diff --git a/00-mpm.conf b/00-mpm.conf index a4a70b8..b15f913 100644 --- a/00-mpm.conf +++ b/00-mpm.conf @@ -1,5 +1,5 @@ # Select the MPM module which should be used by uncommenting exactly -# one of the following LoadModule lines. See the httpd.conf(5) man +# one of the following LoadModule lines. See the httpd.service(8) man # page for more information on changing the MPM. # prefork MPM: Implements a non-threaded, pre-forking web server diff --git a/httpd-2.4.4-r1337344+.patch b/httpd-2.4.4-r1337344+.patch deleted file mode 100644 index 6e5c3e7..0000000 --- a/httpd-2.4.4-r1337344+.patch +++ /dev/null @@ -1,250 +0,0 @@ -# ./pullrev.sh 1337344 1341905 1342065 1341930 - -suexec enhancements: - -1) use syslog for logging -2) use capabilities not setuid/setgid root binary - -http://svn.apache.org/viewvc?view=revision&revision=1337344 -http://svn.apache.org/viewvc?view=revision&revision=1341905 -http://svn.apache.org/viewvc?view=revision&revision=1342065 -http://svn.apache.org/viewvc?view=revision&revision=1341930 - ---- httpd-2.4.4/configure.in.r1337344+ -+++ httpd-2.4.4/configure.in -@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin, - - AC_ARG_WITH(suexec-logfile, - APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[ -- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] ) -+ if test "x$withval" = "xyes"; then -+ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file]) -+ fi -+]) -+ -+AC_ARG_WITH(suexec-syslog, -+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[ -+ if test $withval = "yes"; then -+ if test "x${with_suexec_logfile}" != "xno"; then -+ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"]) -+ AC_MSG_ERROR([suexec does not support both logging to file and syslog]) -+ fi -+ AC_CHECK_FUNCS([vsyslog], [], [ -+ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])]) -+ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog]) -+ fi -+]) -+ - - AC_ARG_WITH(suexec-safepath, - APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[ -@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask, - APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[ - AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] ) - -+INSTALL_SUEXEC=setuid -+AC_ARG_ENABLE([suexec-capabilities], -+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [ -+INSTALL_SUEXEC=caps -+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, -+ [Enable if suexec is installed with Linux capabilities, not setuid]) -+]) -+APACHE_SUBST(INSTALL_SUEXEC) -+ - dnl APR should go after the other libs, so the right symbols can be picked up - if test x${apu_found} != xobsolete; then - AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`" ---- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+ -+++ httpd-2.4.4/docs/manual/suexec.html.en -@@ -372,6 +372,21 @@ - together with the --enable-suexec option to let - APACI accept your request for using the suEXEC feature. - -+
--enable-suexec-capabilities
-+ -+
Linux specific: Normally, -+ the suexec binary is installed "setuid/setgid -+ root", which allows it to run with the full privileges of the -+ root user. If this option is used, the suexec -+ binary will instead be installed with only the setuid/setgid -+ "capability" bits set, which is the subset of full root -+ priviliges required for suexec operation. Note that -+ the suexec binary may not be able to write to a log -+ file in this mode; it is recommended that the -+ --with-suexec-syslog --without-suexec-logfile -+ options are used in conjunction with this mode, so that syslog -+ logging is used instead.
-+ -
--with-suexec-bin=PATH
- -
The path to the suexec binary must be hard-coded -@@ -433,6 +448,12 @@ - "suexec_log" and located in your standard logfile - directory (--logfiledir).
- -+
--with-suexec-syslog
-+ -+
If defined, suexec will log notices and errors to syslog -+ instead of a logfile. This option must be combined -+ with --without-suexec-logfile.
-+ -
--with-suexec-safepath=PATH
- -
Define a safe PATH environment to pass to CGI -@@ -550,9 +571,12 @@ Group webgroup - -

The suEXEC wrapper will write log information - to the file defined with the --with-suexec-logfile -- option as indicated above. If you feel you have configured and -- installed the wrapper properly, have a look at this log and the -- error_log for the server to see where you may have gone astray.

-+ option as indicated above, or to syslog if --with-suexec-syslog -+ is used. If you feel you have configured and -+ installed the wrapper properly, have a look at the log and the -+ error_log for the server to see where you may have gone astray. -+ The output of "suexec -V" will show the options -+ used to compile suexec, if using a binary distribution.

