes, "virtual_script", "1");
--        }
-     }
- 
-     if (script == NULL)
-diff -uap httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306 httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
---- httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c.r1800306
-+++ httpd-2.4.26/modules/proxy/mod_proxy_fcgi.c
-@@ -321,7 +321,6 @@
-     apr_status_t rv;
-     apr_size_t avail_len, len, required_len;
-     int next_elem, starting_elem;
--    int fpm = 0;
-     fcgi_req_config_t *rconf = ap_get_module_config(r->request_config, &proxy_fcgi_module);
-     fcgi_dirconf_t *dconf = ap_get_module_config(r->per_dir_config, &proxy_fcgi_module);
- 
-@@ -354,8 +353,6 @@
-                     *qs = '\0';
-                 }
-             }
--        } else {
--            fpm = 1;
-         }
- 
-         if (newfname) {
-@@ -364,38 +361,9 @@
-         }
-     }
- 
--#if 0
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->filename: %s", (r->filename ? r->filename : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->uri: %s", (r->uri ? r->uri : "nil"));
--    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(09999)
--                  "r->path_info: %s", (r->path_info ? r->path_info : "nil"));
--#endif
--
-     ap_add_common_vars(r);
-     ap_add_cgi_vars(r);
- 
--    if (fpm || apr_table_get(r->notes, "virtual_script")) {
--        /*
--         * Adjust SCRIPT_NAME, PATH_INFO and PATH_TRANSLATED for PHP-FPM
--         * TODO: Right now, PATH_INFO and PATH_TRANSLATED look OK...
--         */
--        const char *pend;
--        const char *script_name = apr_table_get(r->subprocess_env, "SCRIPT_NAME");
--        pend = script_name + strlen(script_name);
--        if (r->path_info && *r->path_info) {
--            pend = script_name + ap_find_path_info(script_name, r->path_info) - 1;
--        }
--        while (pend != script_name && *pend != '/') {
--            pend--;
--        }
--        apr_table_setn(r->subprocess_env, "SCRIPT_NAME", pend);
--        ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r,
--                      "fpm:virtual_script: Modified SCRIPT_NAME to: %s",
--                      pend);
--    }
--
-     /* XXX are there any FastCGI specific env vars we need to send? */
- 
-     /* Give admins final option to fine-tune env vars */
diff --git a/httpd-2.4.10-mod_systemd.patch b/httpd-2.4.27-systemd.patch
similarity index 79%
rename from httpd-2.4.10-mod_systemd.patch
rename to httpd-2.4.27-systemd.patch
index 88d76ac..26aac48 100644
--- a/httpd-2.4.10-mod_systemd.patch
+++ b/httpd-2.4.27-systemd.patch
@@ -1,8 +1,10 @@
-diff --git a/modules/arch/unix/config5.m4 b/modules/arch/unix/config5.m4
-index 77027a8..7a13d5a 100644
---- a/modules/arch/unix/config5.m4
-+++ b/modules/arch/unix/config5.m4
-@@ -18,6 +18,16 @@ APACHE_MODULE(privileges, Per-virtualhost Unix UserIDs and enhanced security for
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+--- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.27/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
    fi
  ])
  
@@ -19,12 +21,10 @@ index 77027a8..7a13d5a 100644
  APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
  
  APACHE_MODPATH_FINISH
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-new file mode 100644
-index 0000000..5381c98
---- /dev/null
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -0,0 +1,145 @@
+diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
+--- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,161 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@@ -66,11 +66,20 @@ index 0000000..5381c98
 +static unsigned long bytes_served;
 +static pid_t mainpid;
 +
++static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
++                              apr_pool_t *ptemp)
++{
++    sd_notify(0,
++              "RELOADING=1\n"
++              "STATUS=Reading configuration...\n");
++    ap_extended_status = 1;
++    return OK;
++}
++
 +static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
 +{
 +    int rv;
 +
-+    ap_extended_status = 1;
 +    mainpid = getpid();
 +
 +    rv = sd_notifyf(0, "READY=1\n"
@@ -91,6 +100,11 @@ index 0000000..5381c98
 +    char bps[5];
 +    int rv;
 +
++    if (!ap_extended_status) {
++        /* Nothing useful to report if ExtendedStatus disabled. */
++        return DECLINED;
++    }
++    
 +    ap_get_sload(&sload);
 +    /* up_time in seconds */
 +    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
@@ -136,6 +150,8 @@ index 0000000..5381c98
 +
 +static void systemd_register_hooks(apr_pool_t *p)
 +{
++    /* Enable ap_extended_status. */
++    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
 +    /* We know the PID in this hook ... */
 +    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
 +    /* Used to update httpd's status line using sd_notifyf */
diff --git a/httpd.spec b/httpd.spec
index 86bad76..1e3abf6 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -57,7 +57,7 @@ Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.10-mod_systemd.patch
+Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
@@ -699,6 +699,7 @@ rm -rf $RPM_BUILD_ROOT
 * Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3.1
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 - add new content-length filter (upstream PR 61222)
+- update mod_systemd (r1802251)
 
 * Thu Sep 21 2017 Jeroen van Meeuwen <kanarip@fedoraproject.org> - 2.4.27-3
 - Address CVE-2017-9798 by applying patch from upstream (#1490344)

From 7c50471725536b88b7bd0cfc23d397dc81ca4ea8 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Jul 2017 12:55:47 +0100
Subject: [PATCH 10/20] Fix grammar.

---
 httpd.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.service b/httpd.service
index 1f707e8..011df3b 100644
--- a/httpd.service
+++ b/httpd.service
@@ -3,7 +3,7 @@
 # Modifying this file in-place is not recommended, because changes
 # will be overwritten during package upgrades.  If you want to
 # customize the behaviour, the best way is to use "systemctl edit"
-# command to create an override unit.
+# to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by

From c96d33c29448223b65d68b1cd21dd4734acd4437 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Fri, 14 Jul 2017 12:57:27 +0100
Subject: [PATCH 11/20] Shorter text in httpd.service.

---
 httpd.service | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/httpd.service b/httpd.service
index 011df3b..1b779e9 100644
--- a/httpd.service
+++ b/httpd.service
@@ -1,9 +1,8 @@
 # See httpd.service(8) for more information on using the httpd service.
 
 # Modifying this file in-place is not recommended, because changes
-# will be overwritten during package upgrades.  If you want to
-# customize the behaviour, the best way is to use "systemctl edit"
-# to create an override unit.
+# will be overwritten during package upgrades.  To customize the
+# behaviour, run "systemctl edit httpd" to create an override unit.
 
 # For example, to pass additional options (such as -D definitions) to
 # the httpd binary at startup, create an override unit (as is done by

From 4f4a88bbca916c3aec829af113dc13bc54eb54be Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 9 Oct 2017 17:36:00 +0100
Subject: [PATCH 12/20] Fix changelog chronology.

