From 2c7ae799ebf1eff410f1e2afc7ece9b9c68f3012 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 7 Jul 2020 11:57:10 +0100 Subject: [PATCH 001/147] Fix build w/o glibc 2.30. --- httpd-2.4.43-gettid.patch | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/httpd-2.4.43-gettid.patch b/httpd-2.4.43-gettid.patch index 894696a..f80b3a7 100644 --- a/httpd-2.4.43-gettid.patch +++ b/httpd-2.4.43-gettid.patch @@ -16,7 +16,7 @@ diff --git a/configure.in b/configure.in index 423d58d4b9a..60cbf7b7f81 100644 --- httpd-2.4.43/configure.in.gettid +++ httpd-2.4.43/configure.in -@@ -500,7 +500,8 @@ +@@ -478,7 +500,8 @@ timegm \ getpgid \ fopen64 \ @@ -26,7 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 ) dnl confirm that a void pointer is large enough to store a long integer -@@ -511,16 +512,19 @@ +@@ -489,16 +512,19 @@ APR_ADDTO(HTTPD_LIBS, [-lselinux]) ]) @@ -52,6 +52,15 @@ index 423d58d4b9a..60cbf7b7f81 100644 dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs --- httpd-2.4.43/server/log.c.gettid +++ httpd-2.4.43/server/log.c +@@ -55,7 +55,7 @@ + #include "ap_mpm.h" + #include "ap_listen.h" + +-#if HAVE_GETTID ++#if HAVE_SYS_GETTID + #include + #include + #endif @@ -625,14 +625,18 @@ #if APR_HAS_THREADS int result; From 2281270aa8f5ee409eb02032f3a3d1f22c99730a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 27 Aug 2020 11:26:08 +0100 Subject: [PATCH 002/147] - sanitize CFLAGS used by /usr/bin/apxs by default (#1873020) - add vendor-apxs script in libdir/httpd/build which exposes full CFLAGS - redefine _httpd_apxs RPM macro to use vendor-apxs --- httpd.spec | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index f0778fc..4ef9658 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -430,7 +430,7 @@ echo %{mmnisa} > $RPM_BUILD_ROOT%{_includedir}/httpd/.mmn mkdir -p $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd < $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs + # Remove unpackaged files rm -vf \ $RPM_BUILD_ROOT%{_libdir}/*.exp \ @@ -738,9 +755,15 @@ exit $rv %dir %{_libdir}/httpd/build %{_libdir}/httpd/build/*.mk %{_libdir}/httpd/build/*.sh +%{_libdir}/httpd/build/vendor-apxs %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Aug 27 2020 Joe Orton - 2.4.46-2 +- sanitize CFLAGS used by /usr/bin/apxs by default (#1873020) +- add vendor-apxs script in libdir/httpd/build which exposes full CFLAGS +- redefine _httpd_apxs RPM macro to use vendor-apxs + * Tue Aug 25 2020 Lubos Uhliarik - 2.4.46-1 - new version 2.4.46 - remove obsolete parts of this spec file From 7584eb0a54bc3d7e9928ac965b7bb93e7e45de50 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 27 Aug 2020 15:27:12 +0100 Subject: [PATCH 003/147] strip /usr/bin/apxs CFLAGS further --- httpd.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index 4ef9658..80133a6 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -532,7 +532,7 @@ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk # Sanitize CFLAGS in standard config_vars.mk -sed '/^CFLAGS/s,-Wall .*,-Wall,' \ +sed '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk sed 's/config_vars.mk/vendor_config_vars.mk/' \ @@ -759,9 +759,12 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Aug 27 2020 Joe Orton - 2.4.46-3 +- strip /usr/bin/apxs CFLAGS further + * Thu Aug 27 2020 Joe Orton - 2.4.46-2 - sanitize CFLAGS used by /usr/bin/apxs by default (#1873020) -- add vendor-apxs script in libdir/httpd/build which exposes full CFLAGS +- add $libdir/httpd/build/vendor-apxs which exposes full CFLAGS - redefine _httpd_apxs RPM macro to use vendor-apxs * Tue Aug 25 2020 Lubos Uhliarik - 2.4.46-1 From c8bf9e154099a01a8f30dde2e71cdb5d9fe40842 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 27 Aug 2020 18:02:26 +0100 Subject: [PATCH 004/147] use make macros (Tom Stellard) --- httpd.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index 80133a6..3d1ba7c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -333,12 +333,12 @@ export LYNX_PATH=/usr/bin/links --disable-http2 \ --disable-md \ $* -make %{?_smp_mflags} +%make_build %install rm -rf $RPM_BUILD_ROOT -make DESTDIR=$RPM_BUILD_ROOT install +%make_install # Install systemd service files mkdir -p $RPM_BUILD_ROOT%{_unitdir} @@ -759,6 +759,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Aug 27 2020 Joe Orton - 2.4.46-4 +- use make macros (Tom Stellard) + * Thu Aug 27 2020 Joe Orton - 2.4.46-3 - strip /usr/bin/apxs CFLAGS further From b2e312a36c3cb324c9692c02aed328007698b8d1 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 6 Nov 2020 13:27:22 +0000 Subject: [PATCH 005/147] add %_httpd_requires to macros --- httpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 3d1ba7c..6c2e8e6 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -435,6 +435,7 @@ cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd < - 2.4.46-5 +- add %%_httpd_requires to macros + * Thu Aug 27 2020 Joe Orton - 2.4.46-4 - use make macros (Tom Stellard) From c1307960e6ed2760d7c0f9b2871cbc6b3a555dcf Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 17 Dec 2020 10:38:29 +0000 Subject: [PATCH 006/147] move mod_lua to a subpackage Recommends: both mod_lua and mod_http2 --- httpd.spec | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index 6c2e8e6..b162123 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -104,7 +104,7 @@ Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} Requires: httpd-tools = %{version}-%{release} Requires: httpd-filesystem = %{version}-%{release} -Requires: mod_http2 +Recommends: mod_http2, mod_lua Requires(pre): httpd-filesystem Requires(preun): systemd-units Requires(postun): systemd-units @@ -169,7 +169,7 @@ Requires: sscg >= 2.2.0, /usr/bin/hostname Conflicts: openssl-libs < 1:1.0.1h-4 %description -n mod_ssl -The mod_ssl module provides strong cryptography for the Apache Web +The mod_ssl module provides strong cryptography for the Apache HTTP server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. @@ -201,6 +201,14 @@ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} The mod_session module and associated backends provide an abstract interface for storing and accessing per-user session data. +%package -n mod_lua +Summary: Lua scripting support for the Apache HTTP Server +Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} + +%description -n mod_lua +The mod_lua module allows the server to be extended with scripts +written in the Lua programming language. + %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %setup -q @@ -649,6 +657,7 @@ exit $rv %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/01-ldap.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/01-session.conf @@ -673,6 +682,7 @@ exit $rv %exclude %{_libdir}/httpd/modules/mod_proxy_html.so %exclude %{_libdir}/httpd/modules/mod_xml2enc.so %exclude %{_libdir}/httpd/modules/mod_session*.so +%exclude %{_libdir}/httpd/modules/mod_lua.so %dir %{contentdir}/error %dir %{contentdir}/error/include @@ -749,6 +759,10 @@ exit $rv %{_libdir}/httpd/modules/mod_auth_form.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/01-session.conf +%files -n mod_lua +%{_libdir}/httpd/modules/mod_lua.so +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf + %files devel %{_includedir}/httpd %{_bindir}/apxs @@ -760,6 +774,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Dec 17 2020 Joe Orton - 2.4.46-6 +- move mod_lua to a subpackage +- Recommends: both mod_lua and mod_http2 + * Fri Nov 6 2020 Joe Orton - 2.4.46-5 - add %%_httpd_requires to macros From ddb1839a16326249781b1e7eba2b3906532a16c0 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 19 Dec 2020 00:31:57 +0000 Subject: [PATCH 007/147] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- httpd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/httpd.spec b/httpd.spec index b162123..7828a0d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -177,6 +177,7 @@ Security (TLS) protocols. Summary: HTML and XML content filters for the Apache HTTP Server Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} BuildRequires: libxml2-devel +BuildRequires: make Epoch: 1 Obsoletes: mod_proxy_html < 1:2.4.1-2 From f61dfedf8a250220f23a8f50f7a8197c73e613a4 Mon Sep 17 00:00:00 2001 From: aegorenk Date: Wed, 20 Jan 2021 15:46:18 +0100 Subject: [PATCH 008/147] prevent htcacheclean from while break when first file processed --- httpd-2.4.46-htcacheclean-dont-break.patch | 13 +++++++++++++ httpd.spec | 7 ++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.46-htcacheclean-dont-break.patch diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch new file mode 100644 index 0000000..e52318a --- /dev/null +++ b/httpd-2.4.46-htcacheclean-dont-break.patch @@ -0,0 +1,13 @@ +diff --git a/support/htcacheclean.c b/support/htcacheclean.c +index 958ba6d..0a7fe3c 100644 +--- a/support/htcacheclean.c ++++ b/support/htcacheclean.c +@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round) + } + } + } +- +- break; + } + } + } diff --git a/httpd.spec b/httpd.spec index 7828a0d..dd13440 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -89,6 +89,7 @@ Patch44: httpd-2.4.46-lua-resume.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch Patch62: httpd-2.4.43-r1870095+.patch +Patch63: httpd-2.4.46-htcacheclean-dont-break.patch # Security fixes @@ -238,6 +239,7 @@ written in the Lua programming language. %patch60 -p1 -b .enable-sslv3 %patch62 -p1 -b .r1870095 +%patch63 -p1 -b .htcacheclean-dont-break # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -775,6 +777,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jan 20 2021 Artem Egorenkov - 2.4.46-7 +- prevent htcacheclean from while break when first file processed + * Thu Dec 17 2020 Joe Orton - 2.4.46-6 - move mod_lua to a subpackage - Recommends: both mod_lua and mod_http2 From 74ee2f12bd87c4ea627b907bc6e4528f64c37d9c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 13:36:50 +0000 Subject: [PATCH 009/147] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index dd13440..9c7f2b8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -777,6 +777,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 2.4.46-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Jan 20 2021 Artem Egorenkov - 2.4.46-7 - prevent htcacheclean from while break when first file processed