From 3be11b9e0c68af20134f68ee62f6eb194f415262 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 2 Jun 2021 14:26:59 +0200 Subject: [PATCH 001/112] new version 2.4.48 Resolves: #1964746 - httpd-2.4.48 is available --- .gitignore | 1 + httpd-2.4.43-r1870095+.patch | 115 ----------- httpd-2.4.43-sslcoalesce.patch | 192 ------------------ httpd-2.4.46-lua-resume.patch | 119 ----------- ...-export.patch => httpd-2.4.48-export.patch | 6 +- ...929+.patch => httpd-2.4.48-r1842929+.patch | 27 +-- httpd.spec | 18 +- sources | 6 +- 8 files changed, 29 insertions(+), 455 deletions(-) delete mode 100644 httpd-2.4.43-r1870095+.patch delete mode 100644 httpd-2.4.43-sslcoalesce.patch delete mode 100644 httpd-2.4.46-lua-resume.patch rename httpd-2.4.43-export.patch => httpd-2.4.48-export.patch (93%) rename httpd-2.4.43-r1842929+.patch => httpd-2.4.48-r1842929+.patch (91%) diff --git a/.gitignore b/.gitignore index 09a5a07..ea4148c 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ x86_64 /httpd-2.4.43.tar.bz2.asc /KEYS /httpd-2.4.46.tar.bz2.asc +/httpd-2.4.48.tar.bz2.asc diff --git a/httpd-2.4.43-r1870095+.patch b/httpd-2.4.43-r1870095+.patch deleted file mode 100644 index 3fc8dfb..0000000 --- a/httpd-2.4.43-r1870095+.patch +++ /dev/null @@ -1,115 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index cbab6a3..765aa4b 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -114,6 +114,45 @@ static int has_buffered_data(request_rec *r) - return result; - } - -+/* If a renegotiation is required for the location, and the request -+ * includes a message body (and the client has not requested a "100 -+ * Continue" response), then the client will be streaming the request -+ * body over the wire already. In that case, it is not possible to -+ * stop and perform a new SSL handshake immediately; once the SSL -+ * library moves to the "accept" state, it will reject the SSL packets -+ * which the client is sending for the request body. -+ * -+ * To allow authentication to complete in the hook, the solution used -+ * here is to fill a (bounded) buffer with the request body, and then -+ * to reinject that request body later. -+ * -+ * This function is called to fill the renegotiation buffer for the -+ * location as required, or fail. Returns zero on success or HTTP_ -+ * error code on failure. -+ */ -+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc) -+{ -+ int rv; -+ apr_size_t rsize; -+ -+ /* ### this is HTTP/1.1 specific, special case for protocol? */ -+ if (r->expecting_100 || !ap_request_has_body(r)) { -+ return 0; -+ } -+ -+ rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize; -+ if (rsize > 0) { -+ /* Fill the I/O buffer with the request body if possible. */ -+ rv = ssl_io_buffer_fill(r, rsize); -+ } -+ else { -+ /* If the reneg buffer size is set to zero, just fail. */ -+ rv = HTTP_REQUEST_ENTITY_TOO_LARGE; -+ } -+ -+ return rv; -+} -+ - #ifdef HAVE_TLSEXT - static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2) - { -@@ -814,41 +853,14 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo - } - } - -- /* If a renegotiation is now required for this location, and the -- * request includes a message body (and the client has not -- * requested a "100 Continue" response), then the client will be -- * streaming the request body over the wire already. In that -- * case, it is not possible to stop and perform a new SSL -- * handshake immediately; once the SSL library moves to the -- * "accept" state, it will reject the SSL packets which the client -- * is sending for the request body. -- * -- * To allow authentication to complete in this auth hook, the -- * solution used here is to fill a (bounded) buffer with the -- * request body, and then to reinject that request body later. -- */ -- if (renegotiate && !renegotiate_quick -- && !r->expecting_100 -- && ap_request_has_body(r)) { -- int rv; -- apr_size_t rsize; -- -- rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : -- dc->nRenegBufferSize; -- if (rsize > 0) { -- /* Fill the I/O buffer with the request body if possible. */ -- rv = ssl_io_buffer_fill(r, rsize); -- } -- else { -- /* If the reneg buffer size is set to zero, just fail. */ -- rv = HTTP_REQUEST_ENTITY_TOO_LARGE; -- } -- -- if (rv) { -+ /* Fill reneg buffer if required. */ -+ if (renegotiate && !renegotiate_quick) { -+ rc = fill_reneg_buffer(r, dc); -+ if (rc) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257) - "could not buffer message body to allow " - "SSL renegotiation to proceed"); -- return rv; -+ return rc; - } - } - -@@ -1132,6 +1144,17 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - } - } - -+ /* Fill reneg buffer if required. */ -+ if (change_vmode) { -+ rc = fill_reneg_buffer(r, dc); -+ if (rc) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228) -+ "could not buffer message body to allow " -+ "TLS Post-Handshake Authentication to proceed"); -+ return rc; -+ } -+ } -+ - if (change_vmode) { - char peekbuf[1]; - diff --git a/httpd-2.4.43-sslcoalesce.patch b/httpd-2.4.43-sslcoalesce.patch deleted file mode 100644 index ef1f728..0000000 --- a/httpd-2.4.43-sslcoalesce.patch +++ /dev/null @@ -1,192 +0,0 @@ - -http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1836237&r2=1836236&pathrev=1836237&view=patch -http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1873985&r2=1876037&view=patch - ---- httpd-2.4.43/modules/ssl/ssl_engine_io.c.sslcoalesce -+++ httpd-2.4.43/modules/ssl/ssl_engine_io.c -@@ -1585,18 +1585,32 @@ - } - - --/* ssl_io_filter_output() produces one SSL/TLS message per bucket -+/* ssl_io_filter_output() produces one SSL/TLS record per bucket - * passed down the output filter stack. This results in a high -- * overhead (network packets) for any output comprising many small -- * buckets. SSI page applied through the HTTP chunk filter, for -- * example, may produce many brigades containing small buckets - -- * [chunk-size CRLF] [chunk-data] [CRLF]. -+ * overhead (more network packets & TLS processing) for any output -+ * comprising many small buckets. SSI output passed through the HTTP -+ * chunk filter, for example, may produce many brigades containing -+ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF]. - * -- * The coalescing filter merges many small buckets into larger buckets -- * where possible, allowing the SSL I/O output filter to handle them -- * more efficiently. */ -+ * Sending HTTP response headers as a separate TLS record to the -+ * response body also reveals information to a network observer (the -+ * size of headers) which can be significant. -+ * -+ * The coalescing filter merges data buckets with the aim of producing -+ * fewer, larger TLS records - without copying/buffering all content -+ * and introducing unnecessary overhead. -+ * -+ * ### This buffering could be probably be done more comprehensively -+ * ### in ssl_io_filter_output itself. -+ * -+ * ### Another possible performance optimisation in particular for the -+ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than -+ * ### a char array to buffer; using apr_brigade_write() to append -+ * ### will use already-allocated memory from the HEAP, reducing # of -+ * ### copies. -+ */ - --#define COALESCE_BYTES (2048) -+#define COALESCE_BYTES (AP_IOBUFSIZE) - - struct coalesce_ctx { - char buffer[COALESCE_BYTES]; -@@ -1609,11 +1623,12 @@ - apr_bucket *e, *upto; - apr_size_t bytes = 0; - struct coalesce_ctx *ctx = f->ctx; -+ apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */ - unsigned count = 0; - - /* The brigade consists of zero-or-more small data buckets which -- * can be coalesced (the prefix), followed by the remainder of the -- * brigade. -+ * can be coalesced (referred to as the "prefix"), followed by the -+ * remainder of the brigade. - * - * Find the last bucket - if any - of that prefix. count gives - * the number of buckets in the prefix. The "prefix" must contain -@@ -1628,24 +1643,97 @@ - e != APR_BRIGADE_SENTINEL(bb) - && !APR_BUCKET_IS_METADATA(e) - && e->length != (apr_size_t)-1 -- && e->length < COALESCE_BYTES -- && (bytes + e->length) < COALESCE_BYTES -- && (ctx == NULL -- || bytes + ctx->bytes + e->length < COALESCE_BYTES); -+ && e->length <= COALESCE_BYTES -+ && (buffered + bytes + e->length) <= COALESCE_BYTES; - e = APR_BUCKET_NEXT(e)) { -- if (e->length) count++; /* don't count zero-length buckets */ -- bytes += e->length; -+ /* don't count zero-length buckets */ -+ if (e->length) { -+ bytes += e->length; -+ count++; -+ } - } -+ -+ /* If there is room remaining and the next bucket is a data -+ * bucket, try to include it in the prefix to coalesce. For a -+ * typical [HEAP] [FILE] HTTP response brigade, this handles -+ * merging the headers and the start of the body into a single TLS -+ * record. */ -+ if (bytes + buffered > 0 -+ && bytes + buffered < COALESCE_BYTES -+ && e != APR_BRIGADE_SENTINEL(bb) -+ && !APR_BUCKET_IS_METADATA(e)) { -+ apr_status_t rv = APR_SUCCESS; -+ -+ /* For an indeterminate length bucket (PIPE/CGI/...), try a -+ * non-blocking read to have it morph into a HEAP. If the -+ * read fails with EAGAIN, it is harmless to try a split -+ * anyway, split is ENOTIMPL for most PIPE-like buckets. */ -+ if (e->length == (apr_size_t)-1) { -+ const char *discard; -+ apr_size_t ignore; -+ -+ rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ); -+ if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232) -+ "coalesce failed to read from %s bucket", -+ e->type->name); -+ return AP_FILTER_ERROR; -+ } -+ } -+ -+ if (rv == APR_SUCCESS) { -+ /* If the read above made the bucket morph, it may now fit -+ * entirely within the buffer. Otherwise, split it so it does -+ * fit. */ -+ if (e->length > COALESCE_BYTES -+ || e->length + buffered + bytes > COALESCE_BYTES) { -+ rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes)); -+ } -+ -+ if (rv == APR_SUCCESS && e->length == 0) { -+ /* As above, don't count in the prefix if the bucket is -+ * now zero-length. */ -+ } -+ else if (rv == APR_SUCCESS) { -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c, -+ "coalesce: adding %" APR_SIZE_T_FMT " bytes " -+ "from split %s bucket, total %" APR_SIZE_T_FMT, -+ e->length, e->type->name, bytes + buffered); -+ -+ count++; -+ bytes += e->length; -+ e = APR_BUCKET_NEXT(e); -+ } -+ else if (rv != APR_ENOTIMPL) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233) -+ "coalesce: failed to split data bucket"); -+ return AP_FILTER_ERROR; -+ } -+ } -+ } -+ - upto = e; - -- /* Coalesce the prefix, if: -- * a) more than one bucket is found to coalesce, or -- * b) the brigade contains only a single data bucket, or -- * c) the data bucket is not last but we have buffered data already. -+ /* Coalesce the prefix, if any of the following are true: -+ * -+ * a) the prefix is more than one bucket -+ * OR -+ * b) the prefix is the entire brigade, which is a single bucket -+ * AND the prefix length is smaller than the buffer size, -+ * OR -+ * c) the prefix is a single bucket -+ * AND there is buffered data from a previous pass. -+ * -+ * The aim with (b) is to buffer a small bucket so it can be -+ * coalesced with future invocations of this filter. e.g. three -+ * calls each with a single 100 byte HEAP bucket should get -+ * coalesced together. But an invocation with a 8192 byte HEAP -+ * should pass through untouched. - */ - if (bytes > 0 - && (count > 1 -- || (upto == APR_BRIGADE_SENTINEL(bb)) -+ || (upto == APR_BRIGADE_SENTINEL(bb) -+ && bytes < COALESCE_BYTES) - || (ctx && ctx->bytes > 0))) { - /* If coalescing some bytes, ensure a context has been - * created. */ -@@ -1656,7 +1744,8 @@ - - ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c, - "coalesce: have %" APR_SIZE_T_FMT " bytes, " -- "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes); -+ "adding %" APR_SIZE_T_FMT " more (buckets=%u)", -+ ctx->bytes, bytes, count); - - /* Iterate through the prefix segment. For non-fatal errors - * in this loop it is safe to break out and fall back to the -@@ -1671,7 +1760,8 @@ - if (APR_BUCKET_IS_METADATA(e) - || e->length == (apr_size_t)-1) { - ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012) -- "unexpected bucket type during coalesce"); -+ "unexpected %s bucket during coalesce", -+ e->type->name); - break; /* non-fatal error; break out */ - } - diff --git a/httpd-2.4.46-lua-resume.patch b/httpd-2.4.46-lua-resume.patch deleted file mode 100644 index 1a22008..0000000 --- a/httpd-2.4.46-lua-resume.patch +++ /dev/null @@ -1,119 +0,0 @@ -diff --git a/modules/lua/config.m4 b/modules/lua/config.m4 -index 29fd563..abeba1c 100644 ---- a/modules/lua/config.m4 -+++ b/modules/lua/config.m4 -@@ -34,7 +34,7 @@ AC_DEFUN([CHECK_LUA_PATH], [dnl - fi - ]) - --dnl Check for Lua 5.3/5.2/5.1 Libraries -+dnl Check for Lua Libraries - dnl CHECK_LUA(ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND]) - dnl Sets: - dnl LUA_CFLAGS -@@ -44,7 +44,7 @@ AC_DEFUN([CHECK_LUA], - - AC_ARG_WITH( - lua, -- [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua 5.3/5.2/5.1 prefix])], -+ [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua installation prefix])], - lua_path="$withval", - :) - -diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c -index 05f1e44..18b628c 100644 ---- a/modules/lua/mod_lua.c -+++ b/modules/lua/mod_lua.c -@@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil - { - apr_pool_t *pool; - ap_lua_vm_spec *spec; -- int n, rc; -+ int n, rc, nres; - lua_State *L; - lua_filter_ctx *ctx; - ap_lua_server_cfg *server_cfg = ap_get_module_config(r->server->module_config, -@@ -410,7 +410,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil - /* If a Lua filter is interested in filtering a request, it must first do a yield, - * otherwise we'll assume that it's not interested and pretend we didn't find it. - */ -- rc = lua_resume(L, 1); -+ rc = lua_resume(L, 1, &nres); - if (rc == LUA_YIELD) { - if (f->frec->providers == NULL) { - /* Not wired by mod_filter */ -@@ -432,7 +432,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil - static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade *pbbIn) - { - request_rec *r = f->r; -- int rc; -+ int rc, nres; - lua_State *L; - lua_filter_ctx* ctx; - conn_rec *c = r->connection; -@@ -492,7 +492,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade - lua_setglobal(L, "bucket"); - - /* If Lua yielded, it means we have something to pass on */ -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); - if (olen > 0) { -@@ -524,7 +524,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade - apr_bucket *pbktEOS; - lua_pushnil(L); - lua_setglobal(L, "bucket"); -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - apr_bucket *pbktOut; - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); -@@ -558,7 +558,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f, - apr_off_t nBytes) - { - request_rec *r = f->r; -- int rc, lastCall = 0; -+ int rc, lastCall = 0, nres; - lua_State *L; - lua_filter_ctx* ctx; - conn_rec *c = r->connection; -@@ -621,7 +621,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f, - lua_setglobal(L, "bucket"); - - /* If Lua yielded, it means we have something to pass on */ -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); - pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc); -@@ -643,7 +643,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f, - apr_bucket *pbktEOS = apr_bucket_eos_create(c->bucket_alloc); - lua_pushnil(L); - lua_setglobal(L, "bucket"); -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - apr_bucket *pbktOut; - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); -diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h -index 0e49cdc..72b4de7 100644 ---- a/modules/lua/mod_lua.h -+++ b/modules/lua/mod_lua.h -@@ -48,7 +48,15 @@ - #if LUA_VERSION_NUM > 501 - /* Load mode for lua_load() */ - #define lua_load(a,b,c,d) lua_load(a,b,c,d,NULL) --#define lua_resume(a,b) lua_resume(a, NULL, b) -+ -+#if LUA_VERSION_NUM > 503 -+#define lua_resume(a,b,c) lua_resume(a, NULL, b, c) -+#else -+/* ### For version < 5.4, assume that exactly one stack item is on the -+ * stack, which is what the code did before but seems dubious. */ -+#define lua_resume(a,b,c) (*(c) = 1, lua_resume(a, NULL, b)) -+#endif -+ - #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0) - #else - #define lua_rawlen(L,i) lua_objlen(L, (i)) diff --git a/httpd-2.4.43-export.patch b/httpd-2.4.48-export.patch similarity index 93% rename from httpd-2.4.43-export.patch rename to httpd-2.4.48-export.patch index 0d9fd72..439f768 100644 --- a/httpd-2.4.43-export.patch +++ b/httpd-2.4.48-export.patch @@ -6,7 +6,7 @@ to do so indirectly. Upstream: https://svn.apache.org/r1861685 (as new default-off configure option) diff --git a/Makefile.in b/Makefile.in -index 9eeb5c7..8746a10 100644 +index 40c7076..ac98e5f 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test @@ -27,7 +27,7 @@ index 9eeb5c7..8746a10 100644 server/libmain.la \ $(BUILTIN_LIBS) \ diff --git a/server/Makefile.in b/server/Makefile.in -index 1fa3344..116850b 100644 +index 8111877..f00bb3f 100644 --- a/server/Makefile.in +++ b/server/Makefile.in @@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \ @@ -36,7 +36,7 @@ index 1fa3344..116850b 100644 util_charset.c util_cookies.c util_debug.c util_xml.c \ - util_filter.c util_pcre.c util_regex.c exports.c \ + util_filter.c util_pcre.c util_regex.c \ - scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \ + scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \ eoc_bucket.c eor_bucket.c core_filters.c \ util_expr_parse.c util_expr_scan.c util_expr_eval.c diff --git a/server/main.c b/server/main.c diff --git a/httpd-2.4.43-r1842929+.patch b/httpd-2.4.48-r1842929+.patch similarity index 91% rename from httpd-2.4.43-r1842929+.patch rename to httpd-2.4.48-r1842929+.patch index b926195..f83a21d 100644 --- a/httpd-2.4.43-r1842929+.patch +++ b/httpd-2.4.48-r1842929+.patch @@ -1,8 +1,8 @@ diff --git a/Makefile.in b/Makefile.in -index 06b8c5a..9eeb5c7 100644 +index 6747aea..40c7076 100644 --- a/Makefile.in +++ b/Makefile.in -@@ -213,6 +213,7 @@ install-cgi: +@@ -233,6 +233,7 @@ install-cgi: install-other: @test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir) @test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir) @@ -11,7 +11,7 @@ index 06b8c5a..9eeb5c7 100644 file=apachecore.$$ext; \ if test -f $$file; then \ diff --git a/acinclude.m4 b/acinclude.m4 -index 95232f5..5d9d669 100644 +index b6ef442..98f1441 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[ @@ -22,7 +22,7 @@ index 95232f5..5d9d669 100644 APACHE_SUBST(other_targets) APACHE_SUBST(progname) APACHE_SUBST(prefix) -@@ -688,6 +689,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ +@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ APACHE_SUBST_EXPANDED_ARG(runtimedir) APACHE_SUBST_EXPANDED_ARG(logfiledir) APACHE_SUBST_EXPANDED_ARG(proxycachedir) @@ -31,7 +31,7 @@ index 95232f5..5d9d669 100644 dnl diff --git a/configure.in b/configure.in -index a63eada..c8f9aa2 100644 +index 37346b2..f303784 100644 --- a/configure.in +++ b/configure.in @@ -41,7 +41,7 @@ dnl Something seems broken here. @@ -56,7 +56,7 @@ index 2b4a70c..e076f41 100644 #endif /* AP_CONFIG_LAYOUT_H */ diff --git a/include/http_config.h b/include/http_config.h -index f9c2d77..c229bc9 100644 +index 77657ae..384a90f 100644 --- a/include/http_config.h +++ b/include/http_config.h @@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname); @@ -124,10 +124,10 @@ index addfd7e..2389f8f 100644 APR_HOOK_MIDDLE); dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); diff --git a/server/core.c b/server/core.c -index 3db9d61..79b2a82 100644 +index d135764..c2176b9 100644 --- a/server/core.c +++ b/server/core.c -@@ -129,6 +129,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; +@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN; AP_DECLARE_DATA int ap_config_generation = 0; @@ -136,7 +136,7 @@ index 3db9d61..79b2a82 100644 static void *create_core_dir_config(apr_pool_t *a, char *dir) { core_dir_config *conf; -@@ -1409,12 +1411,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) +@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) return res_buf; } @@ -147,6 +147,7 @@ index 3db9d61..79b2a82 100644 ap_server_config_defines = saved_server_config_defines; saved_server_config_defines = NULL; server_config_defined_vars = NULL; + ap_runtime_dir = NULL; - return OK; + core_state_dir = NULL; + @@ -154,7 +155,7 @@ index 3db9d61..79b2a82 100644 } /* -@@ -3120,6 +3125,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) +@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) return NULL; } @@ -179,7 +180,7 @@ index 3db9d61..79b2a82 100644 static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg) { const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT); -@@ -4414,6 +4437,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, +@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, "Common directory of server-related files (logs, confs, etc.)"), AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ, "Common directory for run-time files (shared memory, locks, etc.)"), @@ -188,7 +189,7 @@ index 3db9d61..79b2a82 100644 AP_INIT_TAKE1("ErrorLog", set_server_string_slot, (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF, "The filename of the error log"), -@@ -4941,8 +4966,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem +@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem if (!saved_server_config_defines) init_config_defines(pconf); @@ -198,7 +199,7 @@ index 3db9d61..79b2a82 100644 ap_regcomp_set_default_cflags(AP_REG_DEFAULT); -@@ -5170,6 +5194,27 @@ AP_DECLARE(int) ap_state_query(int query) +@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query) } } diff --git a/httpd.spec b/httpd.spec index 6f5ef66..432c1f2 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.46 -Release: 9%{?dist} +Version: 2.4.48 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -67,9 +67,9 @@ Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch Patch19: httpd-2.4.43-detect-systemd.patch # Features/functional changes -Patch21: httpd-2.4.43-r1842929+.patch +Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.43-export.patch +Patch23: httpd-2.4.48-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch @@ -82,14 +82,11 @@ Patch39: httpd-2.4.43-sslprotdefault.patch Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.43-r1828172+.patch -Patch43: httpd-2.4.43-sslcoalesce.patch -Patch44: httpd-2.4.46-lua-resume.patch Patch45: httpd-2.4.43-logjournal.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch62: httpd-2.4.43-r1870095+.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch # Security fixes @@ -235,12 +232,9 @@ written in the Lua programming language. %patch40 -p1 -b .r1861269 %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ -%patch43 -p1 -b .sslcoalesce -%patch44 -p1 -b .luaresume %patch45 -p1 -b .logjournal %patch60 -p1 -b .enable-sslv3 -%patch62 -p1 -b .r1870095 %patch63 -p1 -b .htcacheclean-dont-break # Patch in the vendor string @@ -779,6 +773,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jun 02 2021 Luboš Uhliarik - 2.4.48-1 +- new version 2.4.48 +- Resolves: #1964746 - httpd-2.4.48 is available + * Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 - Resolves: #1914182 - RFE: CustomLog should be able to use journald diff --git a/sources b/sources index a7871fb..5e6cb0c 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.46.tar.bz2) = 5936784bb662e9d8a4f7fe38b70c043b468114d931cd10ea831bfe74461ea5856b64f88f42c567ab791fc8907640a99884ba4b6a600f86d661781812735b6f13 -SHA512 (httpd-2.4.46.tar.bz2.asc) = 1f54c20d1aeedb7c745eb72acd79e1ed61d547b22c3dbe53cd3274ed3d897543cd8c49181d4b15d79c12755746cf0a2464d620f69e254ac3f998760133094df0 -SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056 +SHA512 (httpd-2.4.48.tar.bz2) = 6c250626f1e7d10428a92d984fd48ff841effcc8705f7816ab71b681bbd51d0012ad158dcd13763fe7d630311f2de258b27574603140d648be42796ab8326724 +SHA512 (httpd-2.4.48.tar.bz2.asc) = 9f125de75107b04dd01f71e9e233b1602658b49e38371931b98dc1092be8df05cf7243b5564fa2f56f46544bef61a54a721dee5ca17ce823a2302a7c3698a195 +SHA512 (KEYS) = 7ab66c64eaa4a152e88a913993c8ea0d9c46fd5865788e7b32a9619784d245cef8bddd9700368e3d63ce88ed94df8933e5892878523dc0fce697331136bb829e From 9c327bba1d45d53ebce3ba96c03d273b34f2ed93 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Thu, 7 Oct 2021 20:34:53 +0200 Subject: [PATCH 002/112] new version 2.4.51 --- .gitignore | 1 + httpd.spec | 5 ++++- sources | 5 ++--- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index af7dee4..bd6e204 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ x86_64 /httpd-2.4.48.tar.bz2.asc /httpd-2.4.49.tar.bz2.asc /httpd-2.4.50.tar.bz2.asc +/httpd-2.4.51.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index d15c8bb..77b51a8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,7 +12,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.50 +Version: 2.4.51 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 +- new version 2.4.51 + * Tue Oct 05 2021 Luboš Uhliarik - 2.4.50-1 - new version 2.4.50 diff --git a/sources b/sources index 63a8c16..a3daaf4 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (httpd-2.4.50.tar.bz2) = b1afbaf44e503b822ff2b443881dcb44a93aa55d496f88ae399a2e7def05f78590f266a16da1f2c0aac88e463b76fba20843b1e20a102e76c8269de6fae3e158 -SHA512 (httpd-2.4.50.tar.bz2.asc) = 31ec3cbf342905f63fc070ae51103a695736a0fc5689d38845a7802fa6b48d86bafd5afcf57f7bbee4435691093326ec5f07a904fd3fa877e0453a3830425776 -SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 +SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce From a8ac1433954955b14afb16e5d8e94026fe51496f Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Thu, 7 Oct 2021 20:39:11 +0200 Subject: [PATCH 003/112] Re-add KEYS file --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index a3daaf4..edbf616 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce +SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 0da20265b49dee20822800585b9c12cc439fdf27 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Oct 2021 08:49:54 +0100 Subject: [PATCH 004/112] Add comment on differences with upstream apachectl, no functional change. --- apachectl.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apachectl.sh b/apachectl.sh index 766cfba..823db3b 100755 --- a/apachectl.sh +++ b/apachectl.sh @@ -15,6 +15,13 @@ # See the License for the specific language governing permissions and # limitations under the License. +### +### NOTE: This is a replacement version of the "apachectl" script with +### some differences in behaviour to the version distributed with +### Apache httpd. Please read the apachectl(8) man page for more +### information. +### + if [ "x$1" = "x-k" ]; then shift fi From 948d29f95248a8c30b93b8e24ed3509bd0fe8e20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 8 Oct 2021 13:58:49 +0200 Subject: [PATCH 005/112] new version 2.4.51 --- .gitignore | 4 +- httpd-2.4.43-sslmultiproxy.patch | 118 +++++++++++++++++++++++++++++++ httpd.spec | 69 +++--------------- sources | 4 +- welcome.conf | 3 +- 5 files changed, 130 insertions(+), 68 deletions(-) create mode 100644 httpd-2.4.43-sslmultiproxy.patch diff --git a/.gitignore b/.gitignore index af7dee4..12fe79c 100644 --- a/.gitignore +++ b/.gitignore @@ -38,6 +38,4 @@ x86_64 /httpd-2.4.43.tar.bz2.asc /KEYS /httpd-2.4.46.tar.bz2.asc -/httpd-2.4.48.tar.bz2.asc -/httpd-2.4.49.tar.bz2.asc -/httpd-2.4.50.tar.bz2.asc +/httpd-2.4.51.tar.bz2.asc diff --git a/httpd-2.4.43-sslmultiproxy.patch b/httpd-2.4.43-sslmultiproxy.patch new file mode 100644 index 0000000..349c4ae --- /dev/null +++ b/httpd-2.4.43-sslmultiproxy.patch @@ -0,0 +1,118 @@ +diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c +index 12617b2..0fe7464 100644 +--- a/modules/ssl/mod_ssl.c ++++ b/modules/ssl/mod_ssl.c +@@ -459,6 +459,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf, + return OK; + } + ++static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable; ++static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set; ++ ++ + static SSLConnRec *ssl_init_connection_ctx(conn_rec *c, + ap_conf_vector_t *per_dir_config, + int new_proxy) +@@ -466,6 +470,10 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c, + SSLConnRec *sslconn = myConnConfig(c); + int need_setup = 0; + ++ if (othermod_engine_disable) { ++ othermod_engine_disable(c); ++ } ++ + /* mod_proxy's (r->)per_dir_config has the lifetime of the request, thus + * it uses ssl_engine_set() to reset sslconn->dc when reusing SSL backend + * connections, so we must fall through here. But in the case where we are +@@ -544,6 +552,10 @@ static int ssl_engine_set(conn_rec *c, + { + SSLConnRec *sslconn; + int status; ++ ++ if (othermod_engine_set) { ++ return othermod_engine_set(c, per_dir_config, proxy, enable); ++ } + + if (proxy) { + sslconn = ssl_init_connection_ctx(c, per_dir_config, 1); +@@ -572,12 +584,18 @@ static int ssl_engine_set(conn_rec *c, + + static int ssl_proxy_enable(conn_rec *c) + { +- return ssl_engine_set(c, NULL, 1, 1); ++ if (othermod_engine_set) ++ return othermod_engine_set(c, NULL, 1, 1); ++ else ++ return ssl_engine_set(c, NULL, 1, 1); + } + + static int ssl_engine_disable(conn_rec *c) + { +- return ssl_engine_set(c, NULL, 0, 0); ++ if (othermod_engine_set) ++ return othermod_engine_set(c, NULL, 0, 0); ++ else ++ return ssl_engine_set(c, NULL, 0, 0); + } + + int ssl_init_ssl_connection(conn_rec *c, request_rec *r) +@@ -753,6 +771,9 @@ static void ssl_register_hooks(apr_pool_t *p) + APR_HOOK_MIDDLE); + + ssl_var_register(p); ++ ++ othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable); ++ othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set); + + APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); + APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); +diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c +index 5724f18..81c56ba 100644 +--- a/modules/ssl/ssl_engine_vars.c ++++ b/modules/ssl/ssl_engine_vars.c +@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char + static void ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize); + static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var); + static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl); ++static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https; ++static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup; + + static SSLConnRec *ssl_get_effective_config(conn_rec *c) + { +@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c) + static int ssl_is_https(conn_rec *c) + { + SSLConnRec *sslconn = ssl_get_effective_config(c); +- return sslconn && sslconn->ssl; ++ ++ return (sslconn && sslconn->ssl) ++ || (othermod_is_https && othermod_is_https(c)); + } + + static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION; +@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p) + { + char *cp, *cp2; + ++ othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https); ++ othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup); ++ + APR_REGISTER_OPTIONAL_FN(ssl_is_https); + APR_REGISTER_OPTIONAL_FN(ssl_var_lookup); + APR_REGISTER_OPTIONAL_FN(ssl_ext_list); +@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, + */ + if (result == NULL && c != NULL) { + SSLConnRec *sslconn = ssl_get_effective_config(c); ++ ++ if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) ++ && (!sslconn || !sslconn->ssl) && othermod_var_lookup) { ++ /* For an SSL_* variable, if mod_ssl is not enabled for ++ * this connection and another SSL module is present, pass ++ * through to that module. */ ++ return othermod_var_lookup(p, s, c, r, var); ++ } ++ + if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) + && sslconn && sslconn->ssl) + result = ssl_var_lookup_ssl(p, sslconn, r, var+4); diff --git a/httpd.spec b/httpd.spec index d15c8bb..d4f88af 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,7 +12,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.50 +Version: 2.4.51 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -60,7 +60,6 @@ Source44: httpd@.service Source45: config.layout Source46: apachectl.sh Source47: apachectl.xml -Source48: apache-poweredby.png # build/scripts patches Patch2: httpd-2.4.43-apxs.patch @@ -75,20 +74,19 @@ Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.48-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch +Patch31: httpd-2.4.43-sslmultiproxy.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch Patch39: httpd-2.4.43-sslprotdefault.patch Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch -Patch42: httpd-2.4.48-r1828172+.patch +Patch42: httpd-2.4.43-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch # Security fixes @@ -99,7 +97,7 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: gnupg2 -Requires: /etc/mime.types, system-logos(httpd-logo-ng) +Requires: /etc/mime.types, system-logos-httpd Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} @@ -168,8 +166,6 @@ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 -# mod_ssl/mod_nss cannot both be loaded simultaneously -Conflicts: mod_nss %description -n mod_ssl The mod_ssl module provides strong cryptography for the Apache HTTP @@ -228,8 +224,8 @@ written in the Lua programming language. %patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons -%patch28 -p1 -b .openssl3 %patch30 -p1 -b .cachehardmax +#patch31 -p1 -b .sslmultiproxy %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault %patch39 -p1 -b .sslprotdefault @@ -239,7 +235,6 @@ written in the Lua programming language. %patch45 -p1 -b .logjournal %patch60 -p1 -b .enable-sslv3 -%patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break # Patch in the vendor string @@ -267,9 +262,6 @@ if test "x${vmmn}" != "x%{mmn}"; then exit 1 fi -# A new logo which comes together with a new test page -cp %{SOURCE48} ./docs/icons/apache_pb3.png - # Provide default layout cp $RPM_SOURCE_DIR/config.layout . @@ -456,7 +448,7 @@ EOF # Handle contentdir mkdir $RPM_BUILD_ROOT%{contentdir}/noindex \ $RPM_BUILD_ROOT%{contentdir}/server-status -ln -s ../../testpage/index.html \ +ln -s ../../fedora-testpage/index.html \ $RPM_BUILD_ROOT%{contentdir}/noindex/index.html install -m 644 -p docs/server-status/* \ $RPM_BUILD_ROOT%{contentdir}/server-status @@ -485,12 +477,6 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \ ln -s ../../pixmaps/poweredby.png \ $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png -# Symlink for the system logo -%if 0%{?rhel} >= 9 -ln -s ../../pixmaps/system-noindex-logo.png \ - $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png -%endif - # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs @@ -787,47 +773,8 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Tue Oct 05 2021 Luboš Uhliarik - 2.4.50-1 -- new version 2.4.50 - -* Wed Sep 22 2021 Luboš Uhliarik - 2.4.49-3 -- Rebuilt for CI testing - -* Thu Sep 16 2021 Luboš Uhliarik - 2.4.49-1 -- new version 2.4.49 (#2004776) - -* Tue Sep 14 2021 Sahana Prasad - 2.4.48-8 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-7 -- add symlink to system logo for noindex test page - -* Fri Aug 6 2021 Joe Orton - 2.4.48-4 -- add OpenSSL 3.x compatibility patch - -* Thu Jul 22 2021 Fedora Release Engineering - 2.4.48-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri Jul 16 2021 Joe Orton - 2.4.48-2 -- mod_cgi/mod_cgid: update to unification from trunk -- httpd.conf: add note on care with Listen and starting at boot - -* Wed Jun 02 2021 Luboš Uhliarik - 2.4.48-1 -- new version 2.4.48 -- Resolves: #1964746 - httpd-2.4.48 is available - -* Mon May 03 2021 Lubos Uhliarik - 2.4.46-13 -- Related: #1934739 - Apache trademark update - new logo - -* Fri Apr 9 2021 Joe Orton - 2.4.46-12 -- use OOMPolicy=continue in httpd.service, httpd@.service (#1947475) - -* Wed Mar 31 2021 Lubos Uhliarik - 2.4.46-11 -- Resolves: #1934739 - Apache trademark update - new logo - -* Tue Feb 23 2021 Joe Orton - 2.4.46-10 -- add Conflicts: with mod_nss -- drop use of apr_ldap_rebind (r1878890, #1847585) +* Fri Oct 08 2021 Luboš Uhliarik - 2.4.51-1 +- new version 2.4.51 * Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 - Resolves: #1914182 - RFE: CustomLog should be able to use journald diff --git a/sources b/sources index 63a8c16..edbf616 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.50.tar.bz2) = b1afbaf44e503b822ff2b443881dcb44a93aa55d496f88ae399a2e7def05f78590f266a16da1f2c0aac88e463b76fba20843b1e20a102e76c8269de6fae3e158 -SHA512 (httpd-2.4.50.tar.bz2.asc) = 31ec3cbf342905f63fc070ae51103a695736a0fc5689d38845a7802fa6b48d86bafd5afcf57f7bbee4435691093326ec5f07a904fd3fa877e0453a3830425776 +SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 +SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 diff --git a/welcome.conf b/welcome.conf index 232c251..b279c2f 100644 --- a/welcome.conf +++ b/welcome.conf @@ -16,5 +16,4 @@ Alias /.noindex.html /usr/share/httpd/noindex/index.html -Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png -Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png +Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png From 6c0da47cfc3c50d8a1ab65093674cc190f402764 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 8 Oct 2021 14:46:35 +0200 Subject: [PATCH 006/112] Add missing patch file --- httpd-2.4.43-r1828172+.patch | 1413 ++++++++++++++++++++++++++++++++++ 1 file changed, 1413 insertions(+) create mode 100644 httpd-2.4.43-r1828172+.patch diff --git a/httpd-2.4.43-r1828172+.patch b/httpd-2.4.43-r1828172+.patch new file mode 100644 index 0000000..3487600 --- /dev/null +++ b/httpd-2.4.43-r1828172+.patch @@ -0,0 +1,1413 @@ +diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h +new file mode 100644 +index 0000000..85c9685 +--- /dev/null ++++ b/modules/generators/cgi_common.h +@@ -0,0 +1,359 @@ ++/* Licensed to the Apache Software Foundation (ASF) under one or more ++ * contributor license agreements. See the NOTICE file distributed with ++ * this work for additional information regarding copyright ownership. ++ * The ASF licenses this file to You under the Apache License, Version 2.0 ++ * (the "License"); you may not use this file except in compliance with ++ * the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the License for the specific language governing permissions and ++ * limitations under the License. ++ */ ++ ++#include "apr.h" ++#include "apr_strings.h" ++#include "apr_buckets.h" ++#include "apr_lib.h" ++#include "apr_poll.h" ++ ++#define APR_WANT_STRFUNC ++#define APR_WANT_MEMFUNC ++#include "apr_want.h" ++ ++#include "httpd.h" ++#include "util_filter.h" ++ ++static void discard_script_output(apr_bucket_brigade *bb) ++{ ++ apr_bucket *e; ++ const char *buf; ++ apr_size_t len; ++ ++ for (e = APR_BRIGADE_FIRST(bb); ++ e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); ++ e = APR_BRIGADE_FIRST(bb)) ++ { ++ if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { ++ break; ++ } ++ apr_bucket_delete(e); ++ } ++} ++ ++#ifdef WANT_CGI_BUCKET ++/* A CGI bucket type is needed to catch any output to stderr from the ++ * script; see PR 22030. */ ++static const apr_bucket_type_t bucket_type_cgi; ++ ++struct cgi_bucket_data { ++ apr_pollset_t *pollset; ++ request_rec *r; ++ apr_interval_time_t timeout; ++}; ++ ++/* Create a CGI bucket using pipes from script stdout 'out' ++ * and stderr 'err', for request 'r'. */ ++static apr_bucket *cgi_bucket_create(request_rec *r, ++ apr_interval_time_t timeout, ++ apr_file_t *out, apr_file_t *err, ++ apr_bucket_alloc_t *list) ++{ ++ apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); ++ apr_status_t rv; ++ apr_pollfd_t fd; ++ struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); ++ ++ /* Disable APR timeout handling since we'll use poll() entirely. */ ++ apr_file_pipe_timeout_set(out, 0); ++ apr_file_pipe_timeout_set(err, 0); ++ ++ APR_BUCKET_INIT(b); ++ b->free = apr_bucket_free; ++ b->list = list; ++ b->type = &bucket_type_cgi; ++ b->length = (apr_size_t)(-1); ++ b->start = -1; ++ ++ /* Create the pollset */ ++ rv = apr_pollset_create(&data->pollset, 2, r->pool, 0); ++ if (rv != APR_SUCCESS) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217) ++ "apr_pollset_create(); check system or user limits"); ++ return NULL; ++ } ++ ++ fd.desc_type = APR_POLL_FILE; ++ fd.reqevents = APR_POLLIN; ++ fd.p = r->pool; ++ fd.desc.f = out; /* script's stdout */ ++ fd.client_data = (void *)1; ++ rv = apr_pollset_add(data->pollset, &fd); ++ if (rv != APR_SUCCESS) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218) ++ "apr_pollset_add(); check system or user limits"); ++ return NULL; ++ } ++ ++ fd.desc.f = err; /* script's