From 772e6b5324205514918e095c2329bdebe203113f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 25 Sep 2019 15:23:20 +0100 Subject: [PATCH 1/8] mod_ssl: restore dependency on /usr/bin/hostname (#1135118) Resolves: rhbz#1135118 --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index ed18bf1..51abf88 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 1%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -158,7 +158,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 2.2.0 +Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 @@ -741,6 +741,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Sep 25 2019 Joe Orton - 2.4.41-3 +- mod_ssl: restore dependency on /usr/bin/hostname (#1135118) + * Thu Aug 15 2019 Joe Orton - 2.4.41-1 - update to 2.4.41 From da11a1328607034f40bf58cc0237232a68372b2f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 2 Oct 2019 11:47:35 +0100 Subject: [PATCH 2/8] mod_cgid: possible stdout timeout handling fix (#1757683) Resolves: rhbz#1757683 --- ...172+.patch => httpd-2.4.41-r1828172+.patch | 115 ++++++++++-------- httpd.spec | 7 +- pullrev.sh | 4 +- 3 files changed, 73 insertions(+), 53 deletions(-) rename httpd-2.4.37-r1828172+.patch => httpd-2.4.41-r1828172+.patch (94%) diff --git a/httpd-2.4.37-r1828172+.patch b/httpd-2.4.41-r1828172+.patch similarity index 94% rename from httpd-2.4.37-r1828172+.patch rename to httpd-2.4.41-r1828172+.patch index 822cccf..534acef 100644 --- a/httpd-2.4.37-r1828172+.patch +++ b/httpd-2.4.41-r1828172+.patch @@ -1,10 +1,12 @@ -# ./pullrev.sh 1828172 1862968 1863191 +# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 http://svn.apache.org/viewvc?view=revision&revision=1828172 http://svn.apache.org/viewvc?view=revision&revision=1862968 http://svn.apache.org/viewvc?view=revision&revision=1863191 +http://svn.apache.org/viewvc?view=revision&revision=1867878 +http://svn.apache.org/viewvc?view=revision&revision=1867882 ---- httpd-2.4.37/modules/generators/mod_cgi.c -+++ httpd-2.4.37/modules/generators/mod_cgi.c +--- httpd-2.4.41/modules/generators/mod_cgi.c ++++ httpd-2.4.41/modules/generators/mod_cgi.c @@ -92,6 +92,10 @@ apr_size_t bufbytes; } cgi_server_conf; @@ -287,16 +289,19 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -928,7 +775,7 @@ - apr_file_pipe_timeout_set(script_in, 0); - apr_file_pipe_timeout_set(script_err, 0); +@@ -925,10 +772,7 @@ + AP_DEBUG_ASSERT(script_in != NULL); + #if APR_FILES_AS_SOCKETS +- apr_file_pipe_timeout_set(script_in, 0); +- apr_file_pipe_timeout_set(script_err, 0); +- - b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc); + b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc); if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -985,7 +832,7 @@ +@@ -985,7 +829,7 @@ * stderr output, as normal. */ discard_script_output(bb); apr_brigade_destroy(bb); @@ -305,7 +310,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 log_script_err(r, script_err); } -@@ -1036,7 +883,7 @@ +@@ -1036,7 +880,7 @@ * connection drops or we stopped sending output for some other * reason */ if (rv == APR_SUCCESS && !r->connection->aborted) { @@ -314,7 +319,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 log_script_err(r, script_err); } -@@ -1277,7 +1124,7 @@ +@@ -1277,7 +1121,7 @@ AP_DECLARE_MODULE(cgi) = { STANDARD20_MODULE_STUFF, @@ -323,8 +328,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 NULL, /* dir merger --- default is to override */ create_cgi_config, /* server config */ merge_cgi_config, /* merge server config */ ---- httpd-2.4.37/modules/generators/mod_cgid.c -+++ httpd-2.4.37/modules/generators/mod_cgid.c +--- httpd-2.4.41/modules/generators/mod_cgid.c ++++ httpd-2.4.41/modules/generators/mod_cgid.c @@ -342,15 +342,19 @@ return close(fd); } @@ -350,7 +355,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +369,52 @@ +@@ -365,9 +369,60 @@ } } while (bytes_read < buf_size); @@ -366,11 +371,12 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + + msg.msg_iov = &vec; + msg.msg_iovlen = 1; -+ -+ msg.msg_control = u.buf; -+ msg.msg_controllen = sizeof(u.buf); + -+ if (errfd) *errfd = 0; ++ if (errfd) { ++ msg.msg_control = u.buf; ++ msg.msg_controllen = sizeof(u.buf); ++ *errfd = 0; ++ } + + /* use MSG_WAITALL to skip loop on truncated reads */ + do { @@ -380,10 +386,17 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + if (rc == 0) { + return ECONNRESET; + } -+ -+ cmsg = CMSG_FIRSTHDR(&msg); ++ else if (rc < 0) { ++ return errno; ++ } ++ else if (rc != buf_size) { ++ /* MSG_WAITALL should ensure the recvmsg blocks until the ++ * entire length is read, but let's be paranoid. */ ++ return APR_INCOMPLETE; ++ } ++ + if (errfd -+ && cmsg ++ && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL + && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd)) + && cmsg->cmsg_level == SOL_SOCKET + && cmsg->cmsg_type == SCM_RIGHTS) { @@ -403,7 +416,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +431,7 @@ +@@ -384,7 +439,7 @@ return APR_SUCCESS; } @@ -412,7 +425,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 { va_list ap; int rc; -@@ -399,9 +446,39 @@ +@@ -399,9 +454,39 @@ } va_end(ap); @@ -452,7 +465,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (rc < 0) { return errno; } -@@ -410,7 +487,7 @@ +@@ -410,7 +495,7 @@ } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -461,7 +474,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 { int i; char **environ; -@@ -421,7 +498,7 @@ +@@ -421,7 +506,7 @@ r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -470,7 +483,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (stat != APR_SUCCESS) { return stat; } -@@ -479,14 +556,15 @@ +@@ -479,14 +564,15 @@ return APR_SUCCESS; } @@ -488,7 +501,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (ugid == NULL) { -@@ -507,16 +585,21 @@ +@@ -507,16 +593,21 @@ req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -512,7 +525,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +614,7 @@ +@@ -531,7 +622,7 @@ for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -521,7 +534,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +665,34 @@ +@@ -582,20 +673,34 @@ } } @@ -564,7 +577,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 } static int cgid_server(void *data) -@@ -669,7 +766,7 @@ +@@ -669,7 +774,7 @@ } while (!daemon_should_exit) { @@ -573,7 +586,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -709,7 +806,7 @@ +@@ -709,7 +814,7 @@ r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -582,7 +595,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -741,6 +838,16 @@ +@@ -741,6 +846,16 @@ continue; } @@ -599,7 +612,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -800,7 +907,10 @@ +@@ -800,7 +915,10 @@ close(sd2); } else { @@ -611,7 +624,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -1099,6 +1209,33 @@ +@@ -1099,6 +1217,33 @@ return ret; } @@ -645,7 +658,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1204,6 +1341,11 @@ +@@ -1204,6 +1349,11 @@ return ret; } @@ -657,7 +670,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 static int connect_to_daemon(int *sdptr, request_rec *r, cgid_server_conf *conf) { -@@ -1395,6 +1537,7 @@ +@@ -1395,6 +1545,7 @@ static int cgid_handler(request_rec *r) { @@ -665,7 +678,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 int retval, nph, dbpos; char *argv0, *dbuf; apr_bucket_brigade *bb; -@@ -1404,10 +1547,11 @@ +@@ -1404,10 +1555,11 @@ int seen_eos, child_stopped_reading; int sd; char **env; @@ -678,7 +691,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1416,7 +1560,7 @@ +@@ -1416,7 +1568,7 @@ conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -687,7 +700,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1469,6 +1613,17 @@ +@@ -1469,6 +1621,17 @@ } */ @@ -705,7 +718,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1481,12 +1636,16 @@ +@@ -1481,12 +1644,16 @@ return retval; } @@ -723,7 +736,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; info->r = r; -@@ -1508,12 +1667,7 @@ +@@ -1508,12 +1675,7 @@ */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -737,7 +750,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); /* Transfer any put/post args, CERN style... -@@ -1605,23 +1759,28 @@ +@@ -1605,23 +1767,28 @@ */ shutdown(sd, 1); @@ -774,7 +787,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -@@ -1658,6 +1817,11 @@ +@@ -1658,6 +1825,11 @@ /* Soak up all the script output */ discard_script_output(bb); apr_brigade_destroy(bb); @@ -786,7 +799,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* This redirect needs to be a GET no matter what the original * method was. */ -@@ -1690,7 +1854,6 @@ +@@ -1690,7 +1862,6 @@ } if (nph) { @@ -794,7 +807,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 struct ap_filter_t *cur; /* get rid of all filters up through protocol... since we -@@ -1704,14 +1867,20 @@ +@@ -1704,14 +1875,20 @@ } r->output_filters = r->proto_output_filters = cur; @@ -821,7 +834,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 return OK; /* NOT r->status, even if it has changed. */ } -@@ -1829,7 +1998,7 @@ +@@ -1829,7 +2006,7 @@ return retval; } @@ -830,8 +843,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; ---- httpd-2.4.37/modules/generators/config5.m4 -+++ httpd-2.4.37/modules/generators/config5.m4 +--- httpd-2.4.41/modules/generators/config5.m4 ++++ httpd-2.4.41/modules/generators/config5.m4 @@ -78,4 +78,15 @@ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) @@ -848,9 +861,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 +]) + APACHE_MODPATH_FINISH ---- httpd-2.4.37/modules/generators/cgi_common.h -+++ httpd-2.4.37/modules/generators/cgi_common.h -@@ -0,0 +1,216 @@ +--- httpd-2.4.41/modules/generators/cgi_common.h ++++ httpd-2.4.41/modules/generators/cgi_common.h +@@ -0,0 +1,220 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -902,6 +915,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + apr_pollfd_t fd; + struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); + ++ /* Disable APR timeout handling since we'll use poll() entirely. */ ++ apr_file_pipe_timeout_set(out, 0); ++ apr_file_pipe_timeout_set(err, 0); ++ + APR_BUCKET_INIT(b); + b->free = apr_bucket_free; + b->list = list; diff --git a/httpd.spec b/httpd.spec index 51abf88..b7c7d8d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -77,7 +77,7 @@ Patch38: httpd-2.4.34-sslciphdefault.patch Patch39: httpd-2.4.37-sslprotdefault.patch Patch40: httpd-2.4.39-r1861269.patch Patch41: httpd-2.4.37-r1861793+.patch -Patch42: httpd-2.4.37-r1828172+.patch +Patch42: httpd-2.4.41-r1828172+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -741,6 +741,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Oct 2 2019 Joe Orton - 2.4.41-4 +- mod_cgid: possible stdout timeout handling fix (#1757683) + * Wed Sep 25 2019 Joe Orton - 2.4.41-3 - mod_ssl: restore dependency on /usr/bin/hostname (#1135118) diff --git a/pullrev.sh b/pullrev.sh index 5494c7e..efe221f 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.37 +ver=2.4.41 prefix="httpd-${ver}" suffix="r$1${2:++}" fn="${prefix}-${suffix}.patch" @@ -36,7 +36,7 @@ for r in $*; do echo "+ fetching ${r}" this=`mktemp /tmp/pullrevXXXXXX` svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \ - --addprefix="${prefix}/" > ${this} + -x '*.xml' --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` combinediff --quiet ${prev} ${this} > ${next} rm -f "${this}" From 75477cc3c320a19274efdc96bbd98074c173eecd Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 3 Oct 2019 09:06:46 +0100 Subject: [PATCH 3/8] mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) --- httpd-2.4.41-r1865749.patch | 14 ++++++++++++++ httpd.spec | 7 ++++++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.41-r1865749.patch diff --git a/httpd-2.4.41-r1865749.patch b/httpd-2.4.41-r1865749.patch new file mode 100644 index 0000000..d79a559 --- /dev/null +++ b/httpd-2.4.41-r1865749.patch @@ -0,0 +1,14 @@ +# ./pullrev.sh 1865749 +http://svn.apache.org/viewvc?view=revision&revision=1865749 + +--- httpd-2.4.41/modules/proxy/mod_proxy_balancer.c.r1865749 ++++ httpd-2.4.41/modules/proxy/mod_proxy_balancer.c +@@ -1104,7 +1104,7 @@ + if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname) + return 0; + +- return strcmp(uri.hostname, ap_get_server_name(r)) == 0; ++ return strcasecmp(uri.hostname, ap_get_server_name(r)) == 0; + } + + /* Manages the loadfactors and member status diff --git a/httpd.spec b/httpd.spec index b7c7d8d..4276153 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -83,6 +83,7 @@ Patch42: httpd-2.4.41-r1828172+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch +Patch61: httpd-2.4.41-r1865749.patch # Security fixes @@ -221,6 +222,7 @@ interface for storing and accessing per-user session data. %patch58 -p1 -b .r1738878 %patch60 -p1 -b .enable-sslv3 +%patch61 -p1 -b .r1865749 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -741,6 +743,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 3 2019 Joe Orton - 2.4.41-5 +- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) + * Wed Oct 2 2019 Joe Orton - 2.4.41-4 - mod_cgid: possible stdout timeout handling fix (#1757683) From 93ee9fee48ad0b8ec1d58426304e3d72c6dab8bb Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 3 Oct 2019 09:10:23 +0100 Subject: [PATCH 4/8] Remove suexec patch already merged upstream. --- httpd-2.4.4-r1337344+.patch | 250 ------------------------------------ httpd.spec | 2 - 2 files changed, 252 deletions(-) delete mode 100644 httpd-2.4.4-r1337344+.patch diff --git a/httpd-2.4.4-r1337344+.patch b/httpd-2.4.4-r1337344+.patch deleted file mode 100644 index 6e5c3e7..0000000 --- a/httpd-2.4.4-r1337344+.patch +++ /dev/null @@ -1,250 +0,0 @@ -# ./pullrev.sh 1337344 1341905 1342065 1341930 - -suexec enhancements: - -1) use syslog for logging -2) use capabilities not setuid/setgid root binary - -http://svn.apache.org/viewvc?view=revision&revision=1337344 -http://svn.apache.org/viewvc?view=revision&revision=1341905 -http://svn.apache.org/viewvc?view=revision&revision=1342065 -http://svn.apache.org/viewvc?view=revision&revision=1341930 - ---- httpd-2.4.4/configure.in.r1337344+ -+++ httpd-2.4.4/configure.in -@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin, - - AC_ARG_WITH(suexec-logfile, - APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[ -- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] ) -+ if test "x$withval" = "xyes"; then -+ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file]) -+ fi -+]) -+ -+AC_ARG_WITH(suexec-syslog, -+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[ -+ if test $withval = "yes"; then -+ if test "x${with_suexec_logfile}" != "xno"; then -+ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"]) -+ AC_MSG_ERROR([suexec does not support both logging to file and syslog]) -+ fi -+ AC_CHECK_FUNCS([vsyslog], [], [ -+ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])]) -+ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog]) -+ fi -+]) -+ - - AC_ARG_WITH(suexec-safepath, - APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[ -@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask, - APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[ - AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] ) - -+INSTALL_SUEXEC=setuid -+AC_ARG_ENABLE([suexec-capabilities], -+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [ -+INSTALL_SUEXEC=caps -+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, -+ [Enable if suexec is installed with Linux capabilities, not setuid]) -+]) -+APACHE_SUBST(INSTALL_SUEXEC) -+ - dnl APR should go after the other libs, so the right symbols can be picked up - if test x${apu_found} != xobsolete; then - AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`" ---- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+ -+++ httpd-2.4.4/docs/manual/suexec.html.en -@@ -372,6 +372,21 @@ - together with the --enable-suexec option to let - APACI accept your request for using the suEXEC feature. - -+
--enable-suexec-capabilities
-+ -+
Linux specific: Normally, -+ the suexec binary is installed "setuid/setgid -+ root", which allows it to run with the full privileges of the -+ root user. If this option is used, the suexec -+ binary will instead be installed with only the setuid/setgid -+ "capability" bits set, which is the subset of full root -+ priviliges required for suexec operation. Note that -+ the suexec binary may not be able to write to a log -+ file in this mode; it is recommended that the -+ --with-suexec-syslog --without-suexec-logfile -+ options are used in conjunction with this mode, so that syslog -+ logging is used instead.
-+ -
--with-suexec-bin=PATH
- -
The path to the suexec binary must be hard-coded -@@ -433,6 +448,12 @@ - "suexec_log" and located in your standard logfile - directory (--logfiledir).
- -+
--with-suexec-syslog
-+ -+
If defined, suexec will log notices and errors to syslog -+ instead of a logfile. This option must be combined -+ with --without-suexec-logfile.
-+ -
--with-suexec-safepath=PATH
- -
Define a safe PATH environment to pass to CGI -@@ -550,9 +571,12 @@ Group webgroup - -

The suEXEC wrapper will write log information - to the file defined with the --with-suexec-logfile -- option as indicated above. If you feel you have configured and -- installed the wrapper properly, have a look at this log and the -- error_log for the server to see where you may have gone astray.

-+ option as indicated above, or to syslog if --with-suexec-syslog -+ is used. If you feel you have configured and -+ installed the wrapper properly, have a look at the log and the -+ error_log for the server to see where you may have gone astray. -+ The output of "suexec -V" will show the options -+ used to compile suexec, if using a binary distribution.