---
 httpd.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 1e3abf6..684d071 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -696,7 +696,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Sep 19 2017 Joe Orton <jorton@redhat.com> - 2.4.27-3.1
+* Mon Oct  9 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 - add new content-length filter (upstream PR 61222)
 - update mod_systemd (r1802251)

From 41db69f9b8fcb76650e41bc356f505629dd40dfd Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Tue, 10 Oct 2017 13:31:46 +0200
Subject: [PATCH 13/20] Backport patch for fixing ticket key usage

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
---
 httpd-2.4.27-fixticketkeys.patch | 65 ++++++++++++++++++++++++++++++++
 httpd.spec                       | 10 ++++-
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.27-fixticketkeys.patch

diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
new file mode 100644
index 0000000..3769da9
--- /dev/null
+++ b/httpd-2.4.27-fixticketkeys.patch
@@ -0,0 +1,65 @@
+From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Tue, 22 Mar 2016 13:09:17 +0000
+Subject: [PATCH] mod_ssl: return non ambigous value in
+ ssl_callback_SessionTicket() for encryption mode (we used to return 0,
+ OpenSSL documents returning 1 instead).
+
+Practically this does not change anything since OpenSSL will only check for
+>= 0 return value (non error) for encryption mode (the other possible return
+values are only relevant for decryption mode).
+
+However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
+states:
+"
+The return value of the cb function is used by OpenSSL to determine what
+further processing will occur. The following return values have meaning:
+
+2
+    This indicates that the ctx and hctx have been set and the session can
+    continue on those parameters. Additionally it indicates that the session
+    ticket is in a renewal period and should be replaced. The OpenSSL library
+    will call cb again with an enc argument of 1 to set the new ticket (see
+    RFC5077 3.3 paragraph 2).
+
+1
+    This indicates that the ctx and hctx have been set and the session can
+    continue on those parameters.
+
+0
+    This indicates that it was not possible to set/retrieve a session ticket
+    and the SSL/TLS session will continue by by negotiating a set of
+    cryptographic parameters or using the alternate SSL/TLS resumption
+    mechanism, session ids.
+    If called with enc equal to 0 the library will call the cb again to get a
+    new set of parameters.
+
+less than 0
+    This indicates an error.
+"
+
+So 0 is not appropriate in our code, 1 is what we really want (and it won't
+break if OpenSSL later changes its checks on the callback return value).
+
+Reported by: oknet on github, pull request #18.
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/ssl/ssl_engine_kernel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
+index 91da94c4f58..91d5e926d66 100644
+--- a/modules/ssl/ssl_engine_kernel.c
++++ b/modules/ssl/ssl_engine_kernel.c
+@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
+                       "TLS session ticket key for %s successfully set, "
+                       "creating new session ticket", sc->vhost_id);
+ 
+-        return 0;
++        return 1;
+     }
+     else if (mode == 0) {
+         /* 
diff --git a/httpd.spec b/httpd.spec
index 684d071..d0564d3 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 7%{?dist}
+Release: 8%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -71,6 +71,9 @@ Patch59: httpd-2.4.27-CVE-2017-9798.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
+# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
+Patch61: httpd-2.4.27-fixticketkeys.patch
+
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -218,6 +221,8 @@ interface for storing and accessing per-user session data.
 %patch59 -p4 -b .cve-2017-9798
 %patch60 -p1 -b .r1808230
 
+%patch61 -p1 -b .ticketkeys
+
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 
@@ -696,6 +701,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.27-8
+- Backport patch for fixing ticket key usage
+
 * Mon Oct  9 2017 Joe Orton <jorton@redhat.com> - 2.4.27-7
 - move httpd.service.d, httpd.socket.d dirs to -filesystem
 - add new content-length filter (upstream PR 61222)

From ff612b7eda5a2d2002bf31038e9348362ebfa3ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Tue, 10 Oct 2017 16:06:57 +0200
Subject: [PATCH 14/20] new version 2.4.28

---
 .gitignore                           |  1 +
 httpd-2.4.10-sigint.patch            | 28 ----------------------------
 httpd-2.4.17-socket-activation.patch | 19 +++++++++----------
 httpd-2.4.27-CVE-2017-9798.patch     | 15 ---------------
 httpd.spec                           | 11 +++++------
 sources                              |  2 +-
 6 files changed, 16 insertions(+), 60 deletions(-)
 delete mode 100644 httpd-2.4.10-sigint.patch
 delete mode 100644 httpd-2.4.27-CVE-2017-9798.patch

diff --git a/.gitignore b/.gitignore
index e364382..2f07a6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,4 @@ x86_64
 /httpd.service.8
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
+/httpd-2.4.28.tar.bz2
diff --git a/httpd-2.4.10-sigint.patch b/httpd-2.4.10-sigint.patch
deleted file mode 100644
index ecdd82e..0000000
--- a/httpd-2.4.10-sigint.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
-index 559f90a..a386a75 100644
---- a/server/mpm/prefork/prefork.c
-+++ b/server/mpm/prefork/prefork.c
-@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
- {
-     retained->mpm->mpm_state = AP_MPMQ_STOPPING;
- 
-+    apr_signal(SIGHUP, SIG_IGN);
-+    apr_signal(SIGTERM, SIG_IGN);
-+
-     if (pchild) {
-         apr_pool_destroy(pchild);
-     }
-@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
-          */
-         apr_signal(SIGHUP, just_die);
-         apr_signal(SIGTERM, just_die);
-+        /* Ignore SIGINT in child. This fixes race-condition in signals
-+         * handling when httpd is runnning on foreground and user hits ctrl+c.
-+         * In this case, SIGINT is sent to all children followed by SIGTERM
-+         * from the main process, which interrupts the SIGINT handler and
-+         * leads to inconsistency.
-+         */
-+        apr_signal(SIGINT, SIG_IGN);
-         /* The child process just closes listeners on AP_SIG_GRACEFUL.
-          * The pod is used for signalling the graceful restart.
-          */
diff --git a/httpd-2.4.17-socket-activation.patch b/httpd-2.4.17-socket-activation.patch
index d5cbdf2..dbdd80c 100644
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.17-socket-activation.patch
@@ -1,5 +1,5 @@
 diff --git a/server/listen.c b/server/listen.c
-index 1d9be83..f5f7754 100644
+index a8e9e6f..1a6c1d3 100644
 --- a/server/listen.c
 +++ b/server/listen.c
 @@ -34,6 +34,10 @@
@@ -100,11 +100,10 @@ index 1d9be83..f5f7754 100644
      }
  
  #ifdef WIN32
-@@ -277,6 +286,124 @@ static apr_status_t close_listeners_on_exec(void *v)
-     return APR_SUCCESS;
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
  }
  
-+
 +#ifdef HAVE_SYSTEMD
 +
 +static int find_systemd_socket(process_rec * process, apr_port_t port) {
@@ -222,10 +221,10 @@ index 1d9be83..f5f7754 100644
 +
 +#endif /* HAVE_SYSTEMD */
 +
- static const char *alloc_listener(process_rec *process, char *addr,
+ static const char *alloc_listener(process_rec *process, const char *addr,
                                    apr_port_t port, const char* proto,
                                    void *slave)
-@@ -479,7 +606,7 @@ static int open_listeners(apr_pool_t *pool)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
                  }
              }
  #endif
@@ -234,7 +233,7 @@ index 1d9be83..f5f7754 100644
                  ++num_open;
              }
              else {
-@@ -591,8 +718,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
          }
      }
  