stderr */ ++ fd.client_data = (void *)2; ++ rv = apr_pollset_add(data->pollset, &fd); ++ if (rv != APR_SUCCESS) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219) ++ "apr_pollset_add(); check system or user limits"); ++ return NULL; ++ } ++ ++ data->r = r; ++ data->timeout = timeout; ++ b->data = data; ++ return b; ++} ++ ++/* Create a duplicate CGI bucket using given bucket data */ ++static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data, ++ apr_bucket_alloc_t *list) ++{ ++ apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); ++ APR_BUCKET_INIT(b); ++ b->free = apr_bucket_free; ++ b->list = list; ++ b->type = &bucket_type_cgi; ++ b->length = (apr_size_t)(-1); ++ b->start = -1; ++ b->data = data; ++ return b; ++} ++ ++/* Handle stdout from CGI child. Duplicate of logic from the _read ++ * method of the real APR pipe bucket implementation. */ ++static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out, ++ const char **str, apr_size_t *len) ++{ ++ char *buf; ++ apr_status_t rv; ++ ++ *str = NULL; ++ *len = APR_BUCKET_BUFF_SIZE; ++ buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */ ++ ++ rv = apr_file_read(out, buf, len); ++ ++ if (rv != APR_SUCCESS && rv != APR_EOF) { ++ apr_bucket_free(buf); ++ return rv; ++ } ++ ++ if (*len > 0) { ++ struct cgi_bucket_data *data = a->data; ++ apr_bucket_heap *h; ++ ++ /* Change the current bucket to refer to what we read */ ++ a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free); ++ h = a->data; ++ h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */ ++ *str = buf; ++ APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list)); ++ } ++ else { ++ apr_bucket_free(buf); ++ a = apr_bucket_immortal_make(a, "", 0); ++ *str = a->data; ++ } ++ return rv; ++} ++ ++/* Read method of CGI bucket: polls on stderr and stdout of the child, ++ * sending any stderr output immediately away to the error log. */ ++static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str, ++ apr_size_t *len, apr_read_type_e block) ++{ ++ struct cgi_bucket_data *data = b->data; ++ apr_interval_time_t timeout = 0; ++ apr_status_t rv; ++ int gotdata = 0; ++ ++ if (block != APR_NONBLOCK_READ) { ++ timeout = data->timeout > 0 ? data->timeout : data->r->server->timeout; ++ } ++ ++ do { ++ const apr_pollfd_t *results; ++ apr_int32_t num; ++ ++ rv = apr_pollset_poll(data->pollset, timeout, &num, &results); ++ if (APR_STATUS_IS_TIMEUP(rv)) { ++ if (timeout) { ++ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220) ++ "Timeout waiting for output from CGI script %s", ++ data->r->filename); ++ return rv; ++ } ++ else { ++ return APR_EAGAIN; ++ } ++ } ++ else if (APR_STATUS_IS_EINTR(rv)) { ++ continue; ++ } ++ else if (rv != APR_SUCCESS) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221) ++ "poll failed waiting for CGI child"); ++ return rv; ++ } ++ ++ for (; num; num--, results++) { ++ if (results[0].client_data == (void *)1) { ++ /* stdout */ ++ rv = cgi_read_stdout(b, results[0].desc.f, str, len); ++ if (APR_STATUS_IS_EOF(rv)) { ++ rv = APR_SUCCESS; ++ } ++ gotdata = 1; ++ } else { ++ /* stderr */ ++ apr_status_t rv2 = log_script_err(data->r, results[0].desc.f); ++ if (APR_STATUS_IS_EOF(rv2)) { ++ apr_pollset_remove(data->pollset, &results[0]); ++ } ++ } ++ } ++ ++ } while (!gotdata); ++ ++ return rv; ++} ++ ++static const apr_bucket_type_t bucket_type_cgi = { ++ "CGI", 5, APR_BUCKET_DATA, ++ apr_bucket_destroy_noop, ++ cgi_bucket_read, ++ apr_bucket_setaside_notimpl, ++ apr_bucket_split_notimpl, ++ apr_bucket_copy_notimpl ++}; ++ ++#endif /* WANT_CGI_BUCKET */ ++ ++/* Handle the CGI response output, having set up the brigade with the ++ * CGI or PIPE bucket as appropriate. */ ++static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb, ++ apr_interval_time_t timeout, cgi_server_conf *conf, ++ char *logdata, apr_file_t *script_err) ++{ ++ apr_status_t rv; ++ ++ /* Handle script return... */ ++ if (!nph) { ++ const char *location; ++ char sbuf[MAX_STRING_LEN]; ++ int ret; ++ ++ if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX))) ++ { ++ ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err); ++ ++ /* ++ * ret could be HTTP_NOT_MODIFIED in the case that the CGI script ++ * does not set an explicit status and ap_meets_conditions, which ++ * is called by ap_scan_script_header_err_brigade, detects that ++ * the conditions of the requests are met and the response is ++ * not modified. ++ * In this case set r->status and return OK in order to prevent ++ * running through the error processing stack as this would ++ * break with mod_cache, if the conditions had been set by ++ * mod_cache itself to validate a stale entity. ++ * BTW: We circumvent the error processing stack anyway if the ++ * CGI script set an explicit status code (whatever it is) and ++ * the only possible values for ret here are: ++ * ++ * HTTP_NOT_MODIFIED (set by ap_meets_conditions) ++ * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) ++ * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the ++ * processing of the response of the CGI script, e.g broken headers ++ * or a crashed CGI process). ++ */ ++ if (ret == HTTP_NOT_MODIFIED) { ++ r->status = ret; ++ return OK; ++ } ++ ++ return ret; ++ } ++ ++ location = apr_table_get(r->headers_out, "Location"); ++ ++ if (location && r->status == 200) { ++ /* For a redirect whether internal or not, discard any ++ * remaining stdout from the script, and log any remaining ++ * stderr output, as normal. */ ++ discard_script_output(bb); ++ apr_brigade_destroy(bb); ++ ++ if (script_err) { ++ apr_file_pipe_timeout_set(script_err, timeout); ++ log_script_err(r, script_err); ++ } ++ } ++ ++ if (location && location[0] == '/' && r->status == 200) { ++ /* This redirect needs to be a GET no matter what the original ++ * method was. ++ */ ++ r->method = "GET"; ++ r->method_number = M_GET; ++ ++ /* We already read the message body (if any), so don't allow ++ * the redirected request to think it has one. We can ignore ++ * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. ++ */ ++ apr_table_unset(r->headers_in, "Content-Length"); ++ ++ ap_internal_redirect_handler(location, r); ++ return OK; ++ } ++ else if (location && r->status == 200) { ++ /* XXX: Note that if a script wants to produce its own Redirect ++ * body, it now has to explicitly *say* "Status: 302" ++ */ ++ discard_script_output(bb); ++ apr_brigade_destroy(bb); ++ return HTTP_MOVED_TEMPORARILY; ++ } ++ ++ rv = ap_pass_brigade(r->output_filters, bb); ++ } ++ else /* nph */ { ++ struct ap_filter_t *cur; ++ ++ /* get rid of all filters up through protocol... since we ++ * haven't parsed off the headers, there is no way they can ++ * work ++ */ ++ ++ cur = r->proto_output_filters; ++ while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { ++ cur = cur->next; ++ } ++ r->output_filters = r->proto_output_filters = cur; ++ ++ rv = ap_pass_brigade(r->output_filters, bb); ++ } ++ ++ /* don't soak up script output if errors occurred writing it ++ * out... otherwise, we prolong the life of the script when the ++ * connection drops or we stopped sending output for some other ++ * reason */ ++ if (script_err && rv == APR_SUCCESS && !r->connection->aborted) { ++ apr_file_pipe_timeout_set(script_err, timeout); ++ log_script_err(r, script_err); ++ } ++ ++ if (script_err) apr_file_close(script_err); ++ ++ return OK; /* NOT r->status, even if it has changed. */ ++} +diff --git a/modules/generators/config5.m4 b/modules/generators/config5.m4 +index bf29521..0863553 100644 +--- a/modules/generators/config5.m4 ++++ b/modules/generators/config5.m4 +@@ -78,4 +78,15 @@ fi + + APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) + ++AC_ARG_ENABLE(cgid-fdpassing, ++ [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)], ++ [if test "$enableval" = "yes"; then ++ AC_CHECK_DECL(CMSG_DATA, ++ [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])], ++ [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [ ++#include ++#include ]) ++ fi ++]) ++ + APACHE_MODPATH_FINISH +diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c +index 7e4b126..f438b35 100644 +--- a/modules/generators/mod_cgi.c ++++ b/modules/generators/mod_cgi.c +@@ -92,6 +92,10 @@ typedef struct { + apr_size_t bufbytes; + } cgi_server_conf; + ++typedef struct { ++ apr_interval_time_t timeout; ++} cgi_dirconf; ++ + static void *create_cgi_config(apr_pool_t *p, server_rec *s) + { + cgi_server_conf *c = +@@ -112,6 +116,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv) + return overrides->logname ? overrides : base; + } + ++static void *create_cgi_dirconf(apr_pool_t *p, char *dummy) ++{ ++ cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf)); ++ return c; ++} ++ + static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) + { + server_rec *s = cmd->server; +@@ -150,6 +160,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy, + return NULL; + } + ++static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg) ++{ ++ cgi_dirconf *dc = dummy; ++ ++ if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { ++ return "CGIScriptTimeout has wrong format"; ++ } ++ ++ return NULL; ++} ++ + static const command_rec cgi_cmds[] = + { + AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, +@@ -158,6 +179,9 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, + "the maximum length (in bytes) of the script debug log"), + AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, + "the maximum size (in bytes) to record of a POST request"), ++AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, ++ "The amount of time to wait between successful reads from " ++ "the CGI script, in seconds."), + {NULL} + }; + +@@ -466,23 +490,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out, + apr_filepath_name_get(r->filename)); + } + else { ++ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); ++ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; ++ + apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT); + + *script_in = procnew->out; + if (!*script_in) + return APR_EBADF; +- apr_file_pipe_timeout_set(*script_in, r->server->timeout); ++ apr_file_pipe_timeout_set(*script_in, timeout); + + if (e_info->prog_type == RUN_AS_CGI) { + *script_out = procnew->in; + if (!*script_out) + return APR_EBADF; +- apr_file_pipe_timeout_set(*script_out, r->server->timeout); ++ apr_file_pipe_timeout_set(*script_out, timeout); + + *script_err = procnew->err; + if (!*script_err) + return APR_EBADF; +- apr_file_pipe_timeout_set(*script_err, r->server->timeout); ++ apr_file_pipe_timeout_set(*script_err, timeout); + } + } + } +@@ -536,209 +563,12 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, + return APR_SUCCESS; + } + +-static void discard_script_output(apr_bucket_brigade *bb) +-{ +- apr_bucket *e; +- const char *buf; +- apr_size_t len; +- +- for (e = APR_BRIGADE_FIRST(bb); +- e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); +- e = APR_BRIGADE_FIRST(bb)) +- { +- if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { +- break; +- } +- apr_bucket_delete(e); +- } +-} +- + #if APR_FILES_AS_SOCKETS +- +-/* A CGI bucket type is needed to catch any output to stderr from the +- * script; see PR 22030. */ +-static const apr_bucket_type_t bucket_type_cgi; +- +-struct cgi_bucket_data { +- apr_pollset_t *pollset; +- request_rec *r; +-}; +- +-/* Create a CGI bucket using pipes from script stdout 'out' +- * and stderr 'err', for request 'r'. */ +-static apr_bucket *cgi_bucket_create(request_rec *r, +- apr_file_t *out, apr_file_t *err, +- apr_bucket_alloc_t *list) +-{ +- apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); +- apr_status_t rv; +- apr_pollfd_t fd; +- struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data); +- +- APR_BUCKET_INIT(b); +- b->free = apr_bucket_free; +- b->list = list; +- b->type = &bucket_type_cgi; +- b->length = (apr_size_t)(-1); +- b->start = -1; +- +- /* Create the pollset */ +- rv = apr_pollset_create(&data->pollset, 2, r->pool, 0); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217) +- "apr_pollset_create(); check system or user limits"); +- return NULL; +- } +- +- fd.desc_type = APR_POLL_FILE; +- fd.reqevents = APR_POLLIN; +- fd.p = r->pool; +- fd.desc.f = out; /* script's stdout */ +- fd.client_data = (void *)1; +- rv = apr_pollset_add(data->pollset, &fd); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218) +- "apr_pollset_add(); check system or user limits"); +- return NULL; +- } +- +- fd.desc.f = err; /* script's stderr */ +- fd.client_data = (void *)2; +- rv = apr_pollset_add(data->pollset, &fd); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219) +- "apr_pollset_add(); check system or user limits"); +- return NULL; +- } +- +- data->r = r; +- b->data = data; +- return b; +-} +- +-/* Create a duplicate CGI bucket using given bucket data */ +-static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data, +- apr_bucket_alloc_t *list) +-{ +- apr_bucket *b = apr_bucket_alloc(sizeof(*b), list); +- APR_BUCKET_INIT(b); +- b->free = apr_bucket_free; +- b->list = list; +- b->type = &bucket_type_cgi; +- b->length = (apr_size_t)(-1); +- b->start = -1; +- b->data = data; +- return b; +-} +- +-/* Handle stdout from CGI child. Duplicate of logic from the _read +- * method of the real APR pipe bucket implementation. */ +-static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out, +- const char **str, apr_size_t *len) +-{ +- char *buf; +- apr_status_t rv; +- +- *str = NULL; +- *len = APR_BUCKET_BUFF_SIZE; +- buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */ +- +- rv = apr_file_read(out, buf, len); +- +- if (rv != APR_SUCCESS && rv != APR_EOF) { +- apr_bucket_free(buf); +- return rv; +- } +- +- if (*len > 0) { +- struct cgi_bucket_data *data = a->data; +- apr_bucket_heap *h; +- +- /* Change the current bucket to refer to what we read */ +- a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free); +- h = a->data; +- h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */ +- *str = buf; +- APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list)); +- } +- else { +- apr_bucket_free(buf); +- a = apr_bucket_immortal_make(a, "", 0); +- *str = a->data; +- } +- return rv; +-} +- +-/* Read method of CGI bucket: polls on stderr and stdout of the child, +- * sending any stderr output immediately away to the error log. */ +-static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str, +- apr_size_t *len, apr_read_type_e block) +-{ +- struct cgi_bucket_data *data = b->data; +- apr_interval_time_t timeout; +- apr_status_t rv; +- int gotdata = 0; +- +- timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout; +- +- do { +- const apr_pollfd_t *results; +- apr_int32_t num; +- +- rv = apr_pollset_poll(data->pollset, timeout, &num, &results); +- if (APR_STATUS_IS_TIMEUP(rv)) { +- if (timeout) { +- ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220) +- "Timeout waiting for output from CGI script %s", +- data->r->filename); +- return rv; +- } +- else { +- return APR_EAGAIN; +- } +- } +- else if (APR_STATUS_IS_EINTR(rv)) { +- continue; +- } +- else if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221) +- "poll failed waiting for CGI child"); +- return rv; +- } +- +- for (; num; num--, results++) { +- if (results[0].client_data == (void *)1) { +- /* stdout */ +- rv = cgi_read_stdout(b, results[0].desc.f, str, len); +- if (APR_STATUS_IS_EOF(rv)) { +- rv = APR_SUCCESS; +- } +- gotdata = 1; +- } else { +- /* stderr */ +- apr_status_t rv2 = log_script_err(data->r, results[0].desc.f); +- if (APR_STATUS_IS_EOF(rv2)) { +- apr_pollset_remove(data->pollset, &results[0]); +- } +- } +- } +- +- } while (!gotdata); +- +- return rv; +-} +- +-static const apr_bucket_type_t bucket_type_cgi = { +- "CGI", 5, APR_BUCKET_DATA, +- apr_bucket_destroy_noop, +- cgi_bucket_read, +- apr_bucket_setaside_notimpl, +- apr_bucket_split_notimpl, +- apr_bucket_copy_notimpl +-}; +- ++#define WANT_CGI_BUCKET + #endif + ++#include "cgi_common.h" ++ + static int cgi_handler(request_rec *r) + { + int nph; +@@ -757,6 +587,8 @@ static int cgi_handler(request_rec *r) + apr_status_t rv; + cgi_exec_info_t e_info; + conn_rec *c; ++ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); ++ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; + + if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { + return DECLINED; +@@ -916,10 +748,7 @@ static int cgi_handler(request_rec *r) + AP_DEBUG_ASSERT(script_in != NULL); + + #if APR_FILES_AS_SOCKETS +- apr_file_pipe_timeout_set(script_in, 0); +- apr_file_pipe_timeout_set(script_err, 0); +- +- b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc); ++ b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc); + if (b == NULL) + return HTTP_INTERNAL_SERVER_ERROR; + #else +@@ -929,111 +758,7 @@ static int cgi_handler(request_rec *r) + b = apr_bucket_eos_create(c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(bb, b); + +- /* Handle script return... */ +- if (!nph) { +- const char *location; +- char sbuf[MAX_STRING_LEN]; +- int ret; +- +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { +- ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); +- +- /* +- * ret could be HTTP_NOT_MODIFIED in the case that the CGI script +- * does not set an explicit status and ap_meets_conditions, which +- * is called by ap_scan_script_header_err_brigade, detects that +- * the conditions of the requests are met and the response is +- * not modified. +- * In this case set r->status and return OK in order to prevent +- * running through the error processing stack as this would +- * break with mod_cache, if the conditions had been set by +- * mod_cache itself to validate a stale entity. +- * BTW: We circumvent the error processing stack anyway if the +- * CGI script set an explicit status code (whatever it is) and +- * the only possible values for ret here are: +- * +- * HTTP_NOT_MODIFIED (set by ap_meets_conditions) +- * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) +- * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the +- * processing of the response of the CGI script, e.g broken headers +- * or a crashed CGI process). +- */ +- if (ret == HTTP_NOT_MODIFIED) { +- r->status = ret; +- return OK; +- } +- +- return ret; +- } +- +- location = apr_table_get(r->headers_out, "Location"); +- +- if (location && r->status == 200) { +- /* For a redirect whether internal or not, discard any +- * remaining stdout from the script, and log any remaining +- * stderr output, as normal. */ +- discard_script_output(bb); +- apr_brigade_destroy(bb); +- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- log_script_err(r, script_err); +- } +- +- if (location && location[0] == '/' && r->status == 200) { +- /* This redirect needs to be a GET no matter what the original +- * method was. +- */ +- r->method = "GET"; +- r->method_number = M_GET; +- +- /* We already read the message body (if any), so don't allow +- * the redirected request to think it has one. We can ignore +- * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. +- */ +- apr_table_unset(r->headers_in, "Content-Length"); +- +- ap_internal_redirect_handler(location, r); +- return OK; +- } +- else if (location && r->status == 200) { +- /* XXX: Note that if a script wants to produce its own Redirect +- * body, it now has to explicitly *say* "Status: 302" +- */ +- return HTTP_MOVED_TEMPORARILY; +- } +- +- rv = ap_pass_brigade(r->output_filters, bb); +- } +- else /* nph */ { +- struct ap_filter_t *cur; +- +- /* get rid of all filters up through protocol... since we +- * haven't parsed off the headers, there is no way they can +- * work +- */ +- +- cur = r->proto_output_filters; +- while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { +- cur = cur->next; +- } +- r->output_filters = r->proto_output_filters = cur; +- +- rv = ap_pass_brigade(r->output_filters, bb); +- } +- +- /* don't soak up script output if errors occurred writing it +- * out... otherwise, we prolong the life of the script when the +- * connection drops or we stopped sending output for some other +- * reason */ +- if (rv == APR_SUCCESS && !r->connection->aborted) { +- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- log_script_err(r, script_err); +- } +- +- apr_file_close(script_err); +- +- return OK; /* NOT r->status, even if it has changed. */ ++ return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); + } + + /*============================================================================ +@@ -1268,7 +993,7 @@ static void register_hooks(apr_pool_t *p) + AP_DECLARE_MODULE(cgi) = + { + STANDARD20_MODULE_STUFF, +- NULL, /* dir config creater */ ++ create_cgi_dirconf, /* dir config creater */ + NULL, /* dir merger --- default is to override */ + create_cgi_config, /* server config */ + merge_cgi_config, /* merge server config */ +diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c +index 9f4282c..102d2b3 100644 +--- a/modules/generators/mod_cgid.c ++++ b/modules/generators/mod_cgid.c +@@ -342,15 +342,19 @@ static apr_status_t close_unix_socket(void *thefd) + return close(fd); + } + +-/* deal with incomplete reads and signals +- * assume you really have to read buf_size bytes +- */ +-static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) ++/* Read from the socket dealing with incomplete messages and signals. ++ * Returns 0 on success or errno on failure. Stderr fd passed as ++ * auxiliary data from other end is written to *errfd, or else stderr ++ * fileno if not present. */ ++static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size) + { +- char *buf = vbuf; + int rc; ++#ifndef HAVE_CGID_FDPASSING ++ char *buf = vbuf; + size_t bytes_read = 0; + ++ if (errfd) *errfd = 0; ++ + do { + do { + rc = read(fd, buf + bytes_read, buf_size - bytes_read); +@@ -365,9 +369,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) + } + } while (bytes_read < buf_size); + ++ ++#else /* with FD passing */ ++ struct msghdr msg = {0}; ++ struct iovec vec = {vbuf, buf_size}; ++ struct cmsghdr *cmsg; ++ union { /* union to ensure alignment */ ++ struct cmsghdr cm; ++ char buf[CMSG_SPACE(sizeof(int))]; ++ } u; ++ ++ msg.msg_iov = &vec; ++ msg.msg_iovlen = 1; ++ ++ if (errfd) { ++ msg.msg_control = u.buf; ++ msg.msg_controllen = sizeof(u.buf); ++ *errfd = 0; ++ } ++ ++ /* use MSG_WAITALL to skip loop on truncated reads */ ++ do { ++ rc = recvmsg(fd, &msg, MSG_WAITALL); ++ } while (rc < 0 && errno == EINTR); ++ ++ if (rc == 0) { ++ return ECONNRESET; ++ } ++ else if (rc < 0) { ++ return errno; ++ } ++ else if (rc != buf_size) { ++ /* MSG_WAITALL should ensure the recvmsg blocks until the ++ * entire length is read, but let's be paranoid. */ ++ return APR_INCOMPLETE; ++ } ++ ++ if (errfd ++ && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL ++ && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd)) ++ && cmsg->cmsg_level == SOL_SOCKET ++ && cmsg->cmsg_type == SCM_RIGHTS) { ++ *errfd = *((int *) CMSG_DATA(cmsg)); ++ } ++#endif ++ + return APR_SUCCESS; + } + ++/* As sock_readhdr but without auxiliary fd passing. */ ++static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) ++{ ++ return sock_readhdr(fd, NULL, vbuf, buf_size); ++} ++ + /* deal with signals + */ + static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) +@@ -384,7 +439,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) + return APR_SUCCESS; + } + +-static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) ++static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...) + { + va_list ap; + int rc; +@@ -399,9 +454,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) + } + va_end(ap); + ++#ifndef HAVE_CGID_FDPASSING + do { + rc = writev(fd, vec, count); + } while (rc < 0 && errno == EINTR); ++#else ++ { ++ struct msghdr msg = { 0 }; ++ struct cmsghdr *cmsg; ++ union { /* union for alignment */ ++ char buf[CMSG_SPACE(sizeof(int))]; ++ struct cmsghdr align; ++ } u; ++ ++ msg.msg_iov = vec; ++ msg.msg_iovlen = count; ++ ++ if (auxfd) { ++ msg.msg_control = u.buf; ++ msg.msg_controllen = sizeof(u.buf); ++ ++ cmsg = CMSG_FIRSTHDR(&msg); ++ cmsg->cmsg_level = SOL_SOCKET; ++ cmsg->cmsg_type = SCM_RIGHTS; ++ cmsg->cmsg_len = CMSG_LEN(sizeof(int)); ++ *((int *) CMSG_DATA(cmsg)) = auxfd; ++ } ++ ++ do { ++ rc = sendmsg(fd, &msg, 0); ++ } while (rc < 0 && errno == EINTR); ++ } ++#endif ++ + if (rc < 0) { + return errno; + } +@@ -410,7 +495,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) + } + + static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +- cgid_req_t *req) ++ int *errfd, cgid_req_t *req) + { + int i; + char **environ; +@@ -421,7 +506,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, + r->server = apr_pcalloc(r->pool, sizeof(server_rec)); + + /* read the request header */ +- stat = sock_read(fd, req, sizeof(*req)); ++ stat = sock_readhdr(fd, errfd, req, sizeof(*req)); + if (stat != APR_SUCCESS) { + return stat; + } +@@ -479,14 +564,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, + return APR_SUCCESS; + } + +-static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +- int req_type) ++static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r, ++ char *argv0, char **env, int req_type) + { + int i; + cgid_req_t req = {0}; + apr_status_t stat; + ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r); + core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config); ++ int errfd; + + + if (ugid == NULL) { +@@ -507,16 +593,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, + req.args_len = r->args ? strlen(r->args) : 0; + req.loglevel = r->server->log.level; + ++ if (errpipe) ++ apr_os_file_get(&errfd, errpipe); ++ else ++ errfd = 0; ++ + /* Write the request header */ + if (req.args_len) { +- stat = sock_writev(fd, r, 5, ++ stat = sock_writev(fd, errfd, r, 5, + &req, sizeof(req), + r->filename, req.filename_len, + argv0, req.argv0_len, + r->uri, req.uri_len, + r->args, req.args_len); + } else { +- stat = sock_writev(fd, r, 4, ++ stat = sock_writev(fd, errfd, r, 4, + &req, sizeof(req), + r->filename, req.filename_len, + argv0, req.argv0_len, +@@ -531,7 +622,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, + for (i = 0; i < req.env_count; i++) { + apr_size_t curlen = strlen(env[i]); + +- if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen), ++ if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen), + env[i], curlen)) != APR_SUCCESS) { + return stat; + } +@@ -582,20 +673,34 @@ static void daemon_signal_handler(int sig) + } + } + ++/* Callback executed in the forked child process if exec of the CGI ++ * script fails. For the fd-passing case, output to stderr goes to ++ * the client (request handling thread) and is logged via ++ * ap_log_rerror there. For the non-fd-passing case, the "fake" ++ * request_rec passed via userdata is used to log. */ + static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err, + const char *description) + { +- request_rec *r; + void *vr; + + apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool); +- r = vr; +- +- /* sure we got r, but don't call ap_log_rerror() because we don't +- * have r->headers_in and possibly other storage referenced by +- * ap_log_rerror() +- */ +- ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description); ++ if (vr) { ++ request_rec *r = vr; ++ ++ /* sure we got r, but don't call ap_log_rerror() because we don't ++ * have r->headers_in and possibly other storage referenced by ++ * ap_log_rerror() ++ */ ++ ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description); ++ } ++ else { ++ const char *logstr; ++ ++ logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n", ++ description, &err); ++ fputs(logstr, stderr); ++ fflush(stderr); ++ } + } + + static int cgid_server(void *data) +@@ -669,7 +774,7 @@ static int cgid_server(void *data) + } + + while (!daemon_should_exit) { +- int errfileno = STDERR_FILENO; ++ int errfileno; + char *argv0 = NULL; + char **env = NULL; + const char * const *argv; +@@ -709,7 +814,7 @@ static int cgid_server(void *data) + r = apr_pcalloc(ptrans, sizeof(request_rec)); + procnew = apr_pcalloc(ptrans, sizeof(*procnew)); + r->pool = ptrans; +- stat = get_req(sd2, r, &argv0, &env, &cgid_req); ++ stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req); + if (stat != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_ERR, stat, + main_server, APLOGNO(01248) +@@ -741,6 +846,16 @@ static int cgid_server(void *data) + continue; + } + ++ if (errfileno == 0) { ++ errfileno = STDERR_FILENO; ++ } ++ else { ++ ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server, ++ "using passed fd %d as stderr", errfileno); ++ /* Limit the received fd lifetime to pool lifetime */ ++ apr_pool_cleanup_register(ptrans, (void *)((long)errfileno), ++ close_unix_socket, close_unix_socket); ++ } + apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); + apr_os_file_put(&inout, &sd2, 0, r->pool); + +@@ -800,7 +915,10 @@ static int cgid_server(void *data) + close(sd2); + } + else { +- apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans); ++ if (errfileno == STDERR_FILENO) { ++ /* Used by cgid_child_errfn without fd-passing. */ ++ apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans); ++ } + + argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); + +@@ -1099,6 +1217,33 @@ static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret, + return ret; + } + ++/* Soak up stderr from a script and redirect it to the error log. ++ * TODO: log_scripterror() and this could move to cgi_common.h. */ ++static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err) ++{ ++ char argsbuffer[HUGE_STRING_LEN]; ++ char *newline; ++ apr_status_t rv; ++ cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module); ++ ++ while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN, ++ script_err)) == APR_SUCCESS) { ++ ++ newline = strchr(argsbuffer, '\n'); ++ if (newline) { ++ char *prev = newline - 1; ++ if (prev >= argsbuffer && *prev == '\r') { ++ newline = prev; ++ } ++ ++ *newline = '\0'; ++ } ++ log_scripterror(r, conf, r->status, 0, argsbuffer); ++ } ++ ++ return rv; ++} ++ + static int log_script(request_rec *r, cgid_server_conf * conf, int ret, + char *dbuf, const char *sbuf, apr_bucket_brigade *bb, + apr_file_t *script_err) +@@ -1204,6 +1349,13 @@ static int log_script(request_rec *r, cgid_server_conf * conf, int ret, + return ret; + } + ++/* Pull in CGI bucket implementation. */ ++#define cgi_server_conf cgid_server_conf ++#ifdef HAVE_CGID_FDPASSING ++#define WANT_CGI_BUCKET ++#endif ++#include "cgi_common.h" ++ + static int connect_to_daemon(int *sdptr, request_rec *r, + cgid_server_conf *conf) + { +@@ -1270,23 +1422,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, + return OK; + } + +-static void discard_script_output(apr_bucket_brigade *bb) +-{ +- apr_bucket *e; +- const char *buf; +- apr_size_t len; +- +- for (e = APR_BRIGADE_FIRST(bb); +- e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e); +- e = APR_BRIGADE_FIRST(bb)) +- { +- if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) { +- break; +- } +- apr_bucket_delete(e); +- } +-} +- + /**************************************************************** + * + * Actual cgid handling... +@@ -1391,6 +1526,7 @@ static apr_status_t cleanup_script(void *vptr) + + static int cgid_handler(request_rec *r) + { ++ conn_rec *c = r->connection; + int retval, nph, dbpos; + char *argv0, *dbuf; + apr_bucket_brigade *bb; +@@ -1400,10 +1536,11 @@ static int cgid_handler(request_rec *r) + int seen_eos, child_stopped_reading; + int sd; + char **env; +- apr_file_t *tempsock; ++ apr_file_t *tempsock, *script_err, *errpipe_out; + struct cleanup_script_info *info; + apr_status_t rv; + cgid_dirconf *dc; ++ apr_interval_time_t timeout; + + if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { + return DECLINED; +@@ -1412,7 +1549,7 @@ static int cgid_handler(request_rec *r) + conf = ap_get_module_config(r->server->module_config, &cgid_module); + dc = ap_get_module_config(r->per_dir_config, &cgid_module); + +- ++ timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; + is_included = !strcmp(r->protocol, "INCLUDED"); + + if ((argv0 = strrchr(r->filename, '/')) != NULL) { +@@ -1465,6 +1602,17 @@ static int cgid_handler(request_rec *r) + } + */ + ++#ifdef HAVE_CGID_FDPASSING ++ rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool); ++ if (rv) { ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176) ++ "could not create pipe for stderr"); ++ } ++#else ++ script_err = NULL; ++ errpipe_out = NULL; ++#endif ++ + /* + * httpd core function used to add common environment variables like + * DOCUMENT_ROOT. +@@ -1477,12 +1625,16 @@ static int cgid_handler(request_rec *r) + return retval; + } + +- rv = send_req(sd, r, argv0, env, CGI_REQ); ++ rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ); + if (rv != APR_SUCCESS) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268) + "write to cgi daemon process"); + } + ++ /* The write-end of the pipe is only used by the server, so close ++ * it here. */ ++ if (errpipe_out) apr_file_close(errpipe_out); ++ + info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); + info->conf = conf; + info->r = r; +@@ -1504,12 +1656,7 @@ static int cgid_handler(request_rec *r) + */ + + apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); +- if (dc->timeout > 0) { +- apr_file_pipe_timeout_set(tempsock, dc->timeout); +- } +- else { +- apr_file_pipe_timeout_set(tempsock, r->server->timeout); +- } ++ apr_file_pipe_timeout_set(tempsock, timeout); + apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); + + /* Transfer any put/post args, CERN style... +@@ -1601,114 +1748,19 @@ static int cgid_handler(request_rec *r) + */ + shutdown(sd, 1); + +- /* Handle script return... */ +- if (!nph) { +- conn_rec *c = r->connection; +- const char *location; +- char sbuf[MAX_STRING_LEN]; +- int ret; +- +- bb = apr_brigade_create(r->pool, c->bucket_alloc); +- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- b = apr_bucket_eos_create(c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { +- ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); +- +- /* +- * ret could be HTTP_NOT_MODIFIED in the case that the CGI script +- * does not set an explicit status and ap_meets_conditions, which +- * is called by ap_scan_script_header_err_brigade, detects that +- * the conditions of the requests are met and the response is +- * not modified. +- * In this case set r->status and return OK in order to prevent +- * running through the error processing stack as this would +- * break with mod_cache, if the conditions had been set by +- * mod_cache itself to validate a stale entity. +- * BTW: We circumvent the error processing stack anyway if the +- * CGI script set an explicit status code (whatever it is) and +- * the only possible values for ret here are: +- * +- * HTTP_NOT_MODIFIED (set by ap_meets_conditions) +- * HTTP_PRECONDITION_FAILED (set by ap_meets_conditions) +- * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the +- * processing of the response of the CGI script, e.g broken headers +- * or a crashed CGI process). +- */ +- if (ret == HTTP_NOT_MODIFIED) { +- r->status = ret; +- return OK; +- } +- +- return ret; +- } +- +- location = apr_table_get(r->headers_out, "Location"); +- +- if (location && location[0] == '/' && r->status == 200) { +- +- /* Soak up all the script output */ +- discard_script_output(bb); +- apr_brigade_destroy(bb); +- /* This redirect needs to be a GET no matter what the original +- * method was. +- */ +- r->method = "GET"; +- r->method_number = M_GET; +- +- /* We already read the message body (if any), so don't allow +- * the redirected request to think it has one. We can ignore +- * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR. +- */ +- apr_table_unset(r->headers_in, "Content-Length"); +- +- ap_internal_redirect_handler(location, r); +- return OK; +- } +- else if (location && r->status == 200) { +- /* XXX: Note that if a script wants to produce its own Redirect +- * body, it now has to explicitly *say* "Status: 302" +- */ +- discard_script_output(bb); +- apr_brigade_destroy(bb); +- return HTTP_MOVED_TEMPORARILY; +- } +- +- rv = ap_pass_brigade(r->output_filters, bb); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, +- "Failed to flush CGI output to client"); +- } +- } +- +- if (nph) { +- conn_rec *c = r->connection; +- struct ap_filter_t *cur; +- +- /* get rid of all filters up through protocol... since we +- * haven't parsed off the headers, there is no way they can +- * work +- */ +- +- cur = r->proto_output_filters; +- while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) { +- cur = cur->next; +- } +- r->output_filters = r->proto_output_filters = cur; +- +- bb = apr_brigade_create(r->pool, c->bucket_alloc); +- b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- b = apr_bucket_eos_create(c->bucket_alloc); +- APR_BRIGADE_INSERT_TAIL(bb, b); +- ap_pass_brigade(r->output_filters, bb); +- } ++ bb = apr_brigade_create(r->pool, c->bucket_alloc); ++#ifdef HAVE_CGID_FDPASSING ++ b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc); ++ if (b == NULL) ++ return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */ ++#else ++ b = apr_bucket_pipe_create(tempsock, c->bucket_alloc); ++#endif ++ APR_BRIGADE_INSERT_TAIL(bb, b); ++ b = apr_bucket_eos_create(c->bucket_alloc); ++ APR_BRIGADE_INSERT_TAIL(bb, b); + +- return OK; /* NOT r->status, even if it has changed. */ ++ return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); + } + + +@@ -1825,7 +1877,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, + return retval; + } + +- send_req(sd, r, command, env, SSI_REQ); ++ send_req(sd, NULL, r, command, env, SSI_REQ); + + info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); + info->conf = conf; From 485637a10d7dcace7c60e54f5df10cf824dc421a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 13:53:59 +0100 Subject: [PATCH 007/112] mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) --- ...nssl3.patch => httpd-2.4.51-openssl3.patch | 104 +++++++++--------- httpd.spec | 7 +- 2 files changed, 57 insertions(+), 54 deletions(-) rename httpd-2.4.48-openssl3.patch => httpd-2.4.51-openssl3.patch (83%) diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.51-openssl3.patch similarity index 83% rename from httpd-2.4.48-openssl3.patch rename to httpd-2.4.51-openssl3.patch index f218d16..a4423c7 100644 --- a/httpd-2.4.48-openssl3.patch +++ b/httpd-2.4.51-openssl3.patch @@ -1,11 +1,9 @@ https://github.com/apache/httpd/pull/258 -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 4da24eddcc..5d199cddaf 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) +--- httpd-2.4.51/modules/ssl/ssl_engine_init.