From 9b68b2a610991612a0c8064675e4d83589c04983 Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Fri, 23 Nov 2018 14:11:55 +0100 Subject: [PATCH 01/11] Resolves: #1652678 - TLS connection allowed while all protocols are forbidden --- httpd-2.4.34-sslprotdefault.patch | 53 ----------------- httpd-2.4.37-sslprotdefault.patch | 98 +++++++++++++++++++++++++++++++ httpd.spec | 5 +- 3 files changed, 102 insertions(+), 54 deletions(-) delete mode 100644 httpd-2.4.34-sslprotdefault.patch create mode 100644 httpd-2.4.37-sslprotdefault.patch diff --git a/httpd-2.4.34-sslprotdefault.patch b/httpd-2.4.34-sslprotdefault.patch deleted file mode 100644 index 65f8d40..0000000 --- a/httpd-2.4.34-sslprotdefault.patch +++ /dev/null @@ -1,53 +0,0 @@ - -https://bugzilla.redhat.com/show_bug.cgi?id=1618371 - ---- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslprotdefault -+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c -@@ -119,7 +119,7 @@ - mctx->ticket_key = NULL; - #endif - -- mctx->protocol = SSL_PROTOCOL_DEFAULT; -+ mctx->protocol = SSL_PROTOCOL_NONE; - mctx->protocol_set = 0; - - mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; ---- httpd-2.4.34/modules/ssl/ssl_engine_init.c.sslprotdefault -+++ httpd-2.4.34/modules/ssl/ssl_engine_init.c -@@ -555,9 +555,8 @@ - * Create the new per-server SSL context - */ - if (protocol == SSL_PROTOCOL_NONE) { -- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) -- "No SSL protocols available [hint: SSLProtocol]"); -- return ssl_die(s); -+ ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, -+ "Using OpenSSL/system default SSL/TLS protocols"); - } - - cp = apr_pstrcat(p, -@@ -673,14 +672,8 @@ - } else if (protocol & SSL_PROTOCOL_SSLV3) { - prot = SSL3_VERSION; - #endif -- } else { -- SSL_CTX_free(ctx); -- mctx->ssl_ctx = NULL; -- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) -- "No SSL protocols available [hint: SSLProtocol]"); -- return ssl_die(s); - } -- SSL_CTX_set_max_proto_version(ctx, prot); -+ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot); - - /* Next we scan for the minimal protocol version we should provide, - * but we do not allow holes between max and min */ -@@ -700,7 +693,7 @@ - prot = SSL3_VERSION; - } - #endif -- SSL_CTX_set_min_proto_version(ctx, prot); -+ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot); - #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */ - - #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE diff --git a/httpd-2.4.37-sslprotdefault.patch b/httpd-2.4.37-sslprotdefault.patch new file mode 100644 index 0000000..546fa1f --- /dev/null +++ b/httpd-2.4.37-sslprotdefault.patch @@ -0,0 +1,98 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 55c237e..5467d23 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) + mctx->ticket_key = NULL; + #endif + +- mctx->protocol = SSL_PROTOCOL_DEFAULT; ++ mctx->protocol = SSL_PROTOCOL_NONE; + mctx->protocol_set = 0; + + mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; +@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, + { + if (add->protocol_set) { + mrg->protocol = add->protocol; ++ mrg->protocol_set = 1; + } + else { + mrg->protocol = base->protocol; +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index e3f62fe..31fc0e6 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL; + char *cp; + int protocol = mctx->protocol; ++ int protocol_set = mctx->protocol_set; + SSLSrvConfigRec *sc = mySrvConfig(s); + #if OPENSSL_VERSION_NUMBER >= 0x10100000L + int prot; +@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + * Create the new per-server SSL context + */ + if (protocol == SSL_PROTOCOL_NONE) { +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); +- } ++ if (protocol_set) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) ++ "No SSL protocols available [hint: SSLProtocol]"); ++ return ssl_die(s); ++ } + +- cp = apr_pstrcat(p, ++ ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, ++ "Using OpenSSL/system default SSL/TLS protocols"); ++ cp = "default"; ++ } ++ else { ++ cp = apr_pstrcat(p, + #ifndef OPENSSL_NO_SSL3 + (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""), + #endif +@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + #endif + #endif + NULL); +- cp[strlen(cp)-2] = NUL; ++ cp[strlen(cp)-2] = NUL; ++ } + + ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, + "Creating new SSL context (protocols: %s)", cp); +@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + prot = SSL3_VERSION; + #endif + } else { +- SSL_CTX_free(ctx); +- mctx->ssl_ctx = NULL; +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); ++ if (protocol_set) { ++ SSL_CTX_free(ctx); ++ mctx->ssl_ctx = NULL; ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) ++ "No SSL protocols available [hint: SSLProtocol]"); ++ return ssl_die(s); ++ } + } +- SSL_CTX_set_max_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot); + + /* Next we scan for the minimal protocol version we should provide, + * but we do not allow holes between max and min */ +@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + prot = SSL3_VERSION; + } + #endif +- SSL_CTX_set_min_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot); + #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */ + + #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE diff --git a/httpd.spec b/httpd.spec index 715a9e8..0bf8766 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.37 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -739,6 +739,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Nov 23 2018 Lubos Uhliarik - 2.4.37-5 +- Resolves: #1652678 - TLS connection allowed while all protocols are forbidden + * Thu Nov 8 2018 Joe Orton - 2.4.37-4 - add httpd.conf(5) (#1611361) From 83aac263304f4a2f1f487ef50dfb119969c19d0d Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Fri, 23 Nov 2018 14:13:29 +0100 Subject: [PATCH 02/11] Related: #1652678 - TLS connection allowed while all protocols are forbidden --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 0bf8766..41fb5e3 100644 --- a/httpd.spec +++ b/httpd.spec @@ -76,7 +76,7 @@ Patch31: httpd-2.4.33-sslmultiproxy.patch Patch34: httpd-2.4.17-socket-activation.patch Patch36: httpd-2.4.33-r1830819+.patch Patch38: httpd-2.4.34-sslciphdefault.patch -Patch39: httpd-2.4.34-sslprotdefault.patch +Patch39: httpd-2.4.37-sslprotdefault.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 From 78a459c1bf07b204c5aee534c088f10565edc2f2 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 16 Apr 2019 08:49:29 +0100 Subject: [PATCH 03/11] - mod_reqtimeout: fix default values regression (PR 63325) --- httpd-2.4.37-r1857129.patch | 65 +++++++++++++++++++++++++++++++++++++ httpd.spec | 7 ++++ 2 files changed, 72 insertions(+) create mode 100644 httpd-2.4.37-r1857129.patch diff --git a/httpd-2.4.37-r1857129.patch b/httpd-2.4.37-r1857129.patch new file mode 100644 index 0000000..4dbf05a --- /dev/null +++ b/httpd-2.4.37-r1857129.patch @@ -0,0 +1,65 @@ +# ./pullrev.sh 1857129 +http://svn.apache.org/viewvc?view=revision&revision=1857129 + +--- httpd-2.4.37/modules/filters/mod_reqtimeout.c ++++ httpd-2.4.37/modules/filters/mod_reqtimeout.c +@@ -31,7 +31,7 @@ + #define UNSET -1 + #define MRT_DEFAULT_handshake_TIMEOUT 0 /* disabled */ + #define MRT_DEFAULT_handshake_MAX_TIMEOUT 0 +-#define MRT_DEFAULT_handshake_MIN_RATE APR_INT32_MAX ++#define MRT_DEFAULT_handshake_MIN_RATE 0 + #define MRT_DEFAULT_header_TIMEOUT 20 + #define MRT_DEFAULT_header_MAX_TIMEOUT 40 + #define MRT_DEFAULT_header_MIN_RATE 500 +@@ -220,7 +220,7 @@ + if (block == APR_NONBLOCK_READ || mode == AP_MODE_INIT + || mode == AP_MODE_EATCRLF) { + rv = ap_get_brigade(f->next, bb, mode, block, readbytes); +- if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS) { ++ if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS) { + extend_timeout(ccfg, bb); + } + return rv; +@@ -254,7 +254,7 @@ + } + + if (!APR_BRIGADE_EMPTY(bb)) { +- if (ccfg->cur_stage.rate_factor > 0) { ++ if (ccfg->cur_stage.rate_factor) { + extend_timeout(ccfg, bb); + } + +@@ -315,7 +315,7 @@ + * the real (relevant) bytes to be asked later, within the + * currently alloted time. + */ +- if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS ++ if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS + && mode != AP_MODE_SPECULATIVE) { + extend_timeout(ccfg, bb); + } +@@ -638,17 +638,17 @@ + ap_hook_post_read_request(reqtimeout_before_body, NULL, NULL, + APR_HOOK_MIDDLE); + +-#if MRT_DEFAULT_HANDSHAKE_MIN_RATE > 0 ++#if MRT_DEFAULT_handshake_MIN_RATE + default_handshake_rate_factor = apr_time_from_sec(1) / +- MRT_DEFAULT_HANDSHAKE_MIN_RATE; ++ MRT_DEFAULT_handshake_MIN_RATE; + #endif +-#if MRT_DEFAULT_HEADER_MIN_RATE > 0 ++#if MRT_DEFAULT_header_MIN_RATE + default_header_rate_factor = apr_time_from_sec(1) / +- MRT_DEFAULT_HEADER_MIN_RATE; ++ MRT_DEFAULT_header_MIN_RATE; + #endif +-#if MRT_DEFAULT_BODY_MIN_RATE > 0 ++#if MRT_DEFAULT_body_MIN_RATE + default_body_rate_factor = apr_time_from_sec(1) / +- MRT_DEFAULT_BODY_MIN_RATE; ++ MRT_DEFAULT_body_MIN_RATE; + #endif + } + diff --git a/httpd.spec b/httpd.spec index 8078bda..40148b0 100644 --- a/httpd.spec +++ b/httpd.spec @@ -81,6 +81,8 @@ Patch39: httpd-2.4.37-sslprotdefault.