@@ -265,7 +264,7 @@ index 1d9be83..f5f7754 100644
      }
  
      for (lr = ap_listeners; lr; lr = lr->next) {
-@@ -682,7 +829,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
                              duplr->bind_addr);
                  return stat;
              }
@@ -274,7 +273,7 @@ index 1d9be83..f5f7754 100644
  #if AP_NONBLOCK_WHEN_MULTI_LISTEN
              use_nonblock = (ap_listeners && ap_listeners->next);
              stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
-@@ -809,6 +956,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
      if (argc < 1 || argc > 2) {
          return "Listen requires 1 or 2 arguments.";
      }
@@ -286,7 +285,7 @@ index 1d9be83..f5f7754 100644
  
      rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
      if (rv != APR_SUCCESS) {
-@@ -840,6 +992,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
          ap_str_tolower(proto);
      }
  
diff --git a/httpd-2.4.27-CVE-2017-9798.patch b/httpd-2.4.27-CVE-2017-9798.patch
deleted file mode 100644
index be590f2..0000000
--- a/httpd-2.4.27-CVE-2017-9798.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- httpd/httpd/branches/2.4.x/server/core.c	2017/08/16 16:50:29	1805223
-+++ httpd/httpd/branches/2.4.x/server/core.c	2017/09/08 13:13:11	1807754
-@@ -2266,6 +2266,12 @@
-             /* method has not been registered yet, but resource restriction
-              * is always checked before method handling, so register it.
-              */
-+            if (cmd->pool == cmd->temp_pool) {
-+                /* In .htaccess, we can't globally register new methods. */
-+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
-+                                   "for %s from .htaccess configuration",
-+                                    method, cmd->cmd->name);
-+            }
-             methnum = ap_method_register(cmd->pool,
-                                          apr_pstrdup(cmd->pool, method));
-         }
diff --git a/httpd.spec b/httpd.spec
index d0564d3..379021a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,8 +7,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.27
-Release: 8%{?dist}
+Version: 2.4.28
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -64,10 +64,8 @@ Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
 Patch56: httpd-2.4.4-mod_unique_id.patch
-Patch57: httpd-2.4.10-sigint.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch59: httpd-2.4.27-CVE-2017-9798.patch
 Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
@@ -216,9 +214,7 @@ interface for storing and accessing per-user session data.
 %patch35 -p1 -b .sslciphdefault
 
 %patch56 -p1 -b .uniqueid
-%patch57 -p1 -b .sigint
 %patch58 -p1 -b .r1738878
-%patch59 -p4 -b .cve-2017-9798
 %patch60 -p1 -b .r1808230
 
 %patch61 -p1 -b .ticketkeys
@@ -701,6 +697,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Oct 10 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
+- new version 2.4.28
+
 * Tue Oct 10 2017 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.27-8
 - Backport patch for fixing ticket key usage
 
diff --git a/sources b/sources
index dafe33c..2db6285 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.27.tar.bz2) = 7e7e8070715b74cb6890096a74e194f4c6a49c14bda685b1ad832e84312f1ac4316ea03a430e679502bfd8e1853aefa544ee002a20d0f7e994b9a590c74bc42c
+SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a

From 7eca232f16fca8ef27cf94e1c45b3c4f63cd5447 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Wed, 25 Oct 2017 14:57:17 +0200
Subject: [PATCH 15/20] new version 2.4.29

---
 .gitignore                       |   1 +
 httpd-2.4.27-fixticketkeys.patch |  65 ---------
 httpd-2.4.27-r1808230.patch      | 131 -----------------
 httpd-2.4.4-mod_unique_id.patch  | 239 -------------------------------
 httpd.spec                       |  14 +-
 sources                          |   2 +-
 6 files changed, 6 insertions(+), 446 deletions(-)
 delete mode 100644 httpd-2.4.27-fixticketkeys.patch
 delete mode 100644 httpd-2.4.27-r1808230.patch
 delete mode 100644 httpd-2.4.4-mod_unique_id.patch