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_init.c +@@ -91,7 +91,6 @@ return 1; } @@ -13,7 +11,7 @@ index 4da24eddcc..5d199cddaf 100644 /* * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* -@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen) +@@ -171,6 +170,7 @@ return NULL; /* impossible to reach. */ } @@ -21,7 +19,7 @@ index 4da24eddcc..5d199cddaf 100644 static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, server_rec *s) -@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, +@@ -440,8 +440,9 @@ modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ @@ -32,19 +30,19 @@ index 4da24eddcc..5d199cddaf 100644 init_bio_methods(); #endif -@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s, +@@ -862,7 +863,11 @@ { SSL_CTX *ctx = mctx->ssl_ctx; +#if MODSSL_USE_OPENSSL_PRE_1_1_API ++ /* Note that for OpenSSL>=1.1, auto selection is enabled via ++ * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */ SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); -+#else -+ SSL_CTX_set_dh_auto(ctx, 1); +#endif SSL_CTX_set_info_callback(ctx, ssl_callback_Info); -@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s, +@@ -871,6 +876,23 @@ #endif } @@ -68,7 +66,7 @@ index 4da24eddcc..5d199cddaf 100644 static apr_status_t ssl_init_ctx_verify(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, -@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, +@@ -911,10 +933,8 @@ ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, "Configuring client authentication"); @@ -81,7 +79,7 @@ index 4da24eddcc..5d199cddaf 100644 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) "Unable to configure verify locations " "for client authentication"); -@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, +@@ -999,6 +1019,23 @@ return APR_SUCCESS; } @@ -105,7 +103,7 @@ index 4da24eddcc..5d199cddaf 100644 static apr_status_t ssl_init_ctx_crl(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, -@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, +@@ -1037,8 +1074,8 @@ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) "Configuring certificate revocation facility"); @@ -116,7 +114,7 @@ index 4da24eddcc..5d199cddaf 100644 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) "Host %s: unable to configure X.509 CRL storage " "for certificate revocation", mctx->sc->vhost_id); -@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag, +@@ -1267,6 +1304,31 @@ return 0; } @@ -148,7 +146,7 @@ index 4da24eddcc..5d199cddaf 100644 static apr_status_t ssl_init_server_certs(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, -@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, +@@ -1277,7 +1339,7 @@ const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; int i; X509 *cert; @@ -157,7 +155,7 @@ index 4da24eddcc..5d199cddaf 100644 #ifdef HAVE_ECC EC_GROUP *ecparams = NULL; int nid; -@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, +@@ -1372,8 +1434,7 @@ } else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, SSL_FILETYPE_PEM) < 1) @@ -167,13 +165,15 @@ index 4da24eddcc..5d199cddaf 100644 ssl_asn1_t *asn1; const unsigned char *ptr; -@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s, +@@ -1462,13 +1523,22 @@ */ certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); if (certfile && !modssl_is_engine_id(certfile) - && (dhparams = ssl_dh_GetParamFromFile(certfile))) { - SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); + && (dh = ssl_dh_GetParamFromFile(certfile))) { ++ /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() ++ * for OpenSSL 3.0+. */ + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) "Custom DH parameters (%d bits) for %s loaded from %s", @@ -182,9 +182,17 @@ index 4da24eddcc..5d199cddaf 100644 + modssl_DH_bits(dh), vhost_id, certfile); + DH_free(dh); } ++#if !MODSSL_USE_OPENSSL_PRE_1_1_API ++ else { ++ /* If no parameter is manually configured, enable auto ++ * selection. */ ++ SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); ++ } ++#endif #ifdef HAVE_ECC -@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, + /* +@@ -1518,6 +1588,7 @@ char buf[TLSEXT_TICKET_KEY_LEN]; char *path; modssl_ticket_key_t *ticket_key = mctx->ticket_key; @@ -192,7 +200,7 @@ index 4da24eddcc..5d199cddaf 100644 if (!ticket_key->file_path) { return APR_SUCCESS; -@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, +@@ -1545,11 +1616,22 @@ } memcpy(ticket_key->key_name, buf, 16); @@ -219,7 +227,7 @@ index 4da24eddcc..5d199cddaf 100644 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) "Unable to initialize TLS session ticket key callback " "(incompatible OpenSSL version?)"); -@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, +@@ -1680,7 +1762,7 @@ return ssl_die(s); } @@ -228,7 +236,7 @@ index 4da24eddcc..5d199cddaf 100644 for (n = 0; n < ncerts; n++) { int i; -@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data) +@@ -2277,10 +2359,11 @@ } @@ -242,11 +250,9 @@ index 4da24eddcc..5d199cddaf 100644 return APR_SUCCESS; } -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index cabf753790..3db7077f1e 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio) +--- httpd-2.4.51/modules/ssl/ssl_engine_io.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_io.c +@@ -194,6 +194,10 @@ static int bio_filter_out_read(BIO *bio, char *out, int outl) { /* this is never called */ @@ -257,7 +263,7 @@ index cabf753790..3db7077f1e 100644 return -1; } -@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr) +@@ -293,12 +297,20 @@ static int bio_filter_out_gets(BIO *bio, char *buf, int size) { /* this is never called */ @@ -278,7 +284,7 @@ index cabf753790..3db7077f1e 100644 return -1; } -@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) +@@ -533,22 +545,47 @@ static int bio_filter_in_write(BIO *bio, const char *in, int inl) { @@ -327,7 +333,7 @@ index cabf753790..3db7077f1e 100644 } #if MODSSL_USE_OPENSSL_PRE_1_1_API -@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = { +@@ -573,7 +610,7 @@ bio_filter_in_read, bio_filter_in_puts, /* puts is never called */ bio_filter_in_gets, /* gets is never called */ @@ -336,11 +342,9 @@ index cabf753790..3db7077f1e 100644 bio_filter_create, bio_filter_destroy, NULL -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index b99dcf19d4..aced92d2d0 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client = +--- httpd-2.4.51/modules/ssl/ssl_engine_kernel.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_kernel.c +@@ -1685,6 +1685,7 @@ ** _________________________________________________________________ */ @@ -348,7 +352,7 @@ index b99dcf19d4..aced92d2d0 100644 /* * Hand out standard DH parameters, based on the authentication strength */ -@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen) +@@ -1730,6 +1731,7 @@ return modssl_get_dh_params(keylen); } @@ -356,7 +360,7 @@ index b99dcf19d4..aced92d2d0 100644 /* * This OpenSSL callback function is called when OpenSSL -@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl, +@@ -2614,7 +2616,11 @@ unsigned char *keyname, unsigned char *iv, EVP_CIPHER_CTX *cipher_ctx, @@ -369,7 +373,7 @@ index b99dcf19d4..aced92d2d0 100644 int mode) { conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl, +@@ -2640,7 +2646,13 @@ } EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, ticket_key->aes_key, iv); @@ -384,7 +388,7 @@ index b99dcf19d4..aced92d2d0 100644 ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) "TLS session ticket key for %s successfully set, " -@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl, +@@ -2661,7 +2673,13 @@ EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, ticket_key->aes_key, iv); @@ -399,11 +403,9 @@ index b99dcf19d4..aced92d2d0 100644 ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) "TLS session ticket key for %s successfully set, " -diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c -index 7dbbbdb55e..3b3ceacf0a 100644 ---- a/modules/ssl/ssl_engine_log.c -+++ b/modules/ssl/ssl_engine_log.c -@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s) +--- httpd-2.4.51/modules/ssl/ssl_engine_log.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_log.c +@@ -78,6 +78,16 @@ return APR_EGENERAL; } @@ -420,7 +422,7 @@ index 7dbbbdb55e..3b3ceacf0a 100644 /* * Prints the SSL library error information. */ -@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s) +@@ -87,7 +97,7 @@ const char *data; int flags; @@ -429,10 +431,8 @@ index 7dbbbdb55e..3b3ceacf0a 100644 const char *annotation; char err[256]; -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index a6fc7513a2..b091c58c94 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h +--- httpd-2.4.51/modules/ssl/ssl_private.h.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_private.h @@ -89,6 +89,9 @@ /* must be defined before including ssl.h */ #define OPENSSL_NO_SSL_INTERN @@ -459,7 +459,7 @@ index a6fc7513a2..b091c58c94 100644 #else /* defined(LIBRESSL_VERSION_NUMBER) */ #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) #endif -@@ -674,7 +676,11 @@ typedef struct { +@@ -681,7 +683,11 @@ typedef struct { const char *file_path; unsigned char key_name[16]; @@ -471,7 +471,7 @@ index a6fc7513a2..b091c58c94 100644 unsigned char aes_key[16]; } modssl_ticket_key_t; #endif -@@ -938,8 +944,16 @@ int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); +@@ -945,8 +951,16 @@ int ssl_callback_ClientHello(SSL *, int *, void *); #endif #ifdef HAVE_TLS_SESSION_TICKETS @@ -490,7 +490,7 @@ index a6fc7513a2..b091c58c94 100644 #endif #ifdef HAVE_TLS_ALPN -@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx); +@@ -1124,10 +1138,12 @@ #endif diff --git a/httpd.spec b/httpd.spec index 77b51a8..0cd12da 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.51 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -75,7 +75,7 @@ Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.48-openssl3.patch +Patch28: httpd-2.4.51-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Oct 12 2021 Joe Orton - 2.4.51-2 +- mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) + * Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 - new version 2.4.51 From 331f0eab0a43fa1bf94ad70189f5443e3607d0f0 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 13:54:10 +0100 Subject: [PATCH 008/112] Add rpminspect waivers. --- rpminspect.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..1b4f2fe --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,6 @@ +--- +badfuncs: + # mod_proxy uses inet_ntoa (safely) for IPv4 address matching, + # and APR interfaces for IPv6 addresses. + ignore: + - /usr/lib*/httpd/modules/mod_proxy.so From 913d808969a8223ce7c7c242305fabc7c5eeed9e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 14:01:42 +0100 Subject: [PATCH 009/112] Bump to .51. --- pullrev.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pullrev.sh b/pullrev.sh index f7fb600..87b7cd7 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.48 +#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +ver=2.4.51 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From 923974e191bcfae8a714c666e7ba75566c72aeb3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 14:01:48 +0100 Subject: [PATCH 010/112] - mod_deflate/core: add two brigade handling correctness fixes --- httpd-2.4.51-r1894150.patch | 17 +++++++++++++++++ httpd-2.4.51-r1894152.patch | 36 ++++++++++++++++++++++++++++++++++++ httpd.spec | 5 +++++ 3 files changed, 58 insertions(+) create mode 100644 httpd-2.4.51-r1894150.patch create mode 100644 httpd-2.4.51-r1894152.patch diff --git a/httpd-2.4.51-r1894150.patch b/httpd-2.4.51-r1894150.patch new file mode 100644 index 0000000..c8acff9 --- /dev/null +++ b/httpd-2.4.51-r1894150.patch @@ -0,0 +1,17 @@ +# ./pullrev.sh 1894150 +http://svn.apache.org/viewvc?view=revision&revision=1894150 + +--- httpd-2.4.51/server/util_filter.c ++++ httpd-2.4.51/server/util_filter.c +@@ -565,8 +565,9 @@ + apr_bucket_brigade *bb) + { + if (next) { +- apr_bucket *e; +- if ((e = APR_BRIGADE_LAST(bb)) && APR_BUCKET_IS_EOS(e) && next->r) { ++ apr_bucket *e = APR_BRIGADE_LAST(bb); ++ ++ if (e != APR_BRIGADE_SENTINEL(bb) && APR_BUCKET_IS_EOS(e) && next->r) { + /* This is only safe because HTTP_HEADER filter is always in + * the filter stack. This ensures that there is ALWAYS a + * request-based filter that we can attach this to. If the diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch new file mode 100644 index 0000000..95f5081 --- /dev/null +++ b/httpd-2.4.51-r1894152.patch @@ -0,0 +1,36 @@ +# ./pullrev.sh 1894152 +http://svn.apache.org/viewvc?view=revision&revision=1894152 + +--- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 ++++ httpd-2.4.51/modules/filters/mod_deflate.c +@@ -835,6 +835,7 @@ + while (!APR_BRIGADE_EMPTY(bb)) + { + apr_bucket *b; ++ apr_status_t rv; + + /* + * Optimization: If we are a HEAD request and bytes_sent is not zero +@@ -914,8 +915,6 @@ + } + + if (APR_BUCKET_IS_FLUSH(e)) { +- apr_status_t rv; +- + /* flush the remaining data from the zlib buffers */ + zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate, + Z_SYNC_FLUSH, NO_UPDATE_CRC); +@@ -947,7 +946,12 @@ + } + + /* read */ +- apr_bucket_read(e, &data, &len, APR_BLOCK_READ); ++ rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ); ++ if (rv) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298) ++ "failed reading from %s bucket", e->type->name); ++ return rv; ++ } + if (!len) { + apr_bucket_delete(e); + continue; diff --git a/httpd.spec b/httpd.spec index 0cd12da..9c21ef8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -90,6 +90,8 @@ Patch45: httpd-2.4.43-logjournal.patch Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch +Patch64: httpd-2.4.51-r1894150.patch +Patch65: httpd-2.4.51-r1894152.patch # Security fixes @@ -241,6 +243,8 @@ written in the Lua programming language. %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break +%patch64 -p1 -b .r1894150 +%patch65 -p1 -b .r1894152 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -789,6 +793,7 @@ exit $rv %changelog * Tue Oct 12 2021 Joe Orton - 2.4.51-2 - mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) +- mod_deflate/core: add two brigade handling correctness fixes * Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 - new version 2.4.51 From 34c723953e0376307087f3d5eaa2149f7c421d5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 15 Oct 2021 16:31:44 +0200 Subject: [PATCH 011/112] Added gating for 'testing' --- gating.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gating.yaml b/gating.yaml index ce08116..e4c04e7 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,4 +1,13 @@ --- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_testing] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rawhide +--- !Policy product_versions: - fedora-* decision_contexts: [bodhi_update_push_stable] From 4916eeea5bf7043cec58d0b56ac1c8de2ff1bdcf Mon Sep 17 00:00:00 2001 From: Neal Gompa Date: Mon, 6 Dec 2021 19:35:37 -0500 Subject: [PATCH 012/112] Use NAME from os-release(5) for vendor string Related: #2029071 httpd on CentOS identifies as RHEL --- httpd.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 9c21ef8..31ff412 100644 --- a/httpd.spec +++ b/httpd.spec @@ -3,7 +3,7 @@ %define suexec_caller apache %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} -%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT}) +%define vstring %(source /etc/os-release; echo ${NAME}) %if 0%{?fedora} > 26 || 0%{?rhel} > 7 %global mpm event %else @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.51 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -791,6 +791,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Dec 06 2021 Neal Gompa - 2.4.51-3 +- Use NAME from os-release(5) for vendor string + Related: #2029071 - httpd on CentOS identifies as RHEL + * Tue Oct 12 2021 Joe Orton - 2.4.51-2 - mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) - mod_deflate/core: add two brigade handling correctness fixes From 47d608302424bd85de32bdd0f405fb217c8d1950 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 22 Dec 2021 08:13:43 +0000 Subject: [PATCH 013/112] update to 2.4.52 Resolves: rhbz#2034673 Resolves: rhbz#2034675 --- .gitignore | 1 + httpd-2.4.51-openssl3.patch | 505 ------------------------------------ httpd-2.4.51-r1894150.patch | 17 -- httpd.spec | 11 +- sources | 4 +- 5 files changed, 8 insertions(+), 530 deletions(-) delete mode 100644 httpd-2.4.51-openssl3.patch delete mode 100644 httpd-2.4.51-r1894150.patch diff --git a/.gitignore b/.gitignore index bd6e204..a6fac0d 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ x86_64 /httpd-2.4.49.tar.bz2.asc /httpd-2.4.50.tar.bz2.asc /httpd-2.4.51.tar.bz2.asc +/httpd-2.4.52.tar.bz2.asc diff --git a/httpd-2.4.51-openssl3.patch b/httpd-2.4.51-openssl3.patch deleted file mode 100644 index a4423c7..0000000 --- a/httpd-2.4.51-openssl3.patch +++ /dev/null @@ -1,505 +0,0 @@ - -https://github.com/apache/httpd/pull/258 - ---- httpd-2.4.51/modules/ssl/ssl_engine_init.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_init.c -@@ -91,7 +91,6 @@ - - return 1; - } --#endif - - /* - * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* -@@ -171,6 +170,7 @@ - - return NULL; /* impossible to reach. */ - } -+#endif - - static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, - server_rec *s) -@@ -440,8 +440,9 @@ - - modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - init_dh_params(); --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#else - init_bio_methods(); - #endif - -@@ -862,7 +863,11 @@ - { - SSL_CTX *ctx = mctx->ssl_ctx; - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ /* Note that for OpenSSL>=1.1, auto selection is enabled via -+ * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */ - SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); -+#endif - - SSL_CTX_set_info_callback(ctx, ssl_callback_Info); - -@@ -871,6 +876,23 @@ - #endif - } - -+static APR_INLINE -+int modssl_CTX_load_verify_locations(SSL_CTX *ctx, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!SSL_CTX_load_verify_locations(ctx, file, path)) -+ return 0; -+#else -+ if (file && !SSL_CTX_load_verify_file(ctx, file)) -+ return 0; -+ if (path && !SSL_CTX_load_verify_dir(ctx, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_verify(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -911,10 +933,8 @@ - ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, - "Configuring client authentication"); - -- if (!SSL_CTX_load_verify_locations(ctx, -- mctx->auth.ca_cert_file, -- mctx->auth.ca_cert_path)) -- { -+ if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, -+ mctx->auth.ca_cert_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) - "Unable to configure verify locations " - "for client authentication"); -@@ -999,6 +1019,23 @@ - return APR_SUCCESS; - } - -+static APR_INLINE -+int modssl_X509_STORE_load_locations(X509_STORE *store, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!X509_STORE_load_locations(store, file, path)) -+ return 0; -+#else -+ if (file && !X509_STORE_load_file(store, file)) -+ return 0; -+ if (path && !X509_STORE_load_path(store, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_crl(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1037,8 +1074,8 @@ - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) - "Configuring certificate revocation facility"); - -- if (!store || !X509_STORE_load_locations(store, mctx->crl_file, -- mctx->crl_path)) { -+ if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file, -+ mctx->crl_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) - "Host %s: unable to configure X.509 CRL storage " - "for certificate revocation", mctx->sc->vhost_id); -@@ -1267,6 +1304,31 @@ - return 0; - } - -+static APR_INLINE int modssl_DH_bits(DH *dh) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return DH_bits(dh); -+#else -+ return BN_num_bits(DH_get0_p(dh)); -+#endif -+} -+ -+/* SSL_CTX_use_PrivateKey_file() can fail either because the private -+ * key was encrypted, or due to a mismatch between an already-loaded -+ * cert and the key - a common misconfiguration - from calling -+ * X509_check_private_key(). This macro is passed the last error code -+ * off the OpenSSL stack and evaluates to true only for the first -+ * case. With OpenSSL < 3 the second case is identifiable by the -+ * function code, but function codes are not used from 3.0. */ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY) -+#else -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509 \ -+ || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE)) -+#endif -+ - static apr_status_t ssl_init_server_certs(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1277,7 +1339,7 @@ - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; - X509 *cert; -- DH *dhparams; -+ DH *dh; - #ifdef HAVE_ECC - EC_GROUP *ecparams = NULL; - int nid; -@@ -1372,8 +1434,7 @@ - } - else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, - SSL_FILETYPE_PEM) < 1) -- && (ERR_GET_FUNC(ERR_peek_last_error()) -- != X509_F_X509_CHECK_PRIVATE_KEY)) { -+ && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) { - ssl_asn1_t *asn1; - const unsigned char *ptr; - -@@ -1462,13 +1523,22 @@ - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); - if (certfile && !modssl_is_engine_id(certfile) -- && (dhparams = ssl_dh_GetParamFromFile(certfile))) { -- SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); -+ && (dh = ssl_dh_GetParamFromFile(certfile))) { -+ /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() -+ * for OpenSSL 3.0+. */ -+ SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- DH_bits(dhparams), vhost_id, certfile); -- DH_free(dhparams); -+ modssl_DH_bits(dh), vhost_id, certfile); -+ DH_free(dh); - } -+#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+ else { -+ /* If no parameter is manually configured, enable auto -+ * selection. */ -+ SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); -+ } -+#endif - - #ifdef HAVE_ECC - /* -@@ -1518,6 +1588,7 @@ - char buf[TLSEXT_TICKET_KEY_LEN]; - char *path; - modssl_ticket_key_t *ticket_key = mctx->ticket_key; -+ int res; - - if (!ticket_key->file_path) { - return APR_SUCCESS; -@@ -1545,11 +1616,22 @@ - } - - memcpy(ticket_key->key_name, buf, 16); -- memcpy(ticket_key->hmac_secret, buf + 16, 16); - memcpy(ticket_key->aes_key, buf + 32, 16); -- -- if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -- ssl_callback_SessionTicket)) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ memcpy(ticket_key->hmac_secret, buf + 16, 16); -+ res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#else -+ ticket_key->mac_params[0] = -+ OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16); -+ ticket_key->mac_params[1] = -+ OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); -+ ticket_key->mac_params[2] = -+ OSSL_PARAM_construct_end(); -+ res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#endif -+ if (!res) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) - "Unable to initialize TLS session ticket key callback " - "(incompatible OpenSSL version?)"); -@@ -1680,7 +1762,7 @@ - return ssl_die(s); - } - -- X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); -+ modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); - - for (n = 0; n < ncerts; n++) { - int i; -@@ -2277,10 +2359,11 @@ - - } - --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ free_dh_params(); -+#else - free_bio_methods(); - #endif -- free_dh_params(); - - return APR_SUCCESS; - } ---- httpd-2.4.51/modules/ssl/ssl_engine_io.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_io.c -@@ -194,6 +194,10 @@ - static int bio_filter_out_read(BIO *bio, char *out, int outl) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_read"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -293,12 +297,20 @@ - static int bio_filter_out_gets(BIO *bio, char *buf, int size) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_out_puts(BIO *bio, const char *str) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -533,22 +545,47 @@ - - static int bio_filter_in_write(BIO *bio, const char *in, int inl) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_write"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_puts(BIO *bio, const char *str) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_gets(BIO *bio, char *buf, int size) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr) - { -- return -1; -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ switch (cmd) { -+#ifdef BIO_CTRL_EOF -+ case BIO_CTRL_EOF: -+ return inctx->rc == APR_EOF; -+#endif -+ default: -+ break; -+ } -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: bio_filter_in_ctrl() should not be called with cmd=%i", -+ cmd); -+ AP_DEBUG_ASSERT(0); -+ return 0; - } - - #if MODSSL_USE_OPENSSL_PRE_1_1_API -@@ -573,7 +610,7 @@ - bio_filter_in_read, - bio_filter_in_puts, /* puts is never called */ - bio_filter_in_gets, /* gets is never called */ -- bio_filter_in_ctrl, /* ctrl is never called */ -+ bio_filter_in_ctrl, /* ctrl is called for EOF check */ - bio_filter_create, - bio_filter_destroy, - NULL ---- httpd-2.4.51/modules/ssl/ssl_engine_kernel.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_kernel.c -@@ -1685,6 +1685,7 @@ - ** _________________________________________________________________ - */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* - * Hand out standard DH parameters, based on the authentication strength - */ -@@ -1730,6 +1731,7 @@ - - return modssl_get_dh_params(keylen); - } -+#endif - - /* - * This OpenSSL callback function is called when OpenSSL -@@ -2614,7 +2616,11 @@ - unsigned char *keyname, - unsigned char *iv, - EVP_CIPHER_CTX *cipher_ctx, -- HMAC_CTX *hctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif - int mode) - { - conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -@@ -2640,7 +2646,13 @@ - } - EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) - "TLS session ticket key for %s successfully set, " -@@ -2661,7 +2673,13 @@ - - EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) - "TLS session ticket key for %s successfully set, " ---- httpd-2.4.51/modules/ssl/ssl_engine_log.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_log.c -@@ -78,6 +78,16 @@ - return APR_EGENERAL; - } - -+static APR_INLINE -+unsigned long modssl_ERR_peek_error_data(const char **data, int *flags) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return ERR_peek_error_line_data(NULL, NULL, data, flags); -+#else -+ return ERR_peek_error_data(data, flags); -+#endif -+} -+ - /* - * Prints the SSL library error information. - */ -@@ -87,7 +97,7 @@ - const char *data; - int flags; - -- while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) { -+ while ((e = modssl_ERR_peek_error_data(&data, &flags))) { - const char *annotation; - char err[256]; - ---- httpd-2.4.51/modules/ssl/ssl_private.h.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_private.h -@@ -89,6 +89,9 @@ - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - #include - #include - #include -@@ -134,13 +137,12 @@ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) - #define SSL_CTX_set_max_proto_version(ctx, version) \ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) --#elif LIBRESSL_VERSION_NUMBER < 0x2070000f -+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ - /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (1) --#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ -+#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) - #else /* defined(LIBRESSL_VERSION_NUMBER) */ - #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) - #endif -@@ -681,7 +683,11 @@ - typedef struct { - const char *file_path; - unsigned char key_name[16]; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - unsigned char hmac_secret[16]; -+#else -+ OSSL_PARAM mac_params[3]; -+#endif - unsigned char aes_key[16]; - } modssl_ticket_key_t; - #endif -@@ -945,8 +951,16 @@ - int ssl_callback_ClientHello(SSL *, int *, void *); - #endif - #ifdef HAVE_TLS_SESSION_TICKETS --int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *, -- EVP_CIPHER_CTX *, HMAC_CTX *, int); -+int ssl_callback_SessionTicket(SSL *ssl, -+ unsigned char *keyname, -+ unsigned char *iv, -+ EVP_CIPHER_CTX *cipher_ctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif -+ int mode); - #endif - - #ifdef HAVE_TLS_ALPN -@@ -1124,10 +1138,12 @@ - - #endif - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* Retrieve DH parameters for given key length. Return value should - * be treated as unmutable, since it is stored in process-global - * memory. */ - DH *modssl_get_dh_params(unsigned keylen); -+#endif - - /* Returns non-zero if the request was made over SSL/TLS. If sslconn - * is non-NULL and the request is using SSL/TLS, sets *sslconn to the diff --git a/httpd-2.4.51-r1894150.patch b/httpd-2.4.51-r1894150.patch deleted file mode 100644 index c8acff9..0000000 --- a/httpd-2.4.51-r1894150.patch +++ /dev/null @@ -1,17 +0,0 @@ -# ./pullrev.sh 1894150 -http://svn.apache.org/viewvc?view=revision&revision=1894150 - ---- httpd-2.4.51/server/util_filter.c -+++ httpd-2.4.51/server/util_filter.c -@@ -565,8 +565,9 @@ - apr_bucket_brigade *bb) - { - if (next) { -- apr_bucket *e; -- if ((e = APR_BRIGADE_LAST(bb)) && APR_BUCKET_IS_EOS(e) && next->r) { -+ apr_bucket *e = APR_BRIGADE_LAST(bb); -+ -+ if (e != APR_BRIGADE_SENTINEL(bb) && APR_BUCKET_IS_EOS(e) && next->r) { - /* This is only safe because HTTP_HEADER filter is always in - * the filter stack. This ensures that there is ALWAYS a - * request-based filter that we can attach this to. If the diff --git a/httpd.spec b/httpd.spec index 31ff412..7c583c1 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.51 -Release: 3%{?dist} +Version: 2.4.52 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -75,7 +75,6 @@ Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.51-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -90,7 +89,6 @@ Patch45: httpd-2.4.43-logjournal.patch Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch -Patch64: httpd-2.4.51-r1894150.patch Patch65: httpd-2.4.51-r1894152.patch # Security fixes @@ -230,7 +228,6 @@ written in the Lua programming language. %patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons -%patch28 -p1 -b .openssl3 %patch30 -p1 -b .cachehardmax %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault @@ -243,7 +240,6 @@ written in the Lua programming language. %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break -%patch64 -p1 -b .r1894150 %patch65 -p1 -b .r1894152 # Patch in the vendor string @@ -791,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Dec 22 2021 Joe Orton - 2.4.52-1 +- update to 2.4.52 + * Mon Dec 06 2021 Neal Gompa - 2.4.51-3 - Use NAME from os-release(5) for vendor string Related: #2029071 - httpd on CentOS identifies as RHEL diff --git a/sources b/sources index edbf616..ccf6e13 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 -SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6 +SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05 From d5e28192c4045e2a9b78f51ed763fe7b05386893 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 12:29:29 +0000 Subject: [PATCH 014/112] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 7c583c1..c5b0b35 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.52-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Wed Dec 22 2021 Joe Orton - 2.4.52-1 - update to 2.4.52 From 545b11ecf3afe92e32207d094d9d539807c9b4c5 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 28 Jan 2022 12:02:05 +0000 Subject: [PATCH 015/112] use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk --- httpd.spec | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index c5b0b35..6eed48d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -553,9 +553,12 @@ sed -i '/instdso/s,top_srcdir,top_builddir,' \ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk -# Sanitize CFLAGS in standard config_vars.mk -sed '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ +# Sanitize CFLAGS & LIBTOOL in standard config_vars.mk +sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ + -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \ -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk +diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk || true sed 's/config_vars.mk/vendor_config_vars.mk/' \ $RPM_BUILD_ROOT%{_bindir}/apxs \ @@ -787,6 +790,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jan 28 2022 Joe Orton - 2.4.52-3 +- use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk + * Thu Jan 20 2022 Fedora Release Engineering - 2.4.52-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 98c306e3f2467bdb17e9664f4e1a7803105098a8 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 31 Jan 2022 08:23:58 +0000 Subject: [PATCH 016/112] add libtool to Requires: for httpd-devel (#2048281) Resolves: rhbz#2048281 --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 6eed48d..dab255b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -120,7 +120,7 @@ web server. %package devel Summary: Development interfaces for the Apache HTTP Server -Requires: apr-devel, apr-util-devel, pkgconfig +Requires: apr-devel, apr-util-devel, pkgconfig, libtool Requires: httpd = %{version}-%{release} %description devel @@ -790,6 +790,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jan 31 2022 Joe Orton - 2.4.52-4 +- add libtool to Requires: for httpd-devel (#2048281) + * Fri Jan 28 2022 Joe Orton - 2.4.52-3 - use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk From af43dc5b98bddfb6c0e9d366b330b07b17f92f62 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 1 Feb 2022 08:59:37 +0000 Subject: [PATCH 017/112] rebuild for new OpenLDAP (#2032699) Resolves: rhbz#2032699 --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index dab255b..95dca7d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -790,6 +790,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Feb 1 2022 Joe Orton - 2.4.52-5 +- rebuild for new OpenLDAP (#2032699) + * Mon Jan 31 2022 Joe Orton - 2.4.52-4 - add libtool to Requires: for httpd-devel (#2048281) From cd09c3e5ec09991525f4223c7b03eb5ede6b1d37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 17 Mar 2022 15:44:05 +0100 Subject: [PATCH 018/112] new version 2.4.53 fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 --- .gitignore | 1 + ...md.patch => httpd-2.4.53-detect-systemd.patch | 16 ++++++++-------- ....48-export.patch => httpd-2.4.53-export.patch | 13 +++---------- httpd.spec | 12 ++++++++---- sources | 4 ++-- 5 files changed, 22 insertions(+), 24 deletions(-) rename httpd-2.4.43-detect-systemd.patch => httpd-2.4.53-detect-systemd.patch (76%) rename httpd-2.4.48-export.patch => httpd-2.4.53-export.patch (83%) diff --git a/.gitignore b/.gitignore index a6fac0d..64b8899 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ x86_64 /httpd-2.4.50.tar.bz2.asc /httpd-2.4.51.tar.bz2.asc /httpd-2.4.52.tar.bz2.asc +/httpd-2.4.53.tar.bz2.asc diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch similarity index 76% rename from httpd-2.4.43-detect-systemd.patch rename to httpd-2.4.53-detect-systemd.patch index 540687f..d501b06 100644 --- a/httpd-2.4.43-detect-systemd.patch +++ b/httpd-2.4.53-detect-systemd.patch @@ -1,5 +1,5 @@ diff --git a/Makefile.in b/Makefile.in -index 0b088ac..9eeb5c7 100644 +index a2e9c82..bd8045c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test @@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644 PROGRAM_DEPENDENCIES = \ server/libmain.la \ diff --git a/acinclude.m4 b/acinclude.m4 -index 2a7e5d1..eb28321 100644 +index 97484c9..05abe18 100644 --- a/acinclude.m4 +++ b/acinclude.m4 -@@ -624,6 +624,7 @@ case $host in +@@ -631,6 +631,7 @@ case $host in if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then AC_MSG_WARN([Your system does not support systemd.]) else @@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644 fi fi diff --git a/configure.in b/configure.in -index 3618a5a..74a782b 100644 +index cf437fe..521fc45 100644 --- a/configure.in +++ b/configure.in -@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then +@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) - APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`]) + APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`]) + APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) else - AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/]) + AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/]) fi -@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR) +@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR) APACHE_SUBST(BUILTIN_LIBS) APACHE_SUBST(SHLIBPATH_VAR) APACHE_SUBST(OS_SPECIFIC_VARS) diff --git a/httpd-2.4.48-export.patch b/httpd-2.4.53-export.patch similarity index 83% rename from httpd-2.4.48-export.patch rename to httpd-2.4.53-export.patch index 439f768..d240360 100644 --- a/httpd-2.4.48-export.patch +++ b/httpd-2.4.53-export.patch @@ -1,12 +1,5 @@ - -Reduce size of httpd binary by telling linker to export all symbols -from libmain.a, rather than bloating the symbol table with ap_hack_* -to do so indirectly. - -Upstream: https://svn.apache.org/r1861685 (as new default-off configure option) - diff --git a/Makefile.in b/Makefile.in -index 40c7076..ac98e5f 100644 +index bd8045c..d6733a5 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test @@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644 eoc_bucket.c eor_bucket.c core_filters.c \ util_expr_parse.c util_expr_scan.c util_expr_eval.c diff --git a/server/main.c b/server/main.c -index 62e06df..17c09ee 100644 +index 7da7aa2..e63d2eb 100644 --- a/server/main.c +++ b/server/main.c -@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[]) +@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[]) return !OK; } diff --git a/httpd.spec b/httpd.spec index 95dca7d..713b5f9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.52 -Release: 5%{?dist} +Version: 2.4.53 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -66,11 +66,11 @@ Source48: apache-poweredby.png Patch2: httpd-2.4.43-apxs.patch Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.43-detect-systemd.patch +Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.48-export.patch +Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch @@ -790,6 +790,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 +- new version 2.4.53 +- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 + * Tue Feb 1 2022 Joe Orton - 2.4.52-5 - rebuild for new OpenLDAP (#2032699) diff --git a/sources b/sources index ccf6e13..36266ed 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ +SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756 +SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 -SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6 -SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05 From d9ddc5dc92dab5509d5c763fd25ff7bfcd55b322 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 30 Mar 2022 19:33:41 +0200 Subject: [PATCH 019/112] Try to minimize httpd dependencies - essential binaries moved to httpd-core package - mod_brotli and mod_systemd are now in httpd main package together with .service files - httpd is no longer linked (-lsystemd), all systemd functions moved to mod_systemd module which is now shipped in main httpd package --- 00-base.conf | 1 - 00-brotli.conf | 1 + httpd-2.4.53-separate-systemd-fns.patch | 264 ++++++++++++++++++++++++ httpd.spec | 60 ++++-- 4 files changed, 307 insertions(+), 19 deletions(-) create mode 100644 00-brotli.conf create mode 100644 httpd-2.4.53-separate-systemd-fns.patch diff --git a/00-base.conf b/00-base.conf index 7cabce0..d0123d1 100644 --- a/00-base.conf +++ b/00-base.conf @@ -23,7 +23,6 @@ LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_owner_module modules/mod_authz_owner.