From 74333afc91fe0d824c0135cf71b4fd5987aa3eed Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Mon, 1 Feb 2021 15:48:58 +0100 Subject: [PATCH 010/147] Resolves: #1914182 - RFE: CustomLog should be able to use journald --- httpd-2.4.43-logjournal.patch | 87 +++++++++++++++++++++++++++++++++++ httpd.spec | 7 ++- 2 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.43-logjournal.patch diff --git a/httpd-2.4.43-logjournal.patch b/httpd-2.4.43-logjournal.patch new file mode 100644 index 0000000..cfbd9dc --- /dev/null +++ b/httpd-2.4.43-logjournal.patch @@ -0,0 +1,87 @@ +diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 +index 762e773..0848d2e 100644 +--- a/modules/loggers/config.m4 ++++ b/modules/loggers/config.m4 +@@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) + APACHE_MODPATH_INIT(loggers) + + APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes) ++APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS]) ++ + APACHE_MODULE(log_debug, configurable debug logging, , , most) + APACHE_MODULE(log_forensic, forensic logging) + +diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c +index 996c09c..50a056a 100644 +--- a/modules/loggers/mod_log_config.c ++++ b/modules/loggers/mod_log_config.c +@@ -172,6 +172,10 @@ + #include + #endif + ++#ifdef HAVE_SYSTEMD ++#include ++#endif ++ + #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" + + module AP_MODULE_DECLARE_DATA log_config_module; +@@ -1638,6 +1642,25 @@ static apr_status_t ap_default_log_writer( request_rec *r, + + return rv; + } ++ ++static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, ++ int priority) ++{ ++#ifdef HAVE_SYSTEMD ++ int fd; ++ ++ fd = sd_journal_stream_fd("httpd", priority, 0); ++ if (fd < 0) return fd; ++ ++ /* This is an AF_UNIX socket fd so is more pipe-like than ++ * file-like (the fd is neither seekable or readable), and use of ++ * apr_os_pipe_put_ex() allows cleanup registration. */ ++ return apr_os_pipe_put_ex(outfd, &fd, 1, p); ++#else ++ return APR_ENOTIMPL; ++#endif ++} ++ + static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s, + const char* name) + { +@@ -1650,6 +1673,32 @@ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s, + } + return ap_piped_log_write_fd(pl); + } ++ else if (strncasecmp(name, "journald:", 9) == 0) { ++ int priority; ++ const char *err = ap_parse_log_level(name + 9, &priority); ++ apr_status_t rv; ++ apr_file_t *fd; ++ ++ if (err == NULL && priority > LOG_DEBUG) { ++ err = "TRACE level debugging not supported with journald"; ++ } ++ ++ if (err) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, APR_EBADPATH, s, ++ "invalid journald log priority name %s: %s", ++ name, err); ++ return NULL; ++ } ++ ++ rv = wrap_journal_stream(p, &fd, priority); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, ++ "could not open journald log stream"); ++ return NULL; ++ } ++ ++ return fd; ++ } + else { + const char *fname = ap_server_root_relative(p, name); + apr_file_t *fd; diff --git a/httpd.spec b/httpd.spec index 9c7f2b8..6f5ef66 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 8%{?dist} +Release: 9%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -84,6 +84,7 @@ Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.43-r1828172+.patch Patch43: httpd-2.4.43-sslcoalesce.patch Patch44: httpd-2.4.46-lua-resume.patch +Patch45: httpd-2.4.43-logjournal.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -236,6 +237,7 @@ written in the Lua programming language. %patch42 -p1 -b .r1828172+ %patch43 -p1 -b .sslcoalesce %patch44 -p1 -b .luaresume +%patch45 -p1 -b .logjournal %patch60 -p1 -b .enable-sslv3 %patch62 -p1 -b .r1870095 @@ -777,6 +779,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 +- Resolves: #1914182 - RFE: CustomLog should be able to use journald + * Tue Jan 26 2021 Fedora Release Engineering - 2.4.46-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 5bdf9e2fd6638b499b3ad993da52203458a075fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 5 Feb 2021 14:45:30 +0100 Subject: [PATCH 011/147] plan with Tier1 tests for Fedora CI --- plans/tier1.fmf | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 plans/tier1.fmf diff --git a/plans/tier1.fmf b/plans/tier1.fmf new file mode 100644 index 0000000..3aa33db --- /dev/null +++ b/plans/tier1.fmf @@ -0,0 +1,7 @@ +summary: CI plan with Tier1 beakerlib tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/httpd.git + filter: 'tier: 1' +execute: + how: tmt From 04cd38464804c14749802af2e3bb81c2b3e54cd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 5 Feb 2021 15:18:16 +0100 Subject: [PATCH 012/147] fmf metadata added --- .fmf/version | 1 + 1 file changed, 1 insertion(+) create mode 100644 .fmf/version diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 From 355f667417ebf8224fcb62d078f3f6bd7038028d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 12 Feb 2021 12:53:10 +0100 Subject: [PATCH 013/147] php test replaced with simplier smoke --- tests/httpd-php-mysql-sanity-test/PURPOSE | 3 - .../httpd-php-mysql-sanity-test/new_mysql.php | 12 --- .../httpd-php-mysql-sanity-test/old_mysql.php | 12 --- .../php_mysql_test.conf | 5 - .../php_mysql_test.sql | 6 -- tests/httpd-php-mysql-sanity-test/runtest.sh | 102 ------------------ .../Makefile | 24 ++--- tests/smoke/PURPOSE | 3 + tests/smoke/runtest.sh | 64 +++++++++++ tests/tests.yml | 2 +- 10 files changed, 79 insertions(+), 154 deletions(-) delete mode 100644 tests/httpd-php-mysql-sanity-test/PURPOSE delete mode 100644 tests/httpd-php-mysql-sanity-test/new_mysql.php delete mode 100644 tests/httpd-php-mysql-sanity-test/old_mysql.php delete mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.conf delete mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.sql delete mode 100755 tests/httpd-php-mysql-sanity-test/runtest.sh rename tests/{httpd-php-mysql-sanity-test => smoke}/Makefile (65%) create mode 100644 tests/smoke/PURPOSE create mode 100755 tests/smoke/runtest.sh diff --git a/tests/httpd-php-mysql-sanity-test/PURPOSE b/tests/httpd-php-mysql-sanity-test/PURPOSE deleted file mode 100644 index 59b3931..0000000 --- a/tests/httpd-php-mysql-sanity-test/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test -Description: test fetching data from mysqldb/mariadb through php -Author: Karel Srot diff --git a/tests/httpd-php-mysql-sanity-test/new_mysql.php b/tests/httpd-php-mysql-sanity-test/new_mysql.php deleted file mode 100644 index 6087b11..0000000 --- a/tests/httpd-php-mysql-sanity-test/new_mysql.php +++ /dev/null @@ -1,12 +0,0 @@ - diff --git a/tests/httpd-php-mysql-sanity-test/old_mysql.php b/tests/httpd-php-mysql-sanity-test/old_mysql.php deleted file mode 100644 index 8904c58..0000000 --- a/tests/httpd-php-mysql-sanity-test/old_mysql.php +++ /dev/null @@ -1,12 +0,0 @@ - diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf deleted file mode 100644 index d03c3c3..0000000 --- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf +++ /dev/null @@ -1,5 +0,0 @@ - -Alias /php_mysql_test /var/www/php_mysql_test - - - diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql deleted file mode 100644 index ad931ac..0000000 --- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql +++ /dev/null @@ -1,6 +0,0 @@ - -CREATE DATABASE php_mysql_test; -USE php_mysql_test; - -CREATE TABLE foobar (name VARCHAR(10), value INTEGER); -INSERT INTO foobar VALUES("fish", 42); diff --git a/tests/httpd-php-mysql-sanity-test/runtest.sh b/tests/httpd-php-mysql-sanity-test/runtest.sh deleted file mode 100755 index 6fa8315..0000000 --- a/tests/httpd-php-mysql-sanity-test/runtest.sh +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test -# Description: test fetching data from mysqldb/mariadb through php -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGES="${PACKAGES:-httpd}" -REQUIRES="${REQUIRES:-php $DB}" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport httpd/http" 0 "Import httpd library" - if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then - DB="mysql-server" - rlRun "rlImport mysql/basic" 0 "Import mysqld library" - SERVICE=${mysqlServiceName} - else - DB="mariadb-server" - rlRun "rlImport mariadb55/basic" 0 "Import mariadb library" - SERVICE=${mariadbServiceName} - fi - # install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7) - rlRun "rlImport php/utils" - phpPdoPhpMysqlSetup - rlAssertRpm --all - rlRun "rlServiceStart $SERVICE" 0 - rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1 - rlRun "mysql --verbose -u root < php_mysql_test.sql" - rlRun "httpStop" 0 "Stop httpd if running" - rlRun "> $httpLOGDIR/error_log" - rlRun "rm -rvf $httpROOTDIR/php_mysql_test" - rlRun "mkdir -v $httpROOTDIR/php_mysql_test" - rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/" - php_version=`rlCheckRpm php` - if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then - rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php" - else - rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php" - fi - rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf" - rlRun "chown -R apache: $httpROOTDIR/php_mysql_test" - #rlRun "restorecon $httpROOTDIR/php_mysql_test" - selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test" - rlRun "httpStart" 0 "Start httpd" - rlPhaseEnd - - rlPhaseStartTest - URL="http://localhost/php_mysql_test/" - RETVAL=0 - tries=`seq 1 10` - - for n in ${tries}; do - output=`curl -s $URL/mysql.php` - rv=$? - echo "PHP output ${n}: ${rv} x${output}y" - [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66 - done - - if [ $RETVAL -ne 0 ]; then - rlFail - else - rlPass - fi - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf" - rlRun "rm -rf $httpROOTDIR/php_mysql_test" - rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" - rlRun "rlServiceRestore ${SERVICE}" 0 - rlRun "httpStop" 0 "Stop httpd if running" - # uninstall php-mysql on rhel-6 if it was installed during setup - phpPdoPhpMysqlCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/tests/httpd-php-mysql-sanity-test/Makefile b/tests/smoke/Makefile similarity index 65% rename from tests/httpd-php-mysql-sanity-test/Makefile rename to tests/smoke/Makefile index a688236..6abde94 100644 --- a/tests/httpd-php-mysql-sanity-test/Makefile +++ b/tests/smoke/Makefile @@ -1,12 +1,12 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test -# Description: test fetching data from mysqldb/mariadb through php -# Author: Karel Srot +# Makefile of /CoreOS/httpd/Sanity/smoke +# Description: Simple check of httpd test page +# Author: Branislav Nater # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# Copyright (c) 2021 Red Hat, Inc. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms @@ -24,12 +24,12 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test +export TEST=/CoreOS/httpd/Sanity/smoke export TESTVERSION=1.0 BUILT_FILES= -FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf +FILES=$(METADATA) runtest.sh Makefile PURPOSE .PHONY: all install download clean @@ -43,25 +43,23 @@ clean: rm -f *~ $(BUILT_FILES) --include /usr/share/rhts/lib/rhts-make.include +include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile - @echo "Owner: Karel Srot " > $(METADATA) + @echo "Owner: Branislav Nater " > $(METADATA) @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: test fetching data from mysqldb/mariadb through php" >> $(METADATA) + @echo "Description: Simple check of httpd test page" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: httpd" >> $(METADATA) - @echo "Requires: httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA) + @echo "Requires: httpd mod_ssl" >> $(METADATA) @echo "RhtsRequires: library(httpd/http)" >> $(METADATA) - @echo "RhtsRequires: library(mysql/basic)" >> $(METADATA) - @echo "RhtsRequires: library(mariadb55/basic)" >> $(METADATA) - @echo "RhtsRequires: library(php/utils)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) rhts-lint $(METADATA) diff --git a/tests/smoke/PURPOSE b/tests/smoke/PURPOSE new file mode 100644 index 0000000..510e749 --- /dev/null +++ b/tests/smoke/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/httpd/Sanity/smoke +Description: Simple check of httpd +Author: Branislav Nater diff --git a/tests/smoke/runtest.sh b/tests/smoke/runtest.sh new file mode 100755 index 0000000..f65c8ba --- /dev/null +++ b/tests/smoke/runtest.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Sanity/smoke +# Description: Simple check of httpd test page +# Author: Branislav Nater +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-httpd}" +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie + rlAssertRpm --all + rlFileBackup --clean ${httpCONFDIR}/conf/ + rlFileBackup --clean ${httpCONFDIR}/conf.d/ + rlFileBackup --clean ${httpCONFDIR}/conf.modules.d/ + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun "httpStart" 0 "Start httpd" + rlRun "httpStatus" 0 "Check status" + rlRun "httpStop" 0 "Stop httpd" + + rlRun "httpSecureStart" 0 "Start httpd with ssl" + rlRun "httpInstallCa $(hostname)" 0 "Install CA" + rlRun "httpSecureStatus" 0 "Check status" + rlRun "httpRemoveCa" 0 "Remove CA" + rlRun "httpSecureStop" 0 "Stop httpd with ssl" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rlFileRestore" 0 "Restoring original configuration" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalEnd +rlJournalPrintText diff --git a/tests/tests.yml b/tests/tests.yml index e0ef0be..802bea0 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -6,7 +6,7 @@ tags: - classic tests: - - httpd-php-mysql-sanity-test + - smoke required_packages: - findutils # beakerlib needs find command - which # smoke requires which command From a2204eef190301180f6362bc8ff8f4dc4beb83ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 15 Feb 2021 13:58:24 +0100 Subject: [PATCH 014/147] Skip STI tests in favour of TMT tests (fedora-ci issue#206) --- tests/{tests.yml => ignore_tests.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/{tests.yml => ignore_tests.yml} (100%) diff --git a/tests/tests.yml b/tests/ignore_tests.yml similarity index 100% rename from tests/tests.yml rename to tests/ignore_tests.yml From 2c9507d609c091c1843286c5e039e2868d77cc33 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 23 Feb 2021 16:44:24 +0000 Subject: [PATCH 015/147] add Conflicts: with mod_nss --- httpd-2.4.43-sslmultiproxy.patch | 118 ------------------------------- httpd.spec | 9 ++- 2 files changed, 6 insertions(+), 121 deletions(-) delete mode 100644 httpd-2.4.43-sslmultiproxy.patch diff --git a/httpd-2.4.43-sslmultiproxy.patch b/httpd-2.4.43-sslmultiproxy.patch deleted file mode 100644 index 349c4ae..0000000 --- a/httpd-2.4.43-sslmultiproxy.patch +++ /dev/null @@ -1,118 +0,0 @@ -diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c -index 12617b2..0fe7464 100644 ---- a/modules/ssl/mod_ssl.c -+++ b/modules/ssl/mod_ssl.c -@@ -459,6 +459,10 @@ static int ssl_hook_pre_config(apr_pool_t *pconf, - return OK; - } - -+static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable; -+static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set; -+ -+ - static SSLConnRec *ssl_init_connection_ctx(conn_rec *c, - ap_conf_vector_t *per_dir_config, - int new_proxy) -@@ -466,6 +470,10 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c, - SSLConnRec *sslconn = myConnConfig(c); - int need_setup = 0; - -+ if (othermod_engine_disable) { -+ othermod_engine_disable(c); -+ } -+ - /* mod_proxy's (r->)per_dir_config has the lifetime of the request, thus - * it uses ssl_engine_set() to reset sslconn->dc when reusing SSL backend - * connections, so we must fall through here. But in the case where we are -@@ -544,6 +552,10 @@ static int ssl_engine_set(conn_rec *c, - { - SSLConnRec *sslconn; - int status; -+ -+ if (othermod_engine_set) { -+ return othermod_engine_set(c, per_dir_config, proxy, enable); -+ } - - if (proxy) { - sslconn = ssl_init_connection_ctx(c, per_dir_config, 1); -@@ -572,12 +584,18 @@ static int ssl_engine_set(conn_rec *c, - - static int ssl_proxy_enable(conn_rec *c) - { -- return ssl_engine_set(c, NULL, 1, 1); -+ if (othermod_engine_set) -+ return othermod_engine_set(c, NULL, 1, 1); -+ else -+ return ssl_engine_set(c, NULL, 1, 1); - } - - static int ssl_engine_disable(conn_rec *c) - { -- return ssl_engine_set(c, NULL, 0, 0); -+ if (othermod_engine_set) -+ return othermod_engine_set(c, NULL, 0, 0); -+ else -+ return ssl_engine_set(c, NULL, 0, 0); - } - - int ssl_init_ssl_connection(conn_rec *c, request_rec *r) -@@ -753,6 +771,9 @@ static void ssl_register_hooks(apr_pool_t *p) - APR_HOOK_MIDDLE); - - ssl_var_register(p); -+ -+ othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable); -+ othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set); - - APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); - APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); -diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c -index 5724f18..81c56ba 100644 ---- a/modules/ssl/ssl_engine_vars.c -+++ b/modules/ssl/ssl_engine_vars.c -@@ -54,6 +54,8 @@ static char *ssl_var_lookup_ssl_cipher(apr_pool_t *p, SSLConnRec *sslconn, char - static void ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize); - static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var); - static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl); -+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https; -+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup; - - static SSLConnRec *ssl_get_effective_config(conn_rec *c) - { -@@ -68,7 +70,9 @@ static SSLConnRec *ssl_get_effective_config(conn_rec *c) - static int ssl_is_https(conn_rec *c) - { - SSLConnRec *sslconn = ssl_get_effective_config(c); -- return sslconn && sslconn->ssl; -+ -+ return (sslconn && sslconn->ssl) -+ || (othermod_is_https && othermod_is_https(c)); - } - - static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION; -@@ -137,6 +141,9 @@ void ssl_var_register(apr_pool_t *p) - { - char *cp, *cp2; - -+ othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https); -+ othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup); -+ - APR_REGISTER_OPTIONAL_FN(ssl_is_https); - APR_REGISTER_OPTIONAL_FN(ssl_var_lookup); - APR_REGISTER_OPTIONAL_FN(ssl_ext_list); -@@ -271,6 +278,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, - */ - if (result == NULL && c != NULL) { - SSLConnRec *sslconn = ssl_get_effective_config(c); -+ -+ if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) -+ && (!sslconn || !sslconn->ssl) && othermod_var_lookup) { -+ /* For an SSL_* variable, if mod_ssl is not enabled for -+ * this connection and another SSL module is present, pass -+ * through to that module. */ -+ return othermod_var_lookup(p, s, c, r, var); -+ } -+ - if (strlen(var) > 4 && strcEQn(var, "SSL_", 4) - && sslconn && sslconn->ssl) - result = ssl_var_lookup_ssl(p, sslconn, r, var+4); diff --git a/httpd.spec b/httpd.spec index 6f5ef66..f6e5c7a 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 9%{?dist} +Release: 10%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -75,7 +75,6 @@ Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch -Patch31: httpd-2.4.43-sslmultiproxy.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch Patch39: httpd-2.4.43-sslprotdefault.patch @@ -169,6 +168,8 @@ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 +# mod_ssl/mod_nss cannot both be loaded simultaneously +Conflicts: mod_nss %description -n mod_ssl The mod_ssl module provides strong cryptography for the Apache HTTP @@ -228,7 +229,6 @@ written in the Lua programming language. %patch26 -p1 -b .gettid %patch27 -p1 -b .icons %patch30 -p1 -b .cachehardmax -#patch31 -p1 -b .sslmultiproxy %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault %patch39 -p1 -b .sslprotdefault @@ -779,6 +779,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Feb 23 2021 Joe Orton - 2.4.46-10 +- add Conflicts: with mod_nss + * Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 - Resolves: #1914182 - RFE: CustomLog should be able to use journald From 04961f16338adfe7aa842f716fc069040675cf5b Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 23 Feb 2021 16:50:29 +0000 Subject: [PATCH 016/147] drop use of apr_ldap_rebind (r1878890, #1847585) --- httpd-2.4.46-r1878890.patch | 116 ++++++++++++++++++++++++++++++++++++ httpd.spec | 3 + pullrev.sh | 2 +- 3 files changed, 120 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.46-r1878890.patch diff --git a/httpd-2.4.46-r1878890.patch b/httpd-2.4.46-r1878890.patch new file mode 100644 index 