diff --git a/.gitignore b/.gitignore
index 2f07a6e..b1c1924 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,4 @@ x86_64
 /httpd-2.4.26.tar.bz2
 /httpd-2.4.27.tar.bz2
 /httpd-2.4.28.tar.bz2
+/httpd-2.4.29.tar.bz2
diff --git a/httpd-2.4.27-fixticketkeys.patch b/httpd-2.4.27-fixticketkeys.patch
deleted file mode 100644
index 3769da9..0000000
--- a/httpd-2.4.27-fixticketkeys.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 4171fbfcb249e63f934471054d7a0752272fb8ee Mon Sep 17 00:00:00 2001
-From: Yann Ylavic <ylavic@apache.org>
-Date: Tue, 22 Mar 2016 13:09:17 +0000
-Subject: [PATCH] mod_ssl: return non ambigous value in
- ssl_callback_SessionTicket() for encryption mode (we used to return 0,
- OpenSSL documents returning 1 instead).
-
-Practically this does not change anything since OpenSSL will only check for
->= 0 return value (non error) for encryption mode (the other possible return
-values are only relevant for decryption mode).
-
-However the OpenSSL documentation for SSL_CTX_set_tlsext_ticket_key_cb()
-states:
-"
-The return value of the cb function is used by OpenSSL to determine what
-further processing will occur. The following return values have meaning:
-
-2
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters. Additionally it indicates that the session
-    ticket is in a renewal period and should be replaced. The OpenSSL library
-    will call cb again with an enc argument of 1 to set the new ticket (see
-    RFC5077 3.3 paragraph 2).
-
-1
-    This indicates that the ctx and hctx have been set and the session can
-    continue on those parameters.
-
-0
-    This indicates that it was not possible to set/retrieve a session ticket
-    and the SSL/TLS session will continue by by negotiating a set of
-    cryptographic parameters or using the alternate SSL/TLS resumption
-    mechanism, session ids.
-    If called with enc equal to 0 the library will call the cb again to get a
-    new set of parameters.
-
-less than 0
-    This indicates an error.
-"
-
-So 0 is not appropriate in our code, 1 is what we really want (and it won't
-break if OpenSSL later changes its checks on the callback return value).
-
-Reported by: oknet on github, pull request #18.
-
-
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736186 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/ssl/ssl_engine_kernel.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index 91da94c4f58..91d5e926d66 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -2303,7 +2303,7 @@ int ssl_callback_SessionTicket(SSL *ssl,
-                       "TLS session ticket key for %s successfully set, "
-                       "creating new session ticket", sc->vhost_id);
- 
--        return 0;
-+        return 1;
-     }
-     else if (mode == 0) {
-         /* 
diff --git a/httpd-2.4.27-r1808230.patch b/httpd-2.4.27-r1808230.patch
deleted file mode 100644
index e4062ea..0000000
--- a/httpd-2.4.27-r1808230.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-# ./pullrev.sh 1808230
-http://svn.apache.org/viewvc?view=revision&revision=1808230
-
---- httpd-2.4.27/server/protocol.c
-+++ httpd-2.4.27/server/protocol.c
-@@ -1708,62 +1708,88 @@
-         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
-     }
- 
--    /* Loop through this set of buckets to compute their length
--     */
-+    /* Loop through the brigade to count the length. To avoid
-+     * arbitrary memory consumption with morphing bucket types, this
-+     * loop will stop and pass on the brigade when necessary. */
-     e = APR_BRIGADE_FIRST(b);
-     while (e != APR_BRIGADE_SENTINEL(b)) {
-+        apr_status_t rv;
-+
-         if (APR_BUCKET_IS_EOS(e)) {
-             eos = 1;
-             break;
-         }
--        if (e->length == (apr_size_t)-1) {
-+        /* For a flush bucket, fall through to pass the brigade and
-+         * flush now. */
-+        else if (APR_BUCKET_IS_FLUSH(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+        }
-+        /* For metadata bucket types other than FLUSH, loop. */
-+        else if (APR_BUCKET_IS_METADATA(e)) {
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For determinate length data buckets, count the length and
-+         * continue. */
-+        else if (e->length != (apr_size_t)-1) {
-+            r->bytes_sent += e->length;
-+            e = APR_BUCKET_NEXT(e);
-+            continue;
-+        }
-+        /* For indeterminate length data buckets, perform one read. */
-+        else /* e->length == (apr_size_t)-1 */ {
-             apr_size_t len;
-             const char *ignored;
--            apr_status_t rv;
--
--            /* This is probably a pipe bucket.  Send everything
--             * prior to this, and then read the data for this bucket.
--             */
-+        
-             rv = apr_bucket_read(e, &ignored, &len, eblock);
-+            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
-+                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
-+                              "ap_content_length_filter: "
-+                              "apr_bucket_read() failed");
-+                return rv;
-+            }
-             if (rv == APR_SUCCESS) {
--                /* Attempt a nonblocking read next time through */
-                 eblock = APR_NONBLOCK_READ;
-+                e = APR_BUCKET_NEXT(e);
-                 r->bytes_sent += len;
-             }
-             else if (APR_STATUS_IS_EAGAIN(rv)) {
--                /* Output everything prior to this bucket, and then
--                 * do a blocking read on the next batch.
--                 */
--                if (e != APR_BRIGADE_FIRST(b)) {
--                    apr_bucket *flush;
--                    apr_brigade_split_ex(b, e, ctx->tmpbb);
--                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
-+                apr_bucket *flush;
- 
--                    APR_BRIGADE_INSERT_TAIL(b, flush);
--                    rv = ap_pass_brigade(f->next, b);
--                    if (rv != APR_SUCCESS || f->c->aborted) {
--                        return rv;
--                    }
--                    apr_brigade_cleanup(b);
--                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
--                    e = APR_BRIGADE_FIRST(b);
-+                /* Next read must block. */
-+                eblock = APR_BLOCK_READ;
- 
--                    ctx->data_sent = 1;
--                }
--                eblock = APR_BLOCK_READ;
--                continue;
-+                /* Ensure the last bucket to pass down is a flush if
-+                 * the next read will block. */
-+                flush = apr_bucket_flush_create(f->c->bucket_alloc);
-+                APR_BUCKET_INSERT_BEFORE(e, flush);
-             }
--            else {
--                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
--                              "ap_content_length_filter: "
--                              "apr_bucket_read() failed");
--                return rv;
--            }
-         }
--        else {
--            r->bytes_sent += e->length;
-+
-+        /* Optimization: if the next bucket is EOS (directly after a
-+         * bucket morphed to the heap, or a flush), short-cut to
-+         * handle EOS straight away - allowing C-L to be determined
-+         * for content which is already entirely in memory. */
-+        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
-+            continue;
-         }
--        e = APR_BUCKET_NEXT(e);
-+
-+        /* On reaching here, pass on everything in the brigade up to
-+         * this point. */
-+        apr_brigade_split_ex(b, e, ctx->tmpbb);
-+        
-+        rv = ap_pass_brigade(f->next, b);
-+        if (rv != APR_SUCCESS) {
-+            return rv;
-+        }
-+        else if (f->c->aborted) {
-+            return APR_ECONNABORTED;
-+        }
-+        apr_brigade_cleanup(b);
-+        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
-+        e = APR_BRIGADE_FIRST(b);
-+        
-+        ctx->data_sent = 1;
-     }
- 
-     /* If we've now seen the entire response and it's otherwise
diff --git a/httpd-2.4.4-mod_unique_id.patch b/httpd-2.4.4-mod_unique_id.patch
deleted file mode 100644
index 30bdfe0..0000000
--- a/httpd-2.4.4-mod_unique_id.patch
+++ /dev/null
@@ -1,239 +0,0 @@
---- trunk/modules/metadata/mod_unique_id.c	2011/12/02 23:02:04	1209766
-+++ trunk/modules/metadata/mod_unique_id.c	2013/07/10 16:20:31	1501827
-@@ -31,14 +31,11 @@
- #include "http_log.h"
- #include "http_protocol.h"  /* for ap_hook_post_read_request */
- 
--#if APR_HAVE_UNISTD_H
--#include <unistd.h>         /* for getpid() */
--#endif
-+#define ROOT_SIZE 10
- 
- typedef struct {
-     unsigned int stamp;
--    unsigned int in_addr;
--    unsigned int pid;
-+    char root[ROOT_SIZE];
-     unsigned short counter;
-     unsigned int thread_index;
- } unique_id_rec;
-@@ -64,20 +61,15 @@
-  * gethostbyname (gethostname()) is unique across all the machines at the
-  * "site".
-  *
-- * We also further assume that pids fit in 32-bits.  If something uses more
-- * than 32-bits, the fix is trivial, but it requires the unrolled uuencoding
-- * loop to be extended.  * A similar fix is needed to support multithreaded
-- * servers, using a pid/tid combo.
-- *
-- * Together, the in_addr and pid are assumed to absolutely uniquely identify
-- * this one child from all other currently running children on all servers
-- * (including this physical server if it is running multiple httpds) from each