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule autoindex_module modules/mod_autoindex.so -LoadModule brotli_module modules/mod_brotli.so LoadModule cache_module modules/mod_cache.so LoadModule cache_disk_module modules/mod_cache_disk.so LoadModule cache_socache_module modules/mod_cache_socache.so diff --git a/00-brotli.conf b/00-brotli.conf new file mode 100644 index 0000000..c2e0e9e --- /dev/null +++ b/00-brotli.conf @@ -0,0 +1 @@ +LoadModule brotli_module modules/mod_brotli.so diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch new file mode 100644 index 0000000..14c5f70 --- /dev/null +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -0,0 +1,264 @@ +diff --git a/acinclude.m4 b/acinclude.m4 +index 05abe18..97484c9 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -631,7 +631,6 @@ case $host in + if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then + AC_MSG_WARN([Your system does not support systemd.]) + else +- APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) + fi + fi +diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c +index eda1272..fc059fc 100644 +--- a/modules/arch/unix/mod_systemd.c ++++ b/modules/arch/unix/mod_systemd.c +@@ -35,6 +35,15 @@ + #include + #endif + ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_journal_stream_fd, (const char *, int, int)); ++ + static char describe_listeners[30]; + + static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, +@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s) + return DECLINED; + } + ++static int ap_find_systemd_socket(process_rec * process, apr_port_t port) { ++ int fdcount, fd; ++ int sdc = sd_listen_fds(0); ++ ++ if (sdc < 0) { ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) ++ "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", ++ sdc); ++ return -1; ++ } ++ ++ if (sdc == 0) { ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) ++ "find_systemd_socket: At least one socket must be set."); ++ return -1; ++ } ++ ++ fdcount = atoi(getenv("LISTEN_FDS")); ++ for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { ++ if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { ++ return fd; ++ } ++ } ++ ++ return -1; ++} ++ ++static int ap_systemd_listen_fds(int unset_environment){ ++ return sd_listen_fds(unset_environment); ++} ++ ++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){ ++ return sd_journal_stream_fd("httpd", priority, 0); ++} ++ + static void systemd_register_hooks(apr_pool_t *p) + { ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds); ++ APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket); ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ + /* Enable ap_extended_status. */ + ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST); + /* Signal service is ready. */ +diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 +index 0848d2e..8af2299 100644 +--- a/modules/loggers/config.m4 ++++ b/modules/loggers/config.m4 +@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) + APACHE_MODPATH_INIT(loggers) + + APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes) +-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS]) + + APACHE_MODULE(log_debug, configurable debug logging, , , most) + APACHE_MODULE(log_forensic, forensic logging) +diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c +index 0b11f60..04f08ca 100644 +--- a/modules/loggers/mod_log_config.c ++++ b/modules/loggers/mod_log_config.c +@@ -172,14 +172,16 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" + + module AP_MODULE_DECLARE_DATA log_config_module; + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_journal_stream_fd, (const char *, int, int)); ++ ++#endif ++ + + static int xfer_flags = (APR_WRITE | APR_APPEND | APR_CREATE | APR_LARGEFILE); + static apr_fileperms_t xfer_perms = APR_OS_DEFAULT; +@@ -1640,8 +1642,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, + { + #ifdef HAVE_SYSTEMD + int fd; ++ APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd; ++ ++ systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ if (systemd_journal_stream_fd == NULL) { ++ return APR_ENOTIMPL; ++ } + +- fd = sd_journal_stream_fd("httpd", priority, 0); ++ fd = systemd_journal_stream_fd("httpd", priority, 0); ++ + if (fd < 0) return fd; + + /* This is an AF_UNIX socket fd so is more pipe-like than +diff --git a/server/listen.c b/server/listen.c +index e2e028a..217caf2 100644 +--- a/server/listen.c ++++ b/server/listen.c +@@ -34,10 +34,6 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + /* we know core's module_index is 0 */ + #undef APLOG_MODULE_INDEX + #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX +@@ -65,6 +61,12 @@ static int send_buffer_size; + static int receive_buffer_size; + #ifdef HAVE_SYSTEMD + static int use_systemd = -1; ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); + #endif + + /* TODO: make_sock is just begging and screaming for APR abstraction */ +@@ -325,34 +327,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, + } + + #ifdef HAVE_SYSTEMD +- +-static int find_systemd_socket(process_rec * process, apr_port_t port) { +- int fdcount, fd; +- int sdc = sd_listen_fds(0); +- +- if (sdc < 0) { +- ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) +- "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", +- sdc); +- return -1; +- } +- +- if (sdc == 0) { +- ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) +- "find_systemd_socket: At least one socket must be set."); +- return -1; +- } +- +- fdcount = atoi(getenv("LISTEN_FDS")); +- for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { +- if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { +- return fd; +- } +- } +- +- return -1; +-} +- + static apr_status_t alloc_systemd_listener(process_rec * process, + int fd, const char *proto, + ap_listen_rec **out_rec) +@@ -412,6 +386,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, + { + ap_listen_rec *last, *new; + apr_status_t rv; ++ APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket; ++ ++ find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket); ++ ++ if (!find_systemd_socket) ++ return "Systemd socket activation is used, but mod_systemd is probably" ++ "not loaded"; ++ + int fd = find_systemd_socket(process, port); + if (fd < 0) { + return "Systemd socket activation is used, but this port is not " +@@ -438,7 +420,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, + + return NULL; + } +- + #endif /* HAVE_SYSTEMD */ + + static const char *alloc_listener(process_rec *process, const char *addr, +@@ -707,6 +688,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) + int num_listeners = 0; + const char* proto; + int found; ++#ifdef HAVE_SYSTEMD ++ APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds; ++#endif + + for (ls = s; ls; ls = ls->next) { + proto = ap_get_server_protocol(ls); +@@ -746,7 +730,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) + apr_pool_cleanup_null, s->process->pool); + } + else { +- sd_listen_fds(1); ++ systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); ++ if (systemd_listen_fds != NULL) { ++ systemd_listen_fds(1); ++ } + } + } + else +@@ -963,6 +950,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + apr_port_t port; + apr_status_t rv; + const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); ++#ifdef HAVE_SYSTEMD ++ APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds; ++#endif + + if (err != NULL) { + return err; +@@ -973,7 +963,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + } + #ifdef HAVE_SYSTEMD + if (use_systemd == -1) { +- use_systemd = sd_listen_fds(0) > 0; ++ systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); ++ if (systemd_listen_fds != NULL) { ++ use_systemd = systemd_listen_fds(0) > 0; ++ } + } + #endif + diff --git a/httpd.spec b/httpd.spec index 713b5f9..e1b6162 100644 --- a/httpd.spec +++ b/httpd.spec @@ -52,6 +52,7 @@ Source31: README.confmod Source32: httpd.service.xml Source33: htcacheclean.service.xml Source34: httpd.conf.xml +Source35: 00-brotli.conf Source40: htcacheclean.service Source41: htcacheclean.sysconf Source42: httpd-init.service @@ -83,6 +84,7 @@ Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch +Patch46: httpd-2.4.53-separate-systemd-fns.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -99,25 +101,33 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: gnupg2 -Requires: /etc/mime.types, system-logos(httpd-logo-ng) +Requires: system-logos(httpd-logo-ng) Provides: webserver -Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} -Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} -Requires: httpd-tools = %{version}-%{release} -Requires: httpd-filesystem = %{version}-%{release} +Requires: httpd-core = 0:%{version}-%{release} Recommends: mod_http2, mod_lua -Requires(pre): httpd-filesystem Requires(preun): systemd-units Requires(postun): systemd-units Requires(post): systemd-units -Conflicts: apr < 1.5.0-1 -Provides: mod_proxy_uwsgi = %{version}-%{release} -Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 %description The Apache HTTP Server is a powerful, efficient, and extensible web server. +%package core +Summary: httpd minimal core +Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} +Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} +Provides: mod_proxy_uwsgi = %{version}-%{release} +Requires: /etc/mime.types +Requires: httpd-tools = %{version}-%{release} +Requires: httpd-filesystem = %{version}-%{release} +Requires(pre): httpd-filesystem +Conflicts: apr < 1.5.0-1 +Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 + +%description core +The httpd-core package contains essential httpd binaries. + %package devel Summary: Development interfaces for the Apache HTTP Server Requires: apr-devel, apr-util-devel, pkgconfig, libtool @@ -236,6 +246,7 @@ written in the Lua programming language. %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal +%patch46 -p1 -b .separatesystemd %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 @@ -372,7 +383,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \ 00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \ - 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do + 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \ + 00-brotli.conf; do install -m 644 -p $RPM_SOURCE_DIR/$f \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f done @@ -649,7 +661,21 @@ set -x exit $rv %files +%{_mandir}/man8/* +%{_mandir}/man5/* +%exclude %{_mandir}/man8/httpd-init.* +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf +%{_libdir}/httpd/modules/mod_brotli.so +%{_libdir}/httpd/modules/mod_systemd.so + +%{_unitdir}/httpd.service +%{_unitdir}/httpd@.service +%{_unitdir}/htcacheclean.service +%{_unitdir}/*.socket + +%files core %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE %doc docs/conf/extra/*.conf %doc instance.conf server-status.conf @@ -659,6 +685,7 @@ exit $rv %{_sysconfdir}/httpd/state %{_sysconfdir}/httpd/run %dir %{_sysconfdir}/httpd/conf + %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf %config(noreplace) %{_sysconfdir}/httpd/conf/magic @@ -670,7 +697,10 @@ exit $rv %dir %{_sysconfdir}/httpd/conf.modules.d %{_sysconfdir}/httpd/conf.modules.d/README + %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf @@ -692,6 +722,8 @@ exit $rv %dir %{_libdir}/httpd %dir %{_libdir}/httpd/modules %{_libdir}/httpd/modules/mod*.so +%exclude %{_libdir}/httpd/modules/mod_brotli.so +%exclude %{_libdir}/httpd/modules/mod_systemd.so %exclude %{_libdir}/httpd/modules/mod_auth_form.so %exclude %{_libdir}/httpd/modules/mod_ssl.so %exclude %{_libdir}/httpd/modules/mod_*ldap.so @@ -718,14 +750,6 @@ exit $rv %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy -%{_mandir}/man8/* -%{_mandir}/man5/* -%exclude %{_mandir}/man8/httpd-init.* - -%{_unitdir}/httpd.service -%{_unitdir}/httpd@.service -%{_unitdir}/htcacheclean.service -%{_unitdir}/*.socket %files filesystem %dir %{_sysconfdir}/httpd From af40323aac32d8fc18f81d3d7ad398beec8ca1e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 30 Mar 2022 22:25:02 +0200 Subject: [PATCH 020/112] - bump package version --- httpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index e1b6162..74bf195 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -814,6 +814,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 +- try to minimize httpd dependencies (new httpd-core package) +- mod_systemd and mod_brotli are now in the main httpd package + * Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 - new version 2.4.53 - fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 From 72f074878a48f92d0432b8a06dca5de77f7a5073 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 31 Mar 2022 14:28:16 +0200 Subject: [PATCH 021/112] - add rhbz to ChangeLog and move OPT functions declaration - OPT functions declaration move to header files - added rhbz to ChangeLog --- httpd-2.4.53-separate-systemd-fns.patch | 88 +++++++++++++++---------- httpd.spec | 1 + 2 files changed, 55 insertions(+), 34 deletions(-) diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch index 14c5f70..f495a44 100644 --- a/httpd-2.4.53-separate-systemd-fns.patch +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -10,6 +10,34 @@ index 05abe18..97484c9 100644 AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) fi fi +diff --git a/include/ap_listen.h b/include/ap_listen.h +index 58c2574..d5ed968 100644 +--- a/include/ap_listen.h ++++ b/include/ap_listen.h +@@ -29,6 +29,7 @@ + #include "apr_network_io.h" + #include "httpd.h" + #include "http_config.h" ++#include "apr_optional.h" + + #ifdef __cplusplus + extern "C" { +@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd, + void *dummy, + const char *arg); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); ++#endif ++ ++ + #define LISTEN_COMMANDS \ + AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \ + "Maximum length of the queue of pending connections, as used by listen(2)"), \ diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c index eda1272..fc059fc 100644 --- a/modules/arch/unix/mod_systemd.c @@ -91,10 +119,10 @@ index 0848d2e..8af2299 100644 APACHE_MODULE(log_debug, configurable debug logging, , , most) APACHE_MODULE(log_forensic, forensic logging) diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c -index 0b11f60..04f08ca 100644 +index 0b11f60..c3f0a51 100644 --- a/modules/loggers/mod_log_config.c +++ b/modules/loggers/mod_log_config.c -@@ -172,14 +172,16 @@ +@@ -172,10 +172,6 @@ #include #endif @@ -105,17 +133,7 @@ index 0b11f60..04f08ca 100644 #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" module AP_MODULE_DECLARE_DATA log_config_module; - -+#ifdef HAVE_SYSTEMD -+APR_DECLARE_OPTIONAL_FN(int, -+ ap_systemd_journal_stream_fd, (const char *, int, int)); -+ -+#endif -+ - - static int xfer_flags = (APR_WRITE | APR_APPEND | APR_CREATE | APR_LARGEFILE); - static apr_fileperms_t xfer_perms = APR_OS_DEFAULT; -@@ -1640,8 +1642,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, +@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, { #ifdef HAVE_SYSTEMD int fd; @@ -132,8 +150,23 @@ index 0b11f60..04f08ca 100644 if (fd < 0) return fd; /* This is an AF_UNIX socket fd so is more pipe-like than +diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h +index 877a593..bd52a98 100644 +--- a/modules/loggers/mod_log_config.h ++++ b/modules/loggers/mod_log_config.h +@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ + */ + APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func)); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int)); ++#endif ++ + #endif /* MOD_LOG_CONFIG */ + /** @} */ + diff --git a/server/listen.c b/server/listen.c -index e2e028a..217caf2 100644 +index e2e028a..aa6f91c 100644 --- a/server/listen.c +++ b/server/listen.c @@ -34,10 +34,6 @@ @@ -147,20 +180,7 @@ index e2e028a..217caf2 100644 /* we know core's module_index is 0 */ #undef APLOG_MODULE_INDEX #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX -@@ -65,6 +61,12 @@ static int send_buffer_size; - static int receive_buffer_size; - #ifdef HAVE_SYSTEMD - static int use_systemd = -1; -+ -+APR_DECLARE_OPTIONAL_FN(int, -+ ap_find_systemd_socket, (process_rec *, apr_port_t)); -+ -+APR_DECLARE_OPTIONAL_FN(int, -+ ap_systemd_listen_fds, (int)); - #endif - - /* TODO: make_sock is just begging and screaming for APR abstraction */ -@@ -325,34 +327,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, +@@ -325,34 +321,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, } #ifdef HAVE_SYSTEMD @@ -195,7 +215,7 @@ index e2e028a..217caf2 100644 static apr_status_t alloc_systemd_listener(process_rec * process, int fd, const char *proto, ap_listen_rec **out_rec) -@@ -412,6 +386,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, +@@ -412,6 +380,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, { ap_listen_rec *last, *new; apr_status_t rv; @@ -210,7 +230,7 @@ index e2e028a..217caf2 100644 int fd = find_systemd_socket(process, port); if (fd < 0) { return "Systemd socket activation is used, but this port is not " -@@ -438,7 +420,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, +@@ -438,7 +414,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, return NULL; } @@ -218,7 +238,7 @@ index e2e028a..217caf2 100644 #endif /* HAVE_SYSTEMD */ static const char *alloc_listener(process_rec *process, const char *addr, -@@ -707,6 +688,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) +@@ -707,6 +682,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) int num_listeners = 0; const char* proto; int found; @@ -228,7 +248,7 @@ index e2e028a..217caf2 100644 for (ls = s; ls; ls = ls->next) { proto = ap_get_server_protocol(ls); -@@ -746,7 +730,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) +@@ -746,7 +724,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) apr_pool_cleanup_null, s->process->pool); } else { @@ -240,7 +260,7 @@ index e2e028a..217caf2 100644 } } else -@@ -963,6 +950,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -963,6 +944,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, apr_port_t port; apr_status_t rv; const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); @@ -250,7 +270,7 @@ index e2e028a..217caf2 100644 if (err != NULL) { return err; -@@ -973,7 +963,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -973,7 +957,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, } #ifdef HAVE_SYSTEMD if (use_systemd == -1) { diff --git a/httpd.spec b/httpd.spec index 74bf195..ffbc289 100644 --- a/httpd.spec +++ b/httpd.spec @@ -815,6 +815,7 @@ exit $rv %changelog * Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 +- Resolves: #2070517 - Allow install httpd with smaller footprint - try to minimize httpd dependencies (new httpd-core package) - mod_systemd and mod_brotli are now in the main httpd package From ee221cb72ccb1e6405dbef1634654f58d5c417a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 7 Apr 2022 14:41:27 +0200 Subject: [PATCH 022/112] Related: #2070517 - fix issue when mod_systemd is not loaded --- httpd-2.4.53-separate-systemd-fns.patch | 8 +++++--- httpd.spec | 7 +++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch index f495a44..88b99ff 100644 --- a/httpd-2.4.53-separate-systemd-fns.patch +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -166,7 +166,7 @@ index 877a593..bd52a98 100644 /** @} */ diff --git a/server/listen.c b/server/listen.c -index e2e028a..aa6f91c 100644 +index e2e028a..5d1c0e1 100644 --- a/server/listen.c +++ b/server/listen.c @@ -34,10 +34,6 @@ @@ -224,7 +224,7 @@ index e2e028a..aa6f91c 100644 + find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket); + + if (!find_systemd_socket) -+ return "Systemd socket activation is used, but mod_systemd is probably" ++ return "Systemd socket activation is used, but mod_systemd is probably " + "not loaded"; + int fd = find_systemd_socket(process, port); @@ -270,7 +270,7 @@ index e2e028a..aa6f91c 100644 if (err != NULL) { return err; -@@ -973,7 +957,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -973,7 +957,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, } #ifdef HAVE_SYSTEMD if (use_systemd == -1) { @@ -278,6 +278,8 @@ index e2e028a..aa6f91c 100644 + systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); + if (systemd_listen_fds != NULL) { + use_systemd = systemd_listen_fds(0) > 0; ++ } else { ++ use_systemd = 0; + } } #endif diff --git a/httpd.spec b/httpd.spec index ffbc289..12b67c8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -246,7 +246,7 @@ written in the Lua programming language. %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal -%patch46 -p1 -b .separatesystemd +#patch46 -p1 -b .separatesystemd %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 @@ -814,6 +814,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Apr 07 2022 Luboš Uhliarik - 2.4.53-3 +- Related: #2070517 - fix issue when mod_systemd is not loaded + * Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 - Resolves: #2070517 - Allow install httpd with smaller footprint - try to minimize httpd dependencies (new httpd-core package) From dd6a83760148669d65dbcc64ae5cfcd4b869d00d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 7 Apr 2022 14:44:01 +0200 Subject: [PATCH 023/112] Related: #2070517 - forgot to enable patch again --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 12b67c8..a2cafc3 100644 --- a/httpd.spec +++ b/httpd.spec @@ -246,7 +246,7 @@ written in the Lua programming language. %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal -#patch46 -p1 -b .separatesystemd +%patch46 -p1 -b .separatesystemd %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 From 617530796774531ea87471f2cf8895b6127a0732 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 20 Apr 2022 14:34:09 +0100 Subject: [PATCH 024/112] switch to PCRE2 for new releases --- httpd.spec | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index a2cafc3..cf612b8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -10,10 +10,18 @@ %global mpm prefork %endif +%if 0%{?fedora} > 36 || 0%{?rhel} > 9 +%bcond_without pcre2 +%bcond_with pcre +%else +%bcond_with pcre2 +%bcond_without pcre +%endif + Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -99,7 +107,13 @@ License: ASL 2.0 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel -BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 +BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0 +%if %{with pcre2} +BuildRequires: pcre2-devel +%endif +%if %{with pcre} +BuildRequires: pcre-devel > 5.0 +%endif BuildRequires: gnupg2 Requires: system-logos(httpd-logo-ng) Provides: webserver @@ -300,6 +314,7 @@ xmlto man %{SOURCE47} : Building with MMN %{mmn}, MMN-ISA %{mmnisa} : Default MPM is %{mpm}, vendor string is '%{vstring}' +: Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2} %build # forcibly prevent use of bundled apr, apr-util, pcre @@ -344,7 +359,12 @@ export LYNX_PATH=/usr/bin/links --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \ --with-brotli \ --enable-pie \ +%if %{with pcre2} + --with-pcre2 \ +%endif +%if %{with pcre} --with-pcre \ +%endif --enable-mods-shared=all \ --enable-ssl --with-ssl --disable-distcache \ --enable-proxy --enable-proxy-fdpass \ @@ -814,6 +834,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Apr 20 2022 Joe Orton - 2.4.53-4 +- switch to PCRE2 for new releases + * Thu Apr 07 2022 Luboš Uhliarik - 2.4.53-3 - Related: #2070517 - fix issue when mod_systemd is not loaded From 431047787e0c7db54ea8a8a1ea14676f8ad8b942 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 22 Apr 2022 13:16:56 +0200 Subject: [PATCH 025/112] don't use bomb.gif icon for all files/dirs ending with core --- httpd-2.4.43-icons.patch | 22 ---------------------- httpd.spec | 7 +++++-- 2 files changed, 5 insertions(+), 24 deletions(-) delete mode 100644 httpd-2.4.43-icons.patch diff --git a/httpd-2.4.43-icons.patch b/httpd-2.4.43-icons.patch deleted file mode 100644 index 21518d7..0000000 --- a/httpd-2.4.43-icons.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in -index 51b02ed..0e8b626 100644 ---- a/docs/conf/extra/httpd-autoindex.conf.in -+++ b/docs/conf/extra/httpd-autoindex.conf.in -@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort - Alias /icons/ "@exp_iconsdir@/" - - -- Options Indexes MultiViews -+ Options Indexes MultiViews FollowSymlinks - AllowOverride None - Require all granted - -@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi - AddIcon /icons/uuencoded.gif .uu - AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl - AddIcon /icons/tex.gif .tex --AddIcon /icons/bomb.gif core -+AddIcon /icons/bomb.gif core. - - AddIcon /icons/back.gif .. - AddIcon /icons/hand.right.gif README diff --git a/httpd.spec b/httpd.spec index cf612b8..804746d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -21,7 +21,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -83,7 +83,7 @@ Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch -Patch27: httpd-2.4.43-icons.patch +Patch27: httpd-2.4.53-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -834,6 +834,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 +- don't use bomb.gif icon for all files/dirs ending with core + * Wed Apr 20 2022 Joe Orton - 2.4.53-4 - switch to PCRE2 for new releases From 0a3bbfb33ab78b0980b94f7b5fdf7714a0be0283 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 22 Apr 2022 13:19:04 +0200 Subject: [PATCH 026/112] Add forgoten patch related to autoindex --- httpd-2.4.53-icons.patch | 50 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 httpd-2.4.53-icons.patch diff --git a/httpd-2.4.53-icons.patch b/httpd-2.4.53-icons.patch new file mode 100644 index 0000000..cd125b3 --- /dev/null +++ b/httpd-2.4.53-icons.patch @@ -0,0 +1,50 @@ +diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in +index 51b02ed..93a2b87 100644 +--- a/docs/conf/extra/httpd-autoindex.conf.in ++++ b/docs/conf/extra/httpd-autoindex.conf.in +@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort + Alias /icons/ "@exp_iconsdir@/" + + +- Options Indexes MultiViews ++ Options Indexes MultiViews FollowSymlinks + AllowOverride None + Require all granted + +@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/* + AddIconByType (IMG,/icons/image2.gif) image/* + AddIconByType (SND,/icons/sound2.gif) audio/* + AddIconByType (VID,/icons/movie.gif) video/* ++AddIconByType /icons/bomb.gif application/x-coredump + + AddIcon /icons/binary.gif .bin .exe + AddIcon /icons/binhex.gif .hqx +@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi + AddIcon /icons/uuencoded.gif .uu + AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl + AddIcon /icons/tex.gif .tex +-AddIcon /icons/bomb.gif core + + AddIcon /icons/back.gif .. + AddIcon /icons/hand.right.gif README +diff --git a/docs/conf/magic b/docs/conf/magic +index bc891d9..6402b59 100644 +--- a/docs/conf/magic ++++ b/docs/conf/magic +@@ -383,3 +383,16 @@ + 4 string moov video/quicktime + 4 string mdat video/quicktime + ++AddIconByType /icons/bomb.gif application/x-coredump ++ ++#------------------------------------------------------------------------------ ++# application/x-coredump for LE/BE ELF ++# ++0 string \177ELF ++>5 byte 1 ++>16 leshort 4 application/x-coredump ++ ++0 string \177ELF ++>5 byte 2 ++>16 beshort 4 application/x-coredump ++ From 95aba987928cc886fb5acad00694c32da878174c Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 13 May 2022 15:52:12 +0100 Subject: [PATCH 027/112] use %set_build_flags macro (closes #20) --- httpd.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 804746d..4a997dd 100644 --- a/httpd.spec +++ b/httpd.spec @@ -327,8 +327,7 @@ autoheader && autoconf || exit 1 %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \ support/apxs.in -export CFLAGS=$RPM_OPT_FLAGS -export LDFLAGS="-Wl,-z,relro,-z,now" +%set_build_flags # Hard-code path to links to avoid unnecessary builddep export LYNX_PATH=/usr/bin/links @@ -834,6 +833,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri May 13 2022 Joe Orton - 2.4.53-5 +- use %%set_build_flags macro + * Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 - don't use bomb.gif icon for all files/dirs ending with core From d72d3ea9004ce84445c702b0f416abf530a6efd5 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 13 May 2022 15:55:18 +0100 Subject: [PATCH 028/112] fix NVR. --- httpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 4a997dd..9ae15fc 100644 --- a/httpd.spec +++ b/httpd.spec @@ -21,7 +21,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -833,7 +833,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Fri May 13 2022 Joe Orton - 2.4.53-5 +* Fri May 13 2022 Joe Orton - 2.4.53-6 - use %%set_build_flags macro * Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 From c2f1d6bf301e548fb3fe066802a7b45f4b59a1a8 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 16 May 2022 08:27:06 +0100 Subject: [PATCH 029/112] disable package notes --- httpd.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 9ae15fc..2f6caaf 100644 --- a/httpd.spec +++ b/httpd.spec @@ -18,10 +18,13 @@ %bcond_without pcre %endif +# Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092 +%undefine _package_note_flags + Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -833,6 +836,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon May 16 2022 Joe Orton - 2.4.53-7 +- disable package notes + * Fri May 13 2022 Joe Orton - 2.4.53-6 - use %%set_build_flags macro From 589318da661951c3153a52c0294a66724ebadf75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 10 Jun 2022 00:05:19 +0200 Subject: [PATCH 030/112] new version 2.4.54 --- .gitignore | 1 + ....4.43-selinux.patch => httpd-2.4.54-selinux.patch | 12 ++++++------ httpd.spec | 9 ++++++--- sources | 4 ++-- 4 files changed, 15 insertions(+), 11 deletions(-) rename httpd-2.4.43-selinux.patch => httpd-2.4.54-selinux.patch (85%) diff --git a/.gitignore b/.gitignore index 64b8899..aa90701 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ x86_64 /httpd-2.4.51.tar.bz2.asc /httpd-2.4.52.tar.bz2.asc /httpd-2.4.53.tar.bz2.asc +/httpd-2.4.54.tar.bz2.asc diff --git a/httpd-2.4.43-selinux.patch b/httpd-2.4.54-selinux.patch similarity index 85% rename from httpd-2.4.43-selinux.patch rename to httpd-2.4.54-selinux.patch index 3c3176f..3868b3b 100644 --- a/httpd-2.4.43-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,8 +1,8 @@ diff --git a/configure.in b/configure.in -index c8f9aa2..cb43246 100644 +index 74015ca..8c0ee10 100644 --- a/configure.in +++ b/configure.in -@@ -484,6 +484,11 @@ getloadavg +@@ -508,6 +508,11 @@ getloadavg dnl confirm that a void pointer is large enough to store a long integer APACHE_CHECK_VOID_PTR_LEN @@ -15,10 +15,10 @@ index c8f9aa2..cb43246 100644 [AC_TRY_RUN(#define _GNU_SOURCE #include diff --git a/server/core.c b/server/core.c -index dc0f17a..7ed9527 100644 +index a6fa2fb..cf4cba4 100644 --- a/server/core.c +++ b/server/core.c -@@ -59,6 +59,10 @@ +@@ -65,6 +65,10 @@ #include #endif @@ -28,8 +28,8 @@ index dc0f17a..7ed9527 100644 + /* LimitRequestBody handling */ #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) - #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 0) -@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte + #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */ +@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte } #endif diff --git a/httpd.spec b/httpd.spec index 2f6caaf..80492b2 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.53 -Release: 7%{?dist} +Version: 2.4.54 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -84,7 +84,7 @@ Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch -Patch25: httpd-2.4.43-selinux.patch +Patch25: httpd-2.4.54-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.53-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch @@ -836,6 +836,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-1 +- new version 2.4.54 + * Mon May 16 2022 Joe Orton - 2.4.53-7 - disable package notes diff --git a/sources b/sources index 36266ed..93b0ebf 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756 -SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686 +SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18 +SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From eeff44363350896ad4bfa111a0c097665dfa6af9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 16 Jun 2022 18:11:29 +0200 Subject: [PATCH 031/112] Fix bug in patched magic file for core files recognition --- httpd-2.4.53-icons.patch => httpd-2.4.54-icons.patch | 5 ++--- httpd.spec | 6 +++--- 2 files changed, 5 insertions(+), 6 deletions(-) rename httpd-2.4.53-icons.patch => httpd-2.4.54-icons.patch (93%) diff --git a/httpd-2.4.53-icons.patch b/httpd-2.4.54-icons.patch similarity index 93% rename from httpd-2.4.53-icons.patch rename to httpd-2.4.54-icons.patch index cd125b3..efc0c4d 100644 --- a/httpd-2.4.53-icons.patch +++ b/httpd-2.4.54-icons.patch @@ -28,14 +28,13 @@ index 51b02ed..93a2b87 100644 AddIcon /icons/back.gif .. AddIcon /icons/hand.right.gif README diff --git a/docs/conf/magic b/docs/conf/magic -index bc891d9..6402b59 100644 +index bc891d9..9a41b44 100644 --- a/docs/conf/magic +++ b/docs/conf/magic -@@ -383,3 +383,16 @@ +@@ -383,3 +383,15 @@ 4 string moov video/quicktime 4 string mdat video/quicktime -+AddIconByType /icons/bomb.gif application/x-coredump + +#------------------------------------------------------------------------------ +# application/x-coredump for LE/BE ELF diff --git a/httpd.spec b/httpd.spec index 80492b2..1c6b205 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -86,7 +86,7 @@ Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.54-selinux.patch Patch26: httpd-2.4.43-gettid.patch -Patch27: httpd-2.4.53-icons.patch +Patch27: httpd-2.4.54-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -836,7 +836,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-1 +* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-2 - new version 2.4.54 * Mon May 16 2022 Joe Orton - 2.4.53-7 From e4ec9394be6afb68e49645cbd187fbd23667ba4d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jun 2022 11:39:49 +0100 Subject: [PATCH 032/112] update PCRE config selection Although PCRE 2 was only supposed to be used for Fedora > 36 it has always been configured for Fedora 36 as well due to autoconf weirdness. --- httpd.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/httpd.spec b/httpd.spec index 1c6b205..2038893 100644 --- a/httpd.spec +++ b/httpd.spec @@ -10,7 +10,7 @@ %global mpm prefork %endif -%if 0%{?fedora} > 36 || 0%{?rhel} > 9 +%if 0%{?fedora} > 35 || 0%{?rhel} > 9 %bcond_without pcre2 %bcond_with pcre %else @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -362,10 +362,10 @@ export LYNX_PATH=/usr/bin/links --with-brotli \ --enable-pie \ %if %{with pcre2} - --with-pcre2 \ + --with-pcre2=%{_bindir}/pcre2-config \ %endif %if %{with pcre} - --with-pcre \ + --with-pcre=%{_bindir}/pcre-config \ %endif --enable-mods-shared=all \ --enable-ssl --with-ssl --disable-distcache \ @@ -836,6 +836,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 17 2022 Joe Orton - 2.4.54-3 +- update PCRE config selection + * Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-2 - new version 2.4.54 From bdfad1ea95e7f8710aeb124f918c68e9efb9f1b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Mon, 27 Jun 2022 11:21:54 +0200 Subject: [PATCH 033/112] fix downgrade/upgrade issues mod_ssl and other modules should depend only on httpd-core package --- httpd.spec | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/httpd.spec b/httpd.spec index 2038893..1533131 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -140,6 +140,7 @@ Requires: httpd-tools = %{version}-%{release} Requires: httpd-filesystem = %{version}-%{release} Requires(pre): httpd-filesystem Conflicts: apr < 1.5.0-1 +Conflicts: httpd < 2.4.53-2 Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 %description core @@ -148,7 +149,7 @@ The httpd-core package contains essential httpd binaries. %package devel Summary: Development interfaces for the Apache HTTP Server Requires: apr-devel, apr-util-devel, pkgconfig, libtool -Requires: httpd = %{version}-%{release} +Requires: httpd-core = %{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files @@ -161,7 +162,7 @@ to install this package. %package manual Summary: Documentation for the Apache HTTP Server -Requires: httpd = %{version}-%{release} +Requires: httpd-core = 0:%{version}-%{release} BuildArch: noarch %description manual @@ -191,7 +192,7 @@ Summary: SSL/TLS module for the Apache HTTP Server Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 @@ -205,7 +206,7 @@ Security (TLS) protocols. %package -n mod_proxy_html Summary: HTML and XML content filters for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} BuildRequires: libxml2-devel BuildRequires: make Epoch: 1 @@ -217,7 +218,7 @@ transform and modify HTML and XML content. %package -n mod_ldap Summary: LDAP authentication modules for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: apr-util-ldap %description -n mod_ldap @@ -226,7 +227,7 @@ authentication to the Apache HTTP Server. %package -n mod_session Summary: Session interface for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_session The mod_session module and associated backends provide an abstract @@ -234,7 +235,7 @@ interface for storing and accessing per-user session data. %package -n mod_lua Summary: Lua scripting support for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_lua The mod_lua module allows the server to be extended with scripts @@ -836,6 +837,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 24 2022 Luboš Uhliarik - 2.4.54-4 +- fix downgrade/upgrade issues +- mod_ssl and other modules should depend only on httpd-core package + * Fri Jun 17 2022 Joe Orton - 2.4.54-3 - update PCRE config selection From b4890cc0cc98a70762d115b1f7a580808cbb9c7b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 13:48:08 +0000 Subject: [PATCH 034/112] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 1533131..ba6a0c5 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -837,6 +837,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 2.4.54-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Fri Jun 24 2022 Luboš Uhliarik - 2.4.54-4 - fix downgrade/upgrade issues - mod_ssl and other modules should depend only on httpd-core package From 54cb3fa126b5f8f8dbff7297c840646b19ec0567 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 18 Oct 2022 02:37:04 +0200 Subject: [PATCH 035/112] Provide a sysusers.d file to get user() and group() provides (#2134430) --- httpd.spec | 23 +++++++++++++---------- httpd.sysusers | 2 ++ 2 files changed, 15 insertions(+), 10 deletions(-) create mode 100644 httpd.sysusers diff --git a/httpd.spec b/httpd.spec index ba6a0c5..3ab8372 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -73,6 +73,7 @@ Source45: config.layout Source46: apachectl.sh Source47: apachectl.xml Source48: apache-poweredby.png +Source49: httpd.sysusers # build/scripts patches Patch2: httpd-2.4.43-apxs.patch @@ -111,6 +112,7 @@ BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0 +BuildRequires: systemd-rpm-macros %if %{with pcre2} BuildRequires: pcre2-devel %endif @@ -122,9 +124,7 @@ Requires: system-logos(httpd-logo-ng) Provides: webserver Requires: httpd-core = 0:%{version}-%{release} Recommends: mod_http2, mod_lua -Requires(preun): systemd-units -Requires(postun): systemd-units -Requires(post): systemd-units +%{?systemd_requires} %description The Apache HTTP Server is a powerful, efficient, and extensible @@ -173,7 +173,7 @@ also be found at https://httpd.apache.org/docs/2.4/. %package filesystem Summary: The basic directory layout for the Apache HTTP Server BuildArch: noarch -Requires(pre): /usr/sbin/useradd +%{?sysusers_requires_compat} %description filesystem The httpd-filesystem package contains the basic directory layout @@ -602,6 +602,9 @@ touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +# Fix content dir in sysusers file and install it +install -p -D -m 0644 %{SOURCE49} %{buildroot}%{_sysusersdir}/httpd.conf + # Remove unpackaged files rm -vf \ $RPM_BUILD_ROOT%{_libdir}/*.exp \ @@ -617,11 +620,7 @@ rm -vf \ rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra} %pre filesystem -getent group apache >/dev/null || groupadd -g 48 -r apache -getent passwd apache >/dev/null || \ - useradd -r -u 48 -g apache -s /sbin/nologin \ - -d %{contentdir} -c "Apache" apache -exit 0 +%sysusers_create_compat %{SOURCE49} %post %systemd_post httpd.service htcacheclean.service httpd.socket @@ -785,6 +784,7 @@ exit $rv %dir %{contentdir}/icons %attr(755,root,root) %dir %{_unitdir}/httpd.service.d %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d +%{_sysusersdir}/httpd.conf %files tools %{_bindir}/* @@ -837,6 +837,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 13 2022 Luboš Uhliarik - 2.4.54-6 +- Provide a sysusers.d file to get user() and group() provides (#2134430) + * Thu Jul 21 2022 Fedora Release Engineering - 2.4.54-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/httpd.sysusers b/httpd.sysusers new file mode 100644 index 0000000..26fe0e4 --- /dev/null +++ b/httpd.sysusers @@ -0,0 +1,2 @@ +g apache 48 +u apache 48 "Apache" /usr/share/httpd /sbin/nologin From 654ce8a373d1970c517a37c92c537ff7f86d2f39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 30 Nov 2022 14:25:15 +0100 Subject: [PATCH 036/112] reduce AH03408 level to INFO in proxy_util.c --- httpd-2.4.54-proxy-util-loglevel.patch | 13 +++++++++++++ httpd.spec | 7 ++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.54-proxy-util-loglevel.patch diff --git a/httpd-2.4.54-proxy-util-loglevel.patch b/httpd-2.4.54-proxy-util-loglevel.patch new file mode 100644 index 0000000..e4db49e --- /dev/null +++ b/httpd-2.4.54-proxy-util-loglevel.patch @@ -0,0 +1,13 @@ +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index e488aa6..8267f1b 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -3121,7 +3121,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_check_connection(const char *scheme, + "%s: backend socket is disconnected.", scheme); + } + else { +- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, server, APLOGNO(03408) ++ ap_log_error(APLOG_MARK, APLOG_INFO, 0, server, APLOGNO(03408) + "%s: reusable backend connection is not empty: " + "forcibly closed", scheme); + } diff --git a/httpd.spec b/httpd.spec index 3ab8372..de6cd05 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -104,6 +104,7 @@ Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch +Patch66: httpd-2.4.54-proxy-util-loglevel.patch # Security fixes @@ -270,6 +271,7 @@ written in the Lua programming language. %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break %patch65 -p1 -b .r1894152 +%patch66 -p1 -b .proxyutil-loglevel # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -837,6 +839,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Nov 30 2022 Luboš Uhliarik - 2.4.54-7 +- reduce AH03408 level to INFO in proxy_util.c + * Thu Oct 13 2022 Luboš Uhliarik - 2.4.54-6 - Provide a sysusers.d file to get user() and group() provides (#2134430) From b0e7cd798ea4f3e364b1f2c4cbe768298705dc4d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 19 Dec 2022 14:49:23 +0000 Subject: [PATCH 037/112] define _httpd_statedir macro --- httpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index de6cd05..c2c75ee 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -488,6 +488,7 @@ cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd < - 2.4.54-8 +- define _httpd_statedir macro + * Wed Nov 30 2022 Luboš Uhliarik - 2.4.54-7 - reduce AH03408 level to INFO in proxy_util.c From 8c54e332bbb7b718fffccdd9340bca2ae5ec9b3a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jun 2022 12:21:04 +0100 Subject: [PATCH 038/112] - move SELinux context logging to mod_systemd from httpd binary --- ...