- -
top
-
-@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined') - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ ---- httpd-2.4.4/Makefile.in.r1337344+ -+++ httpd-2.4.4/Makefile.in -@@ -238,11 +238,22 @@ install-man: - cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \ - fi - --install-suexec: -+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC) -+ -+install-suexec-binary: - @if test -f $(builddir)/support/suexec; then \ - test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \ - $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \ -- chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-setuid: -+ @if test -f $(builddir)/support/suexec; then \ -+ chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-caps: -+ @if test -f $(builddir)/support/suexec; then \ -+ setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \ - fi - - suexec: ---- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+ -+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c -@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d - return NULL; - } - -+#ifdef AP_SUEXEC_CAPABILITIES -+/* If suexec is using capabilities, don't test for the setuid bit. */ -+#define SETUID_TEST(finfo) (1) -+#else -+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID) -+#endif -+ - static int - unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, - apr_pool_t *ptemp) -@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_ - ap_unixd_config.suexec_enabled = 0; - if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp)) - == APR_SUCCESS) { -- if ((wrapper.protection & APR_USETID) && wrapper.user == 0 -+ if (SETUID_TEST(wrapper) && wrapper.user == 0 - && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) { - ap_unixd_config.suexec_enabled = 1; - ap_unixd_config.suexec_disabled_reason = ""; ---- httpd-2.4.4/support/suexec.c.r1337344+ -+++ httpd-2.4.4/support/suexec.c -@@ -58,6 +58,10 @@ - #include - #endif - -+#ifdef AP_LOG_SYSLOG -+#include -+#endif -+ - #if defined(PATH_MAX) - #define AP_MAXPATH PATH_MAX - #elif defined(MAXPATHLEN) -@@ -69,7 +73,20 @@ - #define AP_ENVBUF 256 - - extern char **environ; -+ -+#ifdef AP_LOG_SYSLOG -+/* Syslog support. */ -+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV) -+#define AP_LOG_FACILITY LOG_AUTHPRIV -+#elif !defined(AP_LOG_FACILITY) -+#define AP_LOG_FACILITY LOG_AUTH -+#endif -+ -+static int log_open; -+#else -+/* Non-syslog support. */ - static FILE *log = NULL; -+#endif - - static const char *const safe_env_lst[] = - { -@@ -137,7 +154,14 @@ static void err_output(int is_error, con - - static void err_output(int is_error, const char *fmt, va_list ap) - { --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ if (!log_open) { -+ openlog("suexec", LOG_PID, AP_LOG_FACILITY); -+ log_open = 1; -+ } -+ -+ vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap); -+#elif defined(AP_LOG_EXEC) - time_t timevar; - struct tm *lt; - -@@ -295,7 +319,9 @@ int main(int argc, char *argv[]) - #ifdef AP_HTTPD_USER - fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER); - #endif --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ fprintf(stderr, " -D AP_LOG_SYSLOG\n"); -+#elif defined(AP_LOG_EXEC) - fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC); - #endif - #ifdef AP_SAFE_PATH -@@ -591,6 +617,12 @@ int main(int argc, char *argv[]) - #endif /* AP_SUEXEC_UMASK */ - - /* Be sure to close the log file so the CGI can't mess with it. */ -+#ifdef AP_LOG_SYSLOG -+ if (log_open) { -+ closelog(); -+ log_open = 0; -+ } -+#else - if (log != NULL) { - #if APR_HAVE_FCNTL_H - /* -@@ -612,6 +644,7 @@ int main(int argc, char *argv[]) - log = NULL; - #endif - } -+#endif - - /* - * Execute the command, replacing our image with its own. diff --git a/httpd-2.4.37-r1828172+.patch b/httpd-2.4.41-r1828172+.patch similarity index 94% rename from httpd-2.4.37-r1828172+.patch rename to httpd-2.4.41-r1828172+.patch index 822cccf..534acef 100644 --- a/httpd-2.4.37-r1828172+.patch +++ b/httpd-2.4.41-r1828172+.patch @@ -1,10 +1,12 @@ -# ./pullrev.sh 1828172 