-+ * The root is assumed to absolutely uniquely identify this one child
-+ * from all other currently running children on all servers (including
-+ * this physical server if it is running multiple httpds) from each
-  * other.
-  *
-- * The stamp and counter are used to distinguish all hits for a particular
-- * (in_addr,pid) pair.  The stamp is updated using r->request_time,
-- * saving cpu cycles.  The counter is never reset, and is used to permit up to
-- * 64k requests in a single second by a single child.
-+ * The stamp and counter are used to distinguish all hits for a
-+ * particular root.  The stamp is updated using r->request_time,
-+ * saving cpu cycles.  The counter is never reset, and is used to
-+ * permit up to 64k requests in a single second by a single child.
-  *
-  * The 144-bits of unique_id_rec are encoded using the alphabet
-  * [A-Za-z0-9@-], resulting in 24 bytes of printable characters.  That is then
-@@ -92,7 +84,7 @@
-  * module change.
-  *
-  * It is highly desirable that identifiers exist for "eternity".  But future
-- * needs (such as much faster webservers, moving to 64-bit pids, or moving to a
-+ * needs (such as much faster webservers, or moving to a
-  * multithreaded server) may dictate a need to change the contents of
-  * unique_id_rec.  Such a future implementation should ensure that the first
-  * field is still a time_t stamp.  By doing that, it is possible for a site to
-@@ -100,7 +92,15 @@
-  * wait one entire second, and then start all of their new-servers.  This
-  * procedure will ensure that the new space of identifiers is completely unique
-  * from the old space.  (Since the first four unencoded bytes always differ.)
-+ *
-+ * Note: previous implementations used 32-bits of IP address plus pid
-+ * in place of the PRNG output in the "root" field.  This was
-+ * insufficient for IPv6-only hosts, required working DNS to determine
-+ * a unique IP address (fragile), and needed a [0, 1) second sleep
-+ * call at startup to avoid pid reuse.  Use of the PRNG avoids all
-+ * these issues.
-  */
-+
- /*
-  * Sun Jun  7 05:43:49 CEST 1998 -- Alvaro
-  * More comments:
-@@ -116,8 +116,6 @@
-  * htonl/ntohl. Well, this shouldn't be a problem till year 2106.
-  */
- 
--static unsigned global_in_addr;
--
- /*
-  * XXX: We should have a per-thread counter and not use cur_unique_id.counter
-  * XXX: in all threads, because this is bad for performance on multi-processor
-@@ -129,7 +127,7 @@
- /*
-  * Number of elements in the structure unique_id_rec.
-  */
--#define UNIQUE_ID_REC_MAX 5
-+#define UNIQUE_ID_REC_MAX 4
- 
- static unsigned short unique_id_rec_offset[UNIQUE_ID_REC_MAX],
-                       unique_id_rec_size[UNIQUE_ID_REC_MAX],
-@@ -138,113 +136,32 @@
- 
- static int unique_id_global_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server)
- {
--    char str[APRMAXHOSTLEN + 1];
--    apr_status_t rv;
--    char *ipaddrstr;
--    apr_sockaddr_t *sockaddr;
--
-     /*
-      * Calculate the sizes and offsets in cur_unique_id.
-      */
-     unique_id_rec_offset[0] = APR_OFFSETOF(unique_id_rec, stamp);
-     unique_id_rec_size[0] = sizeof(cur_unique_id.stamp);
--    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, in_addr);
--    unique_id_rec_size[1] = sizeof(cur_unique_id.in_addr);
--    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, pid);
--    unique_id_rec_size[2] = sizeof(cur_unique_id.pid);
--    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, counter);
--    unique_id_rec_size[3] = sizeof(cur_unique_id.counter);
--    unique_id_rec_offset[4] = APR_OFFSETOF(unique_id_rec, thread_index);
--    unique_id_rec_size[4] = sizeof(cur_unique_id.thread_index);
-+    unique_id_rec_offset[1] = APR_OFFSETOF(unique_id_rec, root);
-+    unique_id_rec_size[1] = sizeof(cur_unique_id.root);
-+    unique_id_rec_offset[2] = APR_OFFSETOF(unique_id_rec, counter);
-+    unique_id_rec_size[2] = sizeof(cur_unique_id.counter);
-+    unique_id_rec_offset[3] = APR_OFFSETOF(unique_id_rec, thread_index);
-+    unique_id_rec_size[3] = sizeof(cur_unique_id.thread_index);
-     unique_id_rec_total_size = unique_id_rec_size[0] + unique_id_rec_size[1] +
--                               unique_id_rec_size[2] + unique_id_rec_size[3] +
--                               unique_id_rec_size[4];
-+                               unique_id_rec_size[2] + unique_id_rec_size[3];
- 
-     /*
-      * Calculate the size of the structure when encoded.
-      */
-     unique_id_rec_size_uu = (unique_id_rec_total_size*8+5)/6;
- 
--    /*
--     * Now get the global in_addr.  Note that it is not sufficient to use one
--     * of the addresses from the main_server, since those aren't as likely to
--     * be unique as the physical address of the machine
--     */
--    if ((rv = apr_gethostname(str, sizeof(str) - 1, p)) != APR_SUCCESS) {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01563)
--          "unable to find hostname of the server");
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET, 0, 0, p)) == APR_SUCCESS) {
--        global_in_addr = sockaddr->sa.sin.sin_addr.s_addr;
--    }
--    else {
--        ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01564)
--                    "unable to find IPv4 address of \"%s\"", str);
--#if APR_HAVE_IPV6
--        if ((rv = apr_sockaddr_info_get(&sockaddr, str, AF_INET6, 0, 0, p)) == APR_SUCCESS) {
--            memcpy(&global_in_addr,
--                   (char *)sockaddr->ipaddr_ptr + sockaddr->ipaddr_len - sizeof(global_in_addr),
--                   sizeof(global_in_addr));
--            ap_log_error(APLOG_MARK, APLOG_ALERT, rv, main_server, APLOGNO(01565)
--                         "using low-order bits of IPv6 address "
--                         "as if they were unique");
--        }
--        else
--#endif
--        return HTTP_INTERNAL_SERVER_ERROR;
--    }
--
--    apr_sockaddr_ip_get(&ipaddrstr, sockaddr);
--    ap_log_error(APLOG_MARK, APLOG_INFO, 0, main_server, APLOGNO(01566) "using ip addr %s",
--                 ipaddrstr);
--
--    /*
--     * If the server is pummelled with restart requests we could possibly end
--     * up in a situation where we're starting again during the same second
--     * that has been used in previous identifiers.  Avoid that situation.
--     *
--     * In truth, for this to actually happen not only would it have to restart
--     * in the same second, but it would have to somehow get the same pids as
--     * one of the other servers that was running in that second. Which would
--     * mean a 64k wraparound on pids ... not very likely at all.
--     *
--     * But protecting against it is relatively cheap.  We just sleep into the
--     * next second.
--     */
--    apr_sleep(apr_time_from_sec(1) - apr_time_usec(apr_time_now()));
-     return OK;
- }
- 
- static void unique_id_child_init(apr_pool_t *p, server_rec *s)
- {
--    pid_t pid;
--
--    /*
--     * Note that we use the pid because it's possible that on the same
--     * physical machine there are multiple servers (i.e. using Listen). But
--     * it's guaranteed that none of them will share the same pids between
--     * children.
--     *
--     * XXX: for multithread this needs to use a pid/tid combo and probably
--     * needs to be expanded to 32 bits
--     */
--    pid = getpid();
--    cur_unique_id.pid = pid;
--
--    /*
--     * Test our assumption that the pid is 32-bits.  It's possible that
--     * 64-bit machines will declare pid_t to be 64 bits but only use 32
--     * of them.  It would have been really nice to test this during
--     * global_init ... but oh well.
--     */
--    if ((pid_t)cur_unique_id.pid != pid) {
--        ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s, APLOGNO(01567)
--                    "oh no! pids are greater than 32-bits!  I'm broken!");
--    }
--
--    cur_unique_id.in_addr = global_in_addr;
-+    ap_random_insecure_bytes(&cur_unique_id.root,
-+                             sizeof(cur_unique_id.root));
- 
-     /*
-      * If we use 0 as the initial counter we have a little less protection
-@@ -253,13 +170,6 @@
-      */
-     ap_random_insecure_bytes(&cur_unique_id.counter,
-                              sizeof(cur_unique_id.counter));
--
--    /*
--     * We must always use network ordering for these bytes, so that
--     * identifiers are comparable between machines of different byte
--     * orderings.  Note in_addr is already in network order.
--     */
--    cur_unique_id.pid = htonl(cur_unique_id.pid);
- }
- 
- /* NOTE: This is *NOT* the same encoding used by base64encode ... the last two
-@@ -291,10 +201,8 @@
-     unsigned short counter;
-     int i,j,k;
- 
--    new_unique_id.in_addr = cur_unique_id.in_addr;
--    new_unique_id.pid = cur_unique_id.pid;
-+    memcpy(&new_unique_id.root, &cur_unique_id.root, ROOT_SIZE);
-     new_unique_id.counter = cur_unique_id.counter;
--
-     new_unique_id.stamp = htonl((unsigned int)apr_time_sec(r->request_time));
-     new_unique_id.thread_index = htonl((unsigned int)r->connection->id);
- 
diff --git a/httpd.spec b/httpd.spec
index 379021a..c82b88a 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,7 +7,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.28
+Version: 2.4.29
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -63,15 +63,10 @@ Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
-Patch56: httpd-2.4.4-mod_unique_id.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.25-r1738878.patch
-Patch60: httpd-2.4.27-r1808230.patch
 # Security fixes
 