- -
top
-
-@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined') - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ ---- httpd-2.4.4/Makefile.in.r1337344+ -+++ httpd-2.4.4/Makefile.in -@@ -238,11 +238,22 @@ install-man: - cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \ - fi - --install-suexec: -+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC) -+ -+install-suexec-binary: - @if test -f $(builddir)/support/suexec; then \ - test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \ - $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \ -- chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-setuid: -+ @if test -f $(builddir)/support/suexec; then \ -+ chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-caps: -+ @if test -f $(builddir)/support/suexec; then \ -+ setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \ - fi - - suexec: ---- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+ -+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c -@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d - return NULL; - } - -+#ifdef AP_SUEXEC_CAPABILITIES -+/* If suexec is using capabilities, don't test for the setuid bit. */ -+#define SETUID_TEST(finfo) (1) -+#else -+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID) -+#endif -+ - static int - unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, - apr_pool_t *ptemp) -@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_ - ap_unixd_config.suexec_enabled = 0; - if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp)) - == APR_SUCCESS) { -- if ((wrapper.protection & APR_USETID) && wrapper.user == 0 -+ if (SETUID_TEST(wrapper) && wrapper.user == 0 - && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) { - ap_unixd_config.suexec_enabled = 1; - ap_unixd_config.suexec_disabled_reason = ""; ---- httpd-2.4.4/support/suexec.c.r1337344+ -+++ httpd-2.4.4/support/suexec.c -@@ -58,6 +58,10 @@ - #include - #endif - -+#ifdef AP_LOG_SYSLOG -+#include -+#endif -+ - #if defined(PATH_MAX) - #define AP_MAXPATH PATH_MAX - #elif defined(MAXPATHLEN) -@@ -69,7 +73,20 @@ - #define AP_ENVBUF 256 - - extern char **environ; -+ -+#ifdef AP_LOG_SYSLOG -+/* Syslog support. */ -+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV) -+#define AP_LOG_FACILITY LOG_AUTHPRIV -+#elif !defined(AP_LOG_FACILITY) -+#define AP_LOG_FACILITY LOG_AUTH -+#endif -+ -+static int log_open; -+#else -+/* Non-syslog support. */ - static FILE *log = NULL; -+#endif - - static const char *const safe_env_lst[] = - { -@@ -137,7 +154,14 @@ static void err_output(int is_error, con - - static void err_output(int is_error, const char *fmt, va_list ap) - { --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ if (!log_open) { -+ openlog("suexec", LOG_PID, AP_LOG_FACILITY); -+ log_open = 1; -+ } -+ -+ vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap); -+#elif defined(AP_LOG_EXEC) - time_t timevar; - struct tm *lt; - -@@ -295,7 +319,9 @@ int main(int argc, char *argv[]) - #ifdef AP_HTTPD_USER - fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER); - #endif --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ fprintf(stderr, " -D AP_LOG_SYSLOG\n"); -+#elif defined(AP_LOG_EXEC) - fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC); - #endif - #ifdef AP_SAFE_PATH -@@ -591,6 +617,12 @@ int main(int argc, char *argv[]) - #endif /* AP_SUEXEC_UMASK */ - - /* Be sure to close the log file so the CGI can't mess with it. */ -+#ifdef AP_LOG_SYSLOG -+ if (log_open) { -+ closelog(); -+ log_open = 0; -+ } -+#else - if (log != NULL) { - #if APR_HAVE_FCNTL_H - /* -@@ -612,6 +644,7 @@ int main(int argc, char *argv[]) - log = NULL; - #endif - } -+#endif - - /* - * Execute the command, replacing our image with its own. diff --git a/httpd.spec b/httpd.spec index 4276153..7bfbf22 100644 --- a/httpd.spec +++ b/httpd.spec @@ -66,7 +66,6 @@ Patch21: httpd-2.4.39-r1842929+.patch Patch23: httpd-2.4.39-export.patch Patch24: httpd-2.4.1-corelimit.patch Patch25: httpd-2.4.25-selinux.patch -Patch26: httpd-2.4.4-r1337344+.patch Patch27: httpd-2.4.2-icons.patch Patch29: httpd-2.4.33-systemd.patch Patch30: httpd-2.4.4-cachehardmax.patch @@ -207,7 +206,6 @@ interface for storing and accessing per-user session data. %patch23 -p1 -b .export %patch24 -p1 -b .corelimit %patch25 -p1 -b .selinux -#patch26 -p1 -b .r1337344+ %patch27 -p1 -b .icons %patch29 -p1 -b .systemd %patch30 -p1 -b .cachehardmax From 0b5ef4808a96dd72c4a9f74c1255fd5b703f94c2 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 4 Oct 2019 16:47:09 +0100 Subject: [PATCH 5/8] mod_cgid/mod_cgi: further upstream consolidation patches --- httpd-2.4.41-r1828172+.patch | 568 +++++++++++++++++++++++++++-------- httpd.spec | 5 +- 2 files changed, 455 insertions(+), 118 deletions(-) diff --git a/httpd-2.4.41-r1828172+.patch b/httpd-2.4.41-r1828172+.patch index 534acef..72b124b 100644 --- a/httpd-2.4.41-r1828172+.patch +++ b/httpd-2.4.41-r1828172+.patch @@ -1,9 +1,12 @@ -# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 +# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 1867968 1867970 1867971 http://svn.apache.org/viewvc?view=revision&revision=1828172 http://svn.apache.org/viewvc?view=revision&revision=1862968 http://svn.apache.org/viewvc?view=revision&revision=1863191 http://svn.apache.org/viewvc?view=revision&revision=1867878 http://svn.apache.org/viewvc?view=revision&revision=1867882 +http://svn.apache.org/viewvc?view=revision&revision=1867968 +http://svn.apache.org/viewvc?view=revision&revision=1867970 +http://svn.apache.org/viewvc?view=revision&revision=1867971 --- httpd-2.4.41/modules/generators/mod_cgi.c +++ httpd-2.4.41/modules/generators/mod_cgi.c @@ -89,9 +92,31 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 } } } -@@ -563,189 +590,7 @@ +@@ -541,212 +568,10 @@ + return APR_SUCCESS; } +-static void discard_script_output(apr_bucket_brigade *bb) +-{ +- apr_bucket *e; +- const char *buf; +- apr_size_t len; +- apr_status_t rv; +- +- for (e = APR_BRIGADE_FIRST(bb); +- e != APR_BRIGADE_SENTINEL(bb); +- e = APR_BUCKET_NEXT(e)) +- { +- if (APR_BUCKET_IS_EOS(e)) { +- break; +- } +- rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ); +- if (rv != APR_SUCCESS) { +- break; +- } +- } +-} +- #if APR_FILES_AS_SOCKETS - -/* A CGI bucket type is needed to catch any output to stderr from the @@ -276,11 +301,13 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 - apr_bucket_copy_notimpl -}; - -+#include "cgi_common.h" ++#define WANT_CGI_BUCKET #endif ++#include "cgi_common.h" static int cgi_handler(request_rec *r) -@@ -766,6 +611,8 @@ + { +@@ -766,6 +591,8 @@ apr_status_t rv; cgi_exec_info_t e_info; conn_rec *c; @@ -289,7 +316,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -925,10 +772,7 @@ +@@ -925,10 +752,7 @@ AP_DEBUG_ASSERT(script_in != NULL); #if APR_FILES_AS_SOCKETS @@ -301,25 +328,120 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -985,7 +829,7 @@ - * stderr output, as normal. */ - discard_script_output(bb); - apr_brigade_destroy(bb); +@@ -938,111 +762,7 @@ + b = apr_bucket_eos_create(c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(bb, b); + +- /* Handle script return... */ +- if (!nph) { +- const char *location; +- char sbuf[MAX_STRING_LEN]; +- int ret; +- +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { +- ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); +- +- /* +- * ret could be HTTP_NOT_MODIFIED in the case that the CGI script +- * does not set an explicit status and ap_meets_conditions, which +- * is called by ap_scan_script_header_err_brigade, detects that +- * the conditions of the requests are met and the response is +- * not modified. +- * In this case set r->status and return OK in order to prevent +- * running through the error processing stack as this would +- * break with mod_cache, if the conditions had been set by +- * mod_cache itself to validate a stale entity. +- * BTW: We circumvent the error processing stack anyway if the +- * CGI script set an explicit status code (whatever it is) and +- * the only possible values for ret here are: +- * +- * HTTP_NOT_MODIFIED (set by ap_meets_conditions) +- * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) +- * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the +- * processing of the response of the CGI script, e.g broken headers +- * or a crashed CGI process). +- */ +- if (ret == HTTP_NOT_MODIFIED) { +- r->status = ret; +- return OK; +- } +- +- return ret; +- } +- +- location = apr_table_get(r->headers_out, "Location"); +- +- if (location && r->status == 200) { +- /* For a redirect whether internal or not, discard any +- * remaining stdout from the script, and log any remaining +- * stderr output, as normal. */ +- discard_script_output(bb); +- apr_brigade_destroy(bb); - apr_file_pipe_timeout_set(script_err, r->server->timeout); -+ apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - -@@ -1036,7 +880,7 @@ - * connection drops or we stopped sending output for some other - * reason */ - if (rv == APR_SUCCESS && !r->connection->aborted) { +- log_script_err(r, script_err); +- } +- +- if (location && location[0] == '/' && r->status == 200) { +- /* This redirect needs to be a GET no matter what the original +- * method was. +- */ +- r->method = "GET"; +- r->method_number = M_GET; +- +- /* We already read the message body (if any), so don't allow +- * the redirected request to think it has one. We can ignore +- * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. +- */ +- apr_table_unset(r->headers_in, "Content-Length"); +- +- ap_internal_redirect_handler(location, r); +- return OK; +- } +- else if (location && r->status == 200) { +- /* XXX: Note that if a script wants to produce its own Redirect +- * body, it now has to explicitly *say* "Status: 302" +- */ +- return HTTP_MOVED_TEMPORARILY; +- } +- +- rv = ap_pass_brigade(r->output_filters, bb); +- } +- else /* nph */ { +- struct ap_filter_t *cur; +- +- /* get rid of all filters up through protocol... since we +- * haven't parsed off the headers, there is no way they can +- * work +- */ +- +- cur = r->proto_output_filters; +- while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { +- cur = cur->next; +- } +- r->output_filters = r->proto_output_filters = cur; +- +- rv = ap_pass_brigade(r->output_filters, bb); +- } +- +- /* don't soak up script output if errors occurred writing it +- * out... otherwise, we prolong the life of the script when the +- * connection drops or we stopped sending output for some other +- * reason */ +- if (rv == APR_SUCCESS && !r->connection->aborted) { - apr_file_pipe_timeout_set(script_err, r->server->timeout); -+ apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } +- log_script_err(r, script_err); +- } +- +- apr_file_close(script_err); +- +- return OK; /* NOT r->status, even if it has changed. */ ++ return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); + } -@@ -1277,7 +1121,7 @@ + /*============================================================================ +@@ -1277,7 +997,7 @@ AP_DECLARE_MODULE(cgi) = { STANDARD20_MODULE_STUFF, @@ -328,6 +450,24 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 NULL, /* dir merger --- default is to override */ create_cgi_config, /* server config */ merge_cgi_config, /* merge server config */ +--- httpd-2.4.41/modules/generators/config5.m4 ++++ httpd-2.4.41/modules/generators/config5.m4 +@@ -78,4 +78,15 @@ + + APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) + ++AC_ARG_ENABLE(cgid-fdpassing, ++ [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)], ++ [if test "$enableval" = "yes"; then ++ AC_CHECK_DECL(CMSG_DATA, ++ [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])], ++ [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [ ++#include ++#include ]) ++ fi ++]) ++ + APACHE_MODPATH_FINISH --- httpd-2.4.41/modules/generators/mod_cgid.c +++ httpd-2.4.41/modules/generators/mod_cgid.c @@ -342,15 +342,19 @@ @@ -658,19 +798,49 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1204,6 +1349,11 @@ +@@ -1204,6 +1349,13 @@ return ret; } -+#ifdef HAVE_CGID_FDPASSING +/* Pull in CGI bucket implementation. */ -+#include "cgi_common.h" ++#define cgi_server_conf cgid_server_conf ++#ifdef HAVE_CGID_FDPASSING ++#define WANT_CGI_BUCKET +#endif ++#include "cgi_common.h" + static int connect_to_daemon(int *sdptr, request_rec *r, cgid_server_conf *conf) { -@@ -1395,6 +1545,7 @@ +@@ -1270,27 +1422,6 @@ + return OK; + } + +-static void discard_script_output(apr_bucket_brigade *bb) +-{ +- apr_bucket *e; +- const char *buf; +- apr_size_t len; +- apr_status_t rv; +- +- for (e = APR_BRIGADE_FIRST(bb); +- e != APR_BRIGADE_SENTINEL(bb); +- e = APR_BUCKET_NEXT(e)) +- { +- if (APR_BUCKET_IS_EOS(e)) { +- break; +- } +- rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ); +- if (rv != APR_SUCCESS) { +- break; +- } +- } +-} +- + /**************************************************************** + * + * Actual cgid handling... +@@ -1395,6 +1526,7 @@ static int cgid_handler(request_rec *r) { @@ -678,7 +848,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 int retval, nph, dbpos; char *argv0, *dbuf; apr_bucket_brigade *bb; -@@ -1404,10 +1555,11 @@ +@@ -1404,10 +1536,11 @@ int seen_eos, child_stopped_reading; int sd; char **env; @@ -691,7 +861,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1416,7 +1568,7 @@ +@@ -1416,7 +1549,7 @@ conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -700,7 +870,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1469,6 +1621,17 @@ +@@ -1469,6 +1602,17 @@ } */ @@ -718,7 +888,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1481,12 +1644,16 @@ +@@ -1481,12 +1625,16 @@ return retval; } @@ -736,7 +906,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; info->r = r; -@@ -1508,12 +1675,7 @@ +@@ -1508,12 +1656,7 @@ */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -750,10 +920,116 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); /* Transfer any put/post args, CERN style... -@@ -1605,23 +1767,28 @@ +@@ -1605,114 +1748,19 @@ */ shutdown(sd, 1); +- /* Handle script return... */ +- if (!nph) { +- conn_rec *c = r->connection; +- const char *location; +- char sbuf[MAX_STRING_LEN]; +- int ret; +- +- bb = apr_brigade_create(r->pool, c->bucket_alloc); +- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- b = apr_bucket_eos_create(c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { +- ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); +- +- /* +- * ret could be HTTP_NOT_MODIFIED in the case that the CGI script +- * does not set an explicit status and ap_meets_conditions, which +- * is called by ap_scan_script_header_err_brigade, detects that +- * the conditions of the requests are met and the response is +- * not modified. +- * In this case set r->status and return OK in order to prevent +- * running through the error processing stack as this would +- * break with mod_cache, if the conditions had been set by +- * mod_cache itself to validate a stale entity. +- * BTW: We circumvent the error processing stack anyway if the +- * CGI script set an explicit status code (whatever it is) and +- * the only possible values for ret here are: +- * +- * HTTP_NOT_MODIFIED (set by ap_meets_conditions) +- * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) +- * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the +- * processing of the response of the CGI script, e.g broken headers +- * or a crashed CGI process). +- */ +- if (ret == HTTP_NOT_MODIFIED) { +- r->status = ret; +- return OK; +- } +- +- return ret; +- } +- +- location = apr_table_get(r->headers_out, "Location"); +- +- if (location && location[0] == '/' && r->status == 200) { +- +- /* Soak up all the script output */ +- discard_script_output(bb); +- apr_brigade_destroy(bb); +- /* This redirect needs to be a GET no matter what the original +- * method was. +- */ +- r->method = "GET"; +- r->method_number = M_GET; +- +- /* We already read the message body (if any), so don't allow +- * the redirected request to think it has one. We can ignore +- * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. +- */ +- apr_table_unset(r->headers_in, "Content-Length"); +- +- ap_internal_redirect_handler(location, r); +- return OK; +- } +- else if (location && r->status == 200) { +- /* XXX: Note that if a script wants to produce its own Redirect +- * body, it now has to explicitly *say* "Status: 302" +- */ +- discard_script_output(bb); +- apr_brigade_destroy(bb); +- return HTTP_MOVED_TEMPORARILY; +- } +- +- rv = ap_pass_brigade(r->output_filters, bb); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, +- "Failed to flush CGI output to client"); +- } +- } +- +- if (nph) { +- conn_rec *c = r->connection; +- struct ap_filter_t *cur; +- +- /* get rid of all filters up through protocol... since we +- * haven't parsed off the headers, there is no way they can +- * work +- */ +- +- cur = r->proto_output_filters; +- while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { +- cur = cur->next; +- } +- r->output_filters = r->proto_output_filters = cur; +- +- bb = apr_brigade_create(r->pool, c->bucket_alloc); +- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- b = apr_bucket_eos_create(c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- ap_pass_brigade(r->output_filters, bb); +- } + bb = apr_brigade_create(r->pool, c->bucket_alloc); +#ifdef HAVE_CGID_FDPASSING + b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc); @@ -765,76 +1041,13 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 + APR_BRIGADE_INSERT_TAIL(bb, b); + b = apr_bucket_eos_create(c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(bb, b); -+ - /* Handle script return... */ - if (!nph) { -- conn_rec *c = r->connection; - const char *location; - char sbuf[MAX_STRING_LEN]; - int ret; -- bb = apr_brigade_create(r->pool, c->bucket_alloc); -- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- b = apr_bucket_eos_create(c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- - if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, - APLOG_MODULE_INDEX))) - { -- ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); -+ ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); - - /* - * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -@@ -1658,6 +1825,11 @@ - /* Soak up all the script output */ - discard_script_output(bb); - apr_brigade_destroy(bb); -+ if (script_err) { -+ apr_file_pipe_timeout_set(script_err, timeout); -+ log_script_err(r, script_err); -+ } -+ - /* This redirect needs to be a GET no matter what the original - * method was. - */ -@@ -1690,7 +1862,6 @@ - } - - if (nph) { -- conn_rec *c = r->connection; - struct ap_filter_t *cur; - - /* get rid of all filters up through protocol... since we -@@ -1704,14 +1875,20 @@ - } - r->output_filters = r->proto_output_filters = cur; - -- bb = apr_brigade_create(r->pool, c->bucket_alloc); -- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- b = apr_bucket_eos_create(c->bucket_alloc); -- APR_BRIGADE_INSERT_TAIL(bb, b); -- ap_pass_brigade(r->output_filters, bb); -+ rv = ap_pass_brigade(r->output_filters, bb); - } - -+ /* don't soak up script output if errors occurred writing it -+ * out... otherwise, we prolong the life of the script when the -+ * connection drops or we stopped sending output for some other -+ * reason */ -+ if (script_err && rv == APR_SUCCESS && !r->connection->aborted) { -+ apr_file_pipe_timeout_set(script_err, timeout); -+ log_script_err(r, script_err); -+ } -+ -+ if (script_err) apr_file_close(script_err); -+ - return OK; /* NOT r->status, even if it has changed. */ +- return OK; /* NOT r->status, even if it has changed. */ ++ return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); } -@@ -1829,7 +2006,7 @@ + +@@ -1829,7 +1877,7 @@ return retval; } @@ -843,27 +1056,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; ---- httpd-2.4.41/modules/generators/config5.m4 -+++ httpd-2.4.41/modules/generators/config5.m4 -@@ -78,4 +78,15 @@ - - APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) - -+AC_ARG_ENABLE(cgid-fdpassing, -+ [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)], -+ [if test "$enableval" = "yes"; then -+ AC_CHECK_DECL(CMSG_DATA, -+ [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])], -+ [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [ -+#include -+#include ]) -+ fi -+]) -+ - APACHE_MODPATH_FINISH --- httpd-2.4.41/modules/generators/cgi_common.h +++ httpd-2.4.41/modules/generators/cgi_common.h -@@ -0,0 +1,220 @@ +@@ -0,0 +1,359 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -893,6 +1088,24 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 +#include "httpd.h" +#include "util_filter.h" + ++static void discard_script_output(apr_bucket_brigade *bb) ++{ ++ apr_bucket *e; ++ const char *buf; ++ apr_size_t len; ++ ++ for (e = APR_BRIGADE_FIRST(bb); ++ e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); ++ e = APR_BRIGADE_FIRST(bb)) ++ { ++ if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { ++ break; ++ } ++ apr_bucket_delete(e); ++ } ++} ++ ++#ifdef WANT_CGI_BUCKET +/* A CGI bucket type is needed to catch any output to stderr from the + * script; see PR 22030. */ +static const apr_bucket_type_t bucket_type_cgi; @@ -1084,3 +1297,124 @@ http://svn.apache.org/viewvc?view=revision&revision=1867882 + apr_bucket_copy_notimpl +}; + ++#endif /* WANT_CGI_BUCKET */ ++ ++/* Handle the CGI response output, having set up the brigade with the ++ * CGI or PIPE bucket as appropriate. */ ++static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb, ++ apr_interval_time_t timeout, cgi_server_conf *conf, ++ char *logdata, apr_file_t *script_err) ++{ ++ apr_status_t rv; ++ ++ /* Handle script return... */ ++ if (!nph) { ++ const char *location; ++ char sbuf[MAX_STRING_LEN]; ++ int ret; ++ ++ if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX))) ++ { ++ ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err); ++ ++ /* ++ * ret could be HTTP_NOT_MODIFIED in the case that the CGI script ++ * does not set an explicit status and ap_meets_conditions, which ++ * is called by ap_scan_script_header_err_brigade, detects that ++ * the conditions of the requests are met and the response is ++ * not modified. ++ * In this case set r->status and return OK in order to prevent ++ * running through the error processing stack as this would ++ * break with mod_cache, if the conditions had been set by ++ * mod_cache itself to validate a stale entity. ++ * BTW: We circumvent the error processing stack anyway if the ++ * CGI script set an explicit status code (whatever it is) and ++ * the only possible values for ret here are: ++ * ++ * HTTP_NOT_MODIFIED (set by ap_meets_conditions) ++ * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) ++ * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the ++ * processing of the response of the CGI script, e.g broken headers ++ * or a crashed CGI process). ++ */ ++ if (ret == HTTP_NOT_MODIFIED) { ++ r->status = ret; ++ return OK; ++ } ++ ++ return ret; ++ } ++ ++ location = apr_table_get(r->headers_out, "Location"); ++ ++ if (location && r->status == 200) { ++ /* For a redirect whether internal or not, discard any ++ * remaining stdout from the script, and log any remaining ++ * stderr output, as normal. */ ++ discard_script_output(bb); ++ apr_brigade_destroy(bb); ++ ++ if (script_err) { ++ apr_file_pipe_timeout_set(script_err, timeout); ++ log_script_err(r, script_err); ++ } ++ } ++ ++ if (location && location[0] == '/' && r->status == 200) { ++ /* This redirect needs to be a GET no matter what the original ++ * method was. ++ */ ++ r->method = "GET"; ++ r->method_number = M_GET; ++ ++ /* We already read the message body (if any), so don't allow ++ * the redirected request to think it has one. We can ignore ++ * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. ++ */ ++ apr_table_unset(r->headers_in, "Content-Length"); ++ ++ ap_internal_redirect_handler(location, r); ++ return OK; ++ } ++ else if (location && r->status == 200) { ++ /* XXX: Note that if a script wants to produce its own Redirect ++ * body, it now has to explicitly *say* "Status: 302" ++ */ ++ discard_script_output(bb); ++ apr_brigade_destroy(bb); ++ return HTTP_MOVED_TEMPORARILY; ++ } ++ ++ rv = ap_pass_brigade(r->output_filters, bb); ++ } ++ else /* nph */ { ++ struct ap_filter_t *cur; ++ ++ /* get rid of all filters up through protocol... since we ++ * haven't parsed off the headers, there is no way they can ++ * work ++ */ ++ ++ cur = r->proto_output_filters; ++ while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { ++ cur = cur->next; ++ } ++ r->output_filters = r->proto_output_filters = cur; ++ ++ rv = ap_pass_brigade(r->output_filters, bb); ++ } ++ ++ /* don't soak up script output if errors occurred writing it ++ * out... otherwise, we prolong the life of the script when the ++ * connection drops or we stopped sending output for some other ++ * reason */ ++ if (script_err && rv == APR_SUCCESS && !r->connection->aborted) { ++ apr_file_pipe_timeout_set(script_err, timeout); ++ log_script_err(r, script_err); ++ } ++ ++ if (script_err) apr_file_close(script_err); ++ ++ return OK; /* NOT r->status, even if it has changed. */ ++} diff --git a/httpd.spec b/httpd.spec index 7bfbf22..709174d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -741,6 +741,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Oct 4 2019 Joe Orton - 2.4.41-6 +- mod_cgid/mod_cgi: further upstream consolidation patches + * Thu Oct 3 2019 Joe Orton - 2.4.41-5 - mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) From 0f1628abfa8fd1a7446978ed9a44ec07e0473d87 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 21 Nov 2019 16:54:17 +0000 Subject: [PATCH 6/8] mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146) Resolves: rhbz#1775146 --- httpd-2.4.41-r1870095.patch | 119 ++++++++++++++++++++++++++++++++++++ httpd.spec | 7 ++- 2 files changed, 125 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.41-r1870095.patch diff --git a/httpd-2.4.41-r1870095.patch b/httpd-2.4.41-r1870095.patch new file mode 100644 index 0000000..5f5b2e2 --- /dev/null +++ b/httpd-2.4.41-r1870095.patch @@ -0,0 +1,119 @@ +# ./pullrev.sh 1870095 +http://svn.apache.org/viewvc?view=revision&revision=1870095 + +https://bugzilla.redhat.com/show_bug.cgi?id=1775146 + +--- httpd-2.4.41/modules/ssl/ssl_engine_kernel.c ++++ httpd-2.4.41/modules/ssl/ssl_engine_kernel.c +@@ -114,6 +114,45 @@ + return result; + } + ++/* If a renegotiation is required for the location, and the request ++ * includes a message body (and the client has not