0000000..b75d53e --- /dev/null +++ b/httpd-2.4.46-r1878890.patch @@ -0,0 +1,116 @@ +# ./pullrev.sh 1878890 + +http://svn.apache.org/viewvc?view=revision&revision=1878890 + +--- httpd-2.4.46/include/util_ldap.h.r1878890 ++++ httpd-2.4.46/include/util_ldap.h +@@ -32,7 +32,6 @@ + #if APR_MAJOR_VERSION < 2 + /* The LDAP API is currently only present in APR 1.x */ + #include "apr_ldap.h" +-#include "apr_ldap_rebind.h" + #else + #define APR_HAS_LDAP 0 + #endif +--- httpd-2.4.46/modules/ldap/util_ldap.c.r1878890 ++++ httpd-2.4.46/modules/ldap/util_ldap.c +@@ -140,6 +140,38 @@ + return OK; + } + ++/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use ++ * a simpler rebind callback than the implementation in APR-util. ++ * Testing for API version >= 3001 appears safe although OpenLDAP ++ * 2.1.x (API version = 2004) also has the 3-arg API. */ ++#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001 ++ ++#define uldap_rebind_init(p) APR_SUCCESS /* noop */ ++ ++static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request, ++ ber_int_t msgid, void *params) ++{ ++ util_ldap_connection_t *ldc = params; ++ ++ return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE); ++} ++ ++static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc) ++{ ++ ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc); ++ return APR_SUCCESS; ++} ++ ++#else /* !APR_HAS_OPENLDAP_LDAPSDK */ ++ ++#define USE_APR_LDAP_REBIND ++#include ++ ++#define uldap_rebind_init(p) apr_ldap_rebind_init(p) ++#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \ ++ (ldc)->ldap, (ldc)->binddn, \ ++ (ldc)->bindpw) ++#endif + + + /* ------------------------------------------------------------------ */ +@@ -181,6 +213,13 @@ + util_ldap_connection_t *ldc = param; + + if (ldc) { ++#ifdef USE_APR_LDAP_REBIND ++ /* forget the rebind info for this conn */ ++ if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { ++ apr_pool_clear(ldc->rebind_pool); ++ } ++#endif ++ + if (ldc->ldap) { + if (ldc->r) { + ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); +@@ -189,12 +228,6 @@ + ldc->ldap = NULL; + } + ldc->bound = 0; +- +- /* forget the rebind info for this conn */ +- if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { +- apr_ldap_rebind_remove(ldc->ldap); +- apr_pool_clear(ldc->rebind_pool); +- } + } + + return APR_SUCCESS; +@@ -330,7 +363,7 @@ + + if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { + /* Now that we have an ldap struct, add it to the referral list for rebinds. */ +- rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw); ++ rc = uldap_rebind_add(ldc); + if (rc != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277) + "LDAP: Unable to add rebind cross reference entry. Out of memory?"); +@@ -855,6 +888,7 @@ + /* whether or not to keep this connection in the pool when it's returned */ + l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; + ++#ifdef USE_APR_LDAP_REBIND + if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { + if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) { + ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286) +@@ -865,6 +899,7 @@ + return NULL; + } + } ++#endif + + if (p) { + p->next = l; +@@ -3051,7 +3086,7 @@ + } + + /* Initialize the rebind callback's cross reference list. */ +- apr_ldap_rebind_init (p); ++ (void) uldap_rebind_init(p); + + #ifdef AP_LDAP_OPT_DEBUG + if (st->debug_level > 0) { diff --git a/httpd.spec b/httpd.spec index f6e5c7a..233a247 100644 --- a/httpd.spec +++ b/httpd.spec @@ -88,6 +88,7 @@ Patch45: httpd-2.4.43-logjournal.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.46-r1878890.patch Patch62: httpd-2.4.43-r1870095+.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch @@ -240,6 +241,7 @@ written in the Lua programming language. %patch45 -p1 -b .logjournal %patch60 -p1 -b .enable-sslv3 +%patch61 -p1 -b .r1878890 %patch62 -p1 -b .r1870095 %patch63 -p1 -b .htcacheclean-dont-break @@ -781,6 +783,7 @@ exit $rv %changelog * Tue Feb 23 2021 Joe Orton - 2.4.46-10 - add Conflicts: with mod_nss +- drop use of apr_ldap_rebind (r1878890, #1847585) * Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 - Resolves: #1914182 - RFE: CustomLog should be able to use journald diff --git a/pullrev.sh b/pullrev.sh index ada0076..27bbcb3 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.43 +ver=2.4.46 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From f88f49a8c6c057795e68ad001d80ff50d801822a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 25 Feb 2021 13:31:31 +0100 Subject: [PATCH 017/147] Don't run all tier1 tests --- plans/{tier1.fmf => all.fmf} | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) rename plans/{tier1.fmf => all.fmf} (60%) diff --git a/plans/tier1.fmf b/plans/all.fmf similarity index 60% rename from plans/tier1.fmf rename to plans/all.fmf index 3aa33db..e98ae64 100644 --- a/plans/tier1.fmf +++ b/plans/all.fmf @@ -1,7 +1,6 @@ -summary: CI plan with Tier1 beakerlib tests +summary: Test plan with all beakerlib tests discover: how: fmf url: https://src.fedoraproject.org/tests/httpd.git - filter: 'tier: 1' execute: how: tmt From 