-# https://github.com/apache/httpd/commit/4171fbfcb249e63f934471054d7a0752272fb8ee
-Patch61: httpd-2.4.27-fixticketkeys.patch
-
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
@@ -213,11 +208,7 @@ interface for storing and accessing per-user session data.
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
-%patch56 -p1 -b .uniqueid
 %patch58 -p1 -b .r1738878
-%patch60 -p1 -b .r1808230
-
-%patch61 -p1 -b .ticketkeys
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -697,6 +688,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
+- new version 2.4.29
+
 * Tue Oct 10 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.28-1
 - new version 2.4.28
 
diff --git a/sources b/sources
index 2db6285..6978287 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.28.tar.bz2) = 8de8e32b87e6de220e492e74db9df0882fae11c3b9732f3d3316da048c04767ac4429c0433c36f87d8705263e3376f97a7e1f66a9d7a518632a67b6fe617590a
+SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a

From f68f9f06a837965f11953ad52ce31994f93bcb2a Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Wed, 28 Mar 2018 20:18:58 +0100
Subject: [PATCH 16/20] rebase to 2.4.33 (#1560174) add mod_md subpackage; load
 mod_proxy_uwsgi by default

---
 00-proxy.conf                                 |   1 +
 01-md.conf                                    |   1 +
 ...-export.patch => httpd-2.4.33-export.patch |   8 +-
 httpd-2.4.33-mddefault.patch                  |  21 +++
 ...38878.patch => httpd-2.4.33-r1738878.patch | 133 +++++++++---------
 ...patch => httpd-2.4.33-sslciphdefault.patch |  12 +-
 httpd.spec                                    |  43 +++++-
 sources                                       |   2 +-
 8 files changed, 136 insertions(+), 85 deletions(-)
 create mode 100644 01-md.conf
 rename httpd-2.4.4-export.patch => httpd-2.4.33-export.patch (75%)
 create mode 100644 httpd-2.4.33-mddefault.patch
 rename httpd-2.4.25-r1738878.patch => httpd-2.4.33-r1738878.patch (71%)
 rename httpd-2.4.17-sslciphdefault.patch => httpd-2.4.33-sslciphdefault.patch (75%)

diff --git a/00-proxy.conf b/00-proxy.conf
index 448eb63..f0f84c2 100644
--- a/00-proxy.conf
+++ b/00-proxy.conf
@@ -14,4 +14,5 @@ LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 LoadModule proxy_http_module modules/mod_proxy_http.so
 LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
 LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
 LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
diff --git a/01-md.conf b/01-md.conf
new file mode 100644
index 0000000..2739202
--- /dev/null
+++ b/01-md.conf
@@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so
diff --git a/httpd-2.4.4-export.patch b/httpd-2.4.33-export.patch
similarity index 75%
rename from httpd-2.4.4-export.patch
rename to httpd-2.4.33-export.patch
index eb670c6..9adf398 100644
--- a/httpd-2.4.4-export.patch
+++ b/httpd-2.4.33-export.patch
@@ -6,12 +6,12 @@ Upstream-HEAD: needed
 Upstream-2.0: omit
 Upstream-Status: EXPORT_DIRS change is conditional on using shared apr
 
---- httpd-2.4.4/server/Makefile.in.export
-+++ httpd-2.4.4/server/Makefile.in
-@@ -57,9 +57,6 @@ export_files:
- 	( for dir in $(EXPORT_DIRS); do \
+--- httpd-2.4.33/server/Makefile.in.export
++++ httpd-2.4.33/server/Makefile.in
+@@ -60,9 +60,6 @@
  	      ls $$dir/*.h ; \
  	  done; \
+ 	  echo "$(top_srcdir)/server/mpm_fdqueue.h"; \
 -	  for dir in $(EXPORT_DIRS_APR); do \
 -	      ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \
 -	  done; \
diff --git a/httpd-2.4.33-mddefault.patch b/httpd-2.4.33-mddefault.patch
new file mode 100644
index 0000000..9e82fb8
--- /dev/null
+++ b/httpd-2.4.33-mddefault.patch
@@ -0,0 +1,21 @@
+
+Override default.
+
+--- httpd-2.4.33/modules/md/mod_md_config.c.mddefault
++++ httpd-2.4.33/modules/md/mod_md_config.c
+@@ -54,10 +54,14 @@
+ 
+ #define DEF_VAL     (-1)
+ 
++#ifndef MD_DEFAULT_STORE_DIR
++#define MD_DEFAULT_STORE_DIR "state/md"
++#endif
++
+ /* Default settings for the global conf */
+ static md_mod_conf_t defmc = {
+     NULL,
+-    "md",
++    MD_DEFAULT_STORE_DIR,
+     NULL,
+     NULL,
+     80,
diff --git a/httpd-2.4.25-r1738878.patch b/httpd-2.4.33-r1738878.patch
similarity index 71%
rename from httpd-2.4.25-r1738878.patch
rename to httpd-2.4.33-r1738878.patch
index e4b46cc..d7ef42f 100644
--- a/httpd-2.4.25-r1738878.patch
+++ b/httpd-2.4.33-r1738878.patch
@@ -1,28 +1,9 @@
 diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
 index c119a7e..267150a 100644
---- a/modules/proxy/ajp.h
-+++ b/modules/proxy/ajp.h
-@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
-  * @param sock      backend socket
-  * @param r         current request
-  * @param buffsize  max size of the AJP packet.
-+ * @param secret    authentication secret
-  * @param uri       requested uri
-  * @return          APR_SUCCESS or error
-  */
- apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
-                              apr_size_t buffsize,
--                             apr_uri_t *uri);
-+                             apr_uri_t *uri,
-+                             const char *secret);
- 
- /**
-  * Read the ajp message and return the type of the message.
-diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
-index 67353a7..680a8f3 100644
---- a/modules/proxy/ajp_header.c
-+++ b/modules/proxy/ajp_header.c
-@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
+diff -uap httpd-2.4.33/modules/proxy/ajp_header.c.r1738878 httpd-2.4.33/modules/proxy/ajp_header.c
+--- httpd-2.4.33/modules/proxy/ajp_header.c.r1738878
++++ httpd-2.4.33/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@
  
  static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
                                            request_rec *r,
@@ -32,7 +13,7 @@ index 67353a7..680a8f3 100644
  {
      int method;
      apr_uint32_t i, num_headers = 0;
-@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+@@ -293,17 +294,15 @@
                     i, elts[i].key, elts[i].val);
      }
  
@@ -53,7 +34,7 @@ index 67353a7..680a8f3 100644
  
      if (r->user) {
          if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
-@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+@@ -671,7 +670,8 @@
  apr_status_t ajp_send_header(apr_socket_t *sock,
                               request_rec *r,
                               apr_size_t buffsize,
@@ -63,7 +44,7 @@ index 67353a7..680a8f3 100644
  {
      ajp_msg_t *msg;
      apr_status_t rc;
-@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
+@@ -683,7 +683,7 @@
          return rc;
      }
  