-gettid.patch => httpd-2.4.54-gettid.patch | 18 ++-- httpd-2.4.54-selinux.patch | 97 ++++++++++--------- httpd.spec | 18 +++- 3 files changed, 71 insertions(+), 62 deletions(-) rename httpd-2.4.43-gettid.patch => httpd-2.4.54-gettid.patch (90%) diff --git a/httpd-2.4.43-gettid.patch b/httpd-2.4.54-gettid.patch similarity index 90% rename from httpd-2.4.43-gettid.patch rename to httpd-2.4.54-gettid.patch index f80b3a7..dfc447b 100644 --- a/httpd-2.4.43-gettid.patch +++ b/httpd-2.4.54-gettid.patch @@ -14,9 +14,9 @@ Subject: [PATCH] Check and use gettid() directly with glibc 2.30+. diff --git a/configure.in b/configure.in index 423d58d4b9a..60cbf7b7f81 100644 ---- httpd-2.4.43/configure.in.gettid -+++ httpd-2.4.43/configure.in -@@ -478,7 +500,8 @@ +--- httpd-2.4.54/configure.in.gettid ++++ httpd-2.4.54/configure.in +@@ -502,22 +502,26 @@ timegm \ getpgid \ fopen64 \ @@ -26,9 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 ) dnl confirm that a void pointer is large enough to store a long integer -@@ -489,16 +512,19 @@ - APR_ADDTO(HTTPD_LIBS, [-lselinux]) - ]) + APACHE_CHECK_VOID_PTR_LEN -AC_CACHE_CHECK([for gettid()], ac_cv_gettid, +if test $ac_cv_func_gettid = no; then @@ -50,8 +48,8 @@ index 423d58d4b9a..60cbf7b7f81 100644 fi dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs ---- httpd-2.4.43/server/log.c.gettid -+++ httpd-2.4.43/server/log.c +--- httpd-2.4.54/server/log.c.gettid ++++ httpd-2.4.54/server/log.c @@ -55,7 +55,7 @@ #include "ap_mpm.h" #include "ap_listen.h" @@ -61,7 +59,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 #include #include #endif -@@ -625,14 +625,18 @@ +@@ -627,14 +627,18 @@ #if APR_HAS_THREADS int result; #endif @@ -82,7 +80,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 #if APR_HAS_THREADS if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS && result != AP_MPMQ_NOT_SUPPORTED) -@@ -966,7 +970,7 @@ +@@ -968,7 +972,7 @@ #if APR_HAS_THREADS field_start = len; len += cpystrn(buf + len, ":tid ", buflen - len); diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch index 3868b3b..4d66bd8 100644 --- a/httpd-2.4.54-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,24 +1,22 @@ diff --git a/configure.in b/configure.in index 74015ca..8c0ee10 100644 ---- a/configure.in -+++ b/configure.in -@@ -508,6 +508,11 @@ getloadavg - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - -+AC_CHECK_LIB(selinux, is_selinux_enabled, [ -+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) -+ APR_ADDTO(HTTPD_LIBS, [-lselinux]) -+]) -+ - AC_CACHE_CHECK([for gettid()], ac_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include -diff --git a/server/core.c b/server/core.c -index a6fa2fb..cf4cba4 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -65,6 +65,10 @@ +--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux ++++ httpd-2.4.54/modules/arch/unix/config5.m4 +@@ -23,6 +23,11 @@ + AC_MSG_WARN([Your system does not support systemd.]) + enable_systemd="no" + else ++ AC_CHECK_LIB(selinux, is_selinux_enabled, [ ++ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) ++ APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux]) ++ ]) ++ + APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS]) + fi + ]) +--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux ++++ httpd-2.4.54/modules/arch/unix/mod_systemd.c +@@ -35,6 +35,10 @@ #include #endif @@ -26,35 +24,38 @@ index a6fa2fb..cf4cba4 100644 +#include +#endif + - /* LimitRequestBody handling */ - #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) - #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */ -@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte - } - #endif + APR_DECLARE_OPTIONAL_FN(int, + ap_find_systemd_socket, (process_rec *, apr_port_t)); -+#ifdef HAVE_SELINUX -+ { -+ static int already_warned = 0; -+ int is_enabled = is_selinux_enabled() > 0; -+ -+ if (is_enabled && !already_warned) { -+ security_context_t con; -+ -+ if (getcon(&con) == 0) { -+ -+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, -+ "SELinux policy enabled; " -+ "httpd running as context %s", con); -+ -+ already_warned = 1; -+ -+ freecon(con); -+ } -+ } -+ } -+#endif -+ - return OK; +@@ -70,6 +74,20 @@ + return apr_psprintf(p, "%s port %u", addr, sa->port); } ++#ifdef HAVE_SELINUX ++static void log_selinux_context(void) ++{ ++ char *con; ++ ++ if (is_selinux_enabled() && getcon(&con) == 0) { ++ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, ++ "SELinux policy enabled; " ++ "httpd running as context %s", con); ++ freecon(con); ++ } ++} ++#endif ++ + /* Report the service is ready in post_config, which could be during + * startup or after a reload. The server could still hit a fatal + * startup error after this point during ap_run_mpm(), so this is +@@ -87,6 +105,10 @@ + if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) + return OK; + ++#ifdef HAVE_SELINUX ++ log_selinux_context(); ++#endif ++ + for (lr = ap_listeners; lr; lr = lr->next) { + char *s = dump_listener(lr, ptemp); + diff --git a/httpd.spec b/httpd.spec index c2c75ee..6908087 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 8%{?dist} +Release: 9%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -86,7 +86,7 @@ Patch22: httpd-2.4.43-mod_systemd.patch Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.54-selinux.patch -Patch26: httpd-2.4.43-gettid.patch +Patch26: httpd-2.4.54-gettid.patch Patch27: httpd-2.4.54-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch @@ -150,7 +150,7 @@ The httpd-core package contains essential httpd binaries. %package devel Summary: Development interfaces for the Apache HTTP Server Requires: apr-devel, apr-util-devel, pkgconfig, libtool -Requires: httpd-core = %{version}-%{release} +Requires: httpd-core = 0:%{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files @@ -254,7 +254,6 @@ written in the Lua programming language. %patch22 -p1 -b .mod_systemd %patch23 -p1 -b .export %patch24 -p1 -b .corelimit -%patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons %patch30 -p1 -b .cachehardmax @@ -266,6 +265,7 @@ written in the Lua programming language. %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal %patch46 -p1 -b .separatesystemd +%patch25 -p1 -b .selinux %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 @@ -384,6 +384,13 @@ export LYNX_PATH=/usr/bin/links --disable-http2 \ --disable-md \ $* + +if grep -q ac_cv_have_threadsafe_pollset=no config.log; then + cat config.log + : Failed to find thread-safe APR. + exit 1 +fi + %make_build %install @@ -840,6 +847,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Dec 19 2022 Joe Orton - 2.4.54-9 +- move SELinux context logging to mod_systemd + * Mon Dec 19 2022 Joe Orton - 2.4.54-8 - define _httpd_statedir macro From f5d2d48e1d86aaa0427d1b311d052d59a1c5d258 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 19 Dec 2022 16:46:44 +0000 Subject: [PATCH 039/112] Work around aarch64 build failures. --- httpd.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/httpd.spec b/httpd.spec index 6908087..b990f77 100644 --- a/httpd.spec +++ b/httpd.spec @@ -338,6 +338,13 @@ autoheader && autoconf || exit 1 # Hard-code path to links to avoid unnecessary builddep export LYNX_PATH=/usr/bin/links +%ifarch aarch64 +# The configure check for epoll_create() is failing. httpd/apr only +# actually uses epoll_create1() so this test could be smarter. Work +# around it for now. +export ac_cv_func_epoll_create=yes +%endif + # Build the daemon ./configure \ --prefix=%{_sysconfdir}/httpd \ From b568e5c39d5688ba45b3de376c25d56c4c385594 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 20 Dec 2022 09:43:24 +0000 Subject: [PATCH 040/112] htcacheclean.service: add [Install] section, PrivateTmp=yes, Environment=LANG=C (#2149714) --- htcacheclean.service | 5 +++++ httpd.spec | 6 +++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/htcacheclean.service b/htcacheclean.service index d1e9d60..e3eeef9 100644 --- a/htcacheclean.service +++ b/htcacheclean.service @@ -7,5 +7,10 @@ Documentation=man:htcacheclean.service(8) Type=forking User=apache PIDFile=/run/httpd/htcacheclean/pid +Environment=LANG=C EnvironmentFile=/etc/sysconfig/htcacheclean ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS +PrivateTmp=true + +[Install] +WantedBy=multi-user.target diff --git a/httpd.spec b/httpd.spec index b990f77..7271d9f 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 9%{?dist} +Release: 10%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -854,6 +854,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Dec 20 2022 Joe Orton - 2.4.54-10 +- htcacheclean.service: add [Install] section, PrivateTmp=yes, + Environment=LANG=C (#2149714) + * Mon Dec 19 2022 Joe Orton - 2.4.54-9 - move SELinux context logging to mod_systemd From 24cb4dd8699242dfdb5c2c11c0be3fbc620800e1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 12:17:03 +0000 Subject: [PATCH 041/112] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 7271d9f..24b1365 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 10%{?dist} +Release: 11%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -854,6 +854,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 2.4.54-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Dec 20 2022 Joe Orton - 2.4.54-10 - htcacheclean.service: add [Install] section, PrivateTmp=yes, Environment=LANG=C (#2149714) From a97f2e349c41c1599563dfb88056b807b5627e47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 24 Jan 2023 16:50:25 +0100 Subject: [PATCH 042/112] prevent sscg writing /dhparams.pem --- httpd-init.service | 1 + httpd-ssl-gencerts | 1 + httpd.spec | 7 +++++-- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/httpd-init.service b/httpd-init.service index 3074778..704c314 100644 --- a/httpd-init.service +++ b/httpd-init.service @@ -8,5 +8,6 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key [Service] Type=oneshot RemainAfterExit=no +PrivateTmp=true ExecStart=/usr/libexec/httpd-ssl-gencerts diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts index 350f5b5..5c271f7 100755 --- a/httpd-ssl-gencerts +++ b/httpd-ssl-gencerts @@ -33,6 +33,7 @@ sscg -q \ --cert-file /etc/pki/tls/certs/localhost.crt \ --cert-key-file /etc/pki/tls/private/localhost.key \ --ca-file /etc/pki/tls/certs/localhost.crt \ + --dhparams-file /tmp/dhparams.pem \ --lifetime 365 \ --hostname $FQDN \ --email root@$FQDN diff --git a/httpd.spec b/httpd.spec index 24b1365..d398834 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 11%{?dist} +Release: 12%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -194,7 +194,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 2.2.0, /usr/bin/hostname +Requires: sscg >= 3.0.0-7, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 # mod_ssl/mod_nss cannot both be loaded simultaneously @@ -854,6 +854,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Jan 24 2023 Luboš Uhliarik - 2.4.54-12 +- prevent sscg writing /dhparams.pem + * Thu Jan 19 2023 Fedora Release Engineering - 2.4.54-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From a9ebcc1200eda8cb7895d7bde559e5da3645fd2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 24 Jan 2023 17:33:11 +0100 Subject: [PATCH 043/112] sscg in Fedora has --dhparams-file option available since 3.0.3 --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index d398834..9a9fde7 100644 --- a/httpd.spec +++ b/httpd.spec @@ -194,7 +194,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 3.0.0-7, /usr/bin/hostname +Requires: sscg >= 3.0.3, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 # mod_ssl/mod_nss cannot both be loaded simultaneously From 85bd0d7cb0ee0834161ffe8b80f11067b099a2d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 25 Jan 2023 16:15:14 +0100 Subject: [PATCH 044/112] new version 2.4.55 --- .gitignore | 1 + httpd-2.4.43-r1861269.patch | 20 -------------------- httpd-2.4.54-proxy-util-loglevel.patch | 13 ------------- httpd.spec | 11 +++++------ sources | 4 ++-- 5 files changed, 8 insertions(+), 41 deletions(-) delete mode 100644 httpd-2.4.43-r1861269.patch delete mode 100644 httpd-2.4.54-proxy-util-loglevel.patch diff --git a/.gitignore b/.gitignore index aa90701..65a4add 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,4 @@ x86_64 /httpd-2.4.52.tar.bz2.asc /httpd-2.4.53.tar.bz2.asc /httpd-2.4.54.tar.bz2.asc +/httpd-2.4.55.tar.bz2.asc diff --git a/httpd-2.4.43-r1861269.patch b/httpd-2.4.43-r1861269.patch deleted file mode 100644 index 9bff242..0000000 --- a/httpd-2.4.43-r1861269.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index b53f3f8..979489c 100644 ---- a/modules/ssl/ssl_engine_config.c -+++ b/modules/ssl/ssl_engine_config.c -@@ -812,8 +812,14 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd, - static const char *ssl_cmd_check_file(cmd_parms *parms, - const char **file) - { -- const char *filepath = ap_server_root_relative(parms->pool, *file); -+ const char *filepath; - -+ /* If only dumping the config, don't verify the paths */ -+ if (ap_state_query(AP_SQ_RUN_MODE) == AP_SQ_RM_CONFIG_DUMP) { -+ return NULL; -+ } -+ -+ filepath = ap_server_root_relative(parms->pool, *file); - if (!filepath) { - return apr_pstrcat(parms->pool, parms->cmd->name, - ": Invalid file path ", *file, NULL); diff --git a/httpd-2.4.54-proxy-util-loglevel.patch b/httpd-2.4.54-proxy-util-loglevel.patch deleted file mode 100644 index e4db49e..0000000 --- a/httpd-2.4.54-proxy-util-loglevel.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index e488aa6..8267f1b 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -3121,7 +3121,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_check_connection(const char *scheme, - "%s: backend socket is disconnected.", scheme); - } - else { -- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, server, APLOGNO(03408) -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, server, APLOGNO(03408) - "%s: reusable backend connection is not empty: " - "forcibly closed", scheme); - } diff --git a/httpd.spec b/httpd.spec index 9a9fde7..b1d332c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.54 -Release: 12%{?dist} +Version: 2.4.55 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -92,7 +92,6 @@ Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch Patch39: httpd-2.4.43-sslprotdefault.patch -Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch @@ -104,7 +103,6 @@ Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch -Patch66: httpd-2.4.54-proxy-util-loglevel.patch # Security fixes @@ -260,7 +258,6 @@ written in the Lua programming language. %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault %patch39 -p1 -b .sslprotdefault -%patch40 -p1 -b .r1861269 %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal @@ -271,7 +268,6 @@ written in the Lua programming language. %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break %patch65 -p1 -b .r1894152 -%patch66 -p1 -b .proxyutil-loglevel # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -854,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jan 25 2023 Luboš Uhliarik - 2.4.55-1 +- new version 2.4.55 + * Tue Jan 24 2023 Luboš Uhliarik - 2.4.54-12 - prevent sscg writing /dhparams.pem diff --git a/sources b/sources index 93b0ebf..042ceab 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18 -SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b +SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb +SHA512 (httpd-2.4.55.tar.bz2.asc) = 7e9f946a72a9106325ca1479123e9320e6749ba304d945ce48f4eb816710ad7fe6a2e0a9108c98d36a99eacd70c4984a1b5cb1b7e6690cdff77039c4a2732328 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From f03a62dad53d0b50a0818d6da0c289a5617e1e21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 3 Feb 2023 14:50:41 +0100 Subject: [PATCH 045/112] rebuilt with new apr/apr-util --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index b1d332c..a2ce930 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.55 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Feb 03 2023 Luboš Uhliarik - 2.4.55-2 +- rebuilt with new apr/apr-util + * Wed Jan 25 2023 Luboš Uhliarik - 2.4.55-1 - new version 2.4.55 From 47674d08007e376a740a9e48fdc6c70ec23a7ea3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 7 Mar 2023 14:20:57 +0000 Subject: [PATCH 046/112] build and load mod_authnz_fcgi --- 00-base.conf | 1 + httpd.spec | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/00-base.conf b/00-base.conf index d0123d1..bae2bf6 100644 --- a/00-base.conf +++ b/00-base.conf @@ -15,6 +15,7 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_socache_module modules/mod_authn_socache.so +LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule authz_dbd_module modules/mod_authz_dbd.so LoadModule authz_dbm_module modules/mod_authz_dbm.so diff --git a/httpd.spec b/httpd.spec index a2ce930..819fe22 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.55 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -379,7 +379,7 @@ export ac_cv_func_epoll_create=yes --enable-cache \ --enable-disk-cache \ --enable-ldap --enable-authnz-ldap \ - --enable-cgid --enable-cgi \ + --enable-cgid --enable-cgi --enable-authnz-fcgi \ --enable-cgid-fdpassing \ --enable-authn-anon --enable-authn-alias \ --enable-systemd \ @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Mar 7 2023 Joe Orton - 2.4.55-3 +- build and load mod_authnz_fcgi + * Fri Feb 03 2023 Luboš Uhliarik - 2.4.55-2 - rebuilt with new apr/apr-util From 92c4708891a48466340a415d244738573376d98e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 9 Mar 2023 13:02:14 +0100 Subject: [PATCH 047/112] new version 2.4.56 --- .gitignore | 1 + httpd.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 65a4add..4001074 100644 --- a/.gitignore +++ b/.gitignore @@ -46,3 +46,4 @@ x86_64 /httpd-2.4.53.tar.bz2.asc /httpd-2.4.54.tar.bz2.asc /httpd-2.4.55.tar.bz2.asc +/httpd-2.4.56.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index 819fe22..c885e82 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.55 -Release: 3%{?dist} +Version: 2.4.56 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Mar 09 2023 Luboš Uhliarik - 2.4.56-1 +- new version 2.4.56 + * Tue Mar 7 2023 Joe Orton - 2.4.55-3 - build and load mod_authnz_fcgi diff --git a/sources b/sources index 042ceab..290079d 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb -SHA512 (httpd-2.4.55.tar.bz2.asc) = 7e9f946a72a9106325ca1479123e9320e6749ba304d945ce48f4eb816710ad7fe6a2e0a9108c98d36a99eacd70c4984a1b5cb1b7e6690cdff77039c4a2732328 +SHA512 (httpd-2.4.56.tar.bz2) = 5f12cd9878d822384b1bb163fea4d8edee5e7a0dd8b2389264387971268145cccc6a5a27ddf0436c5f1f631acc5fdc4874da2a47911483e421ca40bf783e0e12 +SHA512 (httpd-2.4.56.tar.bz2.asc) = 50f5e1f52e4a9a2f98d6831bc908e74a9d008978572246f668f2a1c6977014f30e77a8197f5db20a3500323f35e3d7d1a38b270cd0b7122aafc58d2df8132d4a SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 4b92db25395917df048cf176d36b9d0e28b625d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 11 Apr 2023 13:10:55 +0200 Subject: [PATCH 048/112] new version 2.4.57 --- .gitignore | 1 + httpd.spec | 5 ++++- sources | 4 ++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4001074..275485b 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ x86_64 /httpd-2.4.54.tar.bz2.asc /httpd-2.4.55.tar.bz2.asc /httpd-2.4.56.tar.bz2.asc +/httpd-2.4.57.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index c885e82..8e8ee8b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,7 +23,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.56 +Version: 2.4.57 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 +- new version 2.4.57 + * Thu Mar 09 2023 Luboš Uhliarik - 2.4.56-1 - new version 2.4.56 diff --git a/sources b/sources index 290079d..ceb40e4 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.56.tar.bz2) = 5f12cd9878d822384b1bb163fea4d8edee5e7a0dd8b2389264387971268145cccc6a5a27ddf0436c5f1f631acc5fdc4874da2a47911483e421ca40bf783e0e12 -SHA512 (httpd-2.4.56.tar.bz2.asc) = 50f5e1f52e4a9a2f98d6831bc908e74a9d008978572246f668f2a1c6977014f30e77a8197f5db20a3500323f35e3d7d1a38b270cd0b7122aafc58d2df8132d4a +SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155 +SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 8d5ccc86d7ffe25b7942d624dcf79810d59c599d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 25 May 2023 08:39:00 +0100 Subject: [PATCH 049/112] - document that "apachectl -t" is supported (#2180884) --- apachectl.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apachectl.xml b/apachectl.xml index 5e40832..34da42c 100644 --- a/apachectl.xml +++ b/apachectl.xml @@ -160,7 +160,7 @@ - + | Run a configuration file syntax test. It parses the configuration files and either reports Syntax OK From 3dbb71b2491f2f8384f5fdba9b8c74dd4da11a0e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 23 Jun 2023 09:59:04 +0100 Subject: [PATCH 050/112] also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 8e8ee8b..06173ae 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.57 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -602,7 +602,7 @@ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk # Sanitize CFLAGS & LIBTOOL in standard config_vars.mk -sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ +sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \ -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \ -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \ @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 23 2023 Joe Orton - 2.4.57-2 +- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk + * Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 - new version 2.4.57 From fd06e529c2de123a89111dde2b26b713b464f017 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Jul 2023 12:13:09 +0100 Subject: [PATCH 051/112] - package /etc/systemd/httpd/httpd.service.d --- httpd.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index 06173ae..bb9f422 100644 --- a/httpd.spec +++ b/httpd.spec @@ -432,8 +432,9 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \ # install systemd override drop directory # Web application packages can drop snippets into this location if # they need ExecStart[pre|post]. -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \ + $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d \ + $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf @@ -797,6 +798,7 @@ exit $rv %dir %{contentdir}/icons %attr(755,root,root) %dir %{_unitdir}/httpd.service.d %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d +%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d %{_sysusersdir}/httpd.conf %files tools @@ -850,7 +852,8 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Fri Jun 23 2023 Joe Orton - 2.4.57-2 +* Wed Jul 5 2023 Joe Orton - 2.4.57-2 +- package /etc/systemd/httpd/httpd.service.d - also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk * Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 From 625e0ea487b869a57e56e3a9c6e846cc056e079d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Jul 2023 12:23:54 +0100 Subject: [PATCH 052/112] - fix use of %patchN --- httpd.spec | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/httpd.spec b/httpd.spec index bb9f422..d0cc281 100644 --- a/httpd.spec +++ b/httpd.spec @@ -243,31 +243,31 @@ written in the Lua programming language. %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %setup -q -%patch2 -p1 -b .apxs -%patch3 -p1 -b .deplibs +%patch -P2 -p1 -b .apxs +%patch -P3 -p1 -b .deplibs -%patch19 -p1 -b .detectsystemd +%patch -P19 -p1 -b .detectsystemd -%patch21 -p1 -b .r1842929+ -%patch22 -p1 -b .mod_systemd -%patch23 -p1 -b .export -%patch24 -p1 -b .corelimit -%patch26 -p1 -b .gettid -%patch27 -p1 -b .icons -%patch30 -p1 -b .cachehardmax -%patch34 -p1 -b .socketactivation -%patch38 -p1 -b .sslciphdefault -%patch39 -p1 -b .sslprotdefault -%patch41 -p1 -b .r1861793+ -%patch42 -p1 -b .r1828172+ -%patch45 -p1 -b .logjournal -%patch46 -p1 -b .separatesystemd -%patch25 -p1 -b .selinux +%patch -P21 -p1 -b .r1842929+ +%patch -P22 -p1 -b .mod_systemd +%patch -P23 -p1 -b .export +%patch -P24 -p1 -b .corelimit +%patch -P26 -p1 -b .gettid +%patch -P27 -p1 -b .icons +%patch -P30 -p1 -b .cachehardmax +%patch -P34 -p1 -b .socketactivation +%patch -P38 -p1 -b .sslciphdefault +%patch -P39 -p1 -b .sslprotdefault +%patch -P41 -p1 -b .r1861793+ +%patch -P42 -p1 -b .r1828172+ +%patch -P45 -p1 -b .logjournal +%patch -P46 -p1 -b .separatesystemd +%patch -P25 -p1 -b .selinux -%patch60 -p1 -b .enable-sslv3 -%patch61 -p1 -b .r1878890 -%patch63 -p1 -b .htcacheclean-dont-break -%patch65 -p1 -b .r1894152 +%patch -P60 -p1 -b .enable-sslv3 +%patch -P61 -p1 -b .r1878890 +%patch -P63 -p1 -b .htcacheclean-dont-break +%patch -P65 -p1 -b .r1894152 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h From e2a22401edb396b1067848a7fc2ecbe7370646fe Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Jul 2023 12:25:22 +0100 Subject: [PATCH 053/112] - fix httpd.service.d creation --- httpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index d0cc281..69027a9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -433,8 +433,8 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \ # Web application packages can drop snippets into this location if # they need ExecStart[pre|post]. mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \ - $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d \ - $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d + $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf From e930ce73066ccc729792fecc7e728c731758842b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 06:29:23 +0000 Subject: [PATCH 054/112] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 69027a9..1048d64 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.57 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -852,6 +852,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 2.4.57-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jul 5 2023 Joe Orton - 2.4.57-2 - package /etc/systemd/httpd/httpd.service.d - also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk From 454bf03452b41ccec6468e89a976d11d4bd2897f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 6 Oct 2023 15:47:34 +0200 Subject: [PATCH 055/112] SPDX migration --- httpd.spec | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 1048d64..7b322c1 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.57 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -105,8 +105,14 @@ Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch # Security fixes +# Patch200: ... + +# Apache-2.0: everything +# BSD-3-Clause: util_pcre.c, ap_regex.h +# metamail AND HPND-sell-variant:: server/util_md5.c: +# Spencer-94: modules/metadata/mod_mime_magic.c +License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94) -License: ASL 2.0 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel @@ -852,6 +858,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Oct 06 2023 Luboš Uhliarik - 2.4.57-4 +- SPDX migration + * Thu Jul 20 2023 Fedora Release Engineering - 2.4.57-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From cdf2aaf5d2118d1c772052db35067ed8a7ab207e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 18 Oct 2023 09:15:16 +0100 Subject: [PATCH 056/112] Minor wording tweaks. --- httpd.service.xml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/httpd.service.xml b/httpd.service.xml index c6bf865..7dfdb97 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -175,7 +175,7 @@ Wants=network-online.target System packages (including the httpd package itself) may restart the httpd service automatically after packages are upgraded, installed, or removed. This is done using the - systemctl try-restart httpd.service, which + systemctl try-restart httpd.service command, which stops then starts the service if it is running. To disable automatic restarts, create the file @@ -183,8 +183,9 @@ Wants=network-online.target When httpd interfaces are added in an update, it may not be safe to reload a running service after upgrading, if updated modules require interfaces - only available in the updated httpd. It is recommended to allow - automatic restarts for this reason. + only available in the updated httpd binary. + It is recommended to allow automatic restarts for this + reason. From c9253b5bbf710374a7cf1e91af75841ffc474d67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 20 Oct 2023 14:13:15 +0200 Subject: [PATCH 057/112] new version 2.4.58 --- .gitignore | 1 + httpd-2.4.48-r1878890.patch | 116 ------------------------------------ httpd.spec | 9 +-- sources | 4 +- 4 files changed, 8 insertions(+), 122 deletions(-) delete mode 100644 httpd-2.4.48-r1878890.patch diff --git a/.gitignore b/.gitignore index 275485b..cc7babc 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ x86_64 /httpd-2.4.55.tar.bz2.asc /httpd-2.4.56.tar.bz2.asc /httpd-2.4.57.tar.bz2.asc +/httpd-2.4.58.tar.bz2.asc diff --git a/httpd-2.4.48-r1878890.patch b/httpd-2.4.48-r1878890.patch deleted file mode 100644 index 7f8ca57..0000000 --- a/httpd-2.4.48-r1878890.patch +++ /dev/null @@ -1,116 +0,0 @@ -diff --git a/include/util_ldap.h b/include/util_ldap.h -index 28e0760..edb8a81 100644 ---- a/include/util_ldap.h -+++ b/include/util_ldap.h -@@ -32,7 +32,6 @@ - #if APR_MAJOR_VERSION < 2 - /* The LDAP API is currently only present in APR 1.x */ - #include "apr_ldap.h" --#include "apr_ldap_rebind.h" - #else - #define APR_HAS_LDAP 0 - #endif -diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c -index 120f268..a5f7995 100644 ---- a/modules/ldap/util_ldap.c -+++ b/modules/ldap/util_ldap.c -@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r) - return OK; - } - -+/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use -+ * a simpler rebind callback than the implementation in APR-util. -+ * Testing for API version >= 3001 appears safe although OpenLDAP -+ * 2.1.x (API version = 2004) also has the 3-arg API. */ -+#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001 -+ -+#define uldap_rebind_init(p) APR_SUCCESS /* noop */ -+ -+static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request, -+ ber_int_t msgid, void *params) -+{ -+ util_ldap_connection_t *ldc = params; -+ -+ return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE); -+} -+ -+static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc) -+{ -+ ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc); -+ return APR_SUCCESS; -+} -+ -+#else /* !APR_HAS_OPENLDAP_LDAPSDK */ -+ -+#define USE_APR_LDAP_REBIND -+#include -+ -+#define uldap_rebind_init(p) apr_ldap_rebind_init(p) -+#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \ -+ (ldc)->ldap, (ldc)->binddn, \ -+ (ldc)->bindpw) -+#endif - - - /* ------------------------------------------------------------------ */ -@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param) - util_ldap_connection_t *ldc = param; - - if (ldc) { -+#ifdef USE_APR_LDAP_REBIND -+ /* forget the rebind info for this conn */ -+ if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { -+ apr_pool_clear(ldc->rebind_pool); -+ } -+#endif -+ - if (ldc->ldap) { - if (ldc->r) { - ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); -@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param) - ldc->ldap = NULL; - } - ldc->bound = 0; -- -- /* forget the rebind info for this conn */ -- if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { -- apr_ldap_rebind_remove(ldc->ldap); -- apr_pool_clear(ldc->rebind_pool); -- } - } - - return APR_SUCCESS; -@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r, - - if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { - /* Now that we have an ldap struct, add it to the referral list for rebinds. */ -- rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw); -+ rc = uldap_rebind_add(ldc); - if (rc != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277) - "LDAP: Unable to add rebind cross reference entry. Out of memory?"); -@@ -856,6 +889,7 @@ static util_ldap_connection_t * - /* whether or not to keep this connection in the pool when it's returned */ - l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; - -+#ifdef USE_APR_LDAP_REBIND - if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { - if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286) -@@ -867,6 +901,7 @@ static util_ldap_connection_t * - } - apr_pool_tag(l->rebind_pool, "util_ldap_rebind"); - } -+#endif - - if (p) { - p->next = l; -@@ -3054,7 +3089,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog, - } - - /* Initialize the rebind callback's cross reference list. */ -- apr_ldap_rebind_init (p); -+ (void) uldap_rebind_init(p); - - #ifdef AP_LDAP_OPT_DEBUG - if (st->debug_level > 0) { diff --git a/httpd.spec b/httpd.spec index 7b322c1..4ff2d58 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.57 -Release: 4%{?dist} +Version: 2.4.58 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -100,7 +100,6 @@ Patch46: httpd-2.4.53-separate-systemd-fns.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch @@ -271,7 +270,6 @@ written in the Lua programming language. %patch -P25 -p1 -b .selinux %patch -P60 -p1 -b .enable-sslv3 -%patch -P61 -p1 -b .r1878890 %patch -P63 -p1 -b .htcacheclean-dont-break %patch -P65 -p1 -b .r1894152 @@ -858,6 +856,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Oct 20 2023 Luboš Uhliarik - 2.4.58-1 +- new version 2.4.58 + * Fri Oct 06 2023 Luboš Uhliarik - 2.4.57-4 - SPDX migration diff --git a/sources b/sources index ceb40e4..8ac3947 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155 -SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd +SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1 +SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From ac146d28f9397bf803ede12450d2acead287a21d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 2 Nov 2023 14:39:09 +0000 Subject: [PATCH 058/112] add dependency on apr-util-1(dbm) so a DBM provider is present --- httpd-2.4.58-properr.patch | 30 ++++++++++++++++++++++++++++++ httpd.spec | 8 +++++++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.58-properr.patch diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch new file mode 100644 index 0000000..4071f25 --- /dev/null +++ b/httpd-2.4.58-properr.patch @@ -0,0 +1,30 @@ +--- httpd-2.4.58/modules/dav/fs/dbm.c.properr ++++ httpd-2.4.58/modules/dav/fs/dbm.c +@@ -100,7 +100,7 @@ + /* There might not be a if we had problems creating it. */ + if (db == NULL) { + errcode = 1; +- errstr = "Could not open property database."; ++ errstr = "Could not open database."; + if (APR_STATUS_IS_EDSOOPEN(status)) + ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) + "The DBM driver could not be loaded"); +@@ -147,7 +147,7 @@ + "mod_dav_fs: The DBM library '%s' could not be loaded: %s", + err->reason, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, +- "Could not load library for property database."); ++ "Could not load library for DBM database."); + } + if ((status = apr_dbm_open2(&file, driver, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, +@@ -162,6 +162,9 @@ + != APR_SUCCESS + && !ro) { + /* ### do something with 'status' */ ++ ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, ++ "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)", ++ pathname, ro ? "only" : "write"); + + /* we can't continue if we couldn't open the file + and we need to write */ diff --git a/httpd.spec b/httpd.spec index 4ff2d58..066d182 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -142,6 +142,9 @@ Provides: mod_proxy_uwsgi = %{version}-%{release} Requires: /etc/mime.types Requires: httpd-tools = %{version}-%{release} Requires: httpd-filesystem = %{version}-%{release} +%if 0%{?fedora} > 39 || 0%{?rhel} > 9 +Requires: apr-util-1(dbm)%{_isa} +%endif Requires(pre): httpd-filesystem Conflicts: apr < 1.5.0-1 Conflicts: httpd < 2.4.53-2 @@ -856,6 +859,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Nov 2 2023 Joe Orton - 2.4.58-2 +- add dependency on apr-util-1(dbm) so a DBM provider is present + * Fri Oct 20 2023 Luboš Uhliarik - 2.4.58-1 - new version 2.4.58 From d69c709d67f1668d05fe7466b677ef5923b1c1f2 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:09:28 +0000 Subject: [PATCH 059/112] Update pullrev.sh. --- pullrev.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pullrev.sh b/pullrev.sh index 87b7cd7..703d376 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.51 +ver=2.4.58 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" @@ -43,7 +43,7 @@ for r in $*; do http*) curl -s "$r" | filterdiff --strip=3 ;; *) svn diff -c ${r} ${repo} ;; esac | filterdiff --remove-timestamps --clean \ - -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \ --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` if ! combinediff -w ${prev} ${this} > ${next}; then @@ -62,4 +62,4 @@ echo "+ git add ${fn}" git add "${fn}" echo "+ spec template:" echo "PatchN: ${fn}" -echo "%patchN -p1 -b .${suffix}" +echo "%patch -PN -p1 -b .${suffix}" From 5d639c7ccf9c83fe9fdbe28d95ed751f8d332620 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:11:45 +0000 Subject: [PATCH 060/112] mod_dav_fs: add DAVLockDBType, use global lock around lockdb --- httpd-2.4.58-properr.patch | 30 --- httpd-2.4.58-r1912477+.patch | 381 +++++++++++++++++++++++++++++++++++ httpd.spec | 7 +- 3 files changed, 387 insertions(+), 31 deletions(-) delete mode 100644 httpd-2.4.58-properr.patch create mode 100644 httpd-2.4.58-r1912477+.patch diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch deleted file mode 100644 index 4071f25..0000000 --- a/httpd-2.4.58-properr.patch +++ /dev/null @@ -1,30 +0,0 @@ ---- httpd-2.4.58/modules/dav/fs/dbm.c.properr -+++ httpd-2.4.58/modules/dav/fs/dbm.c -@@ -100,7 +100,7 @@ - /* There might not be a if we had problems creating it. */ - if (db == NULL) { - errcode = 1; -- errstr = "Could not open property database."; -+ errstr = "Could not open database."; - if (APR_STATUS_IS_EDSOOPEN(status)) - ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) - "The DBM driver could not be loaded"); -@@ -147,7 +147,7 @@ - "mod_dav_fs: The DBM library '%s' could not be loaded: %s", - err->reason, err->msg); - return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, -- "Could not load library for property database."); -+ "Could not load library for DBM database."); - } - if ((status = apr_dbm_open2(&file, driver, pathname, - ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, -@@ -162,6 +162,9 @@ - != APR_SUCCESS - && !ro) { - /* ### do something with 'status' */ -+ ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, -+ "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)", -+ pathname, ro ? "only" : "write"); - - /* we can't continue if we couldn't open the file - and we need to write */ diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch new file mode 100644 index 0000000..6458df8 --- /dev/null +++ b/httpd-2.4.58-r1912477+.patch @@ -0,0 +1,381 @@ +# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438 +http://svn.apache.org/viewvc?view=revision&revision=1912477 +http://svn.apache.org/viewvc?view=revision&revision=1912571 +http://svn.apache.org/viewvc?view=revision&revision=1912718 +http://svn.apache.org/viewvc?view=revision&revision=1913654 +http://svn.apache.org/viewvc?view=revision&revision=1914438 + +--- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/config6.m4 +@@ -20,4 +20,10 @@ + + APACHE_MODULE(dav_fs, DAV provider for the filesystem. --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav) + ++if test "x$enable_dav_fs" = "xshared"; then ++ # The only symbol which needs to be exported is the module ++ # structure, so ask libtool to hide everything else: ++ APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module]) ++fi ++ + APACHE_MODPATH_FINISH +--- httpd-2.4.58/modules/dav/fs/dbm.