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch +# https://bz.apache.org/bugzilla/show_bug.cgi?id=63325 +Patch61: httpd-2.4.37-r1857129.patch # Security fixes @@ -228,6 +230,7 @@ interface for storing and accessing per-user session data. %patch58 -p1 -b .r1738878 %patch60 -p1 -b .enable-sslv3 +%patch61 -p1 -b .r1857129 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -731,6 +734,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Apr 9 2019 Joe Orton - 2.4.39-3 +- fix statedir symlink to point to /var/lib/httpd (#1697662) +- mod_reqtimeout: fix default values regression (PR 63325) + * Tue Apr 02 2019 Lubos Uhliarik - 2.4.39-2 - update to 2.4.39 From 18806f84ade65779711f21ff321f8d7d63eba3cd Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 16 Apr 2019 08:45:34 +0100 Subject: [PATCH 04/11] Grammar fixes/tweaks. --- httpd.conf.xml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/httpd.conf.xml b/httpd.conf.xml index 3a02111..13e5d69 100644 --- a/httpd.conf.xml +++ b/httpd.conf.xml @@ -129,12 +129,12 @@ Module configuration files Module configuration files are provided in the - /etc/httpd/conf.modules.d/ directory. Filenames - in this directory are by convention prefixed with two digit numeric - prefix to ensure they are processed in the desired order. Core - modules provide with the httpd package are - loaded by files with a prefix to ensure - these are loaded first. Only filenames with a + /etc/httpd/conf.modules.d/ directory. + Filenames in this directory are by convention prefixed with two + digit numeric prefix to ensure they are processed in the desired + order. Core modules provided with the httpd + package are loaded by files with a prefix + to ensure these load first. Only filenames with a suffix in this directory will be processed. @@ -160,8 +160,8 @@ /etc/httpd/conf.modules.d/00-systemd.conf This file loads which is necessary for the correct operation of the - httpd.service service, and should not be - removed or disabled. + httpd.service systemd unit, and should + not be removed or disabled. From 56d5617a1c06f685964bb1f5db332a4b0ad118c3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 16 Apr 2019 09:10:28 +0100 Subject: [PATCH 05/11] - fix systemd_postun usage. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 40148b0..4360549 100644 --- a/httpd.spec +++ b/httpd.spec @@ -546,7 +546,7 @@ exit 0 %systemd_preun httpd.service htcacheclean.service httpd.socket %postun -%systemd_postun +%systemd_postun httpd.service htcacheclean.service httpd.socket # Trigger for conversion from SysV, per guidelines at: # https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd From de55b6ba3b75c2dd6045b1430a1421790952d799 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 16 Apr 2019 08:48:10 +0100 Subject: [PATCH 06/11] - fix statedir symlink to point to /var/lib/httpd (#1697662) --- httpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 4360549..ff6ec31 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.39 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -466,7 +466,7 @@ ln -s ../../pixmaps/poweredby.png \ # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs -ln -s ../..%{_localstatedir}/lib/httpd/state $RPM_BUILD_ROOT/etc/httpd/state +ln -s ../..%{_localstatedir}/lib/httpd $RPM_BUILD_ROOT/etc/httpd/state ln -s /run/httpd $RPM_BUILD_ROOT/etc/httpd/run ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules From 4a9b5752e3d3b7d347c08ffa0ca4be81d800b1f5 Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Fri, 16 Aug 2019 00:14:09 +0200 Subject: [PATCH 07/11] Removed patch, which is already part of upstream codebase --- httpd-2.4.37-r1857129.patch | 65 ------------------------------------- httpd.spec | 5 +-- 2 files changed, 1 insertion(+), 69 deletions(-) delete mode 100644 httpd-2.4.37-r1857129.patch diff --git a/httpd-2.4.37-r1857129.patch b/httpd-2.4.37-r1857129.patch deleted file mode 100644 index 4dbf05a..0000000 --- a/httpd-2.4.37-r1857129.patch +++ /dev/null @@ -1,65 +0,0 @@ -# ./pullrev.sh 1857129 -http://svn.apache.org/viewvc?view=revision&revision=1857129 - ---- httpd-2.4.37/modules/filters/mod_reqtimeout.c -+++ httpd-2.4.37/modules/filters/mod_reqtimeout.c -@@ -31,7 +31,7 @@ - #define UNSET -1 - #define MRT_DEFAULT_handshake_TIMEOUT 0 /* disabled */ - #define MRT_DEFAULT_handshake_MAX_TIMEOUT 0 --#define MRT_DEFAULT_handshake_MIN_RATE APR_INT32_MAX -+#define MRT_DEFAULT_handshake_MIN_RATE 0 - #define MRT_DEFAULT_header_TIMEOUT 20 - #define MRT_DEFAULT_header_MAX_TIMEOUT 40 - #define MRT_DEFAULT_header_MIN_RATE 500 -@@ -220,7 +220,7 @@ - if (block == APR_NONBLOCK_READ || mode == AP_MODE_INIT - || mode == AP_MODE_EATCRLF) { - rv = ap_get_brigade(f->next, bb, mode, block, readbytes); -- if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS) { -+ if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS) { - extend_timeout(ccfg, bb); - } - return rv; -@@ -254,7 +254,7 @@ - } - - if (!APR_BRIGADE_EMPTY(bb)) { -- if (ccfg->cur_stage.rate_factor > 0) { -+ if (ccfg->cur_stage.rate_factor) { - extend_timeout(ccfg, bb); - } - -@@ -315,7 +315,7 @@ - * the real (relevant) bytes to be asked later, within the - * currently alloted time. - */ -- if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS -+ if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS - && mode != AP_MODE_SPECULATIVE) { - extend_timeout(ccfg, bb); - } -@@ -638,17 +638,17 @@ - ap_hook_post_read_request(reqtimeout_before_body, NULL, NULL, - APR_HOOK_MIDDLE); - --#if MRT_DEFAULT_HANDSHAKE_MIN_RATE > 0 -+#if MRT_DEFAULT_handshake_MIN_RATE - default_handshake_rate_factor = apr_time_from_sec(1) / -- MRT_DEFAULT_HANDSHAKE_MIN_RATE; -+ MRT_DEFAULT_handshake_MIN_RATE; - #endif --#if MRT_DEFAULT_HEADER_MIN_RATE > 0 -+#if MRT_DEFAULT_header_MIN_RATE - default_header_rate_factor = apr_time_from_sec(1) / -- MRT_DEFAULT_HEADER_MIN_RATE; -+ MRT_DEFAULT_header_MIN_RATE; - #endif --#if MRT_DEFAULT_BODY_MIN_RATE > 0 -+#if MRT_DEFAULT_body_MIN_RATE - default_body_rate_factor = apr_time_from_sec(1) / -- MRT_DEFAULT_BODY_MIN_RATE; -+ MRT_DEFAULT_body_MIN_RATE; - #endif - } - diff --git a/httpd.spec b/httpd.spec index 9eda715..ed18bf1 100644 --- a/httpd.spec +++ b/httpd.spec @@ -83,8 +83,6 @@ Patch42: httpd-2.4.37-r1828172+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch -# https://bz.apache.org/bugzilla/show_bug.cgi?id=63325 -Patch61: httpd-2.4.37-r1857129.patch # Security fixes @@ -223,7 +221,6 @@ interface for storing and accessing per-user session data. %patch58 -p1 -b .r1738878 %patch60 -p1 -b .enable-sslv3 -%patch61 -p1 -b .r1857129 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -808,7 +805,7 @@ exit $rv * Mon Jan 14 2019 Björn Esser - 2.4.37-6 - Rebuilt for libcrypt.so.2 (#1666033) -* Thu Nov 22 2018 Lubos Uhliarik - 2.4.37-5 +* Thu Nov 22 2018 Luboš Uhliarik - 2.4.37-5 - Resolves: #1652678 - TLS connection allowed while all protocols are forbidden * Thu Nov 8 2018 Joe Orton - 2.4.37-4 From 772e6b5324205514918e095c2329bdebe203113f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 25 Sep 2019 15:23:20 +0100 Subject: [PATCH 08/11] mod_ssl: restore dependency on /usr/bin/hostname (#1135118) Resolves: rhbz#1135118 --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index ed18bf1..51abf88 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 1%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -158,7 +158,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 2.2.0 +Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 @@ -741,6 +741,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Sep 25 2019 Joe Orton - 2.4.41-3 +- mod_ssl: restore dependency on /usr/bin/hostname (#1135118) + * Thu Aug 15 2019 Joe Orton - 2.4.41-1 - update to 2.4.41 From da11a1328607034f40bf58cc0237232a68372b2f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 2 Oct 2019 11:47:35 +0100 Subject: [PATCH 09/11] mod_cgid: possible stdout timeout handling fix (#1757683) Resolves: rhbz#1757683 --- ...172+.patch => httpd-2.4.41-r1828172+.patch | 115 ++++++++++-------- httpd.spec | 7 +- pullrev.sh | 4 +- 3 files changed, 73 insertions(+), 53 deletions(-) rename httpd-2.4.37-r1828172+.patch => httpd-2.4.41-r1828172+.patch (94%) diff --git a/httpd-2.4.37-r1828172+.patch b/httpd-2.4.41-r1828172+.patch similarity index 94% rename from httpd-2.4.37-r1828172+.patch rename to httpd-2.4.41-r1828172+.patch index 822cccf..534acef 100644 --- a/httpd-2.4.37-r1828172+.patch +++ b/httpd-2.4.41-r1828172+.patch @@ -1,10 +1,12 @@ -# ./pullrev.sh 1828172 1862968 1863191 +# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 http://svn.apache.org/viewvc?view=revision&revision=1828172 http://svn.apache.org/viewvc?view=revision&revision=1862968 http://svn.apache.org/viewvc?view=revision&revision=1863191 +http://svn.apache.org/viewvc?view=revision&revision=1867878 +http://svn.apache.org/viewvc?view=revision&revision=1867882 ---- httpd-2.4.37/modules/generators/mod_cgi.c -+++ httpd-2.4.37/modules/generators/mod_cgi.c +--- httpd-2.4.41/modules/generators/mod_cgi.c ++++ httpd-2.4.41/modules/generators/mod_cgi.c @@ -92,6 +92,10 @@ apr_size_t bufbytes; } cgi_server_conf; @@ -287,16 +289,19 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -928,7 +775,7 @@ - apr_file_pipe_timeout_set(script_in, 0); - apr_file_pipe_timeout_set(script_err, 0); +@@ -925,10 +772,7 @@ + AP_DEBUG_ASSERT(script_in != NULL); + #if APR_FILES_AS_SOCKETS +- apr_file_pipe_timeout_set(script_in, 0); +- apr_file_pipe_timeout_set(script_err, 0); +- - b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc); + b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc); if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -985,7 +832,7 @@ +@@ -985,7 +829,7 @@ * stderr output, as normal. */ discard_script_output(bb); apr_brigade_destroy(bb); @@ -305,7 +310,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 log_script_err(r, script_err); } -@@ -1036,7 +883,7 @@ +@@ -1036,7 +880,7 @@ * connection drops or we stopped sending output for some other * reason */ if (rv == APR_SUCCESS && !r->connection->aborted) { @@ -314,7 +319,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 log_script_err(r, script_err); } -@@ -1277,7 +1124,7 @@ +@@ -1277,7 +1121,7 @@ AP_DECLARE_MODULE(cgi) = { STANDARD20_MODULE_STUFF, @@ -323,8 +328,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 NULL, /* dir merger --- default is to override */ create_cgi_config, /* server config */ merge_cgi_config, /* merge server config */ ---- httpd-2.4.37/modules/generators/mod_cgid.c -+++ httpd-2.4.37/modules/generators/mod_cgid.c +--- httpd-2.4.41/modules/generators/mod_cgid.c ++++ httpd-2.4.41/modules/generators/mod_cgid.c @@ -342,15 +342,19 @@ return close(fd); } @@ -350,7 +355,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +369,52 @@ +@@ -365,9 +369,60 @@ } } while (bytes_read < buf_size); @@ -366,11 +371,12 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + + msg.msg_iov = &vec; + msg.msg_iovlen = 1; -+ -+ msg.msg_control = u.buf; -+ msg.msg_controllen = sizeof(u.buf); + -+ if (errfd) *errfd = 0; ++ if (errfd) { ++ msg.msg_control = u.buf; ++ msg.msg_controllen = sizeof(u.buf); ++ *errfd = 0; ++ } + + /* use MSG_WAITALL to skip loop on truncated reads */ + do { @@ -380,10 +386,17 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + if (rc == 0) { + return ECONNRESET; + } -+ -+ cmsg = CMSG_FIRSTHDR(&msg); ++ else if (rc < 0) { ++ return errno; ++ } ++ else if (rc != buf_size) { ++ /* MSG_WAITALL should ensure the recvmsg blocks until the ++ * entire length is read, but let's be paranoid. */ ++ return APR_INCOMPLETE; ++ } ++ + if (errfd -+ && cmsg ++ && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL + && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd)) + && cmsg->cmsg_level == SOL_SOCKET + && cmsg->cmsg_type == SCM_RIGHTS) { @@ -403,7 +416,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +431,7 @@ +@@ -384,7 +439,7 @@ return APR_SUCCESS; } @@ -412,7 +425,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 { va_list ap; int rc; -@@ -399,9 +446,39 @@ +@@ -399,9 +454,39 @@ } va_end(ap); @@ -452,7 +465,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (rc < 0) { return errno; } -@@ -410,7 +487,7 @@ +@@ -410,7 +495,7 @@ } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -461,7 +474,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 { int i; char **environ; -@@ -421,7 +498,7 @@ +@@ -421,7 +506,7 @@ r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -470,7 +483,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (stat != APR_SUCCESS) { return stat; } -@@ -479,14 +556,15 @@ +@@ -479,14 +564,15 @@ return APR_SUCCESS; } @@ -488,7 +501,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (ugid == NULL) { -@@ -507,16 +585,21 @@ +@@ -507,16 +593,21 @@ req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -512,7 +525,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +614,7 @@ +@@ -531,7 +622,7 @@ for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -521,7 +534,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +665,34 @@ +@@ -582,20 +673,34 @@ } } @@ -564,7 +577,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 } static int cgid_server(void *data) -@@ -669,7 +766,7 @@ +@@ -669,7 +774,7 @@ } while (!daemon_should_exit) { @@ -573,7 +586,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -709,7 +806,7 @@ +@@ -709,7 +814,7 @@ r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -582,7 +595,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -741,6 +838,16 @@ +@@ -741,6 +846,16 @@ continue; } @@ -599,7 +612,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -800,7 +907,10 @@ +@@ -800,7 +915,10 @@ close(sd2); } else { @@ -611,7 +624,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -1099,6 +1209,33 @@ +@@ -1099,6 +1217,33 @@ return ret; } @@ -645,7 +658,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1204,6 +1341,11 @@ +@@ -1204,6 +1349,11 @@ return ret; } @@ -657,7 +670,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 static int connect_to_daemon(int *sdptr, request_rec *r, cgid_server_conf *conf) { -@@ -1395,6 +1537,7 @@ +@@ -1395,6 +1545,7 @@ static int cgid_handler(request_rec *r) { @@ -665,7 +678,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 int retval, nph, dbpos; char *argv0, *dbuf; apr_bucket_brigade *bb; -@@ -1404,10 +1547,11 @@ +@@ -1404,10 +1555,11 @@ int seen_eos, child_stopped_reading; int sd; char **env; @@ -678,7 +691,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1416,7 +1560,7 @@ +@@ -1416,7 +1568,7 @@ conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -687,7 +700,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1469,6 +1613,17 @@ +@@ -1469,6 +1621,17 @@ } */ @@ -705,7 +718,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1481,12 +1636,16 @@ +@@ -1481,12 +1644,16 @@ return retval; } @@ -723,7 +736,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; info->r = r; -@@ -1508,12 +1667,7 @@ +@@ -1508,12 +1675,7 @@ */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -737,7 +750,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); /* Transfer any put/post args, CERN style... -@@ -1605,23 +1759,28 @@ +@@ -1605,23 +1767,28 @@ */ shutdown(sd, 1); @@ -774,7 +787,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* * ret could be HTTP_NOT_MODIFIED in the case that the CGI script -@@ -1658,6 +1817,11 @@ +@@ -1658,6 +1825,11 @@ /* Soak up all the script output */ discard_script_output(bb); apr_brigade_destroy(bb); @@ -786,7 +799,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 /* This redirect needs to be a GET no matter what the original * method was. */ -@@ -1690,7 +1854,6 @@ +@@ -1690,7 +1862,6 @@ } if (nph) { @@ -794,7 +807,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 struct ap_filter_t *cur; /* get rid of all filters up through protocol... since we -@@ -1704,14 +1867,20 @@ +@@ -1704,14 +1875,20 @@ } r->output_filters = r->proto_output_filters = cur; @@ -821,7 +834,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 return OK; /* NOT r->status, even if it has changed. */ } -@@ -1829,7 +1998,7 @@ +@@ -1829,7 +2006,7 @@ return retval; } @@ -830,8 +843,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; ---- httpd-2.4.37/modules/generators/config5.m4 -+++ httpd-2.4.37/modules/generators/config5.m4 +--- httpd-2.4.41/modules/generators/config5.m4 ++++ httpd-2.4.41/modules/generators/config5.m4 @@ -78,4 +78,15 @@ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) @@ -848,9 +861,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 +]) + APACHE_MODPATH_FINISH ---- httpd-2.4.37/modules/generators/cgi_common.h -+++ httpd-2.4.37/modules/generators/cgi_common.h -@@ -0,0 +1,216 @@ +--- httpd-2.4.41/modules/generators/cgi_common.h ++++ httpd-2.4.41/modules/generators/cgi_common.h +@@ -0,0 +1,220 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -902,6 +915,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191 + apr_pollfd_t fd; + struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); + ++ /* Disable APR timeout handling since we'll use poll() entirely. */ ++ apr_file_pipe_timeout_set(out, 0); ++ apr_file_pipe_timeout_set(err, 0); ++ + APR_BUCKET_INIT(b); + b->free = apr_bucket_free; + b->list = list; diff --git a/httpd.spec b/httpd.spec index 51abf88..b7c7d8d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -77,7 +77,7 @@ Patch38: httpd-2.4.34-sslciphdefault.patch Patch39: httpd-2.4.37-sslprotdefault.patch Patch40: httpd-2.4.39-r1861269.patch Patch41: httpd-2.4.37-r1861793+.patch -Patch42: httpd-2.4.37-r1828172+.patch +Patch42: httpd-2.4.41-r1828172+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -741,6 +741,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Oct 2 2019 Joe Orton - 2.4.41-4 +- mod_cgid: possible stdout timeout handling fix (#1757683) + * Wed Sep 25 2019 Joe Orton - 2.4.41-3 - mod_ssl: restore dependency on /usr/bin/hostname (#1135118) diff --git a/pullrev.sh b/pullrev.sh index 5494c7e..efe221f 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.37 +ver=2.4.41 prefix="httpd-${ver}" suffix="r$1${2:++}" fn="${prefix}-${suffix}.patch" @@ -36,7 +36,7 @@ for r in $*; do echo "+ fetching ${r}" this=`mktemp /tmp/pullrevXXXXXX` svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \ - --addprefix="${prefix}/" > ${this} + -x '*.xml' --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` combinediff --quiet ${prev} ${this} > ${next} rm -f "${this}" From ece85ad37fb3d95897c414c735401dc80f632884 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 3 Oct 2019 09:06:46 +0100 Subject: [PATCH 10/11] mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) --- httpd-2.4.41-r1865749.patch | 14 ++++++++++++++ httpd.spec | 7 ++++++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.41-r1865749.patch diff --git a/httpd-2.4.41-r1865749.patch b/httpd-2.4.41-r1865749.patch new file mode 100644 index 0000000..d79a559 --- /dev/null +++ b/httpd-2.4.41-r1865749.patch @@ -0,0 +1,14 @@ +# ./pullrev.sh 1865749 +http://svn.apache.org/viewvc?view=revision&revision=1865749 + +--- httpd-2.4.41/modules/proxy/mod_proxy_balancer.c.r1865749 ++++ httpd-2.4.41/modules/proxy/mod_proxy_balancer.c +@@ -1104,7 +1104,7 @@ + if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname) + return 0; + +- return strcmp(uri.hostname, ap_get_server_name(r)) == 0; ++ return strcasecmp(uri.hostname, ap_get_server_name(r)) == 0; + } + + /* Manages the loadfactors and member status diff --git a/httpd.spec b/httpd.spec index b7c7d8d..4276153 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.41 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -83,6 +83,7 @@ Patch42: httpd-2.4.41-r1828172+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch58: httpd-2.4.34-r1738878.patch Patch60: httpd-2.4.34-enable-sslv3.patch +Patch61: httpd-2.4.41-r1865749.patch # Security fixes @@ -221,6 +222,7 @@ interface for storing and accessing per-user session data. %patch58 -p1 -b .r1738878 %patch60 -p1 -b .enable-sslv3 +%patch61 -p1 -b .r1865749 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -741,6 +743,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 3 2019 Joe Orton - 2.4.41-5 +- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688) + * Wed Oct 2 2019 Joe Orton - 2.4.41-4 - mod_cgid: possible stdout timeout handling fix (#1757683) From fb0978d09f607ff24bd3e368c4ac7c955b9fa82d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 3 Oct 2019 09:10:23 +0100 Subject: [PATCH 11/11] Remove suexec patch already merged upstream. --- httpd-2.4.4-r1337344+.patch | 250 ------------------------------------ httpd.spec | 2 - 2 files changed, 252 deletions(-) delete mode 100644 httpd-2.4.4-r1337344+.patch diff --git a/httpd-2.4.4-r1337344+.patch b/httpd-2.4.4-r1337344+.patch deleted file mode 100644 index 6e5c3e7..0000000 --- a/httpd-2.4.4-r1337344+.patch +++ /dev/null @@ -1,250 +0,0 @@ -# ./pullrev.sh 1337344 1341905 1342065 1341930 - -suexec enhancements: - -1) use syslog for logging -2) use capabilities not setuid/setgid root binary - -http://svn.apache.org/viewvc?view=revision&revision=1337344 -http://svn.apache.org/viewvc?view=revision&revision=1341905 -http://svn.apache.org/viewvc?view=revision&revision=1342065 -http://svn.apache.org/viewvc?view=revision&revision=1341930 - ---- httpd-2.4.4/configure.in.r1337344+ -+++ httpd-2.4.4/configure.in -@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin, - - AC_ARG_WITH(suexec-logfile, - APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[ -- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] ) -+ if test "x$withval" = "xyes"; then -+ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file]) -+ fi -+]) -+ -+AC_ARG_WITH(suexec-syslog, -+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[ -+ if test $withval = "yes"; then -+ if test "x${with_suexec_logfile}" != "xno"; then -+ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"]) -+ AC_MSG_ERROR([suexec does not support both logging to file and syslog]) -+ fi -+ AC_CHECK_FUNCS([vsyslog], [], [ -+ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])]) -+ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog]) -+ fi -+]) -+ - - AC_ARG_WITH(suexec-safepath, - APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[ -@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask, - APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[ - AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] ) - -+INSTALL_SUEXEC=setuid -+AC_ARG_ENABLE([suexec-capabilities], -+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [ -+INSTALL_SUEXEC=caps -+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, -+ [Enable if suexec is installed with Linux capabilities, not setuid]) -+]) -+APACHE_SUBST(INSTALL_SUEXEC) -+ - dnl APR should go after the other libs, so the right symbols can be picked up - if test x${apu_found} != xobsolete; then - AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`" ---- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+ -+++ httpd-2.4.4/docs/manual/suexec.html.en -@@ -372,6 +372,21 @@ - together with the --enable-suexec option to let - APACI accept your request for using the suEXEC feature. - -+
--enable-suexec-capabilities
-+ -+
Linux specific: Normally, -+ the suexec binary is installed "setuid/setgid -+ root", which allows it to run with the full privileges of the -+ root user. If this option is used, the suexec -+ binary will instead be installed with only the setuid/setgid -+ "capability" bits set, which is the subset of full root -+ priviliges required for suexec operation. Note that -+ the suexec binary may not be able to write to a log -+ file in this mode; it is recommended that the -+ --with-suexec-syslog --without-suexec-logfile -+ options are used in conjunction with this mode, so that syslog -+ logging is used instead.
-+ -
--with-suexec-bin=PATH
- -
The path to the suexec binary must be hard-coded -@@ -433,6 +448,12 @@ - "suexec_log" and located in your standard logfile - directory (--logfiledir).
- -+
--with-suexec-syslog
-+ -+
If defined, suexec will log notices and errors to syslog -+ instead of a logfile. This option must be combined -+ with --without-suexec-logfile.
-+ -
--with-suexec-safepath=PATH
- -
Define a safe PATH environment to pass to CGI -@@ -550,9 +571,12 @@ Group webgroup - -

The suEXEC wrapper will write log information - to the file defined with the --with-suexec-logfile -- option as indicated above. If you feel you have configured and -- installed the wrapper properly, have a look at this log and the -- error_log for the server to see where you may have gone astray.