@@ -72,48 +53,29 @@ index 67353a7..680a8f3 100644
      if (rc != APR_SUCCESS) {
          ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
                 "ajp_send_header: ajp_marshal_into_msgb failed");
-diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
-index f6fb473..f693f63 100644
---- a/modules/proxy/mod_proxy.c
-+++ b/modules/proxy/mod_proxy.c
-@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p,
-                                 (int)sizeof(worker->s->upgrade));
-         }
-     }
-+    else if (!strcasecmp(key, "secret")) {
-+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
-+            return apr_psprintf(p, "Secret length must be < %d characters",
-+                                (int)sizeof(worker->s->secret));
-+        }
-+    }
-     else {
-         if (set_worker_hc_param_f) {
-             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
-diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
-index 8a0ad10..f92c185 100644
---- a/modules/proxy/mod_proxy.h
-+++ b/modules/proxy/mod_proxy.h
-@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL )
- #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
- #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
- #define PROXY_BALANCER_MAX_STICKY_SIZE  64
-+#define PROXY_WORKER_MAX_SECRET_SIZE    64
+diff -uap httpd-2.4.33/modules/proxy/ajp.h.r1738878 httpd-2.4.33/modules/proxy/ajp.h
+--- httpd-2.4.33/modules/proxy/ajp.h.r1738878
++++ httpd-2.4.33/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
++ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
++                             apr_uri_t *uri,
++                             const char *secret);
  
- /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
-  * dotted together(?) this would fit the below size (+ trailing NUL).
-@@ -443,6 +444,7 @@ typedef struct {
-     hcmethod_t      method;     /* method to use for health check */
-     apr_interval_time_t interval;
-     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
-+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
- } proxy_worker_shared;
- 
- #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
-diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
-index 051724e..e706518 100644
---- a/modules/proxy/mod_proxy_ajp.c
-+++ b/modules/proxy/mod_proxy_ajp.c
-@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+ /**
+  * Read the ajp message and return the type of the message.
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+--- httpd-2.4.33/modules/proxy/mod_proxy_ajp.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@
      apr_off_t content_length = 0;
      int original_status = r->status;
      const char *original_status_line = r->status_line;
@@ -121,7 +83,7 @@ index 051724e..e706518 100644
  
      if (psf->io_buffer_size_set)
         maxsize = psf->io_buffer_size;
-@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+@@ -202,12 +203,15 @@
         maxsize = AJP_MSG_BUFFER_SZ;
      maxsize = APR_ALIGN(maxsize, 1024);
  
@@ -138,3 +100,38 @@ index 051724e..e706518 100644
      if (status != APR_SUCCESS) {
          conn->close = 1;
          ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.c
+--- httpd-2.4.33/modules/proxy/mod_proxy.c.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.c
+@@ -318,6 +318,12 @@
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
++    else if (!strcasecmp(key, "secret")) {
++        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
++            return apr_psprintf(p, "Secret length must be < %d characters",
++                                (int)sizeof(worker->s->secret));
++        }
++    }
+     else {
+         if (set_worker_hc_param_f) {
+             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
+diff -uap httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878 httpd-2.4.33/modules/proxy/mod_proxy.h
+--- httpd-2.4.33/modules/proxy/mod_proxy.h.r1738878
++++ httpd-2.4.33/modules/proxy/mod_proxy.h
+@@ -353,6 +353,7 @@
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
++#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ #define PROXY_RFC1035_HOSTNAME_SIZE	256
+ 
+@@ -447,6 +448,7 @@
+     apr_interval_time_t interval;
+     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
+     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
++    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
diff --git a/httpd-2.4.17-sslciphdefault.patch b/httpd-2.4.33-sslciphdefault.patch
similarity index 75%
rename from httpd-2.4.17-sslciphdefault.patch
rename to httpd-2.4.33-sslciphdefault.patch
index 8efc461..f2919b8 100644
--- a/httpd-2.4.17-sslciphdefault.patch
+++ b/httpd-2.4.33-sslciphdefault.patch
@@ -3,9 +3,9 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1109119
 
 Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 
---- httpd-2.4.17/modules/ssl/ssl_engine_config.c.sslciphdefault
-+++ httpd-2.4.17/modules/ssl/ssl_engine_config.c
-@@ -708,8 +708,10 @@ const char *ssl_cmd_SSLCipherSuite(cmd_p
+--- httpd-2.4.33/modules/ssl/ssl_engine_config.c.sslciphdefault
++++ httpd-2.4.33/modules/ssl/ssl_engine_config.c
+@@ -758,8 +758,10 @@
      SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
      SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
@@ -18,9 +18,9 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
  
      if (cmd->path) {
          dc->szCipherSuite = arg;
-@@ -1428,8 +1430,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(
+@@ -1502,8 +1504,10 @@
  {
-     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
  
 -    /* always disable null and export ciphers */
 -    arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
@@ -29,5 +29,5 @@ Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
 +    if (strncmp(arg, "PROFILE=", 8) != 0)
 +        arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL);
  
-     sc->proxy->auth.cipher_suite = arg;
+     dc->proxy->auth.cipher_suite = arg;
  
diff --git a/httpd.spec b/httpd.spec
index c82b88a..2cc7874 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -7,7 +7,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.29
+Version: 2.4.33
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -37,6 +37,7 @@ Source25: 01-session.conf
 Source26: 10-listen443.conf
 Source27: httpd.socket
 Source28: 00-optional.conf
+Source29: 01-md.conf
 # Documentation
 Source30: README.confd
 Source31: README.confmod
@@ -52,7 +53,7 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
-Patch23: httpd-2.4.4-export.patch
+Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
@@ -61,10 +62,12 @@ Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
-Patch35: httpd-2.4.17-sslciphdefault.patch
+Patch35: httpd-2.4.33-sslciphdefault.patch
+
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
-Patch58: httpd-2.4.25-r1738878.patch
+Patch58: httpd-2.4.33-r1738878.patch
+
 # Security fixes
 
 License: ASL 2.0
@@ -156,6 +159,19 @@ The mod_ssl module provides strong cryptography for the Apache Web
 server via the Secure Sockets Layer (SSL) and Transport Layer
 Security (TLS) protocols.
 
+%package -n mod_md
+Group: System Environment/Daemons
+Summary: Certificate provisioning using ACME for the Apache HTTP Server
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
+BuildRequires: jansson-devel, libcurl-devel
+
+%description -n mod_md
+This module manages common properties of domains for one or more
+virtual hosts. Specifically it can use the ACME protocol (RFC Draft)
+to automate certificate provisioning. These will be configured for
+managed domains and their virtual hosts automatically. This includes
+renewal of certificates before they expire.
+
 %package -n mod_proxy_html
 Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
@@ -204,7 +220,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
@@ -305,7 +321,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \
     $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README
 for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \
          00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \
-         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do
+         01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \
+         01-md.conf; do
   install -m 644 -p $RPM_SOURCE_DIR/$f \
         $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f
 done
@@ -348,6 +365,7 @@ install -m 644 -p $RPM_SOURCE_DIR/httpd.tmpfiles \
 
 # Other directories
 mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav \
+         $RPM_BUILD_ROOT%{_localstatedir}/lib/httpd \
          $RPM_BUILD_ROOT/run/httpd/htcacheclean
 
 # Substitute in defaults which are usually done (badly) by "make install"
@@ -407,6 +425,7 @@ ln -s ../../pixmaps/poweredby.png \
 
 # symlinks for /etc/httpd
 ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
+ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state
 ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run
 ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
 