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/dbm.c +@@ -47,6 +47,10 @@ + #include "http_log.h" + #include "http_main.h" /* for ap_server_conf */ + ++#ifndef DEFAULT_PROPDB_DBM_TYPE ++#define DEFAULT_PROPDB_DBM_TYPE "default" ++#endif ++ + APLOG_USE_MODULE(dav_fs); + + struct dav_db { +@@ -100,7 +104,7 @@ + /* There might not be a if we had problems creating it. */ + if (db == NULL) { + errcode = 1; +- errstr = "Could not open property database."; ++ errstr = "Could not open database."; + if (APR_STATUS_IS_EDSOOPEN(status)) + ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) + "The DBM driver could not be loaded"); +@@ -129,10 +133,10 @@ + /* dav_dbm_open_direct: Opens a *dbm database specified by path. + * ro = boolean read-only flag. + */ +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb) ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb) + { +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) + const apr_dbm_driver_t *driver; + const apu_err_t *err; + #endif +@@ -141,13 +145,13 @@ + + *pdb = NULL; + +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) +- if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) { ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++ if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289) +- "mod_dav_fs: The DBM library '%s' could not be loaded: %s", +- err->reason, err->msg); ++ "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s", ++ err->reason, dbmtype, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, +- "Could not load library for property database."); ++ "Could not load library for database."); + } + if ((status = apr_dbm_open2(&file, driver, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, +@@ -156,7 +160,7 @@ + return dav_fs_dbm_error(NULL, p, status); + } + #else +- if ((status = apr_dbm_open(&file, pathname, ++ if ((status = apr_dbm_open_ex(&file, dbmtype, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, + APR_OS_DEFAULT, p)) + != APR_SUCCESS +@@ -206,7 +210,7 @@ + + /* ### do we need to deal with the umask? */ + +- return dav_dbm_open_direct(p, pathname, ro, pdb); ++ return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb); + } + + void dav_dbm_close(dav_db *db) +--- httpd-2.4.58/modules/dav/fs/lock.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/lock.c +@@ -181,8 +181,7 @@ + { + request_rec *r; /* for accessing the uuid state */ + apr_pool_t *pool; /* a pool to use */ +- const char *lockdb_path; /* where is the lock database? */ +- ++ const dav_fs_server_conf *conf; /* lock database config & metadata */ + int opened; /* we opened the database */ + dav_db *db; /* if non-NULL, the lock database */ + }; +@@ -292,6 +291,19 @@ + return dav_compare_locktoken(lt1, lt2); + } + ++static apr_status_t dav_fs_lockdb_cleanup(void *data) ++{ ++ dav_lockdb *lockdb = data; ++ ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ ++ if (lockdb->info->db) { ++ dav_dbm_close(lockdb->info->db); ++ } ++ ++ return APR_SUCCESS; ++} ++ + /* + ** dav_fs_really_open_lockdb: + ** +@@ -300,15 +312,27 @@ + static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb) + { + dav_error *err; ++ apr_status_t rv; + + if (lockdb->info->opened) + return NULL; + ++ rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex); ++ if (rv) { ++ return dav_new_error(lockdb->info->pool, ++ HTTP_INTERNAL_SERVER_ERROR, ++ DAV_ERR_LOCK_OPENDB, rv, ++ "Could not lock mutex for lock database."); ++ } ++ + err = dav_dbm_open_direct(lockdb->info->pool, +- lockdb->info->lockdb_path, ++ lockdb->info->conf->lockdb_path, ++ lockdb->info->conf->lockdb_type, + lockdb->ro, + &lockdb->info->db); + if (err != NULL) { ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ + return dav_push_error(lockdb->info->pool, + HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_OPENDB, +@@ -316,6 +340,10 @@ + err); + } + ++ apr_pool_cleanup_register(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup, ++ dav_fs_lockdb_cleanup); ++ + /* all right. it is opened now. */ + lockdb->info->opened = 1; + +@@ -341,9 +369,9 @@ + comb->pub.info = &comb->priv; + comb->priv.r = r; + comb->priv.pool = r->pool; +- +- comb->priv.lockdb_path = dav_get_lockdb_path(r); +- if (comb->priv.lockdb_path == NULL) { ++ comb->priv.conf = dav_fs_get_server_conf(r); ++ ++ if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) { + return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_NO_DB, 0, + "A lock database was not specified with the " +@@ -369,8 +397,8 @@ + */ + static void dav_fs_close_lockdb(dav_lockdb *lockdb) + { +- if (lockdb->info->db != NULL) +- dav_dbm_close(lockdb->info->db); ++ apr_pool_cleanup_run(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup); + } + + /* +--- httpd-2.4.58/modules/dav/fs/mod_dav_fs.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/mod_dav_fs.c +@@ -14,31 +14,35 @@ + * limitations under the License. + */ + ++#if !defined(_MSC_VER) && !defined(NETWARE) ++#include "ap_config_auto.h" ++#endif ++ + #include "httpd.h" + #include "http_config.h" ++#include "http_core.h" ++#include "http_log.h" + #include "apr_strings.h" + + #include "mod_dav.h" + #include "repos.h" + +-/* per-server configuration */ +-typedef struct { +- const char *lockdb_path; +- +-} dav_fs_server_conf; +- + extern module AP_MODULE_DECLARE_DATA dav_fs_module; + + #ifndef DEFAULT_DAV_LOCKDB + #define DEFAULT_DAV_LOCKDB "davlockdb" + #endif ++#ifndef DEFAULT_DAV_LOCKDB_TYPE ++#define DEFAULT_DAV_LOCKDB_TYPE "default" ++#endif + +-const char *dav_get_lockdb_path(const request_rec *r) +-{ +- dav_fs_server_conf *conf; ++static const char dav_fs_mutexid[] = "dav_fs-lockdb"; + +- conf = ap_get_module_config(r->server->module_config, &dav_fs_module); +- return conf->lockdb_path; ++static apr_global_mutex_t *dav_fs_lockdb_mutex; ++ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r) ++{ ++ return ap_get_module_config(r->server->module_config, &dav_fs_module); + } + + static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s) +@@ -57,15 +61,50 @@ + + newconf->lockdb_path = + child->lockdb_path ? child->lockdb_path : parent->lockdb_path; ++ newconf->lockdb_type = ++ child->lockdb_type ? child->lockdb_type : parent->lockdb_type; + + return newconf; + } + ++static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp) ++{ ++ if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0)) ++ return !OK; ++ return OK; ++} ++ ++static void dav_fs_child_init(apr_pool_t *p, server_rec *s) ++{ ++ apr_status_t rv; ++ ++ rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex, ++ apr_global_mutex_lockfile(dav_fs_lockdb_mutex), ++ p); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, ++ APLOGNO(10488) "child init failed for mutex"); ++ } ++} ++ + static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *base_server) + { + server_rec *s; ++ apr_status_t rv; + ++ /* Ignore first pass through the config. */ ++ if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) ++ return OK; ++ ++ rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL, ++ base_server, p, 0); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server, ++ APLOGNO(10489) "could not create lock mutex"); ++ return !OK; ++ } ++ + for (s = base_server; s; s = s->next) { + dav_fs_server_conf *conf; + +@@ -74,6 +113,13 @@ + if (!conf->lockdb_path) { + conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB); + } ++ if (!conf->lockdb_type) { ++ conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE; ++ } ++ ++ /* Mutex is common across all vhosts, but could have one per ++ * vhost if required. */ ++ conf->lockdb_mutex = dav_fs_lockdb_mutex; + } + + return OK; +@@ -98,19 +144,36 @@ + return NULL; + } + ++/* ++ * Command handler for the DAVLockDBType directive, which is TAKE1 ++ */ ++static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config, ++ const char *arg1) ++{ ++ dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config, ++ &dav_fs_module); ++ conf->lockdb_type = arg1; ++ ++ return NULL; ++} ++ + static const command_rec dav_fs_cmds[] = + { + /* per server */ + AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF, + "specify a lock database"), ++ AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF, ++ "specify a lock database DBM type"), + + { NULL } + }; + + static void register_hooks(apr_pool_t *p) + { ++ ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE); +- ++ ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE); ++ + dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL, + APR_HOOK_MIDDLE); + dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); +--- httpd-2.4.58/modules/dav/fs/repos.h.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/repos.h +@@ -25,6 +25,8 @@ + #ifndef _DAV_FS_REPOS_H_ + #define _DAV_FS_REPOS_H_ + ++#include "util_mutex.h" ++ + /* the subdirectory to hold all DAV-related information for a directory */ + #define DAV_FS_STATE_DIR ".DAV" + #define DAV_FS_STATE_FILE_FOR_DIR ".state_for_dir" +@@ -53,8 +55,8 @@ + /* DBM functions used by the repository and locking providers */ + extern const dav_hooks_db dav_hooks_db_dbm; + +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb); ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb); + void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname, + const char **state1, const char **state2); + dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key); +@@ -64,8 +66,15 @@ + int dav_dbm_exists(dav_db *db, apr_datum_t key); + void dav_dbm_close(dav_db *db); + +-/* where is the lock database located? */ +-const char *dav_get_lockdb_path(const request_rec *r); ++/* Per-server configuration. */ ++typedef struct { ++ const char *lockdb_path; ++ const char *lockdb_type; ++ apr_global_mutex_t *lockdb_mutex; ++} dav_fs_server_conf; ++ ++/* Returns server configuration for the request. */ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r); + + const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r); + const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r); diff --git a/httpd.spec b/httpd.spec index 066d182..bff884c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -96,6 +96,7 @@ Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch Patch46: httpd-2.4.53-separate-systemd-fns.patch +Patch47: httpd-2.4.58-r1912477+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -271,6 +272,7 @@ written in the Lua programming language. %patch -P45 -p1 -b .logjournal %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux +%patch -P47 -p1 -b .r1912477+ %patch -P60 -p1 -b .enable-sslv3 %patch -P63 -p1 -b .htcacheclean-dont-break @@ -859,6 +861,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Dec 8 2023 Joe Orton - 2.4.58-3 +- mod_dav_fs: add DAVLockDBType, use global lock around lockdb + * Thu Nov 2 2023 Joe Orton - 2.4.58-2 - add dependency on apr-util-1(dbm) so a DBM provider is present From 3d4b4777ce7dcd6b777cc57052faeb192828f618 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:55:58 +0000 Subject: [PATCH 061/112] - fix build with libxml2 2.12 --- httpd-2.4.58-r1914013.patch | 14 ++++++++++++++ httpd.spec | 2 ++ 2 files changed, 16 insertions(+) create mode 100644 httpd-2.4.58-r1914013.patch diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch new file mode 100644 index 0000000..f9e0786 --- /dev/null +++ b/httpd-2.4.58-r1914013.patch @@ -0,0 +1,14 @@ +# ./pullrev.sh 1914013 +http://svn.apache.org/viewvc?view=revision&revision=1914013 + +--- httpd-2.4.58/modules/filters/mod_xml2enc.c ++++ httpd-2.4.58/modules/filters/mod_xml2enc.c +@@ -209,7 +209,7 @@ + + /* to sniff, first we look for BOM */ + if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) { +- ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf, ++ ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf, + ctx->bytes); + if (HAVE_ENCODING(ctx->xml2enc)) { + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432) diff --git a/httpd.spec b/httpd.spec index bff884c..5bd2c4d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -101,6 +101,7 @@ Patch47: httpd-2.4.58-r1912477+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.58-r1914013.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch @@ -275,6 +276,7 @@ written in the Lua programming language. %patch -P47 -p1 -b .r1912477+ %patch -P60 -p1 -b .enable-sslv3 +%patch -P61 -p1 -b .r1914013 %patch -P63 -p1 -b .htcacheclean-dont-break %patch -P65 -p1 -b .r1894152 From af4e8a43b66a9ed63903c84ca4b9be765bda87a1 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Dec 2023 08:59:47 +0000 Subject: [PATCH 062/112] Note build fix. --- httpd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/httpd.spec b/httpd.spec index 5bd2c4d..f593ac4 100644 --- a/httpd.spec +++ b/httpd.spec @@ -865,6 +865,7 @@ exit $rv %changelog * Fri Dec 8 2023 Joe Orton - 2.4.58-3 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb +- fix build with libxml2 2.12 * Thu Nov 2 2023 Joe Orton - 2.4.58-2 - add dependency on apr-util-1(dbm) so a DBM provider is present From 16be14d05f9d8cf33661a58715a302be8872ce81 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 11:48:45 +0000 Subject: [PATCH 063/112] fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) mod_ssl: move to provider API for pkcs11 support (#2253014) --- httpd-2.4.58-r1913912+.patch | 847 +++++++++++++++++++++++++++++++++++ httpd-2.4.58-r1914365.patch | 219 +++++++++ httpd.spec | 10 +- pullrev.sh | 6 +- 4 files changed, 1079 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.58-r1913912+.patch create mode 100644 httpd-2.4.58-r1914365.patch diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch new file mode 100644 index 0000000..c8ea8fa --- /dev/null +++ b/httpd-2.4.58-r1913912+.patch @@ -0,0 +1,847 @@ +# ./pullrev.sh 1913912 1915067 + +http://svn.apache.org/viewvc?view=revision&revision=1913912 +http://svn.apache.org/viewvc?view=revision&revision=1915067 + +--- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 ++++ httpd-2.4.58/modules/ssl/mod_ssl.c +@@ -25,8 +25,7 @@ + */ + + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "util_md5.h" + #include "util_mutex.h" + #include "ap_provider.h" +@@ -75,11 +74,9 @@ + SSL_CMD_SRV(SessionCache, TAKE1, + "SSL Session Cache storage " + "('none', 'nonenotnull', 'dbm:/path/to/file')") +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + SSL_CMD_SRV(CryptoDevice, TAKE1, + "SSL external Crypto Device usage " + "('builtin', '...')") +-#endif + SSL_CMD_SRV(RandomSeed, TAKE23, + "SSL Pseudo Random Number Generator (PRNG) seeding source " + "('startup|connect builtin|file:/path|exec:/path [bytes]')") +--- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912 ++++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h +@@ -30,14 +30,17 @@ + + /* OpenSSL headers */ + +-#ifndef SSL_PRIVATE_H + #include +-#if (OPENSSL_VERSION_NUMBER >= 0x10001000) ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include /* for OPENSSL_API_LEVEL */ ++#endif ++#if OPENSSL_VERSION_NUMBER >= 0x10001000 + /* must be defined before including ssl.h */ + #define OPENSSL_NO_SSL_INTERN + #endif + #include +-#endif ++#include ++#include + + /** + * init_server hook -- allow SSL_CTX-specific initialization to be performed by +--- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_config.c +@@ -27,6 +27,7 @@ + damned if you don't.'' + -- Unknown */ + #include "ssl_private.h" ++ + #include "util_mutex.h" + #include "ap_provider.h" + +@@ -593,14 +594,15 @@ + return NULL; + } + +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd, + void *dcfg, + const char *arg) + { + SSLModConfigRec *mc = myModConfig(cmd->server); + const char *err; ++#if MODSSL_HAVE_ENGINE_API + ENGINE *e; ++#endif + + if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { + return err; +@@ -609,13 +611,16 @@ + if (strcEQ(arg, "builtin")) { + mc->szCryptoDevice = NULL; + } ++#if MODSSL_HAVE_ENGINE_API + else if ((e = ENGINE_by_id(arg))) { + mc->szCryptoDevice = arg; + ENGINE_free(e); + } ++#endif + else { + err = "SSLCryptoDevice: Invalid argument; must be one of: " + "'builtin' (none)"; ++#if MODSSL_HAVE_ENGINE_API + e = ENGINE_get_first(); + while (e) { + err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e), +@@ -624,12 +629,12 @@ + * on the 'old' e, per the docs in engine.h. */ + e = ENGINE_get_next(e); + } ++#endif + return err; + } + + return NULL; + } +-#endif + + const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd, + void *dcfg, +--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c +@@ -27,8 +27,7 @@ + see Recursive.'' + -- Unknown */ + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "mpm_common.h" + #include "mod_md.h" + +@@ -218,6 +217,16 @@ + } + #endif + ++static APR_INLINE unsigned long modssl_runtime_lib_version(void) ++{ ++#if MODSSL_USE_OPENSSL_PRE_1_1_API ++ return SSLeay(); ++#else ++ return OpenSSL_version_num(); ++#endif ++} ++ ++ + /* + * Per-module initialization + */ +@@ -225,18 +234,22 @@ + apr_pool_t *ptemp, + server_rec *base_server) + { ++ unsigned long runtime_lib_version = modssl_runtime_lib_version(); + SSLModConfigRec *mc = myModConfig(base_server); + SSLSrvConfigRec *sc; + server_rec *s; + apr_status_t rv; + apr_array_header_t *pphrases; + +- if (SSLeay() < MODSSL_LIBRARY_VERSION) { ++ AP_DEBUG_ASSERT(mc); ++ ++ if (runtime_lib_version < MODSSL_LIBRARY_VERSION) { + ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882) + "Init: this version of mod_ssl was compiled against " +- "a newer library (%s, version currently loaded is %s)" ++ "a newer library (%s (%s), version currently loaded is 0x%lX)" + " - may result in undefined or erroneous behavior", +- MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT); ++ MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT, ++ runtime_lib_version); + } + + /* We initialize mc->pid per-process in the child init, +@@ -313,11 +326,9 @@ + /* + * SSL external crypto device ("engine") support + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) { + return rv; + } +-#endif + + ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883) + "Init: Initialized %s library", MODSSL_LIBRARY_NAME); +@@ -473,9 +484,9 @@ + * Support for external a Crypto Device ("engine"), usually + * a hardware accelerator card for crypto operations. + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p) + { ++#if MODSSL_HAVE_ENGINE_API + SSLModConfigRec *mc = myModConfig(s); + ENGINE *e; + +@@ -507,10 +518,9 @@ + + ENGINE_free(e); + } +- ++#endif + return APR_SUCCESS; + } +-#endif + + #ifdef HAVE_TLSEXT + static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, +@@ -1320,15 +1330,6 @@ + return 0; + } + +-static APR_INLINE int modssl_DH_bits(DH *dh) +-{ +-#if OPENSSL_VERSION_NUMBER < 0x30000000L +- return DH_bits(dh); +-#else +- return BN_num_bits(DH_get0_p(dh)); +-#endif +-} +- + /* SSL_CTX_use_PrivateKey_file() can fail either because the private + * key was encrypted, or due to a mismatch between an already-loaded + * cert and the key - a common misconfiguration - from calling +@@ -1354,15 +1355,10 @@ + SSLModConfigRec *mc = myModConfig(s); + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; +- X509 *cert; +- DH *dh; ++ EVP_PKEY *pkey; + #ifdef HAVE_ECC +- EC_GROUP *ecparams = NULL; +- int nid; +- EC_KEY *eckey = NULL; +-#endif +-#ifndef HAVE_SSL_CONF_CMD +- SSL *ssl; ++ EC_GROUP *ecgroup = NULL; ++ int curve_nid = 0; + #endif + + /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ +@@ -1373,7 +1369,7 @@ + (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, + const char *)); + i++) { +- EVP_PKEY *pkey; ++ X509 *cert = NULL; + const char *engine_certfile = NULL; + + key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); +@@ -1416,8 +1412,6 @@ + if (modssl_is_engine_id(keyfile)) { + apr_status_t rv; + +- cert = NULL; +- + if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, + engine_certfile, keyfile, + &cert, &pkey))) { +@@ -1488,22 +1482,21 @@ + * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later, + * and SSL_CTX_get0_certificate is implemented.) + */ +- if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) { ++ cert = SSL_CTX_get0_certificate(mctx->ssl_ctx); + #else +- ssl = SSL_new(mctx->ssl_ctx); ++ { ++ SSL *ssl = SSL_new(mctx->ssl_ctx); + if (ssl) { + /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */ + SSL_set_connect_state(ssl); + cert = SSL_get_certificate(ssl); ++ SSL_free(ssl); ++ } + } +- if (!ssl || !cert) { + #endif ++ if (!cert) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566) + "Unable to retrieve certificate %s", key_id); +-#ifndef HAVE_SSL_CONF_CMD +- if (ssl) +- SSL_free(ssl); +-#endif + return APR_EGENERAL; + } + +@@ -1525,10 +1518,6 @@ + } + #endif + +-#ifndef HAVE_SSL_CONF_CMD +- SSL_free(ssl); +-#endif +- + ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568) + "Certificate and private key %s configured from %s and %s", + key_id, certfile, keyfile); +@@ -1538,15 +1527,33 @@ + * Try to read DH parameters from the (first) SSLCertificateFile + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); +- if (certfile && !modssl_is_engine_id(certfile) +- && (dh = ssl_dh_GetParamFromFile(certfile))) { +- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() +- * for OpenSSL 3.0+. */ ++ if (certfile && !modssl_is_engine_id(certfile)) { ++ int done = 0, num_bits = 0; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ DH *dh = modssl_dh_from_file(certfile); ++ if (dh) { ++ num_bits = DH_bits(dh); + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); ++ DH_free(dh); ++ done = 1; ++ } ++#else ++ pkey = modssl_dh_pkey_from_file(certfile); ++ if (pkey) { ++ num_bits = EVP_PKEY_get_bits(pkey); ++ if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) { ++ EVP_PKEY_free(pkey); ++ } ++ else { ++ done = 1; ++ } ++ } ++#endif ++ if (done) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", +- modssl_DH_bits(dh), vhost_id, certfile); +- DH_free(dh); ++ num_bits, vhost_id, certfile); ++ } + } + #if !MODSSL_USE_OPENSSL_PRE_1_1_API + else { +@@ -1561,13 +1568,27 @@ + * Similarly, try to read the ECDH curve name from SSLCertificateFile... + */ + if (certfile && !modssl_is_engine_id(certfile) +- && (ecparams = ssl_ec_GetParamFromFile(certfile)) +- && (nid = EC_GROUP_get_curve_name(ecparams)) +- && (eckey = EC_KEY_new_by_curve_name(nid))) { ++ && (ecgroup = modssl_ec_group_from_file(certfile)) ++ && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) { ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid); ++ if (eckey) { + SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ++ EC_KEY_free(eckey); ++ } ++ else { ++ curve_nid = 0; ++ } ++#else ++ if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) { ++ curve_nid = 0; ++ } ++#endif ++ if (curve_nid) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) + "ECDH curve %s for %s specified in %s", +- OBJ_nid2sn(nid), vhost_id, certfile); ++ OBJ_nid2sn(curve_nid), vhost_id, certfile); ++ } + } + /* + * ...otherwise, enable auto curve selection (OpenSSL 1.0.2) +@@ -1575,18 +1596,20 @@ + * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList + */ + #if MODSSL_USE_OPENSSL_PRE_1_1_API +- else { ++ if (!curve_nid) { + #if defined(SSL_CTX_set_ecdh_auto) + SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1); + #else +- eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ if (eckey) { + SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ++ EC_KEY_free(eckey); ++ } + #endif + } + #endif + /* OpenSSL assures us that _free() is NULL-safe */ +- EC_KEY_free(eckey); +- EC_GROUP_free(ecparams); ++ EC_GROUP_free(ecgroup); + #endif + + return APR_SUCCESS; +--- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_io.c +@@ -28,8 +28,7 @@ + core keeps dumping.'' + -- Unknown */ + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "apr_date.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake, +@@ -2283,14 +2282,7 @@ + ssl_io_filter_cleanup, apr_pool_cleanup_null); + + if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) { +- BIO *rbio = SSL_get_rbio(ssl), +- *wbio = SSL_get_wbio(ssl); +- BIO_set_callback(rbio, ssl_io_data_cb); +- BIO_set_callback_arg(rbio, (void *)ssl); +- if (wbio && wbio != rbio) { +- BIO_set_callback(wbio, ssl_io_data_cb); +- BIO_set_callback_arg(wbio, (void *)ssl); +- } ++ modssl_set_io_callbacks(ssl); + } + + return; +@@ -2374,13 +2366,22 @@ + "+-------------------------------------------------------------------------+"); + } + +-long ssl_io_data_cb(BIO *bio, int cmd, +- const char *argp, ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static long modssl_io_cb(BIO *bio, int cmd, const char *argp, ++ size_t len, int argi, long argl, int rc, ++ size_t *processed) ++#else ++static long modssl_io_cb(BIO *bio, int cmd, const char *argp, + int argi, long argl, long rc) ++#endif + { + SSL *ssl; + conn_rec *c; + server_rec *s; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ (void)len; ++ (void)processed; ++#endif + + if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL) + return rc; +@@ -2402,7 +2403,7 @@ + "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s", + MODSSL_LIBRARY_NAME, + (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"), +- rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), ++ (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), + bio, argp, dump); + if (*dump != '\0' && argp != NULL) + ssl_io_data_dump(c, s, argp, rc); +@@ -2417,3 +2418,25 @@ + } + return rc; + } ++ ++static APR_INLINE void set_bio_callback(BIO *bio, void *arg) ++{ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ BIO_set_callback_ex(bio, modssl_io_cb); ++#else ++ BIO_set_callback(bio, modssl_io_cb); ++#endif ++ BIO_set_callback_arg(bio, arg); ++} ++ ++void modssl_set_io_callbacks(SSL *ssl) ++{ ++ BIO *rbio = SSL_get_rbio(ssl), ++ *wbio = SSL_get_wbio(ssl); ++ if (rbio) { ++ set_bio_callback(rbio, ssl); ++ } ++ if (wbio && wbio != rbio) { ++ set_bio_callback(wbio, ssl); ++ } ++} +--- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c +@@ -2581,6 +2581,7 @@ + sc->server->pks->service_unavailable : 0; + + ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s); ++ + /* + * There is one special filter callback, which is set + * very early depending on the base_server's log level. +@@ -2589,14 +2590,7 @@ + * we need to set that callback here. + */ + if (APLOGtrace4(s)) { +- BIO *rbio = SSL_get_rbio(ssl), +- *wbio = SSL_get_wbio(ssl); +- BIO_set_callback(rbio, ssl_io_data_cb); +- BIO_set_callback_arg(rbio, (void *)ssl); +- if (wbio && wbio != rbio) { +- BIO_set_callback(wbio, ssl_io_data_cb); +- BIO_set_callback_arg(wbio, (void *)ssl); +- } ++ modssl_set_io_callbacks(ssl); + } + + return 1; +--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c +@@ -30,6 +30,8 @@ + -- Clifford Stoll */ + #include "ssl_private.h" + ++#include ++ + typedef struct { + server_rec *s; + apr_pool_t *p; +@@ -606,8 +608,7 @@ + return (len); + } + +- +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + + /* OpenSSL UI implementation for passphrase entry; largely duplicated + * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be +@@ -831,7 +832,7 @@ + const char *certid, const char *keyid, + X509 **pubkey, EVP_PKEY **privkey) + { +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + const char *c, *scheme; + ENGINE *e; + UI_METHOD *ui_method = get_passphrase_ui(p); +--- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_private.h +@@ -83,16 +83,13 @@ + + #include "ap_expr.h" + +-/* OpenSSL headers */ +-#include +-#if (OPENSSL_VERSION_NUMBER >= 0x10001000) +-/* must be defined before including ssl.h */ +-#define OPENSSL_NO_SSL_INTERN +-#endif +-#if OPENSSL_VERSION_NUMBER >= 0x30000000 +-#include ++/* keep first for compat API */ ++#ifndef OPENSSL_API_COMPAT ++#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */ + #endif +-#include ++#include "mod_ssl_openssl.h" ++ ++/* OpenSSL headers */ + #include + #include + #include +@@ -102,12 +99,23 @@ + #include + #include + #include ++#include ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include ++#endif + + /* Avoid tripping over an engine build installed globally and detected + * when the user points at an explicit non-engine flavor of OpenSSL + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \ ++ && (OPENSSL_VERSION_NUMBER < 0x30000000 \ ++ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ ++ && !defined(OPENSSL_NO_ENGINE) + #include ++#define MODSSL_HAVE_ENGINE_API 1 ++#endif ++#ifndef MODSSL_HAVE_ENGINE_API ++#define MODSSL_HAVE_ENGINE_API 0 + #endif + + #if (OPENSSL_VERSION_NUMBER < 0x0090801f) +@@ -142,10 +150,18 @@ + * include most changes from OpenSSL >= 1.1 (new functions, macros, + * deprecations, ...), so we have to work around this... + */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) ++#if LIBRESSL_VERSION_NUMBER < 0x2070000f ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 ++#else ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 ++#endif + #else /* defined(LIBRESSL_VERSION_NUMBER) */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 ++#else ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 + #endif ++#endif /* defined(LIBRESSL_VERSION_NUMBER) */ + + #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L + #define HAVE_FIPS +@@ -211,7 +227,10 @@ + #endif + + /* Secure Remote Password */ +-#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) ++#if !defined(OPENSSL_NO_SRP) \ ++ && (OPENSSL_VERSION_NUMBER < 0x30000000L \ ++ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ ++ && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) + #define HAVE_SRP + #include + #endif +@@ -254,6 +273,14 @@ + #endif + #endif + ++/* those may be deprecated */ ++#ifndef X509_get_notBefore ++#define X509_get_notBefore X509_getm_notBefore ++#endif ++#ifndef X509_get_notAfter ++#define X509_get_notAfter X509_getm_notAfter ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) + #define HAVE_OPENSSL_KEYLOG + #endif +@@ -1019,7 +1046,7 @@ + /** I/O */ + void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); + void ssl_io_filter_register(apr_pool_t *); +-long ssl_io_data_cb(BIO *, int, const char *, int, long, long); ++void modssl_set_io_callbacks(SSL *ssl); + + /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request + * to allow an SSL renegotiation to take place. */ +@@ -1057,9 +1084,13 @@ + X509 **pubkey, EVP_PKEY **privkey); + + /** Diffie-Hellman Parameter Support */ +-DH *ssl_dh_GetParamFromFile(const char *); ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++DH *modssl_dh_from_file(const char *); ++#else ++EVP_PKEY *modssl_dh_pkey_from_file(const char *); ++#endif + #ifdef HAVE_ECC +-EC_GROUP *ssl_ec_GetParamFromFile(const char *); ++EC_GROUP *modssl_ec_group_from_file(const char *); + #endif + + /* Store the EVP_PKEY key (serialized into DER) in the hash table with +--- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util.c +@@ -476,7 +476,7 @@ + + int modssl_is_engine_id(const char *name) + { +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + /* ### Can handle any other special ENGINE key names here? */ + return strncmp(name, "pkcs11:", 7) == 0; + #else +--- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c +@@ -464,29 +464,52 @@ + ** _________________________________________________________________ + */ + +-DH *ssl_dh_GetParamFromFile(const char *file) ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++DH *modssl_dh_from_file(const char *file) + { +- DH *dh = NULL; ++ DH *dh; + BIO *bio; + + if ((bio = BIO_new_file(file, "r")) == NULL) + return NULL; + dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); + BIO_free(bio); +- return (dh); ++ ++ return dh; ++} ++#else ++EVP_PKEY *modssl_dh_pkey_from_file(const char *file) ++{ ++ EVP_PKEY *pkey; ++ BIO *bio; ++ ++ if ((bio = BIO_new_file(file, "r")) == NULL) ++ return NULL; ++ pkey = PEM_read_bio_Parameters(bio, NULL); ++ BIO_free(bio); ++ ++ return pkey; + } ++#endif + + #ifdef HAVE_ECC +-EC_GROUP *ssl_ec_GetParamFromFile(const char *file) ++EC_GROUP *modssl_ec_group_from_file(const char *file) + { +- EC_GROUP *group = NULL; ++ EC_GROUP *group; + BIO *bio; + + if ((bio = BIO_new_file(file, "r")) == NULL) + return NULL; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L + group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); ++#else ++ group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters, ++ PEM_STRING_ECPARAMETERS, bio, ++ NULL, NULL, NULL); ++#endif + BIO_free(bio); +- return (group); ++ ++ return group; + } + #endif + +--- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c +@@ -29,9 +29,9 @@ + -- Alexei Sayle */ + + #include "ssl_private.h" ++ + #include "ap_mpm.h" + #include "apr_thread_mutex.h" +-#include "mod_ssl_openssl.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, + (server_rec *s, apr_pool_t *p, +--- httpd-2.4.58/support/ab.c.r1913912 ++++ httpd-2.4.58/support/ab.c +@@ -166,13 +166,18 @@ + + #if defined(HAVE_OPENSSL) + +-#include ++#include + #include + #include + #include + #include + #include + #include ++#include ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + #define USE_SSL + + #define SK_NUM(x) sk_X509_num(x) +@@ -555,22 +560,33 @@ + * + */ + #ifdef USE_SSL +-static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret) ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static long ssl_print_cb(BIO *bio, int cmd, const char *argp, ++ size_t len, int argi, long argl, int ret, ++ size_t *processed) ++#else ++static long ssl_print_cb(BIO *bio, int cmd, const char *argp, ++ int argi, long argl, long ret) ++#endif + { + BIO *out; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ (void)len; ++ (void)processed; ++#endif + + out=(BIO *)BIO_get_callback_arg(bio); + if (out == NULL) return(ret); + + if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) { + BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n", +- bio, argp, argi, ret, ret); ++ bio, argp, argi, (long)ret, (long)ret); + BIO_dump(out,(char *)argp,(int)ret); + return(ret); + } + else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) { + BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n", +- bio, argp, argi, ret, ret); ++ bio, argp, argi, (long)ret, (long)ret); + BIO_dump(out,(char *)argp,(int)ret); + } + return ret; +@@ -765,17 +781,29 @@ + break; + #ifndef OPENSSL_NO_EC + case EVP_PKEY_EC: { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ size_t len; ++ char cname[80]; ++ if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, ++ cname, sizeof(cname), &len)) { ++ cname[0] = '?'; ++ len = 1; ++ } ++ cname[len] = '\0'; ++#else + const char *cname = NULL; + EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); + int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); + EC_KEY_free(ec); + cname = EC_curve_nid2nist(nid); +- if (!cname) ++ if (!cname) { + cname = OBJ_nid2sn(nid); +- ++ if (!cname) ++ cname = "?"; ++ } ++#endif + apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits", +- cname, +- EVP_PKEY_bits(key)); ++ cname, EVP_PKEY_bits(key)); + break; + } + #endif +@@ -1428,7 +1456,11 @@ + SSL_set_bio(c->ssl, bio, bio); + SSL_set_connect_state(c->ssl); + if (verbosity >= 4) { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ BIO_set_callback_ex(bio, ssl_print_cb); ++#else + BIO_set_callback(bio, ssl_print_cb); ++#endif + BIO_set_callback_arg(bio, (void *)bio_err); + } + #ifdef HAVE_TLSEXT diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch new file mode 100644 index 0000000..e7390eb --- /dev/null +++ b/httpd-2.4.58-r1914365.patch @@ -0,0 +1,219 @@ +# ./pullrev.sh 1914365 +http://svn.apache.org/viewvc?view=revision&revision=1914365 + +--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c +@@ -1421,8 +1421,10 @@ + if (cert) { + if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137) +- "Failed to configure engine certificate %s, check %s", +- key_id, certfile); ++ "Failed to configure certificate %s from %s, check %s", ++ key_id, mc->szCryptoDevice ? ++ mc->szCryptoDevice : "provider", ++ certfile); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return APR_EGENERAL; + } +@@ -1433,8 +1435,9 @@ + + if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130) +- "Failed to configure private key %s from engine", +- keyfile); ++ "Failed to configure private key %s from %s", ++ keyfile, mc->szCryptoDevice ? ++ mc->szCryptoDevice : "provider"); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return APR_EGENERAL; + } +--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c +@@ -31,6 +31,9 @@ + #include "ssl_private.h" + + #include ++#if MODSSL_HAVE_OPENSSL_STORE ++#include ++#endif + + typedef struct { + server_rec *s; +@@ -608,7 +611,7 @@ + return (len); + } + +-#if MODSSL_HAVE_ENGINE_API ++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE + + /* OpenSSL UI implementation for passphrase entry; largely duplicated + * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be +@@ -826,13 +829,14 @@ + } + #endif + +- +-apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, ++#if MODSSL_HAVE_ENGINE_API ++static apr_status_t modssl_load_keypair_engine(server_rec *s, apr_pool_t *p, + const char *vhostid, +- const char *certid, const char *keyid, +- X509 **pubkey, EVP_PKEY **privkey) ++ const char *certid, ++ const char *keyid, ++ X509 **pubkey, ++ EVP_PKEY **privkey) + { +-#if MODSSL_HAVE_ENGINE_API + const char *c, *scheme; + ENGINE *e; + UI_METHOD *ui_method = get_passphrase_ui(p); +@@ -906,6 +910,118 @@ + ENGINE_free(e); + + return APR_SUCCESS; ++} ++#endif ++ ++#if MODSSL_HAVE_OPENSSL_STORE ++static OSSL_STORE_INFO *modssl_load_store_uri(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *uri, int info_type) ++{ ++ OSSL_STORE_CTX *sctx; ++ UI_METHOD *ui_method = get_passphrase_ui(p); ++ pphrase_cb_arg_t ppcb; ++ OSSL_STORE_INFO *info = NULL; ++ ++ memset(&ppcb, 0, sizeof ppcb); ++ ppcb.s = s; ++ ppcb.p = p; ++ ppcb.bPassPhraseDialogOnce = TRUE; ++ ppcb.key_id = vhostid; ++ ppcb.pkey_file = uri; ++ ++ sctx = OSSL_STORE_open(uri, ui_method, &ppcb, NULL, NULL); ++ if (!sctx) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(10491) ++ "Init: OSSL_STORE_open failed for PKCS#11 URI `%s'", ++ uri); ++ return NULL; ++ } ++ ++ while (!OSSL_STORE_eof(sctx)) { ++ info = OSSL_STORE_load(sctx); ++ if (!info) ++ break; ++ ++ if (OSSL_STORE_INFO_get_type(info) == info_type) ++ break; ++ ++ OSSL_STORE_INFO_free(info); ++ info = NULL; ++ } ++ ++ OSSL_STORE_close(sctx); ++ ++ return info; ++} ++ ++static apr_status_t modssl_load_keypair_store(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *certid, ++ const char *keyid, ++ X509 **pubkey, ++ EVP_PKEY **privkey) ++{ ++ OSSL_STORE_INFO *info = NULL; ++ ++ *privkey = NULL; ++ *pubkey = NULL; ++ ++ info = modssl_load_store_uri(s, p, vhostid, keyid, OSSL_STORE_INFO_PKEY); ++ if (!info) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10492) ++ "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ *privkey = OSSL_STORE_INFO_get1_PKEY(info); ++ OSSL_STORE_INFO_free(info); ++ if (!*privkey) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10493) ++ "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ if (certid) { ++ info = modssl_load_store_uri(s, p, vhostid, certid, OSSL_STORE_INFO_CERT); ++ if (!info) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10494) ++ "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ *pubkey = OSSL_STORE_INFO_get1_CERT(info); ++ OSSL_STORE_INFO_free(info); ++ if (!*pubkey) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10495) ++ "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'", ++ certid); ++ return ssl_die(s); ++ } ++ } ++ ++ return APR_SUCCESS; ++} ++#endif ++ ++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *certid, const char *keyid, ++ X509 **pubkey, EVP_PKEY **privkey) ++{ ++#if MODSSL_HAVE_OPENSSL_STORE ++ SSLModConfigRec *mc = myModConfig(s); ++ ++ if (!mc->szCryptoDevice) ++ return modssl_load_keypair_store(s, p, vhostid, certid, keyid, ++ pubkey, privkey); ++#endif ++#if MODSSL_HAVE_ENGINE_API ++ return modssl_load_keypair_engine(s, p, vhostid, certid, keyid, ++ pubkey, privkey); + #else + return APR_ENOTIMPL; + #endif +--- httpd-2.4.58/modules/ssl/ssl_private.h.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_private.h +@@ -118,6 +118,15 @@ + #define MODSSL_HAVE_ENGINE_API 0 + #endif + ++/* Use OpenSSL 3.x STORE for loading URI keys and certificates starting with ++ * OpenSSL 3.0 ++ */ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#define MODSSL_HAVE_OPENSSL_STORE 1 ++#else ++#define MODSSL_HAVE_OPENSSL_STORE 0 ++#endif ++ + #if (OPENSSL_VERSION_NUMBER < 0x0090801f) + #error mod_ssl requires OpenSSL 0.9.8a or later + #endif +--- httpd-2.4.58/modules/ssl/ssl_util.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_util.c +@@ -476,7 +476,7 @@ + + int modssl_is_engine_id(const char *name) + { +-#if MODSSL_HAVE_ENGINE_API ++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE + /* ### Can handle any other special ENGINE key names here? */ + return strncmp(name, "pkcs11:", 7) == 0; + #else diff --git a/httpd.spec b/httpd.spec index f593ac4..8bd81c5 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -97,6 +97,8 @@ Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch Patch46: httpd-2.4.53-separate-systemd-fns.patch Patch47: httpd-2.4.58-r1912477+.patch +Patch48: httpd-2.4.58-r1913912+.patch +Patch49: httpd-2.4.58-r1914365.