diff --git a/.gitignore b/.gitignore index 8df7f18..f2fccfd 100644 --- a/.gitignore +++ b/.gitignore @@ -55,4 +55,3 @@ x86_64 /httpd-2.4.63.tar.bz2.asc /httpd-2.4.64.tar.bz2.asc /httpd-2.4.65.tar.bz2.asc -/httpd-2.4.66.tar.bz2.asc diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch deleted file mode 100644 index 315b9c2..0000000 --- a/httpd-2.4.65-hcheck-stuck.patch +++ /dev/null @@ -1,66 +0,0 @@ ---- a/modules/proxy/mod_proxy_hcheck.c -+++ b/modules/proxy/mod_proxy_hcheck.c -@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state - sctx_t *ctx = (sctx_t *)data; - server_rec *s = ctx->s; - proxy_server_conf *conf; -+ proxy_worker **workers; -+ proxy_worker *worker; -+ apr_time_t now; -+ int i, n; - -+ conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); -+ balancer = (proxy_balancer *)conf->balancers->elts; -+ - switch (state) { - case AP_WATCHDOG_STATE_STARTING: - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258) - "%s watchdog started.", - HCHECK_WATHCHDOG_NAME); -+ /* set last update time for all workers */ -+ now = apr_time_now(); -+ for (i = 0; i < conf->balancers->nelts; i++, balancer++) { -+ workers = (proxy_worker **)balancer->workers->elts; -+ for (n = 0; n < balancer->workers->nelts; n++, ++workers) { -+ worker = *workers; -+ if (worker->s->updated == 0) { -+ worker->s->updated = now; -+ } -+ } -+ } - #if HC_USE_THREADS - if (tpsize && hctp == NULL) { - rv = apr_thread_pool_create(&hctp, tpsize, -@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state - - case AP_WATCHDOG_STATE_RUNNING: - /* loop thru all workers */ -- if (s) { -- int i; -- conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); -- balancer = (proxy_balancer *)conf->balancers->elts; -- ctx->s = s; -+ { -+ now = apr_time_now(); - for (i = 0; i < conf->balancers->nelts; i++, balancer++) { -- int n; -- apr_time_t now; -- proxy_worker **workers; -- proxy_worker *worker; - /* Have any new balancers or workers been added dynamically? */ - ap_proxy_sync_balancer(balancer, s, conf); - workers = (proxy_worker **)balancer->workers->elts; -- now = apr_time_now(); -- for (n = 0; n < balancer->workers->nelts; n++) { -+ for (n = 0; n < balancer->workers->nelts; n++, workers++) { - worker = *workers; - if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) && - (worker->s->method != NONE) && -@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state - hc_check(NULL, baton); - } - } -- workers++; - } - } - } diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch new file mode 100644 index 0000000..0831efc --- /dev/null +++ b/httpd-2.4.65-sslvhostsnipolicy.patch @@ -0,0 +1,554 @@ +From 0263d1e290bc029c5c059fdaa4f21ca9885f9c84 Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Wed, 12 Nov 2025 11:11:41 +0100 +Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the + compatibility level required for VirtualHost matching. + +For "secure" and "authonly" modes, a hash of the policy-relevant vhost +configuration is created and stored in the post_config hooks, reducing +the runtime code complexity (and overhead). + +* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New + function, replacing ssl_server_compatible et al. + +* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New + function. + +* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash, + hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash): + New functions. + (ssl_init_Module): Invoke create_sni_policy_hash to store the hash + for every SSLSrvConfigRec. + +* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field. + (SSLSrvConfigRec): Add sni_policy_hash field. + +PR: 69743 +GitHub: closes #561 +--- + docs/manual/mod/mod_ssl.html.en | 77 ++++++++++++++++++ + modules/ssl/mod_ssl.c | 2 + + modules/ssl/ssl_engine_config.c | 41 ++++++++++ + modules/ssl/ssl_engine_init.c | 107 +++++++++++++++++++++++++ + modules/ssl/ssl_engine_kernel.c | 133 ++++++-------------------------- + modules/ssl/ssl_private.h | 17 ++++ + 6 files changed, 267 insertions(+), 110 deletions(-) + +diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en +index e2a4a99..95f0667 100644 +--- a/docs/manual/mod/mod_ssl.html.en ++++ b/docs/manual/mod/mod_ssl.html.en +@@ -125,6 +125,7 @@ to provide the cryptography engine.

+
  • SSLUseStapling
    • +
  • SSLVerifyClient
    • +
  • SSLVerifyDepth
    • ++
  • SSLVHostSNIPolicy
    • + +

    Bugfix checklist

    See also

    +