@@ -563,6 +582,7 @@ rm -rf $RPM_BUILD_ROOT
 
 %{_sysconfdir}/httpd/modules
 %{_sysconfdir}/httpd/logs
+%{_sysconfdir}/httpd/state
 %{_sysconfdir}/httpd/run
 %dir %{_sysconfdir}/httpd/conf
 %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf
@@ -600,6 +620,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/httpd/modules/mod*.so
 %exclude %{_libdir}/httpd/modules/mod_auth_form.so
 %exclude %{_libdir}/httpd/modules/mod_ssl.so
+%exclude %{_libdir}/httpd/modules/mod_md.so
 %exclude %{_libdir}/httpd/modules/mod_*ldap.so
 %exclude %{_libdir}/httpd/modules/mod_proxy_html.so
 %exclude %{_libdir}/httpd/modules/mod_xml2enc.so
@@ -618,6 +639,7 @@ rm -rf $RPM_BUILD_ROOT
 %attr(0700,apache,apache) %dir /run/httpd/htcacheclean
 %attr(0700,root,root) %dir %{_localstatedir}/log/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav
+%attr(0700,apache,apache) %dir %{_localstatedir}/lib/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd
 %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy
 
@@ -677,6 +699,11 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/httpd/modules/mod_auth_form.so
 %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
 
+%files -n mod_md
+%defattr(-,root,root)
+%{_libdir}/httpd/modules/mod_md.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
+
 %files devel
 %defattr(-,root,root)
 %{_includedir}/httpd
@@ -688,6 +715,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
+- rebase to 2.4.33 (#1560174)
+- add mod_md subpackage; load mod_proxy_uwsgi by default
+
 * Wed Oct 25 2017 Luboš Uhliarik <luhliari@redhat.com> - 2.4.29-1
 - new version 2.4.29
 
diff --git a/sources b/sources
index 6978287..e8c3a89 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (httpd-2.4.29.tar.bz2) = 840982fd3d21463bc5c1747f211dfacf3abdf634d149e49bb49fd2e5deda140de602dbdf31e1bbe5337a48f718ab2261c408e83a8dd39a9291ee7b6b7a85639a
+SHA512 (httpd-2.4.33.tar.bz2) = e74b2b3346d67be45a8bc8a7cbb8eabf5c403a5cfe5797a976f94a539529843fbcdf03b9ca0548816b2cf37f4ce0eb301f8d5af25b1270fdf8dd9f5bf0585269

From f56e21847dd26be1e91112fef9ded50c737a89d7 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Fri, 30 Mar 2018 17:24:23 -0700
Subject: [PATCH 17/20] Exclude mod_md config file from main package (#1562413)

---
 httpd.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/httpd.spec b/httpd.spec
index 2cc7874..dc1b559 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -601,6 +601,7 @@ rm -rf $RPM_BUILD_ROOT
 %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf
 %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf
+%exclude %{_sysconfdir}/httpd/conf.modules.d/01-md.conf
 
 %config(noreplace) %{_sysconfdir}/sysconfig/htcacheclean
 %ghost %{_sysconfdir}/sysconfig/httpd
@@ -715,6 +716,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
+- Exclude mod_md config file from main package (#1562413)
+
 * Wed Mar 28 2018 Joe Orton <jorton@redhat.com> - 2.4.33-1
 - rebase to 2.4.33 (#1560174)
 - add mod_md subpackage; load mod_proxy_uwsgi by default

From 31cf3e9de5ba8e0766534c6125ccb3a4e82fa05d Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Thu, 12 Apr 2018 08:03:52 +0100
Subject: [PATCH 18/20] mod_ssl: drop implicit 'SSLEngine on' for vhost w/o
 certs (#1564537) Resolves: rhbz#1564537

---
 httpd-2.4.33-sslmerging.patch | 15 +++++++++++++++
 httpd.spec                    |  8 +++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 httpd-2.4.33-sslmerging.patch

diff --git a/httpd-2.4.33-sslmerging.patch b/httpd-2.4.33-sslmerging.patch
new file mode 100644
index 0000000..066b5c8
--- /dev/null
+++ b/httpd-2.4.33-sslmerging.patch
@@ -0,0 +1,15 @@
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+
+--- httpd-2.4.33/modules/ssl/ssl_engine_init.c.sslmerging
++++ httpd-2.4.33/modules/ssl/ssl_engine_init.c
+@@ -261,7 +261,8 @@
+          * the protocol is https. */
+         if (ap_get_server_protocol(s) 
+             && strcmp("https", ap_get_server_protocol(s)) == 0
+-            && sc->enabled == SSL_ENABLED_UNSET) {
++            && sc->enabled == SSL_ENABLED_UNSET
++            && (!apr_is_empty_array(sc->server->pks->cert_files))) {
+             sc->enabled = SSL_ENABLED_TRUE;
+         }
+ 
diff --git a/httpd.spec b/httpd.spec
index dc1b559..980a41b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -67,6 +67,8 @@ Patch35: httpd-2.4.33-sslciphdefault.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.33-r1738878.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1564537
+Patch59: httpd-2.4.33-sslmerging.patch
 
 # Security fixes
 
@@ -225,6 +227,7 @@ interface for storing and accessing per-user session data.
 %patch35 -p1 -b .sslciphdefault
 
 %patch58 -p1 -b .r1738878
+%patch59 -p1 -b .sslmerging
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -716,6 +719,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
+- mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
+
 * Fri Mar 30 2018 Adam Williamson <awilliam@redhat.com> - 2.4.33-2
 - Exclude mod_md config file from main package (#1562413)
 

From 77f88e99ce49bad052b14b2f87da358bf8631fe2 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Mon, 16 Apr 2018 08:25:48 +0100
Subject: [PATCH 19/20] mod_md: change hard-coded default MdStoreDir to
 state/md (#1563846) Resolves: rhbz#1563846

---
 httpd.spec | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 980a41b..497bfb4 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.33
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@@ -53,6 +53,7 @@ Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
+Patch21: httpd-2.4.33-mddefault.patch
 Patch23: httpd-2.4.33-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
@@ -215,6 +216,7 @@ interface for storing and accessing per-user session data.
 
 %patch19 -p1 -b .detectsystemd
 
+%patch21 -p1 -b .mddefault
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
@@ -222,7 +224,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-#patch31 -p1 -b .sslmultiproxy
+%patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
@@ -719,6 +721,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
+- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
+- mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
+
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3
 - mod_ssl: drop implicit 'SSLEngine on' for vhost w/o certs (#1564537)
 

From 3ffaeaa96aba408e63e84ff825dddd171bea39e1 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@redhat.com>
Date: Tue, 1 May 2018 21:40:57 +0100
Subject: [PATCH 20/20] Remove mention of mod_ssl/nss compat fix.

---
 httpd.spec | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/httpd.spec b/httpd.spec
index 497bfb4..1b186ae 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -224,7 +224,7 @@ interface for storing and accessing per-user session data.
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmultiproxy
+#patch31 -p1 -b .sslmultiproxy
 %patch34 -p1 -b .socketactivation
 %patch35 -p1 -b .sslciphdefault
 
@@ -722,7 +722,6 @@ rm -rf $RPM_BUILD_ROOT
 
 %changelog
 * Mon Apr 16 2018 Joe Orton <jorton@redhat.com> - 2.4.33-4
-- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511)
 - mod_md: change hard-coded default MdStoreDir to state/md (#1563846)
 
 * Thu Apr 12 2018 Joe Orton <jorton@redhat.com> - 2.4.33-3