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -274,6 +276,8 @@ written in the Lua programming language. %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux %patch -P47 -p1 -b .r1912477+ +%patch -P48 -p1 -b .r1913912 +%patch -P49 -p1 -b .r1914365 %patch -P60 -p1 -b .enable-sslv3 %patch -P61 -p1 -b .r1914013 @@ -863,6 +867,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jan 5 2024 Joe Orton - 2.4.58-4 +- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) +- mod_ssl: move to provider API for pkcs11 support (#2253014) + * Fri Dec 8 2023 Joe Orton - 2.4.58-3 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb - fix build with libxml2 2.12 diff --git a/pullrev.sh b/pullrev.sh index 703d376..7ace161 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,7 +6,7 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" ver=2.4.58 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" @@ -43,7 +43,9 @@ for r in $*; do http*) curl -s "$r" | filterdiff --strip=3 ;; *) svn diff -c ${r} ${repo} ;; esac | filterdiff --remove-timestamps --clean \ - -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \ + -x 'CHANGES' -x 'changes-entries/*.txt' \ + -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x '.github/*' \ --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` if ! combinediff -w ${prev} ${this} > ${next}; then From fcc34b87be47c9a4d2931865ae235a7fe6743dbe Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 11:55:23 +0000 Subject: [PATCH 064/112] Fix suffix. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 8bd81c5..dc3b6e9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -276,7 +276,7 @@ written in the Lua programming language. %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux %patch -P47 -p1 -b .r1912477+ -%patch -P48 -p1 -b .r1913912 +%patch -P48 -p1 -b .r1913912+ %patch -P49 -p1 -b .r1914365 %patch -P60 -p1 -b .enable-sslv3 From ab864817dceb5ee4d715e71a70f8892ea6c53a17 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 16:21:21 +0000 Subject: [PATCH 065/112] - renumber patches to apply in numerical order - use %autosetup --- httpd.spec | 70 ++++++++++++++++-------------------------------------- 1 file changed, 21 insertions(+), 49 deletions(-) diff --git a/httpd.spec b/httpd.spec index dc3b6e9..2c71c87 100644 --- a/httpd.spec +++ b/httpd.spec @@ -81,31 +81,31 @@ Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes -Patch21: httpd-2.4.48-r1842929+.patch -Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.53-export.patch -Patch24: httpd-2.4.43-corelimit.patch -Patch25: httpd-2.4.54-selinux.patch -Patch26: httpd-2.4.54-gettid.patch -Patch27: httpd-2.4.54-icons.patch -Patch30: httpd-2.4.43-cachehardmax.patch -Patch34: httpd-2.4.43-socket-activation.patch -Patch38: httpd-2.4.43-sslciphdefault.patch -Patch39: httpd-2.4.43-sslprotdefault.patch -Patch41: httpd-2.4.43-r1861793+.patch -Patch42: httpd-2.4.48-r1828172+.patch -Patch45: httpd-2.4.43-logjournal.patch -Patch46: httpd-2.4.53-separate-systemd-fns.patch -Patch47: httpd-2.4.58-r1912477+.patch -Patch48: httpd-2.4.58-r1913912+.patch -Patch49: httpd-2.4.58-r1914365.patch +Patch20: httpd-2.4.48-r1842929+.patch +Patch21: httpd-2.4.43-mod_systemd.patch +Patch22: httpd-2.4.53-export.patch +Patch23: httpd-2.4.43-corelimit.patch +Patch24: httpd-2.4.54-gettid.patch +Patch25: httpd-2.4.54-icons.patch +Patch26: httpd-2.4.43-cachehardmax.patch +Patch27: httpd-2.4.43-socket-activation.patch +Patch28: httpd-2.4.43-sslciphdefault.patch +Patch29: httpd-2.4.43-sslprotdefault.patch +Patch30: httpd-2.4.43-r1861793+.patch +Patch31: httpd-2.4.48-r1828172+.patch +Patch32: httpd-2.4.43-logjournal.patch +Patch33: httpd-2.4.53-separate-systemd-fns.patch +Patch34: httpd-2.4.58-r1912477+.patch +Patch35: httpd-2.4.58-r1913912+.patch +Patch36: httpd-2.4.58-r1914365.patch +Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.58-r1914013.patch -Patch63: httpd-2.4.46-htcacheclean-dont-break.patch -Patch65: httpd-2.4.51-r1894152.patch +Patch62: httpd-2.4.46-htcacheclean-dont-break.patch +Patch63: httpd-2.4.51-r1894152.patch # Security fixes # Patch200: ... @@ -254,35 +254,7 @@ written in the Lua programming language. %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%setup -q -%patch -P2 -p1 -b .apxs -%patch -P3 -p1 -b .deplibs - -%patch -P19 -p1 -b .detectsystemd - -%patch -P21 -p1 -b .r1842929+ -%patch -P22 -p1 -b .mod_systemd -%patch -P23 -p1 -b .export -%patch -P24 -p1 -b .corelimit -%patch -P26 -p1 -b .gettid -%patch -P27 -p1 -b .icons -%patch -P30 -p1 -b .cachehardmax -%patch -P34 -p1 -b .socketactivation -%patch -P38 -p1 -b .sslciphdefault -%patch -P39 -p1 -b .sslprotdefault -%patch -P41 -p1 -b .r1861793+ -%patch -P42 -p1 -b .r1828172+ -%patch -P45 -p1 -b .logjournal -%patch -P46 -p1 -b .separatesystemd -%patch -P25 -p1 -b .selinux -%patch -P47 -p1 -b .r1912477+ -%patch -P48 -p1 -b .r1913912+ -%patch -P49 -p1 -b .r1914365 - -%patch -P60 -p1 -b .enable-sslv3 -%patch -P61 -p1 -b .r1914013 -%patch -P63 -p1 -b .htcacheclean-dont-break -%patch -P65 -p1 -b .r1894152 +%autosetup -p1 -S gendiff # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h From df3d3d1151513090e3ba649f03bdaa6817d87c5e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 16:21:32 +0000 Subject: [PATCH 066/112] - remove some old workarounds --- httpd.spec | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/httpd.spec b/httpd.spec index 2c71c87..a34b641 100644 --- a/httpd.spec +++ b/httpd.spec @@ -318,16 +318,6 @@ autoheader && autoconf || exit 1 %set_build_flags -# Hard-code path to links to avoid unnecessary builddep -export LYNX_PATH=/usr/bin/links - -%ifarch aarch64 -# The configure check for epoll_create() is failing. httpd/apr only -# actually uses epoll_create1() so this test could be smarter. Work -# around it for now. -export ac_cv_func_epoll_create=yes -%endif - # Build the daemon ./configure \ --prefix=%{_sysconfdir}/httpd \ From 9e93ea3734c71f5ca0d57b5a1a2bea873d0408e5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 22:15:08 +0000 Subject: [PATCH 067/112] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index a34b641..396594c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jan 5 2024 Joe Orton - 2.4.58-4 - fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) - mod_ssl: move to provider API for pkcs11 support (#2253014) From 7fa757742fa45e9f48ffb6c6d7d53bd18dfdf521 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 21:49:39 +0000 Subject: [PATCH 068/112] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 396594c..3b40eed 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 756bc47b6f56edcff7e1408b0fac760177276a7e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 11:55:21 +0000 Subject: [PATCH 069/112] Add upstream tracking notes for patches. --- httpd-2.4.43-apxs.patch | 3 +++ httpd-2.4.43-corelimit.patch | 3 +++ httpd-2.4.43-r1861793+.patch | 5 +++-- httpd-2.4.46-htcacheclean-dont-break.patch | 3 +++ httpd-2.4.48-r1828172+.patch | 2 ++ httpd-2.4.48-r1842929+.patch | 3 +++ httpd-2.4.51-r1894152.patch | 2 ++ httpd-2.4.54-gettid.patch | 3 +++ httpd-2.4.58-r1912477+.patch | 2 ++ httpd-2.4.58-r1913912+.patch | 2 ++ httpd-2.4.58-r1914013.patch | 2 ++ httpd-2.4.58-r1914365.patch | 2 ++ 12 files changed, 30 insertions(+), 2 deletions(-) diff --git a/httpd-2.4.43-apxs.patch b/httpd-2.4.43-apxs.patch index b1185b2..808d6a8 100644 --- a/httpd-2.4.43-apxs.patch +++ b/httpd-2.4.43-apxs.patch @@ -1,3 +1,6 @@ + +Upstream-Status: local customisation + diff --git a/support/apxs.in b/support/apxs.in index b2705fa..c331631 100644 --- a/support/apxs.in diff --git a/httpd-2.4.43-corelimit.patch b/httpd-2.4.43-corelimit.patch index dd4b874..8c9899c 100644 --- a/httpd-2.4.43-corelimit.patch +++ b/httpd-2.4.43-corelimit.patch @@ -1,3 +1,6 @@ + +Upstream-Status: local customisation + diff --git a/server/core.c b/server/core.c index 79b2a82..dc0f17a 100644 --- a/server/core.c diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch index 08e96cb..89d0328 100644 --- a/httpd-2.4.43-r1861793+.patch +++ b/httpd-2.4.43-r1861793+.patch @@ -1,5 +1,6 @@ -diff --git a/configure.in b/configure.in -index cb43246..0bb6b0d 100644 + +Upstream-Status: proposed for 2.4.59 + --- httpd-2.4.43/configure.in.r1861793+ +++ httpd-2.4.43/configure.in @@ -465,6 +465,28 @@ diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch index e52318a..919e9e3 100644 --- a/httpd-2.4.46-htcacheclean-dont-break.patch +++ b/httpd-2.4.46-htcacheclean-dont-break.patch @@ -1,3 +1,6 @@ + +Upstream-Status: r1915508, proposed for 2.4.59 + diff --git a/support/htcacheclean.c b/support/htcacheclean.c index 958ba6d..0a7fe3c 100644 --- a/support/htcacheclean.c diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.48-r1828172+.patch index 37f1855..5f3be4c 100644 --- a/httpd-2.4.48-r1828172+.patch +++ b/httpd-2.4.48-r1828172+.patch @@ -1,6 +1,8 @@ https://github.com/apache/httpd/pull/209 +Upstream-Status: in trunk, not proposed for 2.4.x + diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 index 0000000000..69df73ce68 diff --git a/httpd-2.4.48-r1842929+.patch b/httpd-2.4.48-r1842929+.patch index f83a21d..c1837e7 100644 --- a/httpd-2.4.48-r1842929+.patch +++ b/httpd-2.4.48-r1842929+.patch @@ -1,3 +1,6 @@ + +Upstream-Status: in trunk, not proposed for 2.4.x + diff --git a/Makefile.in b/Makefile.in index 6747aea..40c7076 100644 --- a/Makefile.in diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch index 95f5081..10c4b3f 100644 --- a/httpd-2.4.51-r1894152.patch +++ b/httpd-2.4.51-r1894152.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1894152 http://svn.apache.org/viewvc?view=revision&revision=1894152 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 +++ httpd-2.4.51/modules/filters/mod_deflate.c @@ -835,6 +835,7 @@ diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch index dfc447b..88c956d 100644 --- a/httpd-2.4.54-gettid.patch +++ b/httpd-2.4.54-gettid.patch @@ -1,3 +1,6 @@ + +Upstream-Status: everything but last hunk merged for 2.4.59 + From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 7 Jul 2020 09:48:01 +0100 diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch index 6458df8..eb3deff 100644 --- a/httpd-2.4.58-r1912477+.patch +++ b/httpd-2.4.58-r1912477+.patch @@ -5,6 +5,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1912718 http://svn.apache.org/viewvc?view=revision&revision=1913654 http://svn.apache.org/viewvc?view=revision&revision=1914438 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+ +++ httpd-2.4.58/modules/dav/fs/config6.m4 @@ -20,4 +20,10 @@ diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch index c8ea8fa..f8fd4a4 100644 --- a/httpd-2.4.58-r1913912+.patch +++ b/httpd-2.4.58-r1913912+.patch @@ -3,6 +3,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1913912 http://svn.apache.org/viewvc?view=revision&revision=1915067 +Upstream-Status: merged for 2.4.59 + --- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 +++ httpd-2.4.58/modules/ssl/mod_ssl.c @@ -25,8 +25,7 @@ diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch index f9e0786..02dcac3 100644 --- a/httpd-2.4.58-r1914013.patch +++ b/httpd-2.4.58-r1914013.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1914013 http://svn.apache.org/viewvc?view=revision&revision=1914013 +Upstream-Status: merged for 2.4.59 + --- httpd-2.4.58/modules/filters/mod_xml2enc.c +++ httpd-2.4.58/modules/filters/mod_xml2enc.c @@ -209,7 +209,7 @@ diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch index e7390eb..8512de3 100644 --- a/httpd-2.4.58-r1914365.patch +++ b/httpd-2.4.58-r1914365.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1914365 http://svn.apache.org/viewvc?view=revision&revision=1914365 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365 +++ httpd-2.4.58/modules/ssl/ssl_engine_init.c @@ -1421,8 +1421,10 @@ From dee54cd734ac9fb909a122b141005210c218dbfd Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 13:04:06 +0000 Subject: [PATCH 070/112] - Updated Systemd security settings (closes #3) (Rahul Sundaram) - updated httpd.service(5) man page (Joe Orton) --- httpd.service | 19 ++++++++++++++++++- httpd.service.xml | 24 +++++++++++++++++------- httpd.spec | 6 +++++- httpd@.service | 19 ++++++++++++++++++- 4 files changed, 58 insertions(+), 10 deletions(-) diff --git a/httpd.service b/httpd.service index c5b5e08..b75e28c 100644 --- a/httpd.service +++ b/httpd.service @@ -26,8 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed -PrivateTmp=true +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/httpd.service.xml b/httpd.service.xml index 7dfdb97..3ddbc9e 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -231,7 +231,16 @@ Wants=network-online.target Process policies and restrictions - The httpd service uses the following options: + The httpd.service unit enables a + variety of sandboxing options. Many of these prevent the service + from changing the system configuration - such as + ProtectClock and + ProtectKernelModules. See + systemd.exec5 + and + systemd.service5 + for more information on these options. Particular notice should + be taken of the following: PrivateTmp is enabled by @@ -247,13 +256,14 @@ Wants=network-online.target the policy to continue, httpd will continue to run (and recover) if a single child is terminated because of excess memory consumption. - - See - systemd.exec5 - and - systemd.service5 - for more information. + ProtectHome is set to + read-only by default. CGI scripts run via + UserDir will not be able modify any + content in /home by + default. + + diff --git a/httpd.spec b/httpd.spec index 3b40eed..b2ea95b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jan 15 2024 Rahul Sundaram - 2.4.58-7 +- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening +- updated httpd.service(5) (Joe Orton) + * Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/httpd@.service b/httpd@.service index 84424fb..8b20b90 100644 --- a/httpd@.service +++ b/httpd@.service @@ -19,8 +19,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed -PrivateTmp=true +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target From 264f63b024fd9a66004460be7ea80195c27cc33f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 17:02:24 +0000 Subject: [PATCH 071/112] - ignore source file changes in rpminspect's "upstream" module --- rpminspect.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 1b4f2fe..17e48d1 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,3 +4,18 @@ badfuncs: # and APR interfaces for IPv6 addresses. ignore: - /usr/lib*/httpd/modules/mod_proxy.so +upstream: + ignore: + - *.xml + - *.service + - *.socket + - *.conf + - *.sysconf + - *.tmpfiles + - README.* + - *.sysusers + - *.png + - httpd-ssl-* + - config.layout + - action*.sh + - apachectl.* From 5096106709c71826233d39ae724535d5795c6485 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 12:42:59 +0000 Subject: [PATCH 072/112] Add gating configuration. --- gating.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gating.yaml b/gating.yaml index e4c04e7..fb11fa9 100644 --- a/gating.yaml +++ b/gating.yaml @@ -14,3 +14,14 @@ decision_contexts: [bodhi_update_push_stable] subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} From 27131dea8da568264571886f93bc0f30ff455eb3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:23:51 +0000 Subject: [PATCH 073/112] Update tracking. --- httpd-2.4.51-r1894152.patch | 2 +- httpd-2.4.54-selinux.patch | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch index 10c4b3f..20e6784 100644 --- a/httpd-2.4.51-r1894152.patch +++ b/httpd-2.4.51-r1894152.patch @@ -1,7 +1,7 @@ # ./pullrev.sh 1894152 http://svn.apache.org/viewvc?view=revision&revision=1894152 -Upstream-Status: in trunk, not proposed for 2.4.x +Upstream-Status: merged for 2.4.59 --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 +++ httpd-2.4.51/modules/filters/mod_deflate.c diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch index 4d66bd8..661b983 100644 --- a/httpd-2.4.54-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,3 +1,6 @@ + +Upstream-Status: in trunk not in 2.4.x + diff --git a/configure.in b/configure.in index 74015ca..8c0ee10 100644 --- httpd-2.4.54/modules/arch/unix/config5.m4.selinux From 2ce898b07d9c7824441c032793f3dc1ed473088d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:23:56 +0000 Subject: [PATCH 074/112] rebuild to fix changelog ordering --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index b2ea95b..1bd5e95 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,7 +829,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Mon Jan 15 2024 Rahul Sundaram - 2.4.58-7 +* Thu Mar 28 2024 Joe Orton - 2.4.58-8 +- rebuild to fix changelog ordering + +* Mon Feb 15 2024 Rahul Sundaram - 2.4.58-7 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening - updated httpd.service(5) (Joe Orton) From 1c126ced89f57ab99219139a2ccdd2f6d657927b Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:25:42 +0000 Subject: [PATCH 075/112] really fix changelog ordering. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 1bd5e95..048057d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -832,7 +832,7 @@ exit $rv * Thu Mar 28 2024 Joe Orton - 2.4.58-8 - rebuild to fix changelog ordering -* Mon Feb 15 2024 Rahul Sundaram - 2.4.58-7 +* Thu Mar 7 2024 Rahul Sundaram - 2.4.58-7 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening - updated httpd.service(5) (Joe Orton) From 9ee4b1c3240908f7f663a0534198e600a4bc6cbc Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Apr 2024 09:22:35 +0100 Subject: [PATCH 076/112] update to 2.4.59 --- .gitignore | 1 + httpd-2.4.43-r1861793+.patch | 272 ------ httpd-2.4.46-htcacheclean-dont-break.patch | 16 - httpd-2.4.51-r1894152.patch | 38 - httpd-2.4.54-gettid.patch | 94 -- httpd-2.4.58-r1913912+.patch | 849 ------------------ httpd-2.4.58-r1914013.patch | 16 - httpd-2.4.59-gettid.patch | 14 + ...172+.patch => httpd-2.4.59-unifycgid.patch | 292 +++--- httpd.spec | 16 +- sources | 4 +- 11 files changed, 168 insertions(+), 1444 deletions(-) delete mode 100644 httpd-2.4.43-r1861793+.patch delete mode 100644 httpd-2.4.46-htcacheclean-dont-break.patch delete mode 100644 httpd-2.4.51-r1894152.patch delete mode 100644 httpd-2.4.54-gettid.patch delete mode 100644 httpd-2.4.58-r1913912+.patch delete mode 100644 httpd-2.4.58-r1914013.patch create mode 100644 httpd-2.4.59-gettid.patch rename httpd-2.4.48-r1828172+.patch => httpd-2.4.59-unifycgid.patch (91%) diff --git a/.gitignore b/.gitignore index cc7babc..bdad39b 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ x86_64 /httpd-2.4.56.tar.bz2.asc /httpd-2.4.57.tar.bz2.asc /httpd-2.4.58.tar.bz2.asc +/httpd-2.4.59.tar.bz2.asc diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch deleted file mode 100644 index 89d0328..0000000 --- a/httpd-2.4.43-r1861793+.patch +++ /dev/null @@ -1,272 +0,0 @@ - -Upstream-Status: proposed for 2.4.59 - ---- httpd-2.4.43/configure.in.r1861793+ -+++ httpd-2.4.43/configure.in -@@ -465,6 +465,28 @@ - AC_SEARCH_LIBS(crypt, crypt) - CRYPT_LIBS="$LIBS" - APACHE_SUBST(CRYPT_LIBS) -+ -+if test "$ac_cv_search_crypt" != "no"; then -+ # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt -+ AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [ -+ AC_RUN_IFELSE([AC_LANG_PROGRAM([[ -+#include -+#include -+#include -+ -+#define PASSWD_0 "Hello world!" -+#define SALT_0 "\$6\$saltstring" -+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \ -+ "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" -+]], [char *result = crypt(PASSWD_0, SALT_0); -+ if (!result) return 1; -+ if (strcmp(result, EXPECT_0)) return 2; -+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])]) -+ if test "$ap_cv_crypt_sha2" = yes; then -+ AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes]) -+ fi -+fi -+ - LIBS="$saved_LIBS" - - dnl See Comment #Spoon ---- httpd-2.4.43/docs/man/htpasswd.1.r1861793+ -+++ httpd-2.4.43/docs/man/htpasswd.1 -@@ -27,16 +27,16 @@ - .SH "SYNOPSIS" - - .PP --\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR -+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR -+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR -+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR -+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR - - - .SH "SUMMARY" -@@ -48,7 +48,7 @@ - Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&. - - .PP --\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&. -+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&. - - .PP - This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&. -@@ -73,17 +73,26 @@ - \fB-m\fR - Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&. - .TP -+\fB-2\fR -+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&. -+.TP -+\fB-5\fR -+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&. -+.TP - \fB-B\fR - Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&. - .TP - \fB-C\fR - This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&. - .TP -+\fB-r\fR -+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&. -+.TP - \fB-d\fR - Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&. - .TP - \fB-s\fR --Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&. -+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&. - .TP - \fB-p\fR - Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&. -@@ -152,10 +161,13 @@ - When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&. - - .PP --The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&. -+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&. -+ -+.PP -+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&. - - .PP --The SHA and \fBcrypt()\fR formats are insecure by today's standards\&. -+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&. - - .SH "RESTRICTIONS" - ---- httpd-2.4.43/support/htpasswd.c.r1861793+ -+++ httpd-2.4.43/support/htpasswd.c -@@ -109,17 +109,21 @@ - "for it." NL - " -i Read password from stdin without verification (for script usage)." NL - " -m Force MD5 encryption of the password (default)." NL -- " -B Force bcrypt encryption of the password (very secure)." NL -+ " -2 Force SHA-256 crypt() hash of the password (very secure)." NL -+ " -5 Force SHA-512 crypt() hash of the password (very secure)." NL -+ " -B Force bcrypt encryption of the password (very secure)." NL - " -C Set the computing time used for the bcrypt algorithm" NL - " (higher is more secure but slower, default: %d, valid: 4 to 17)." NL -+ " -r Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL -+ " (higher is more secure but slower, default: 5000)." NL - " -d Force CRYPT encryption of the password (8 chars max, insecure)." NL -- " -s Force SHA encryption of the password (insecure)." NL -+ " -s Force SHA-1 encryption of the password (insecure)." NL - " -p Do not encrypt the password (plaintext, insecure)." NL - " -D Delete the specified user." NL - " -v Verify password for the specified user." NL - "On other systems than Windows and NetWare the '-p' flag will " - "probably not work." NL -- "The SHA algorithm does not use a salt and is less secure than the " -+ "The SHA-1 algorithm does not use a salt and is less secure than the " - "MD5 algorithm." NL, - BCRYPT_DEFAULT_COST - ); -@@ -178,7 +182,7 @@ - if (rv != APR_SUCCESS) - exit(ERR_SYNTAX); - -- while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) { -+ while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) { - switch (opt) { - case 'c': - *mask |= APHTP_NEWFILE; ---- httpd-2.4.43/support/passwd_common.c.r1861793+ -+++ httpd-2.4.43/support/passwd_common.c -@@ -179,16 +179,21 @@ - int mkhash(struct passwd_ctx *ctx) - { - char *pw; -- char salt[16]; -+ char salt[17]; - apr_status_t rv; - int ret = 0; - #if CRYPT_ALGO_SUPPORTED - char *cbuf; - #endif -+#ifdef HAVE_CRYPT_SHA2 -+ const char *setting; -+ char method; -+#endif - -- if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) { -+ if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT -+ && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) { - apr_file_printf(errfile, -- "Warning: Ignoring -C argument for this algorithm." NL); -+ "Warning: Ignoring -C/-r argument for this algorithm." NL); - } - - if (ctx->passwd == NULL) { -@@ -246,6 +251,34 @@ - break; - #endif /* CRYPT_ALGO_SUPPORTED */ - -+#ifdef HAVE_CRYPT_SHA2 -+ case ALG_CRYPT_SHA256: -+ case ALG_CRYPT_SHA512: -+ ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool); -+ if (ret != 0) -+ break; -+ -+ method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6'; -+ -+ if (ctx->cost) -+ setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s", -+ method, ctx->cost, salt); -+ else -+ setting = apr_psprintf(ctx->pool, "$%c$%s", -+ method, salt); -+ -+ cbuf = crypt(pw, setting); -+ if (cbuf == NULL) { -+ rv = APR_FROM_OS_ERROR(errno); -+ ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv); -+ ret = ERR_PWMISMATCH; -+ break; -+ } -+ -+ apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1); -+ break; -+#endif /* HAVE_CRYPT_SHA2 */ -+ - #if BCRYPT_ALGO_SUPPORTED - case ALG_BCRYPT: - rv = apr_generate_random_bytes((unsigned char*)salt, 16); -@@ -294,6 +327,19 @@ - case 's': - ctx->alg = ALG_APSHA; - break; -+#ifdef HAVE_CRYPT_SHA2 -+ case '2': -+ ctx->alg = ALG_CRYPT_SHA256; -+ break; -+ case '5': -+ ctx->alg = ALG_CRYPT_SHA512; -+ break; -+#else -+ case '2': -+ case '5': -+ ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform."; -+ return ERR_ALG_NOT_SUPP; -+#endif - case 'p': - ctx->alg = ALG_PLAIN; - #if !PLAIN_ALGO_SUPPORTED -@@ -324,11 +370,12 @@ - return ERR_ALG_NOT_SUPP; - #endif - break; -- case 'C': { -+ case 'C': -+ case 'r': { - char *endptr; - long num = strtol(opt_arg, &endptr, 10); - if (*endptr != '\0' || num <= 0) { -- ctx->errstr = "argument to -C must be a positive integer"; -+ ctx->errstr = "argument to -C/-r must be a positive integer"; - return ERR_SYNTAX; - } - ctx->cost = num; ---- httpd-2.4.43/support/passwd_common.h.r1861793+ -+++ httpd-2.4.43/support/passwd_common.h -@@ -28,6 +28,8 @@ - #include "apu_version.h" - #endif - -+#include "ap_config_auto.h" -+ - #define MAX_STRING_LEN 256 - - #define ALG_PLAIN 0 -@@ -35,6 +37,8 @@ - #define ALG_APMD5 2 - #define ALG_APSHA 3 - #define ALG_BCRYPT 4 -+#define ALG_CRYPT_SHA256 5 -+#define ALG_CRYPT_SHA512 6 - - #define BCRYPT_DEFAULT_COST 5 - -@@ -84,7 +88,7 @@ - apr_size_t out_len; - char *passwd; - int alg; -- int cost; -+ int cost; /* cost for bcrypt, rounds for SHA-2 */ - enum { - PW_PROMPT = 0, - PW_ARG, diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch deleted file mode 100644 index 919e9e3..0000000 --- a/httpd-2.4.46-htcacheclean-dont-break.patch +++ /dev/null @@ -1,16 +0,0 @@ - -Upstream-Status: r1915508, proposed for 2.4.59 - -diff --git a/support/htcacheclean.c b/support/htcacheclean.c -index 958ba6d..0a7fe3c 100644 ---- a/support/htcacheclean.c -+++ b/support/htcacheclean.c -@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round) - } - } - } -- -- break; - } - } - } diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch deleted file mode 100644 index 20e6784..0000000 --- a/httpd-2.4.51-r1894152.patch +++ /dev/null @@ -1,38 +0,0 @@ -# ./pullrev.sh 1894152 -http://svn.apache.org/viewvc?view=revision&revision=1894152 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 -+++ httpd-2.4.51/modules/filters/mod_deflate.c -@@ -835,6 +835,7 @@ - while (!APR_BRIGADE_EMPTY(bb)) - { - apr_bucket *b; -+ apr_status_t rv; - - /* - * Optimization: If we are a HEAD request and bytes_sent is not zero -@@ -914,8 +915,6 @@ - } - - if (APR_BUCKET_IS_FLUSH(e)) { -- apr_status_t rv; -- - /* flush the remaining data from the zlib buffers */ - zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate, - Z_SYNC_FLUSH, NO_UPDATE_CRC); -@@ -947,7 +946,12 @@ - } - - /* read */ -- apr_bucket_read(e, &data, &len, APR_BLOCK_READ); -+ rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ); -+ if (rv) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298) -+ "failed reading from %s bucket", e->type->name); -+ return rv; -+ } - if (!len) { - apr_bucket_delete(e); - continue; diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch deleted file mode 100644 index 88c956d..0000000 --- a/httpd-2.4.54-gettid.patch +++ /dev/null @@ -1,94 +0,0 @@ - -Upstream-Status: everything but last hunk merged for 2.4.59 - -From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001 -From: Joe Orton -Date: Tue, 7 Jul 2020 09:48:01 +0100 -Subject: [PATCH] Check and use gettid() directly with glibc 2.30+. - -* configure.in: Check for gettid() and define HAVE_SYS_GETTID if - gettid() is only usable via syscall(). - -* server/log.c (log_tid): Use gettid() directly if available. ---- - configure.in | 14 +++++++++----- - server/log.c | 8 ++++++-- - 2 files changed, 15 insertions(+), 7 deletions(-) - -diff --git a/configure.in b/configure.in -index 423d58d4b9a..60cbf7b7f81 100644 ---- httpd-2.4.54/configure.in.gettid -+++ httpd-2.4.54/configure.in -@@ -502,22 +502,26 @@ - timegm \ - getpgid \ - fopen64 \ --getloadavg -+getloadavg \ -+gettid - ) - - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - --AC_CACHE_CHECK([for gettid()], ac_cv_gettid, -+if test $ac_cv_func_gettid = no; then -+ # On Linux before glibc 2.30, gettid() is only usable via syscall() -+ AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include - #include - #include - int main(int argc, char **argv) { - pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; }, --[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])]) --if test "$ac_cv_gettid" = "yes"; then -- AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()]) -+ [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])]) -+ if test "$ap_cv_gettid" = "yes"; then -+ AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()]) -+ fi - fi - - dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs ---- httpd-2.4.54/server/log.c.gettid -+++ httpd-2.4.54/server/log.c -@@ -55,7 +55,7 @@ - #include "ap_mpm.h" - #include "ap_listen.h" - --#if HAVE_GETTID -+#if HAVE_SYS_GETTID - #include - #include - #endif -@@ -627,14 +627,18 @@ - #if APR_HAS_THREADS - int result; - #endif --#if HAVE_GETTID -+#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID) - if (arg && *arg == 'g') { -+#ifdef HAVE_GETTID -+ pid_t tid = gettid(); -+#else - pid_t tid = syscall(SYS_gettid); -+#endif - if (tid == -1) - return 0; - return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid); - } --#endif -+#endif /* HAVE_GETTID || HAVE_SYS_GETTID */ - #if APR_HAS_THREADS - if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS - && result != AP_MPMQ_NOT_SUPPORTED) -@@ -968,7 +972,7 @@ - #if APR_HAS_THREADS - field_start = len; - len += cpystrn(buf + len, ":tid ", buflen - len); -- item_len = log_tid(info, NULL, buf + len, buflen - len); -+ item_len = log_tid(info, "g", buf + len, buflen - len); - if (!item_len) - len = field_start; - else diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch deleted file mode 100644 index f8fd4a4..0000000 --- a/httpd-2.4.58-r1913912+.patch +++ /dev/null @@ -1,849 +0,0 @@ -# ./pullrev.sh 1913912 1915067 - -http://svn.apache.org/viewvc?view=revision&revision=1913912 -http://svn.apache.org/viewvc?view=revision&revision=1915067 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 -+++ httpd-2.4.58/modules/ssl/mod_ssl.c -@@ -25,8 +25,7 @@ - */ - - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "util_md5.h" - #include "util_mutex.h" - #include "ap_provider.h" -@@ -75,11 +74,9 @@ - SSL_CMD_SRV(SessionCache, TAKE1, - "SSL Session Cache storage " - "('none', 'nonenotnull', 'dbm:/path/to/file')") --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - SSL_CMD_SRV(CryptoDevice, TAKE1, - "SSL external Crypto Device usage " - "('builtin', '...')") --#endif - SSL_CMD_SRV(RandomSeed, TAKE23, - "SSL Pseudo Random Number Generator (PRNG) seeding source " - "('startup|connect builtin|file:/path|exec:/path [bytes]')") ---- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912 -+++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h -@@ -30,14 +30,17 @@ - - /* OpenSSL headers */ - --#ifndef SSL_PRIVATE_H - #include --#if (OPENSSL_VERSION_NUMBER >= 0x10001000) -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include /* for OPENSSL_API_LEVEL */ -+#endif -+#if OPENSSL_VERSION_NUMBER >= 0x10001000 - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif - #include --#endif -+#include -+#include - - /** - * init_server hook -- allow SSL_CTX-specific initialization to be performed by ---- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_config.c -@@ -27,6 +27,7 @@ - damned if you don't.'' - -- Unknown */ - #include "ssl_private.h" -+ - #include "util_mutex.h" - #include "ap_provider.h" - -@@ -593,14 +594,15 @@ - return NULL; - } - --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd, - void *dcfg, - const char *arg) - { - SSLModConfigRec *mc = myModConfig(cmd->server); - const char *err; -+#if MODSSL_HAVE_ENGINE_API - ENGINE *e; -+#endif - - if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { - return err; -@@ -609,13 +611,16 @@ - if (strcEQ(arg, "builtin")) { - mc->szCryptoDevice = NULL; - } -+#if MODSSL_HAVE_ENGINE_API - else if ((e = ENGINE_by_id(arg))) { - mc->szCryptoDevice = arg; - ENGINE_free(e); - } -+#endif - else { - err = "SSLCryptoDevice: Invalid argument; must be one of: " - "'builtin' (none)"; -+#if MODSSL_HAVE_ENGINE_API - e = ENGINE_get_first(); - while (e) { - err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e), -@@ -624,12 +629,12 @@ - * on the 'old' e, per the docs in engine.h. */ - e = ENGINE_get_next(e); - } -+#endif - return err; - } - - return NULL; - } --#endif - - const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd, - void *dcfg, ---- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_init.c -@@ -27,8 +27,7 @@ - see Recursive.'' - -- Unknown */ - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "mpm_common.h" - #include "mod_md.h" - -@@ -218,6 +217,16 @@ - } - #endif - -+static APR_INLINE unsigned long modssl_runtime_lib_version(void) -+{ -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ return SSLeay(); -+#else -+ return OpenSSL_version_num(); -+#endif -+} -+ -+ - /* - * Per-module initialization - */ -@@ -225,18 +234,22 @@ - apr_pool_t *ptemp, - server_rec *base_server) - { -+ unsigned long runtime_lib_version = modssl_runtime_lib_version(); - SSLModConfigRec *mc = myModConfig(base_server); - SSLSrvConfigRec *sc; - server_rec *s; - apr_status_t rv; - apr_array_header_t *pphrases; - -- if (SSLeay() < MODSSL_LIBRARY_VERSION) { -+ AP_DEBUG_ASSERT(mc); -+ -+ if (runtime_lib_version < MODSSL_LIBRARY_VERSION) { - ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882) - "Init: this version of mod_ssl was compiled against " -- "a newer library (%s, version currently loaded is %s)" -+ "a newer library (%s (%s), version currently loaded is 0x%lX)" - " - may result in undefined or erroneous behavior", -- MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT); -+ MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT, -+ runtime_lib_version); - } - - /* We initialize mc->pid per-process in the child init, -@@ -313,11 +326,9 @@ - /* - * SSL external crypto device ("engine") support - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) { - return rv; - } --#endif - - ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883) - "Init: Initialized %s library", MODSSL_LIBRARY_NAME); -@@ -473,9 +484,9 @@ - * Support for external a Crypto Device ("engine"), usually - * a hardware accelerator card for crypto operations. - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p) - { -+#if MODSSL_HAVE_ENGINE_API - SSLModConfigRec *mc = myModConfig(s); - ENGINE *e; - -@@ -507,10 +518,9 @@ - - ENGINE_free(e); - } -- -+#endif - return APR_SUCCESS; - } --#endif - - #ifdef HAVE_TLSEXT - static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, -@@ -1320,15 +1330,6 @@ - return 0; - } - --static APR_INLINE int modssl_DH_bits(DH *dh) --{ --#if OPENSSL_VERSION_NUMBER < 0x30000000L -- return DH_bits(dh); --#else -- return BN_num_bits(DH_get0_p(dh)); --#endif --} -- - /* SSL_CTX_use_PrivateKey_file() can fail either because the private - * key was encrypted, or due to a mismatch between an already-loaded - * cert and the key - a common misconfiguration - from calling -@@ -1354,15 +1355,10 @@ - SSLModConfigRec *mc = myModConfig(s); - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; -- X509 *cert; -- DH *dh; -+ EVP_PKEY *pkey; - #ifdef HAVE_ECC -- EC_GROUP *ecparams = NULL; -- int nid; -- EC_KEY *eckey = NULL; --#endif --#ifndef HAVE_SSL_CONF_CMD -- SSL *ssl; -+ EC_GROUP *ecgroup = NULL; -+ int curve_nid = 0; - #endif - - /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ -@@ -1373,7 +1369,7 @@ - (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, - const char *)); - i++) { -- EVP_PKEY *pkey; -+ X509 *cert = NULL; - const char *engine_certfile = NULL; - - key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); -@@ -1416,8 +1412,6 @@ - if (modssl_is_engine_id(keyfile)) { - apr_status_t rv; - -- cert = NULL; -- - if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, - engine_certfile, keyfile, - &cert, &pkey))) { -@@ -1488,22 +1482,21 @@ - * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later, - * and SSL_CTX_get0_certificate is implemented.) - */ -- if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) { -+ cert = SSL_CTX_get0_certificate(mctx->ssl_ctx); - #else -- ssl = SSL_new(mctx->ssl_ctx); -+ { -+ SSL *ssl = SSL_new(mctx->ssl_ctx); - if (ssl) { - /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */ - SSL_set_connect_state(ssl); - cert = SSL_get_certificate(ssl); -+ SSL_free(ssl); -+ } - } -- if (!ssl || !cert) { - #endif -+ if (!cert) { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566) - "Unable to retrieve certificate %s", key_id); --#ifndef HAVE_SSL_CONF_CMD -- if (ssl) -- SSL_free(ssl); --#endif - return APR_EGENERAL; - } - -@@ -1525,10 +1518,6 @@ - } - #endif - --#ifndef HAVE_SSL_CONF_CMD -- SSL_free(ssl); --#endif -- - ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568) - "Certificate and private key %s configured from %s and %s", - key_id, certfile, keyfile); -@@ -1538,15 +1527,33 @@ - * Try to read DH parameters from the (first) SSLCertificateFile - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); -- if (certfile && !modssl_is_engine_id(certfile) -- && (dh = ssl_dh_GetParamFromFile(certfile))) { -- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() -- * for OpenSSL 3.0+. */ -+ if (certfile && !modssl_is_engine_id(certfile)) { -+ int done = 0, num_bits = 0; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ DH *dh = modssl_dh_from_file(certfile); -+ if (dh) { -+ num_bits = DH_bits(dh); - SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); -+ DH_free(dh); -+ done = 1; -+ } -+#else -+ pkey = modssl_dh_pkey_from_file(certfile); -+ if (pkey) { -+ num_bits = EVP_PKEY_get_bits(pkey); -+ if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) { -+ EVP_PKEY_free(pkey); -+ } -+ else { -+ done = 1; -+ } -+ } -+#endif -+ if (done) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- modssl_DH_bits(dh), vhost_id, certfile); -- DH_free(dh); -+ num_bits, vhost_id, certfile); -+ } - } - #if !MODSSL_USE_OPENSSL_PRE_1_1_API - else { -@@ -1561,13 +1568,27 @@ - * Similarly, try to read the ECDH curve name from SSLCertificateFile... - */ - if (certfile && !modssl_is_engine_id(certfile) -- && (ecparams = ssl_ec_GetParamFromFile(certfile)) -- && (nid = EC_GROUP_get_curve_name(ecparams)) -- && (eckey = EC_KEY_new_by_curve_name(nid))) { -+ && (ecgroup = modssl_ec_group_from_file(certfile)) -+ && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid); -+ if (eckey) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); -+ EC_KEY_free(eckey); -+ } -+ else { -+ curve_nid = 0; -+ } -+#else -+ if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) { -+ curve_nid = 0; -+ } -+#endif -+ if (curve_nid) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) - "ECDH curve %s for %s specified in %s", -- OBJ_nid2sn(nid), vhost_id, certfile); -+ OBJ_nid2sn(curve_nid), vhost_id, certfile); -+ } - } - /* - * ...otherwise, enable auto curve selection (OpenSSL 1.0.2) -@@ -1575,18 +1596,20 @@ - * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList - */ - #if MODSSL_USE_OPENSSL_PRE_1_1_API -- else { -+ if (!curve_nid) { - #if defined(SSL_CTX_set_ecdh_auto) - SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1); - #else -- eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ if (eckey) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); -+ EC_KEY_free(eckey); -+ } - #endif - } - #endif - /* OpenSSL assures us that _free() is NULL-safe */ -- EC_KEY_free(eckey); -- EC_GROUP_free(ecparams); -+ EC_GROUP_free(ecgroup); - #endif - - return APR_SUCCESS; ---- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_io.c -@@ -28,8 +28,7 @@ - core keeps dumping.'' - -- Unknown */ - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "apr_date.h" - - APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake, -@@ -2283,14 +2282,7 @@ - ssl_io_filter_cleanup, apr_pool_cleanup_null); - - if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) { -- BIO *rbio = SSL_get_rbio(ssl), -- *wbio = SSL_get_wbio(ssl); -- BIO_set_callback(rbio, ssl_io_data_cb); -- BIO_set_callback_arg(rbio, (void *)ssl); -- if (wbio && wbio != rbio) { -- BIO_set_callback(wbio, ssl_io_data_cb); -- BIO_set_callback_arg(wbio, (void *)ssl); -- } -+ modssl_set_io_callbacks(ssl); - } - - return; -@@ -2374,13 +2366,22 @@ - "+-------------------------------------------------------------------------+"); - } - --long ssl_io_data_cb(BIO *bio, int cmd, -- const char *argp, -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+static long modssl_io_cb(BIO *bio, int cmd, const char *argp, -+ size_t len, int argi, long argl, int rc, -+ size_t *processed) -+#else -+static long modssl_io_cb(BIO *bio, int cmd, const char *argp, - int argi, long argl, long rc) -+#endif - { - SSL *ssl; - conn_rec *c; - server_rec *s; -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ (void)len; -+ (void)processed; -+#endif - - if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL) - return rc; -@@ -2402,7 +2403,7 @@ - "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s", - MODSSL_LIBRARY_NAME, - (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"), -- rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), -+ (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), - bio, argp, dump); - if (*dump != '\0' && argp != NULL) - ssl_io_data_dump(c, s, argp, rc); -@@ -2417,3 +2418,25 @@ - } - return rc; - } -+ -+static APR_INLINE void set_bio_callback(BIO *bio, void *arg) -+{ -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ BIO_set_callback_ex(bio, modssl_io_cb); -+#else -+ BIO_set_callback(bio, modssl_io_cb); -+#endif -+ BIO_set_callback_arg(bio, arg); -+} -+ -+void modssl_set_io_callbacks(SSL *ssl) -+{ -+ BIO *rbio = SSL_get_rbio(ssl), -+ *wbio = SSL_get_wbio(ssl); -+ if (rbio) { -+ set_bio_callback(rbio, ssl); -+ } -+ if (wbio && wbio != rbio) { -+ set_bio_callback(wbio, ssl); -+ } -+} ---- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c -@@ -2581,6 +2581,7 @@ - sc->server->pks->service_unavailable : 0; - - ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s); -+ - /* - * There is one special filter callback, which is set - * very early depending on the base_server's log level. -@@ -2589,14 +2590,7 @@ - * we need to set that callback here. - */ - if (APLOGtrace4(s)) { -- BIO *rbio = SSL_get_rbio(ssl), -- *wbio = SSL_get_wbio(ssl); -- BIO_set_callback(rbio, ssl_io_data_cb); -- BIO_set_callback_arg(rbio, (void *)ssl); -- if (wbio && wbio != rbio) { -- BIO_set_callback(wbio, ssl_io_data_cb); -- BIO_set_callback_arg(wbio, (void *)ssl); -- } -+ modssl_set_io_callbacks(ssl); - } - - return 1; ---- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c -@@ -30,6 +30,8 @@ - -- Clifford Stoll */ - #include "ssl_private.h" - -+#include -+ - typedef struct { - server_rec *s; - apr_pool_t *p; -@@ -606,8 +608,7 @@ - return (len); - } - -- --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - - /* OpenSSL UI implementation for passphrase entry; largely duplicated - * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be -@@ -831,7 +832,7 @@ - const char *certid, const char *keyid, - X509 **pubkey, EVP_PKEY **privkey) - { --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - const char *c, *scheme; - ENGINE *e; - UI_METHOD *ui_method = get_passphrase_ui(p); ---- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_private.h -@@ -83,16 +83,13 @@ - - #include "ap_expr.h" - --/* OpenSSL headers */ --#include --#if (OPENSSL_VERSION_NUMBER >= 0x10001000) --/* must be defined before including ssl.h */ --#define OPENSSL_NO_SSL_INTERN --#endif --#if OPENSSL_VERSION_NUMBER >= 0x30000000 --#include -+/* keep first for compat API */ -+#ifndef OPENSSL_API_COMPAT -+#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */ - #endif --#include -+#include "mod_ssl_openssl.h" -+ -+/* OpenSSL headers */ - #include - #include - #include -@@ -102,12 +99,23 @@ - #include - #include - #include -+#include -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - - /* Avoid tripping over an engine build installed globally and detected - * when the user points at an explicit non-engine flavor of OpenSSL - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \ -+ && (OPENSSL_VERSION_NUMBER < 0x30000000 \ -+ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ -+ && !defined(OPENSSL_NO_ENGINE) - #include -+#define MODSSL_HAVE_ENGINE_API 1 -+#endif -+#ifndef MODSSL_HAVE_ENGINE_API -+#define MODSSL_HAVE_ENGINE_API 0 - #endif - - #if (OPENSSL_VERSION_NUMBER < 0x0090801f) -@@ -142,10 +150,18 @@ - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) -+#if LIBRESSL_VERSION_NUMBER < 0x2070000f -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 -+#else -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 -+#endif - #else /* defined(LIBRESSL_VERSION_NUMBER) */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) -+#if OPENSSL_VERSION_NUMBER < 0x10100000L -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 -+#else -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 - #endif -+#endif /* defined(LIBRESSL_VERSION_NUMBER) */ - - #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L - #define HAVE_FIPS -@@ -211,7 +227,10 @@ - #endif - - /* Secure Remote Password */ --#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) -+#if !defined(OPENSSL_NO_SRP) \ -+ && (OPENSSL_VERSION_NUMBER < 0x30000000L \ -+ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ -+ && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) - #define HAVE_SRP - #include - #endif -@@ -254,6 +273,14 @@ - #endif - #endif - -+/* those may be deprecated */ -+#ifndef X509_get_notBefore -+#define X509_get_notBefore X509_getm_notBefore -+#endif -+#ifndef X509_get_notAfter -+#define X509_get_notAfter X509_getm_notAfter -+#endif -+ - #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) - #define HAVE_OPENSSL_KEYLOG - #endif -@@ -1019,7 +1046,7 @@ - /** I/O */ - void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); - void ssl_io_filter_register(apr_pool_t *); --long ssl_io_data_cb(BIO *, int, const char *, int, long, long); -+void modssl_set_io_callbacks(SSL *ssl); - - /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request - * to allow an SSL renegotiation to take place. */ -@@ -1057,9 +1084,13 @@ - X509 **pubkey, EVP_PKEY **privkey); - - /** Diffie-Hellman Parameter Support */ --DH *ssl_dh_GetParamFromFile(const char *); -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+DH *modssl_dh_from_file(const char *); -+#else -+EVP_PKEY *modssl_dh_pkey_from_file(const char *); -+#endif - #ifdef HAVE_ECC --EC_GROUP *ssl_ec_GetParamFromFile(const char *); -+EC_GROUP *modssl_ec_group_from_file(const char *); - #endif - - /* Store the EVP_PKEY key (serialized into DER) in the hash table with ---- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util.c -@@ -476,7 +476,7 @@ - - int modssl_is_engine_id(const char *name) - { --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - /* ### Can handle any other special ENGINE key names here? */ - return strncmp(name, "pkcs11:", 7) == 0; - #else ---- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c -@@ -464,29 +464,52 @@ - ** _________________________________________________________________ - */ - --DH *ssl_dh_GetParamFromFile(const char *file) -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+DH *modssl_dh_from_file(const char *file) - { -- DH *dh = NULL; -+ DH *dh; - BIO *bio; - - if ((bio = BIO_new_file(file, "r")) == NULL) - return NULL; - dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); - BIO_free(bio); -- return (dh); -+ -+ return dh; -+} -+#else -+EVP_PKEY *modssl_dh_pkey_from_file(const char *file) -+{ -+ EVP_PKEY *pkey; -+ BIO *bio; -+ -+ if ((bio = BIO_new_file(file, "r")) == NULL) -+ return NULL; -+ pkey = PEM_read_bio_Parameters(bio, NULL); -+ BIO_free(bio); -+ -+ return pkey; - } -+#endif - - #ifdef HAVE_ECC --EC_GROUP *ssl_ec_GetParamFromFile(const char *file) -+EC_GROUP *modssl_ec_group_from_file(const char *file) - { -- EC_GROUP *group = NULL; -+ EC_GROUP *group; - BIO *bio; - - if ((bio = BIO_new_file(file, "r")) == NULL) - return NULL; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); -+#else -+ group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters, -+ PEM_STRING_ECPARAMETERS, bio, -+ NULL, NULL, NULL); -+#endif - BIO_free(bio); -- return (group); -+ -+ return group; - } - #endif - ---- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c -@@ -29,9 +29,9 @@ - -- Alexei Sayle */ - - #include "ssl_private.h" -+ - #include "ap_mpm.h" - #include "apr_thread_mutex.h" --#include "mod_ssl_openssl.h" - - APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, - (server_rec *s, apr_pool_t *p, ---- httpd-2.4.58/support/ab.c.r1913912 -+++ httpd-2.4.58/support/ab.c -@@ -166,13 +166,18 @@ - - #if defined(HAVE_OPENSSL) - --#include -+#include - #include - #include - #include - #include - #include - #include -+#include -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#include -+#endif -+ - #define USE_SSL - - #define SK_NUM(x) sk_X509_num(x) -@@ -555,22 +560,33 @@ - * - */ - #ifdef USE_SSL --static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret) -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+static long ssl_print_cb(BIO *bio, int cmd, const char *argp, -+ size_t len, int argi, long argl, int ret, -+ size_t *processed) -+#else -+static long ssl_print_cb(BIO *bio, int cmd, const char *argp, -+ int argi, long argl, long ret) -+#endif - { - BIO *out; -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ (void)len; -+ (void)processed; -+#endif - - out=(BIO *)BIO_get_callback_arg(bio); - if (out == NULL) return(ret); - - if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) { - BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n", -- bio, argp, argi, ret, ret); -+ bio, argp, argi, (long)ret, (long)ret); - BIO_dump(out,(char *)argp,(int)ret); - return(ret); - } - else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) { - BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n", -- bio, argp, argi, ret, ret); -+ bio, argp, argi, (long)ret, (long)ret); - BIO_dump(out,(char *)argp,(int)ret); - } - return ret; -@@ -765,17 +781,29 @@ - break; - #ifndef OPENSSL_NO_EC - case EVP_PKEY_EC: { -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ size_t len; -+ char cname[80]; -+ if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, -+ cname, sizeof(cname), &len)) { -+ cname[0] = '?'; -+ len = 1; -+ } -+ cname[len] = '\0'; -+#else - const char *cname = NULL; - EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); - int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); - EC_KEY_free(ec); - cname = EC_curve_nid2nist(nid); -- if (!cname) -+ if (!cname) { - cname = OBJ_nid2sn(nid); -- -+ if (!cname) -+ cname = "?"; -+ } -+#endif - apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits", -- cname, -- EVP_PKEY_bits(key)); -+ cname, EVP_PKEY_bits(key)); - break; - } - #endif -@@ -1428,7 +1456,11 @@ - SSL_set_bio(c->ssl, bio, bio); - SSL_set_connect_state(c->ssl); - if (verbosity >= 4) { -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ BIO_set_callback_ex(bio, ssl_print_cb); -+#else - BIO_set_callback(bio, ssl_print_cb); -+#endif - BIO_set_callback_arg(bio, (void *)bio_err); - } - #ifdef HAVE_TLSEXT diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch deleted file mode 100644 index 02dcac3..0000000 --- a/httpd-2.4.58-r1914013.patch +++ /dev/null @@ -1,16 +0,0 @@ -# ./pullrev.sh 1914013 -http://svn.apache.org/viewvc?view=revision&revision=1914013 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.58/modules/filters/mod_xml2enc.c -+++ httpd-2.4.58/modules/filters/mod_xml2enc.c -@@ -209,7 +209,7 @@ - - /* to sniff, first we look for BOM */ - if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) { -- ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf, -+ ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf, - ctx->bytes); - if (HAVE_ENCODING(ctx->xml2enc)) { - ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432) diff --git a/httpd-2.4.59-gettid.patch b/httpd-2.4.59-gettid.patch new file mode 100644 index 0000000..4857e37 --- /dev/null +++ b/httpd-2.4.59-gettid.patch @@ -0,0 +1,14 @@ + +Upstream-Status: not pushed upstream + +--- httpd-2.4.54/server/log.c.gettid ++++ httpd-2.4.54/server/log.c +@@ -968,7 +972,7 @@ + #if APR_HAS_THREADS + field_start = len; + len += cpystrn(buf + len, ":tid ", buflen - len); +- item_len = log_tid(info, NULL, buf + len, buflen - len); ++ item_len = log_tid(info, "g", buf + len, buflen - len); + if (!item_len) + len = field_start; + else diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.59-unifycgid.patch similarity index 91% rename from httpd-2.4.48-r1828172+.patch rename to httpd-2.4.59-unifycgid.patch index 5f3be4c..54216e0 100644 --- a/httpd-2.4.48-r1828172+.patch +++ b/httpd-2.4.59-unifycgid.patch @@ -1,14 +1,41 @@ https://github.com/apache/httpd/pull/209 -Upstream-Status: in trunk, not proposed for 2.4.x - +diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml +index ddacd4af19..6d4379d165 100644 +--- a/.github/workflows/linux.yml ++++ b/.github/workflows/linux.yml +@@ -48,11 +48,11 @@ jobs: + - name: Shared MPMs, all-modules + config: --enable-mods-shared=reallyall --enable-mpms-shared=all + # ------------------------------------------------------------------------- +- - name: Event MPM, all-modules, mod_cgid only +- config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi ++ - name: Event MPM, all-modules, mod_cgid fdpassing ++ config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing + # ------------------------------------------------------------------------- +- - name: Event MPM, all-modules, no CMSG_DATA +- config: --enable-mods-shared=reallyall --with-mpm=event ac_cv_have_decl_CMSG_DATA=no ++ - name: Event MPM, all-modules, mod_cgid w/o fdpassing ++ config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi + # ------------------------------------------------------------------------- + - name: Default, all-modules + install + config: --enable-mods-shared=reallyall +diff --git a/changes-entries/pr54221.txt b/changes-entries/pr54221.txt +new file mode 100644 +index 0000000000..62b75ea4dd +--- /dev/null ++++ b/changes-entries/pr54221.txt +@@ -0,0 +1,3 @@ ++ *) mod_cgid: Optional support for file descriptor passing, fixing ++ error log handling (configure --enable-cgid-fdpassing) on Unix ++ platforms. PR 54221. [Joe Orton] diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 -index 0000000000..69df73ce68 +index 0000000000..66f9418f21 --- /dev/null +++ b/modules/generators/cgi_common.h -@@ -0,0 +1,629 @@ +@@ -0,0 +1,639 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -37,6 +64,7 @@ index 0000000000..69df73ce68 + +#include "httpd.h" +#include "util_filter.h" ++#include "util_script.h" + +static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv; +static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps; @@ -439,9 +467,18 @@ index 0000000000..69df73ce68 + char sbuf[MAX_STRING_LEN]; + int ret; + -+ if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -+ APLOG_MODULE_INDEX))) -+ { ++ ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX); ++ ++ /* xCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ ++ if (ret != OK) { + /* In the case of a timeout reading script output, clear + * the brigade to avoid a second attempt to read the + * output. */ @@ -659,10 +696,18 @@ index bf295217e0..086355353b 100644 + APACHE_MODPATH_FINISH diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c -index 7e4b126c10..421124a0cb 100644 +index 1f7778617e..3799b06ce3 100644 --- a/modules/generators/mod_cgi.c +++ b/modules/generators/mod_cgi.c -@@ -61,9 +61,6 @@ +@@ -48,7 +48,6 @@ + #include "http_protocol.h" + #include "http_main.h" + #include "http_log.h" +-#include "util_script.h" + #include "ap_mpm.h" + #include "mod_core.h" + #include "mod_cgi.h" +@@ -61,9 +60,6 @@ module AP_MODULE_DECLARE_DATA cgi_module; @@ -672,14 +717,10 @@ index 7e4b126c10..421124a0cb 100644 static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command; /* Read and discard the data in the brigade produced by a CGI script */ -@@ -92,6 +89,15 @@ typedef struct { - apr_size_t bufbytes; - } cgi_server_conf; +@@ -96,6 +92,11 @@ typedef struct { + apr_interval_time_t timeout; + } cgi_dirconf; -+typedef struct { -+ apr_interval_time_t timeout; -+} cgi_dirconf; -+ +#if APR_FILES_AS_SOCKETS +#define WANT_CGI_BUCKET +#endif @@ -688,44 +729,7 @@ index 7e4b126c10..421124a0cb 100644 static void *create_cgi_config(apr_pool_t *p, server_rec *s) { cgi_server_conf *c = -@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv) - return overrides->logname ? overrides : base; - } - -+static void *create_cgi_dirconf(apr_pool_t *p, char *dummy) -+{ -+ cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf)); -+ return c; -+} -+ - static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) - { - server_rec *s = cmd->server; -@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy, - return NULL; - } - -+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg) -+{ -+ cgi_dirconf *dc = dummy; -+ -+ if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { -+ return "CGIScriptTimeout has wrong format"; -+ } -+ -+ return NULL; -+} -+ - static const command_rec cgi_cmds[] = - { - AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, -@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, - "the maximum length (in bytes) of the script debug log"), - AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, - "the maximum size (in bytes) to record of a POST request"), -+AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, -+ "The amount of time to wait between successful reads from " -+ "the CGI script, in seconds."), +@@ -185,64 +186,6 @@ AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_C {NULL} }; @@ -790,37 +794,7 @@ index 7e4b126c10..421124a0cb 100644 static int log_script(request_rec *r, cgi_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out, - apr_filepath_name_get(r->filename)); - } - else { -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; -+ - apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT); - - *script_in = procnew->out; - if (!*script_in) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_in, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_in, timeout); - - if (e_info->prog_type == RUN_AS_CGI) { - *script_out = procnew->in; - if (!*script_out) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_out, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_out, timeout); - - *script_err = procnew->err; - if (!*script_err) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_err, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_err, timeout); - } - } - } -@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, +@@ -563,230 +506,23 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, return APR_SUCCESS; } @@ -963,11 +937,14 @@ index 7e4b126c10..421124a0cb 100644 - apr_size_t *len, apr_read_type_e block) -{ - struct cgi_bucket_data *data = b->data; -- apr_interval_time_t timeout; +- apr_interval_time_t timeout = 0; - apr_status_t rv; - int gotdata = 0; +- cgi_dirconf *dc = ap_get_module_config(data->r->per_dir_config, &cgi_module); - -- timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout; +- if (block != APR_NONBLOCK_READ) { +- timeout = dc->timeout > 0 ? dc->timeout : data->r->server->timeout; +- } - - do { - const apr_pollfd_t *results; @@ -1048,10 +1025,10 @@ index 7e4b126c10..421124a0cb 100644 apr_status_t rv; cgi_exec_info_t e_info; - conn_rec *c; -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; + cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); + apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; - if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { +@@ -794,8 +530,6 @@ static int cgi_handler(request_rec *r) return DECLINED; } @@ -1060,7 +1037,7 @@ index 7e4b126c10..421124a0cb 100644 is_included = !strcmp(r->protocol, "INCLUDED"); p = r->main ? r->main->pool : r->pool; -@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r) +@@ -864,83 +598,24 @@ static int cgi_handler(request_rec *r) return HTTP_INTERNAL_SERVER_ERROR; } @@ -1157,7 +1134,7 @@ index 7e4b126c10..421124a0cb 100644 /* Is this flush really needed? */ apr_file_flush(script_out); apr_file_close(script_out); -@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r) +@@ -948,10 +623,7 @@ static int cgi_handler(request_rec *r) AP_DEBUG_ASSERT(script_in != NULL); #if APR_FILES_AS_SOCKETS @@ -1169,7 +1146,7 @@ index 7e4b126c10..421124a0cb 100644 if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r) +@@ -961,120 +633,7 @@ static int cgi_handler(request_rec *r) b = apr_bucket_eos_create(c->bucket_alloc); APR_BRIGADE_INSERT_TAIL(bb, b); @@ -1179,9 +1156,18 @@ index 7e4b126c10..421124a0cb 100644 - char sbuf[MAX_STRING_LEN]; - int ret; - -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { +- ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX); +- +- /* xCGI has its own body framing mechanism which we don't +- * match against any provided Content-Length, so let the +- * core determine C-L vs T-E based on what's actually sent. +- */ +- if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) +- apr_table_unset(r->headers_out, "Content-Length"); +- apr_table_unset(r->headers_out, "Transfer-Encoding"); +- +- if (ret != OK) { - ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); - - /* @@ -1220,7 +1206,7 @@ index 7e4b126c10..421124a0cb 100644 - * stderr output, as normal. */ - discard_script_output(bb); - apr_brigade_destroy(bb); -- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - @@ -1271,7 +1257,7 @@ index 7e4b126c10..421124a0cb 100644 - * connection drops or we stopped sending output for some other - * reason */ - if (rv == APR_SUCCESS && !r->connection->aborted) { -- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - @@ -1282,7 +1268,7 @@ index 7e4b126c10..421124a0cb 100644 } /*============================================================================ -@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1188,107 +747,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, return APR_SUCCESS; } @@ -1390,7 +1376,7 @@ index 7e4b126c10..421124a0cb 100644 /* This is the means by which unusual (non-unix) os's may find alternate * means to run a given command (e.g. shebang/registry parsing on Win32) */ -@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p) +@@ -1304,6 +765,7 @@ static void register_hooks(apr_pool_t *p) static const char * const aszPre[] = { "mod_include.c", NULL }; ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST); @@ -1398,18 +1384,19 @@ index 7e4b126c10..421124a0cb 100644 } AP_DECLARE_MODULE(cgi) = - { - STANDARD20_MODULE_STUFF, -- NULL, /* dir config creater */ -+ create_cgi_dirconf, /* dir config creater */ - NULL, /* dir merger --- default is to override */ - create_cgi_config, /* server config */ - merge_cgi_config, /* merge server config */ diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c -index 2258a683b7..dddfb25254 100644 +index 4bab59f932..1d55b8dc48 100644 --- a/modules/generators/mod_cgid.c +++ b/modules/generators/mod_cgid.c -@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; +@@ -57,7 +57,6 @@ + #include "http_protocol.h" + #include "http_main.h" + #include "http_log.h" +-#include "util_script.h" + #include "ap_mpm.h" + #include "mpm_common.h" + #include "mod_suexec.h" +@@ -80,11 +79,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew); static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server); @@ -1421,7 +1408,7 @@ index 2258a683b7..dddfb25254 100644 static apr_pool_t *pcgi = NULL; static pid_t daemon_pid; -@@ -220,6 +215,15 @@ typedef struct { +@@ -220,6 +214,15 @@ typedef struct { #endif } cgid_req_t; @@ -1437,7 +1424,7 @@ index 2258a683b7..dddfb25254 100644 /* This routine is called to create the argument list to be passed * to the CGI script. When suexec is enabled, the suexec path, user, and * group are the first three arguments to be passed; if not, all three -@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd) +@@ -342,15 +345,19 @@ static apr_status_t close_unix_socket(void *thefd) return close(fd); } @@ -1462,7 +1449,7 @@ index 2258a683b7..dddfb25254 100644 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) +@@ -365,9 +372,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) } } while (bytes_read < buf_size); @@ -1523,7 +1510,7 @@ index 2258a683b7..dddfb25254 100644 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) +@@ -384,7 +442,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) return APR_SUCCESS; } @@ -1532,7 +1519,7 @@ index 2258a683b7..dddfb25254 100644 { va_list ap; int rc; -@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -399,9 +457,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } va_end(ap); @@ -1572,7 +1559,7 @@ index 2258a683b7..dddfb25254 100644 if (rc < 0) { return errno; } -@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -410,7 +498,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -1581,7 +1568,7 @@ index 2258a683b7..dddfb25254 100644 { int i; char **environ; -@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -421,7 +509,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -1590,7 +1577,7 @@ index 2258a683b7..dddfb25254 100644 if (stat != APR_SUCCESS) { return stat; } -@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -431,6 +519,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } @@ -1605,7 +1592,7 @@ index 2258a683b7..dddfb25254 100644 /* handle module indexes and such */ rconf = (void **)ap_create_request_config(r->pool); -@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -479,14 +575,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } @@ -1623,7 +1610,7 @@ index 2258a683b7..dddfb25254 100644 if (ugid == NULL) { -@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -507,16 +604,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -1647,7 +1634,7 @@ index 2258a683b7..dddfb25254 100644 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -531,7 +633,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -1656,7 +1643,7 @@ index 2258a683b7..dddfb25254 100644 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig) +@@ -582,20 +684,34 @@ static void daemon_signal_handler(int sig) } } @@ -1699,7 +1686,7 @@ index 2258a683b7..dddfb25254 100644 } static int cgid_server(void *data) -@@ -670,7 +787,7 @@ static int cgid_server(void *data) +@@ -670,7 +786,7 @@ static int cgid_server(void *data) } while (!daemon_should_exit) { @@ -1708,7 +1695,7 @@ index 2258a683b7..dddfb25254 100644 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -710,7 +827,7 @@ static int cgid_server(void *data) +@@ -710,7 +826,7 @@ static int cgid_server(void *data) r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -1717,7 +1704,7 @@ index 2258a683b7..dddfb25254 100644 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -742,6 +859,16 @@ static int cgid_server(void *data) +@@ -742,6 +858,16 @@ static int cgid_server(void *data) continue; } @@ -1734,7 +1721,7 @@ index 2258a683b7..dddfb25254 100644 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -801,7 +928,10 @@ static int cgid_server(void *data) +@@ -801,7 +927,10 @@ static int cgid_server(void *data) close(sd2); } else { @@ -1746,7 +1733,7 @@ index 2258a683b7..dddfb25254 100644 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, +@@ -946,16 +1075,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, if (ret != OK ) { return ret; } @@ -1763,7 +1750,7 @@ index 2258a683b7..dddfb25254 100644 } return ret; } -@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] = +@@ -1066,41 +1185,6 @@ static const command_rec cgid_cmds[] = {NULL} }; @@ -1805,7 +1792,7 @@ index 2258a683b7..dddfb25254 100644 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1221,7 +1305,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, ++connect_tries; if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) { return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno, @@ -1814,7 +1801,7 @@ index 2258a683b7..dddfb25254 100644 } if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) { /* Save errno for later */ -@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1242,7 +1326,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, } else { close(sd); @@ -1823,7 +1810,7 @@ index 2258a683b7..dddfb25254 100644 "unable to connect to cgi daemon after multiple tries"); } } -@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1258,13 +1342,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, if (connect_errno == ENOENT && apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > DEFAULT_CONNECT_STARTUP_DELAY) { @@ -1842,7 +1829,7 @@ index 2258a683b7..dddfb25254 100644 "cgid daemon is gone; is Apache terminating?"); } } -@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1272,23 +1358,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, return OK; } @@ -1866,7 +1853,7 @@ index 2258a683b7..dddfb25254 100644 /**************************************************************** * * Actual cgid handling... -@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * +@@ -1374,7 +1443,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * return stat; } @@ -1877,7 +1864,7 @@ index 2258a683b7..dddfb25254 100644 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261) "daemon couldn't find CGI process for connection %lu", r->connection->id); -@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr) +@@ -1393,19 +1464,21 @@ static apr_status_t cleanup_script(void *vptr) static int cgid_handler(request_rec *r) { @@ -1903,7 +1890,7 @@ index 2258a683b7..dddfb25254 100644 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r) +@@ -1414,7 +1487,7 @@ static int cgid_handler(request_rec *r) conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -1912,7 +1899,7 @@ index 2258a683b7..dddfb25254 100644 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r) +@@ -1429,12 +1502,12 @@ static int cgid_handler(request_rec *r) argv0 = r->filename; if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) { @@ -1927,7 +1914,7 @@ index 2258a683b7..dddfb25254 100644 "attempt to include NPH CGI script"); } -@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r) +@@ -1443,12 +1516,12 @@ static int cgid_handler(request_rec *r) #error at mod_cgi.c for required code in this path. #else if (r->finfo.filetype == APR_NOFILE) { @@ -1942,7 +1929,7 @@ index 2258a683b7..dddfb25254 100644 "attempt to invoke directory as script"); } -@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r) +@@ -1456,7 +1529,7 @@ static int cgid_handler(request_rec *r) r->path_info && *r->path_info) { /* default to accept */ @@ -1951,7 +1938,7 @@ index 2258a683b7..dddfb25254 100644 "AcceptPathInfo off disallows user's path"); } /* -@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r) +@@ -1467,6 +1540,17 @@ static int cgid_handler(request_rec *r) } */ @@ -1969,7 +1956,7 @@ index 2258a683b7..dddfb25254 100644 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r) +@@ -1479,24 +1563,28 @@ static int cgid_handler(request_rec *r) return retval; } @@ -2005,7 +1992,7 @@ index 2258a683b7..dddfb25254 100644 } /* We are putting the socket discriptor into an apr_file_t so that we can -@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r) +@@ -1506,95 +1594,25 @@ static int cgid_handler(request_rec *r) */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -2114,7 +2101,7 @@ index 2258a683b7..dddfb25254 100644 } /* we're done writing, or maybe we didn't write at all; -@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r) +@@ -1603,134 +1621,22 @@ static int cgid_handler(request_rec *r) */ shutdown(sd, 1); @@ -2131,9 +2118,18 @@ index 2258a683b7..dddfb25254 100644 - b = apr_bucket_eos_create(c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(bb, b); - -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { +- ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX); +- +- /* xCGI has its own body framing mechanism which we don't +- * match against any provided Content-Length, so let the +- * core determine C-L vs T-E based on what's actually sent. +- */ +- if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) +- apr_table_unset(r->headers_out, "Content-Length"); +- apr_table_unset(r->headers_out, "Transfer-Encoding"); +- +- if (ret != OK) { - ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); - - /* @@ -2253,7 +2249,7 @@ index 2258a683b7..dddfb25254 100644 static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb, char *s) { -@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r) +@@ -1815,7 +1721,7 @@ static void add_ssi_vars(request_rec *r) } static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, @@ -2262,7 +2258,7 @@ index 2258a683b7..dddfb25254 100644 { char **env; int sd; -@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1836,7 +1742,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return retval; } @@ -2271,7 +2267,7 @@ index 2258a683b7..dddfb25254 100644 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; -@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1881,91 +1787,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return APR_SUCCESS; } @@ -2363,7 +2359,7 @@ index 2258a683b7..dddfb25254 100644 static void register_hook(apr_pool_t *p) { static const char * const aszPre[] = { "mod_include.c", NULL }; -@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p) +@@ -1973,6 +1794,7 @@ static void register_hook(apr_pool_t *p) ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE); ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE); diff --git a/httpd.spec b/httpd.spec index 048057d..7bb8b5a 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.58 -Release: 8%{?dist} +Version: 2.4.59 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -85,27 +85,22 @@ Patch20: httpd-2.4.48-r1842929+.patch Patch21: httpd-2.4.43-mod_systemd.patch Patch22: httpd-2.4.53-export.patch Patch23: httpd-2.4.43-corelimit.patch -Patch24: httpd-2.4.54-gettid.patch +Patch24: httpd-2.4.59-gettid.patch Patch25: httpd-2.4.54-icons.patch Patch26: httpd-2.4.43-cachehardmax.patch Patch27: httpd-2.4.43-socket-activation.patch Patch28: httpd-2.4.43-sslciphdefault.patch Patch29: httpd-2.4.43-sslprotdefault.patch -Patch30: httpd-2.4.43-r1861793+.patch -Patch31: httpd-2.4.48-r1828172+.patch +Patch31: httpd-2.4.59-unifycgid.patch Patch32: httpd-2.4.43-logjournal.patch Patch33: httpd-2.4.53-separate-systemd-fns.patch Patch34: httpd-2.4.58-r1912477+.patch -Patch35: httpd-2.4.58-r1913912+.patch Patch36: httpd-2.4.58-r1914365.patch Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.58-r1914013.patch -Patch62: httpd-2.4.46-htcacheclean-dont-break.patch -Patch63: httpd-2.4.51-r1894152.patch # Security fixes # Patch200: ... @@ -829,6 +824,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Apr 5 2024 Joe Orton - 2.4.59-1 +- update to 2.4.59 + * Thu Mar 28 2024 Joe Orton - 2.4.58-8 - rebuild to fix changelog ordering diff --git a/sources b/sources index 8ac3947..e8e92fb 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1 -SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.59.tar.bz2) = 209da0bbac5e2564d4590302515b35495be6402273ff4024aa93e85e44554c95e053201d606383936425a41e1b5b97e6b40055dcbb385eb691a5029a6f3158c2 +SHA512 (httpd-2.4.59.tar.bz2.asc) = 85237e204e57d930e2b7a85a21f8d593e81895f96350c3a345978538a536f3c0614ba89256905c0aa558880fc6fb10608b8dd7cbd026af326b1d83601c267f2d From 26cf4a8749501f156c4984ec9c4f6f17449ee09a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 15 Apr 2024 09:03:50 +0100 Subject: [PATCH 077/112] mod_ssl: add DH param handling fix (r1916863) --- httpd-2.4.59-r1916863.patch | 54 +++++++++++++++++++++++++++++++++++++ httpd.spec | 6 ++++- pullrev.sh | 4 +-- 3 files changed, 61 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.59-r1916863.patch diff --git a/httpd-2.4.59-r1916863.patch b/httpd-2.4.59-r1916863.patch new file mode 100644 index 0000000..162662c --- /dev/null +++ b/httpd-2.4.59-r1916863.patch @@ -0,0 +1,54 @@ +# ./pullrev.sh 1916863 +http://svn.apache.org/viewvc?view=revision&revision=1916863 + +Upstream-Status: in trunk, not proposed for 2.4.x + +--- httpd-2.4.59/modules/ssl/ssl_engine_init.c ++++ httpd-2.4.59/modules/ssl/ssl_engine_init.c +@@ -1416,6 +1416,7 @@ + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; + EVP_PKEY *pkey; ++ int custom_dh_done = 0; + #ifdef HAVE_ECC + EC_GROUP *ecgroup = NULL; + int curve_nid = 0; +@@ -1591,14 +1592,14 @@ + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); + if (certfile && !modssl_is_engine_id(certfile)) { +- int done = 0, num_bits = 0; ++ int num_bits = 0; + #if OPENSSL_VERSION_NUMBER < 0x30000000L + DH *dh = modssl_dh_from_file(certfile); + if (dh) { + num_bits = DH_bits(dh); + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); + DH_free(dh); +- done = 1; ++ custom_dh_done = 1; + } + #else + pkey = modssl_dh_pkey_from_file(certfile); +@@ -1608,18 +1609,18 @@ + EVP_PKEY_free(pkey); + } + else { +- done = 1; ++ custom_dh_done = 1; + } + } + #endif +- if (done) { ++ if (custom_dh_done) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", + num_bits, vhost_id, certfile); + } + } + #if !MODSSL_USE_OPENSSL_PRE_1_1_API +- else { ++ if (!custom_dh_done) { + /* If no parameter is manually configured, enable auto + * selection. */ + SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); diff --git a/httpd.spec b/httpd.spec index 7bb8b5a..864c8b7 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.59 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -101,6 +101,7 @@ Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.59-r1916863.patch # Security fixes # Patch200: ... @@ -824,6 +825,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Apr 15 2024 Joe Orton - 2.4.59-2 +- mod_ssl: add DH param handling fix (r1916863) + * Fri Apr 5 2024 Joe Orton - 2.4.59-1 - update to 2.4.59 diff --git a/pullrev.sh b/pullrev.sh index 7ace161..f21a7fb 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.58 +#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +ver=2.4.59 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From c83c1cdcee789c8f509204448b8b1f7c62295c49 Mon Sep 17 00:00:00 2001 From: Michal Srb Date: Wed, 17 Apr 2024 15:36:18 +0000 Subject: [PATCH 078/112] Fix rpminspect.yaml syntax Any entries in the upstream inspection block that contain wildcards for glob(7) specification need to be wrapped in single quotes. We are also changing the badfuncs block to allow the specific function in mod_proxy.so rather than ignoring the entire file. Thanks to David Cantrell who discovered this problem (in OSCI-6724) and proposed the fix. --- rpminspect.yaml | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 17e48d1..7696d42 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -2,20 +2,21 @@ badfuncs: # mod_proxy uses inet_ntoa (safely) for IPv4 address matching, # and APR interfaces for IPv6 addresses. - ignore: - - /usr/lib*/httpd/modules/mod_proxy.so + allowed: + /usr/lib*/httpd/modules/mod_proxy.so: + - inet_ntoa upstream: ignore: - - *.xml - - *.service - - *.socket - - *.conf - - *.sysconf - - *.tmpfiles - - README.* - - *.sysusers - - *.png - - httpd-ssl-* + - '*.xml' + - '*.service' + - '*.socket' + - '*.conf' + - '*.sysconf' + - '*.tmpfiles' + - 'README.*' + - '*.sysusers' + - '*.png' + - 'httpd-ssl-*' - config.layout - - action*.sh - - apachectl.* + - 'action*.sh' + - 'apachectl.*' From 53ecf37db77bbc8f033dfabe31590005d2c666f9 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 3 May 2024 08:59:53 +0100 Subject: [PATCH 079/112] apachectl(8): use BUG_REPORT_URL from /etc/os-release apachectl(8): fix grammar (#2278748) httpd.service.xml(8): mention ProtectSystem= setting --- apachectl.xml | 5 +++-- httpd.service.xml | 11 +++++++++-- httpd.spec | 13 +++++++++---- 3 files changed, 21 insertions(+), 8 deletions(-) diff --git a/apachectl.xml b/apachectl.xml index 34da42c..fb3a86d 100644 --- a/apachectl.xml +++ b/apachectl.xml @@ -5,6 +5,7 @@ ]>