From be37def4282fef3beb2b89e4bdae752e3aa1b10c Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Tue, 22 May 2018 14:35:05 +0000 Subject: [PATCH 1/2] merged with f28 --- httpd.service.xml | 15 ++++++++------- httpd.spec | 5 ++--- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/httpd.service.xml b/httpd.service.xml index bc6c503..1e6a8ce 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -139,7 +139,7 @@ Wants=network-online.target httpd is started. To inhibit certificate generation, use systemctl mask httpd-init.service after installing mod_ssl, and adjust the mod_ssl configuration to use - an appropriate certicate and key. + an appropriate certificate and key. @@ -276,15 +276,15 @@ Wants=network-online.target configuration file /etc/httpd/conf/foobar.conf. The environment variable is set to - the instance name by the unit and is available name for use - within the configuration file. + the instance name by the unit and is available for use within + the configuration file. To allow multiple instances of httpd to run simultaneously, a number of configuration directives must be - changed; such as PidFile and - DefaultRuntimeDir to pick non-conflict paths, - and Listen to choose ports. The example - configuration file + changed, such as PidFile and + DefaultRuntimeDir to pick non-conflicting + paths, and Listen to choose different ports. + The example configuration file /usr/share/doc/httpd/instance.conf demonstrates how to make such changes using variable. @@ -312,6 +312,7 @@ ReloadPropagatedFrom=httpd.service /usr/lib/systemd/system/httpd.service, /usr/lib/systemd/system/httpd.socket, + /usr/lib/systemd/system/httpd@.service, /etc/systemd/systemd/httpd.service.d diff --git a/httpd.spec b/httpd.spec index 7e63af8..d66c063 100644 --- a/httpd.spec +++ b/httpd.spec @@ -70,7 +70,7 @@ Patch26: httpd-2.4.4-r1337344+.patch Patch27: httpd-2.4.2-icons.patch Patch29: httpd-2.4.27-systemd.patch Patch30: httpd-2.4.4-cachehardmax.patch -Patch31: httpd-2.4.33-sslmultiproxy.patch +Patch31: httpd-2.4.18-sslmultiproxy.patch Patch34: httpd-2.4.17-socket-activation.patch Patch35: httpd-2.4.33-sslciphdefault.patch @@ -229,7 +229,7 @@ interface for storing and accessing per-user session data. %patch27 -p1 -b .icons %patch29 -p1 -b .systemd %patch30 -p1 -b .cachehardmax -%patch31 -p1 -b .sslmultiproxy +#patch31 -p1 -b .sslmultiproxy %patch34 -p1 -b .socketactivation %patch35 -p1 -b .sslciphdefault %patch58 -p1 -b .r1738878 @@ -729,7 +729,6 @@ exit $rv - add httpd@.service; update httpd.service(8) and add new stub * Mon Apr 16 2018 Joe Orton - 2.4.33-4 -- mod_ssl: fix mod_nss compat patch (Rob Crittenden, #1566511) - mod_md: change hard-coded default MdStoreDir to state/md (#1563846) * Thu Apr 12 2018 Joe Orton - 2.4.33-3 From 11c805e029cbcbb4237c2f2f57ffcf145b92082a Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Tue, 22 May 2018 15:34:13 +0000 Subject: [PATCH 2/2] Added missing patch --- httpd-2.4.18-sslmultiproxy.patch | 98 ++++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 httpd-2.4.18-sslmultiproxy.patch diff --git a/httpd-2.4.18-sslmultiproxy.patch b/httpd-2.4.18-sslmultiproxy.patch new file mode 100644 index 0000000..3f00f3f --- /dev/null +++ b/httpd-2.4.18-sslmultiproxy.patch @@ -0,0 +1,98 @@ +diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c +index 717a694..a3ce718 100644 +--- a/modules/ssl/mod_ssl.c ++++ b/modules/ssl/mod_ssl.c +@@ -395,6 +395,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c) + return sslconn; + } + ++static typeof(ssl_proxy_enable) *othermod_proxy_enable; ++static typeof(ssl_engine_disable) *othermod_engine_disable; ++ + int ssl_proxy_enable(conn_rec *c) + { + SSLSrvConfigRec *sc; +@@ -403,6 +406,12 @@ int ssl_proxy_enable(conn_rec *c) + sc = mySrvConfig(sslconn->server); + + if (!sc->proxy_enabled) { ++ if (othermod_proxy_enable) { ++ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, ++ "mod_ssl proxy not configured, passing through to other module."); ++ return othermod_proxy_enable(c); ++ } ++ + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961) + "SSL Proxy requested for %s but not enabled " + "[Hint: SSLProxyEngine]", sc->vhost_id); +@@ -422,6 +431,10 @@ int ssl_engine_disable(conn_rec *c) + + SSLConnRec *sslconn = myConnConfig(c); + ++ if (othermod_engine_disable) { ++ othermod_engine_disable(c); ++ } ++ + if (sslconn) { + sc = mySrvConfig(sslconn->server); + } +@@ -621,6 +634,9 @@ static void ssl_register_hooks(apr_pool_t *p) + ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE); + + ssl_var_register(p); ++ ++ othermod_proxy_enable = APR_RETRIEVE_OPTIONAL_FN(ssl_proxy_enable); ++ othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable); + + APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); + APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); +diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c +index a6b0d0d..24fd8c7 100644 +--- a/modules/ssl/ssl_engine_vars.c ++++ b/modules/ssl/ssl_engine_vars.c +@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char + static void ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize); + static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var); + static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl); ++static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https; ++static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup; + + static SSLConnRec *ssl_get_effective_config(conn_rec *c) + { +@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c) + static int ssl_is_https(conn_rec *c) + { + SSLConnRec *sslconn = ssl_get_effective_config(c); +- return sslconn && sslconn->ssl; ++ ++ return (sslconn && sslconn->ssl) ++ || (othermod_is_https && othermod_is_https(c)); + } + + static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION; +@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p) + { + char *cp, *cp2; + ++ othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https); ++ othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup); ++ + APR_REGISTER_OPTIONAL_FN(ssl_is_https); + APR_REGISTER_OPTIONAL_FN(ssl_var_lookup); + APR_REGISTER_OPTIONAL_FN(ssl_ext_list); +@@ -272,6 +279,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, + */ + if (result == NULL && c != NULL) { + SSLConnRec *sslconn = ssl_get_effective_config(c); ++ ++ if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) ++ && (!sslconn || !sslconn->ssl) && othermod_var_lookup) { ++ /* For an SSL_* variable, if mod_ssl is not enabled for ++ * this connection and another SSL module is present, pass ++ * through to that module. */ ++ return othermod_var_lookup(p, s, c, r, var); ++ } ++ + if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) + && sslconn && sslconn->ssl) + result = ssl_var_lookup_ssl(p, sslconn, r, var+4);