-+ option as indicated above, or to syslog if --with-suexec-syslog -+ is used. If you feel you have configured and -+ installed the wrapper properly, have a look at the log and the -+ error_log for the server to see where you may have gone astray. -+ The output of "suexec -V" will show the options -+ used to compile suexec, if using a binary distribution.

- -
top
-
-@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined') - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ ---- httpd-2.4.4/Makefile.in.r1337344+ -+++ httpd-2.4.4/Makefile.in -@@ -238,11 +238,22 @@ install-man: - cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \ - fi - --install-suexec: -+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC) -+ -+install-suexec-binary: - @if test -f $(builddir)/support/suexec; then \ - test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \ - $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \ -- chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-setuid: -+ @if test -f $(builddir)/support/suexec; then \ -+ chmod 4755 $(DESTDIR)$(sbindir)/suexec; \ -+ fi -+ -+install-suexec-caps: -+ @if test -f $(builddir)/support/suexec; then \ -+ setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \ - fi - - suexec: ---- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+ -+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c -@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d - return NULL; - } - -+#ifdef AP_SUEXEC_CAPABILITIES -+/* If suexec is using capabilities, don't test for the setuid bit. */ -+#define SETUID_TEST(finfo) (1) -+#else -+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID) -+#endif -+ - static int - unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, - apr_pool_t *ptemp) -@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_ - ap_unixd_config.suexec_enabled = 0; - if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp)) - == APR_SUCCESS) { -- if ((wrapper.protection & APR_USETID) && wrapper.user == 0 -+ if (SETUID_TEST(wrapper) && wrapper.user == 0 - && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) { - ap_unixd_config.suexec_enabled = 1; - ap_unixd_config.suexec_disabled_reason = ""; ---- httpd-2.4.4/support/suexec.c.r1337344+ -+++ httpd-2.4.4/support/suexec.c -@@ -58,6 +58,10 @@ - #include - #endif - -+#ifdef AP_LOG_SYSLOG -+#include -+#endif -+ - #if defined(PATH_MAX) - #define AP_MAXPATH PATH_MAX - #elif defined(MAXPATHLEN) -@@ -69,7 +73,20 @@ - #define AP_ENVBUF 256 - - extern char **environ; -+ -+#ifdef AP_LOG_SYSLOG -+/* Syslog support. */ -+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV) -+#define AP_LOG_FACILITY LOG_AUTHPRIV -+#elif !defined(AP_LOG_FACILITY) -+#define AP_LOG_FACILITY LOG_AUTH -+#endif -+ -+static int log_open; -+#else -+/* Non-syslog support. */ - static FILE *log = NULL; -+#endif - - static const char *const safe_env_lst[] = - { -@@ -137,7 +154,14 @@ static void err_output(int is_error, con - - static void err_output(int is_error, const char *fmt, va_list ap) - { --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ if (!log_open) { -+ openlog("suexec", LOG_PID, AP_LOG_FACILITY); -+ log_open = 1; -+ } -+ -+ vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap); -+#elif defined(AP_LOG_EXEC) - time_t timevar; - struct tm *lt; - -@@ -295,7 +319,9 @@ int main(int argc, char *argv[]) - #ifdef AP_HTTPD_USER - fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER); - #endif --#ifdef AP_LOG_EXEC -+#if defined(AP_LOG_SYSLOG) -+ fprintf(stderr, " -D AP_LOG_SYSLOG\n"); -+#elif defined(AP_LOG_EXEC) - fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC); - #endif - #ifdef AP_SAFE_PATH -@@ -591,6 +617,12 @@ int main(int argc, char *argv[]) - #endif /* AP_SUEXEC_UMASK */ - - /* Be sure to close the log file so the CGI can't mess with it. */ -+#ifdef AP_LOG_SYSLOG -+ if (log_open) { -+ closelog(); -+ log_open = 0; -+ } -+#else - if (log != NULL) { - #if APR_HAVE_FCNTL_H - /* -@@ -612,6 +644,7 @@ int main(int argc, char *argv[]) - log = NULL; - #endif - } -+#endif - - /* - * Execute the command, replacing our image with its own. diff --git a/httpd.spec b/httpd.spec index 4276153..7bfbf22 100644 --- a/httpd.spec +++ b/httpd.spec @@ -66,7 +66,6 @@ Patch21: httpd-2.4.39-r1842929+.patch Patch23: httpd-2.4.39-export.patch Patch24: httpd-2.4.1-corelimit.patch Patch25: httpd-2.4.25-selinux.patch -Patch26: httpd-2.4.4-r1337344+.patch Patch27: httpd-2.4.2-icons.patch Patch29: httpd-2.4.33-systemd.patch Patch30: httpd-2.4.4-cachehardmax.patch @@ -207,7 +206,6 @@ interface for storing and accessing per-user session data. %patch23 -p1 -b .export %patch24 -p1 -b .corelimit %patch25 -p1 -b .selinux -#patch26 -p1 -b .r1337344+ %patch27 -p1 -b .icons %patch29 -p1 -b .systemd %patch30 -p1 -b .cachehardmax