requested a "100 ++ * Continue" response), then the client will be streaming the request ++ * body over the wire already. In that case, it is not possible to ++ * stop and perform a new SSL handshake immediately; once the SSL ++ * library moves to the "accept" state, it will reject the SSL packets ++ * which the client is sending for the request body. ++ * ++ * To allow authentication to complete in the hook, the solution used ++ * here is to fill a (bounded) buffer with the request body, and then ++ * to reinject that request body later. ++ * ++ * This function is called to fill the renegotiation buffer for the ++ * location as required, or fail. Returns zero on success or HTTP_ ++ * error code on failure. ++ */ ++static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc) ++{ ++ int rv; ++ apr_size_t rsize; ++ ++ /* ### this is HTTP/1.1 specific, special case for protocol? */ ++ if (r->expecting_100 || !ap_request_has_body(r)) { ++ return 0; ++ } ++ ++ rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize; ++ if (rsize > 0) { ++ /* Fill the I/O buffer with the request body if possible. */ ++ rv = ssl_io_buffer_fill(r, rsize); ++ } ++ else { ++ /* If the reneg buffer size is set to zero, just fail. */ ++ rv = HTTP_REQUEST_ENTITY_TOO_LARGE; ++ } ++ ++ return rv; ++} ++ + #ifdef HAVE_TLSEXT + static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2) + { +@@ -814,41 +853,14 @@ + } + } + +- /* If a renegotiation is now required for this location, and the +- * request includes a message body (and the client has not +- * requested a "100 Continue" response), then the client will be +- * streaming the request body over the wire already. In that +- * case, it is not possible to stop and perform a new SSL +- * handshake immediately; once the SSL library moves to the +- * "accept" state, it will reject the SSL packets which the client +- * is sending for the request body. +- * +- * To allow authentication to complete in this auth hook, the +- * solution used here is to fill a (bounded) buffer with the +- * request body, and then to reinject that request body later. +- */ +- if (renegotiate && !renegotiate_quick +- && !r->expecting_100 +- && ap_request_has_body(r)) { +- int rv; +- apr_size_t rsize; +- +- rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : +- dc->nRenegBufferSize; +- if (rsize > 0) { +- /* Fill the I/O buffer with the request body if possible. */ +- rv = ssl_io_buffer_fill(r, rsize); +- } +- else { +- /* If the reneg buffer size is set to zero, just fail. */ +- rv = HTTP_REQUEST_ENTITY_TOO_LARGE; +- } +- +- if (rv) { ++ /* Fill reneg buffer if required. */ ++ if (renegotiate && !renegotiate_quick) { ++ rc = fill_reneg_buffer(r, dc); ++ if (rc) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257) + "could not buffer message body to allow " + "SSL renegotiation to proceed"); +- return rv; ++ return rc; + } + } + +@@ -1132,7 +1144,18 @@ + } + } + ++ /* Fill reneg buffer if required. */ + if (change_vmode) { ++ rc = fill_reneg_buffer(r, dc); ++ if (rc) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ "could not buffer message body to allow " ++ "TLS Post-Handshake Authentication to proceed"); ++ return rc; ++ } ++ } ++ ++ if (change_vmode) { + char peekbuf[1]; + + if (r->connection->master) { diff --git a/httpd.spec b/httpd.spec index 709174d..e60bbf9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 6%{?dist} +Release: 6.1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -83,6 +83,7 @@ Patch42: httpd-2.4.41-r1828172+.patch Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch Patch61: httpd-2.4.41-r1865749.patch +Patch62: httpd-2.4.41-r1870095.patch # Security fixes @@ -221,6 +222,7 @@ interface for storing and accessing per-user session data. %patch58 -p1 -b .r1738878 %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1865749 +%patch62 -p1 -b .r1870095 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -741,6 +743,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Nov 21 2019 Joe Orton - 2.4.41-9 +- mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146) + * Fri Oct 4 2019 Joe Orton - 2.4.41-6 - mod_cgid/mod_cgi: further upstream consolidation patches From f425607336f9a9921589e703e5dbf53c697326ab Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 22 Nov 2019 17:18:49 +0000 Subject: [PATCH 7/8] Merge from f31 --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index e60bbf9..410ff7d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -743,7 +743,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Thu Nov 21 2019 Joe Orton - 2.4.41-9 +* Thu Nov 21 2019 Joe Orton - 2.4.41-6.1 - mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146) * Fri Oct 4 2019 Joe Orton - 2.4.41-6 From 1f4a25cb669818590d44b0ddd1ffa5127ac99d8d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 21 Nov 2019 16:56:37 +0000 Subject: [PATCH 8/8] mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146) --- ...-r1870095.patch => httpd-2.4.41-r1870095+.patch | 14 ++++++-------- httpd.spec | 2 +- 2 files changed, 7 insertions(+), 9 deletions(-) rename httpd-2.4.41-r1870095.patch => httpd-2.4.41-r1870095+.patch (96%) diff --git a/httpd-2.4.41-r1870095.patch b/httpd-2.4.41-r1870095+.patch similarity index 96% rename from httpd-2.4.41-r1870095.patch rename to httpd-2.4.41-r1870095+.patch index 5f5b2e2..f29e6f2 100644 --- a/httpd-2.4.41-r1870095.patch +++ b/httpd-2.4.41-r1870095+.patch @@ -1,7 +1,6 @@ -# ./pullrev.sh 1870095 +# ./pullrev.sh 1870095 1870097 http://svn.apache.org/viewvc?view=revision&revision=1870095 - -https://bugzilla.redhat.com/show_bug.cgi?id=1775146 +http://svn.apache.org/viewvc?view=revision&revision=1870097 --- httpd-2.4.41/modules/ssl/ssl_engine_kernel.c +++ httpd-2.4.41/modules/ssl/ssl_engine_kernel.c @@ -98,22 +97,21 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1775146 } } -@@ -1132,7 +1144,18 @@ +@@ -1132,6 +1144,17 @@ } } + /* Fill reneg buffer if required. */ - if (change_vmode) { ++ if (change_vmode) { + rc = fill_reneg_buffer(r, dc); + if (rc) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228) + "could not buffer message body to allow " + "TLS Post-Handshake Authentication to proceed"); + return rc; + } + } + -+ if (change_vmode) { + if (change_vmode) { char peekbuf[1]; - if (r->connection->master) { diff --git a/httpd.spec b/httpd.spec index 410ff7d..a0d706b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -83,7 +83,7 @@ Patch42: httpd-2.4.41-r1828172+.patch Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch Patch61: httpd-2.4.41-r1865749.patch -Patch62: httpd-2.4.41-r1870095.patch +Patch62: httpd-2.4.41-r1870095+.patch # Security fixes