1862968 1863191 +# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 http://svn.apache.org/viewvc?view=revision&revision=1828172 http://svn.apache.org/viewvc?view=revision&revision=1862968 http://svn.apache.org/viewvc?view=revision&revision=1863191 +http://svn.apache.org/viewvc?view=revision&revision=1867878 +http://svn.apache.org/viewvc?view=revision&revision=1867882 ---- httpd-2.4.37/modules/generators/mod_cgi.c -+++ httpd-2.4.37/modules/generators/mod_cgi.c +--- httpd-2.4.41/modules/generators/mod_cgi.c ++++ httpd-2.4.41/modules/generators/mod_cgi.c @@ -92,6 +92,10 @@ apr_size_t bufbytes; } cgi_server_conf; @@ -287,16 +289,19 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -928,7 +775,7 @@ - apr_file_pipe_timeout_set(script_in, 0); - apr_file_pipe_timeout_set(script_err, 0); +@@ -925,10 +772,7 @@ + AP_DEBUG_ASSERT(script_in != NULL); + #if APR_FILES_AS_SOCKETS +- apr_file_pipe_timeout_set(script_in, 0); +- apr_file_pipe_timeout_set(script_err, 0); +- - b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc); + b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc); if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -985,7 +832,7 @@ +@@ -985,7 +829,7 @@ * stderr output, as normal. */ discard_script_output(bb); apr_brigade_destroy(bb); @@ -305,7 +310,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 log_script_err(r, script_err); } -@@ -1036,7 +883,7 @@ +@@ -1036,7 +880,7 @@ * connection drops or we stopped sending output for some other * reason */ if (rv == APR_SUCCESS && !r->connection->aborted) { @@ -314,7 +319,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 log_script_err(r, script_err); } -@@ -1277,7 +1124,7 @@ +@@ -1277,7 +1121,7 @@ AP_DECLARE_MODULE(cgi) = { STANDARD20_MODULE_STUFF, @@ -323,8 +328,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 NULL, /* dir merger --- default is to override */ create_cgi_config, /* server config */ merge_cgi_config, /* merge server config */ ---- httpd-2.4.37/modules/generators/mod_cgid.c -+++ httpd-2.4.37/modules/generators/mod_cgid.c +--- httpd-2.4.41/modules/generators/mod_cgid.c ++++ httpd-2.4.41/modules/generators/mod_cgid.c @@ -342,15 +342,19 @@ return close(fd); } @@ -350,7 +355,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +369,52 @@ +@@ -365,9 +369,60 @@ } } while (bytes_read < buf_size); @@ -366,11 +371,12 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + + msg.msg_iov = &vec; + msg.msg_iovlen = 1; -+ -+ msg.msg_control = u.buf; -+ msg.msg_controllen = sizeof(u.buf); + -+ if (errfd) *errfd = 0; ++ if (errfd) { ++ msg.msg_control = u.buf; ++ msg.msg_controllen = sizeof(u.buf); ++ *errfd = 0; ++ } + + /* use MSG_WAITALL to skip loop on truncated reads */ + do { @@ -380,10 +386,17 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + if (rc == 0) { + return ECONNRESET; + } -+ -+ cmsg = CMSG_FIRSTHDR(&msg); ++ else if (rc < 0) { ++ return errno; ++ } ++ else if (rc != buf_size) { ++ /* MSG_WAITALL should ensure the recvmsg blocks until the ++ * entire length is read, but let's be paranoid. */ ++ return APR_INCOMPLETE; ++ } ++ + if (errfd -+ && cmsg ++ && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL + && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd)) + && cmsg->cmsg_level == SOL_SOCKET + && cmsg->cmsg_type == SCM_RIGHTS) { @@ -403,7 +416,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +431,7 @@ +@@ -384,7 +439,7 @@ return APR_SUCCESS; } @@ -412,7 +425,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 { va_list ap; int rc; -@@ -399,9 +446,39 @@ +@@ -399,9 +454,39 @@ } va_end(ap); @@ -452,7 +465,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (rc < 0) { return errno; } -@@ -410,7 +487,7 @@ +@@ -410,7 +495,7 @@ } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -461,7 +474,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 { int i; char **environ; -@@ -421,7 +498,7 @@ +@@ -421,7 +506,7 @@ r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -470,7 +483,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (stat != APR_SUCCESS) { return stat; } -@@ -479,14 +556,15 @@ +@@ -479,14 +564,15 @@ return APR_SUCCESS; } @@ -488,7 +501,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (ugid == NULL) { -@@ -507,16 +585,21 @@ +@@ -507,16 +593,21 @@ req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -512,7 +525,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +614,7 @@ +@@ -531,7 +622,7 @@ for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -521,7 +534,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +665,34 @@ +@@ -582,20 +673,34 @@ } } @@ -564,7 +577,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 } static int cgid_server(void *data) -@@ -669,7 +766,7 @@ +@@ -669,7 +774,7 @@ } while (!daemon_should_exit) { @@ -573,7 +586,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -709,7 +806,7 @@ +@@ -709,7 +814,7 @@ r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -582,7 +595,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -741,6 +838,16 @@ +@@ -741,6 +846,16 @@ continue; } @@ -599,7 +612,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -800,7 +907,10 @@ +@@ -800,7 +915,10 @@ close(sd2); } else { @@ -611,7 +624,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -1099,6 +1209,33 @@ +@@ -1099,6 +1217,33 @@ return ret; } @@ -645,7 +658,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1204,6 +1341,11 @@ +@@ -1204,6 +1349,11 @@ return ret; } @@ -657,7 +670,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 static int connect_to_daemon(int *sdptr, request_rec *r, cgid_server_conf *conf) { -@@ -1395,6 +1537,7 @@ +@@ -1395,6 +1545,7 @@ static int cgid_handler(request_rec *r) { @@ -665,7 +678,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 int retval, nph, dbpos; char *argv0, *dbuf; apr_bucket_brigade *bb; -@@ -1404,10 +1547,11 @@ +@@ -1404,10 +1555,11 @@ int seen_eos, child_stopped_reading; int sd; char **env; @@ -678,7 +691,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1416,7 +1560,7 @@ +@@ -1416,7 +1568,7 @@ conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -687,7 +700,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1469,6 +1613,17 @@ +@@ -1469,6 +1621,17 @@ } */ @@ -705,7 +718,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1481,12 +1636,16 @@ +@@ -1481,12 +1644,16 @@ return retval; } @@ -723,7 +736,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; info->r = r; -@@ -1508,12 +1667,7 @@ +@@ -1508,12 +1675,7 @@ */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -737,7 +750,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); /* Transfer any put/post args, CERN style... -@@ -1605,23 +1759,28 @@ +@@ -1605,23 +1767,28 @@ */ shutdown(sd, 1); @@ -774,7 +787,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -@@ -1658,6 +1817,11 @@ +@@ -1658,6 +1825,11 @@ /* Soak up all the script output */ discard_script_output(bb); apr_brigade_destroy(bb); @@ -786,7 +799,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* This redirect needs to be a GET no matter what the original * method was. */ -@@ -1690,7 +1854,6 @@ +@@ -1690,7 +1862,6 @@ } if (nph) { @@ -794,7 +807,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 struct ap_filter_t *cur; /* get rid of all filters up through protocol... since we -@@ -1704,14 +1867,20 @@ +@@ -1704,14 +1875,20 @@ } r->output_filters = r->proto_output_filters = cur; @@ -821,7 +834,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 return OK; /* NOT r->status, even if it has changed. */ } -@@ -1829,7 +1998,7 @@ +@@ -1829,7 +2006,7 @@ return retval; } @@ -830,8 +843,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; ---- httpd-2.4.37/modules/generators/config5.m4 -+++ httpd-2.4.37/modules/generators/config5.m4 +--- httpd-2.4.41/modules/generators/config5.m4 ++++ httpd-2.4.41/modules/generators/config5.m4 @@ -78,4 +78,15 @@ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) @@ -848,9 +861,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 +]) + APACHE_MODPATH_FINISH ---- httpd-2.4.37/modules/generators/cgi_common.h -+++ httpd-2.4.37/modules/generators/cgi_common.h -@@ -0,0 +1,216 @@ +--- httpd-2.4.41/modules/generators/cgi_common.h ++++ httpd-2.4.41/modules/generators/cgi_common.h +@@ -0,0 +1,220 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -902,6 +915,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + apr_pollfd_t fd; + struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); + ++ /* Disable APR timeout handling since we'll use poll() entirely. */ ++ apr_file_pipe_timeout_set(out, 0); ++ apr_file_pipe_timeout_set(err, 0); ++ + APR_BUCKET_INIT(b); + b->free = apr_bucket_free; + b->list = list; diff --git a/httpd-2.4.41-r1865749.patch b/httpd-2.4.41-r1865749.patch new file mode 100644 index 0000000..d79a559 --- /dev/null +++ b/httpd-2.4.41-r1865749.patch @@ -0,0 +1,14 @@ +# ./pullrev.sh 1865749 +http://svn.apache.org/viewvc?view=revision&revision=1865749 + +--- httpd-2.4.41/modules/proxy/mod_proxy_balancer.c.r1865749 ++++ httpd-2.4.41/modules/proxy/mod_proxy_balancer.c +@@ -1104,7 +1104,7 @@ + if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname) + return 0; + +- return strcmp(uri.hostname, ap_get_server_name(r)) == 0; ++ return strcasecmp(uri.hostname, ap_get_server_name(r)) == 0; + } + + /* Manages the loadfactors and member status diff --git a/httpd.conf b/httpd.conf index 6ab68cb..a7af0dc 100644 --- a/httpd.conf +++ b/httpd.conf @@ -6,9 +6,6 @@ # # for a discussion of each configuration directive. # -# See the httpd.conf(5) man page for more information on this configuration, -# and httpd.service(8) on using and configuring the httpd service. -# # Do NOT simply read the instructions in here without understanding # what they do. They're here only as hints or reminders. If you are unsure # consult the online docs. You have been warned. diff --git a/httpd.spec b/httpd.spec index ed18bf1..7bfbf22 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 1%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -66,7 +66,6 @@ Patch21: httpd-2.4.39-r1842929+.patch Patch23: httpd-2.4.39-export.patch Patch24: httpd-2.4.1-corelimit.patch Patch25: httpd-2.4.25-selinux.patch -Patch26: httpd-2.4.4-r1337344+.patch Patch27: httpd-2.4.2-icons.patch Patch29: httpd-2.4.33-systemd.patch Patch30: httpd-2.4.4-cachehardmax.patch @@ -77,12 +76,13 @@ Patch38: httpd-2.4.34-sslciphdefault.patch Patch39: httpd-2.4.37-sslprotdefault.patch Patch40: httpd-2.4.39-r1861269.patch Patch41: httpd-2.4.37-r1861793+.patch -Patch42: httpd-2.4.37-r1828172+.patch +Patch42: httpd-2.4.41-r1828172+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch +Patch61: httpd-2.4.41-r1865749.patch # Security fixes @@ -158,7 +158,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 2.2.0 +Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 @@ -206,7 +206,6 @@ interface for storing and accessing per-user session data. %patch23 -p1 -b .export %patch24 -p1 -b .corelimit %patch25 -p1 -b .selinux -#patch26 -p1 -b .r1337344+ %patch27 -p1 -b .icons %patch29 -p1 -b .systemd %patch30 -p1 -b .cachehardmax @@ -221,6 +220,7 @@ interface for storing and accessing per-user session data. %patch58 -p1 -b .r1738878 %patch60 -p1 -b .enable-sslv3 +%patch61 -p1 -b .r1865749 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -741,6 +741,15 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 3 2019 Joe Orton - 2.4.41-5 +- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) + +* Wed Oct 2 2019 Joe Orton - 2.4.41-4 +- mod_cgid: possible stdout timeout handling fix (#1757683) + +* Wed Sep 25 2019 Joe Orton - 2.4.41-3 +- mod_ssl: restore dependency on /usr/bin/hostname (#1135118) + * Thu Aug 15 2019 Joe Orton - 2.4.41-1 - update to 2.4.41 diff --git a/pullrev.sh b/pullrev.sh index 5494c7e..efe221f 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.37 +ver=2.4.41 prefix="httpd-${ver}" suffix="r$1${2:++}" fn="${prefix}-${suffix}.patch" @@ -36,7 +36,7 @@ for r in $*; do echo "+ fetching ${r}" this=`mktemp /tmp/pullrevXXXXXX` svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \ - --addprefix="${prefix}/" > ${this} + -x '*.xml' --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` combinediff --quiet ${prev} ${this} > ${next} rm -f "${this}"