28153dbcc10727f155e28cc9a0865d918570e03e Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Wed, 31 Mar 2021 14:11:00 +0200 Subject: [PATCH 018/147] Resolves: #1934739 - Apache trademark update - new logo --- apache-poweredby.png | Bin 0 -> 5714 bytes httpd.spec | 12 ++++++++++-- welcome.conf | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 apache-poweredby.png diff --git a/apache-poweredby.png b/apache-poweredby.png new file mode 100644 index 0000000000000000000000000000000000000000..5663a23ad527e8983d82529485a0dc7f33230a08 GIT binary patch literal 5714 zcmV-Y7Om-tP)pF8FWQhbW?9;ba!ELWdL_~cP?peYja~^aAhuUa%Y?FJQ@H172ioj zK~#9!R9BkDPP&uK={cS0nPjHBllTy15k(W++ZY{VToSiHRlQe$;)X_9L}gbj zcX5wVBSvFP;u4JezAHgRM8ySn5djq!RB&J5pZi_vm9L5_EsA<3>3QeeBlXt%zW3jM z|9@Rve#Na@aPZq&t-hUB6eF}cX_iK(-=@(?N7*>f#!WUJ8OKfIJ{;SMa|3izcz{m# ziAJM&%jN&e)~Qpce+$s*y98+UUmC$EXM?Ia%8mD$t`Wt~4A3|Jr9d+n41dsQq!t>T zn8IGN#0h}CXxwKMnyS@Gofw#}{BD5@2?=?fEwcd(xZD@Lv_7aiMMe##UVZvnJ>ET} z7wyZ)p!FLz(zgq~qlm~Td%@hCumsG2%0tfYs$NLkz!)w`7r=GVdA9c1IgwRpp}MT zZog^p__EPS7i>}4wCOV_JNpRz@Z%!BZ)kKZ9XfQ_bdIPGqSL3(P~z|;vunqU9Z%b~ z?=byd_VaR@F>@CGd-w}Cb?ett z?u84Ky6k5fFfiN<)S{vyv-9VEGmloRTxGUz_SbW$xVV^3o;<}rz~Ss{3hvR99|KTD zSFdvL!3OXg0QdrmT>ZITU-P#@bzO~WhRq3QA2~t^!-kuF_y1xb^$G3I|1Kyf0+tJCk`_mPfPoSeq6Me&Ye3)gNMf0%O6Xa)YkoK zz;)=*;WeW=Vm2{Q!i=wG(ym>*O)oQb`j@nm{hmB^8XY`zh*ME?Y#cuZ-lqf?Kwv2E zxn;{%8aE-?^n1 zEX~XVS(Ki>hw}6DsdwLgrsMlFGbw4r$m*y*dzi}e*O$fb{%%xU%_afrI(Pm&h4vp{ z;(hrA1#Ed%@G7Vvkf8GUVEzy$5D=M}2RPrGkUWutZHt%U-UGuU%mf6^zjpmPr~GQ_ zk0%(2@2Lu&za)9F2jyFv0G7|?%a`d3CM2NGWn}Ei!x{U_GctdcFQXI(P2%?{FCS>-Dt)M6o%uZhErw$Fq@UbTp^|Vvf^zA|#Zhzz7SE zr1R%^&S(C8bm$JB7#IT837vwfGq26iflqO{j3 z(wV6$Gc9kvX6-uqB|V)}7nnLIQ8uk)Wq9$DrMA?DeejyV$>3xb^A|RsSoVw}XMxB* z%#7+yN)!W>H-z#F&>#iV_w1z|J9lwP91P$vbcU0?SD}VupM?d$B*gOkEW!i7oT8 zisP0;LWNzp#+oh$3j1#14<^uHS^T_w1s%xBGP4dUhW?^PBQ;YCBqEm@_fy=X?#*;x zRx-`4gOyWiusK9lTi7t$xoUh*r|+V?L64rjO{xbd50oYw>;N$<>!6wBH8SB{UAu<7 zsTz1w-+ANVH*Tp9=DN|n*=}@ax_ep4BsbAIHNv6$e0$xFrQFGG$!4kVZD&*mB^gu( z{SM9m{5^8i7&HH#VysltiAjc5uRcg|TLfxImq&1Th-=w47_jdr&NH)Mj89N z{O(uoR65n2ZcV7&(l%cVa<@lH+cFEaq8Rl;H@q!RG8EyXM~_ipa1WE49SXAiTh^V_ z_WItMT-u#_+3S!@|kV*n<*^?1H;(Kogwp|O%SZrV(bA3x^Kk1uD;v^?k1 zb9KXt7{;>;VBqggOQW&lCUDgSu5<7|tKMF%bQO*UHNm?YQ@iceSdUW1^R5HHdns-? z@-pUp@Jn~PJ;_}g6&3Zyph1J)WV+^`5LmJdE-@Z2S_2RSq1*su9}9y(s}=j(j-FWr zfB+QY78^EhU1HgBim%3b(2bF`cQNUEl7U!i0&tGo zqmn7^=WmU7Zxt36^Y@5|sL+Ur!HHp!gEe7cLn=840z_%PC4g|;T5eWM(DPO;C#_cB z`nghwkvF`+t5&b!u61*VfS95tcn}(w!oBuf9^^?^27A)gXwQNh2KQw*l05cYOZ3Pt ziucH8z&>T8{7Sq#541-{Mm8B38QC&CJgO6;M#1u)+{U&LDzWhi^z`Xd6L@fwnXxE& zXrzxS1E`a}Rh~2`Y6zFUM~)ulF%A5-VKd&4BfWeUA zfLe3gOr^0@oY$@2z&*y6zCQ$jEOfqWYD(P;A;RnDwRLkYNIsMoyIE z%BZowH!&ayK=P$M#Pg~x9ng+YY?bvwc!8827qj3Hbi7`DLMvT#=VU|>iL~+@B8G;r@nNyb3HoOwcd$bP2HWjVqLnRXA~LC zC=x*S;y_+3hk|W#&VJ@Q;#?O7I+v zX%zu1gC1>j->0;<>JA3|#~|MbOQ$Im$_3vov>9To(1il)sR7>J zcbfh6pj)FGY|v3ZzvDU0-=`BT>km8Gx&fW~m{DW9`gEp)FP#C9UF)7X*Uk5Br}z(b z(wHg(D2fAJDl$W#?L-z7qG^!C(1mR2elAY<>ejZbT1{qU)oMf-2i+TG9dG!->f_Dc z&&g>4AQ?4Q09k&zZT+8en$-`>Y4(A;Qvj5twhnk`zH;H-6H^{uPdaw|xXJQBrj!i; ze^CRx1Fj7{57cV>m<r@0CtvHnvDko$Y&I32IPZmk7oaHY8*vDO!hiiaZ$0!+UWNMO`q`< z&so{9aT8ZvknD4v8P&svk5JWo+wa_X*9)GlZrD5G#Oe8o_~lMv*d*rEDZ0diS4B_dT+A+f+p? z9y$tOs52*??)u@6dxRFWS7=TQNMb-{>=zoZF{8)|Aj`5`8)q{BcaRENfTI8wJ7C7d zIcw6p-CDl8Tlna4n$VJd5k4dUxld>j!GJ7NQsjOaNTKn$teSp*Qze${;1a&z0Du#n zHR6RkHxodZtS(X~2l*ZqOlsA~}P-Ken4M!$ya54O0QO%&-R6$1! zNMb-vUoQBcSRwcmsB$%~3f(f-dUR4XXfKC! zk?Z~7!2?cZGPT{jdDF}*k68Jr(PL%)*U>VtUg97Xj<9#K$(}LX0Wi@$>Z8fEqaH34 zLM|;90{1U<)z1Tvse;HTQfCCxf9Zk-A#Z|O)ulc$6Yl|U6H3VL-@ngGYuBz@Pn(%Q zk>3+_e@OK(^2A$}@*k}w+t@koFe>~XduBV|ABUH_L&}yY1%OY@8Pi@+~neN`b%S&;Q7mkEd zR3;#mnG=mD&8`j1g@1)0i#4aD_5tBRKBbp|73@w@O)+>Zj;*oD_^;$8v zR^P~p?$MgbwFl3b>@hem***Ln)dYt|^A|SvD{_e~5=bp;nNekmWCA1{J$m$r!XgG4 z-&g#wGGpiIZM?OJV<6gD2|lV$tj}oAIATB&19IsY&-hJaJY(7K7#h#U1O{xf$IvSb z$PZMdKAp5so;xzIkivKG-aYzi=Il!E){jx(v;E>(n*lX6XsAXa_HB(O*wvoNkMvA9 zGRiZa#(2gBvcI3;Z-B~xd_2Y@X5IwP*e+}dzoy>O6?<8GhcV;E^R#8uFr#%qm3^T+ z#aAa?ss@M$o+FiOBzY&bP4Y_Wl;oMX&ES<-l;k}uYJ^uJ8N3pR0Z9zVN25JsZ!sXd zsJC>bW{gno*-9or`U=W)AuuY{AZw+97nXmayG8X1Q^a&zAcp#d{xRM=Y4I@cBw|3$ zNbpX|80IychI=Z=(SR3AW~pbGxs!-u>EP)<6x zD;vY8(p-2^7CUkWp>$f$UeIr|ED0D=&)^m9Gb$<8dt_w1_lULeK8ApJZ^Pn5FGFae zcTzWlui#&gcuUApnSoH=|QWUa~@ zO7X3x!Rn+v%A|9RCe@Va9b3n+K;x47N=%)R@rG80S6x)zj2gx*%W_?0VW9p6?FP`E z06g$Hj)RU>;}u$IwY3|K7&)p^BDR%s08;`c_gE;l@b|~PHPmPH1pc@CjMoM=FubWE zc5Jnq4|(3Gq{lv_u|Q2hHkyrIGvIwI9MO~Bv;1lphEby{0f;Ug&sp+M z*cd5ivJUbYJ228`d?U4~4h7nBlnqM|`W!NBk^2Y`l~NYTcUq#emutn9@;S3S;C)>J}u!s6Bf9*P!08@tme8Z8e8wN!;SQ0k)pLH*`e|PHFG--uKlG=xchW^o+z@a?=dqyH} zA7GJL3n#(gA<=ft5rT2z1%WdX5;yC<%R*t1Pt>zC67#vB&u0(;&qYLp>tsJ`vMh#xc z0MYu3VngsSczjVZD@oFS>vTFdCXiYN=%haE9+Qk8^@-)Z;7I|WR+?!~o;)%2cd#7D z1%e;YV*fEvv>IW*JV(Lv4+x|VO~N3^>1kFDBvHY2W!4Ns ztp+?AO^_$ALU-WB+O`cUZ`Y>#DElK`dYesl;2B2VHmXMffU@-B#*G`i-yk}NpzE8w zOaUyC=9T@mz{9a0$K?upM(G}^st3l5_9ImVuvya{R{})o2Yb(lx`C!W%6)TE=Fp^rAyqJfTE1+zgzgdsdNpwkEp;zqYNm}09%o^m*cRy;vi47 zTd??RBx>BKN2a}#r?~iM?V*Oo#BqyE0huwRRaJ+X;nbV-Y71n+qZA?4ob?dzUXCRR#By33nmI=D$`5jcU7atz|ZVy zd;GkCWmi~O$W5=kd-rjMk7_CTIH*r9(#j}WE{Hj92IaI0l;}TnxZrB133NFkrYmH>*&YRDdv-}&q zYiyU}qu-bQd!rw+hReUw#)DRj2N~_*!^m)Qg5beD4zV!>UgO`@GOg~0dRr9vAyE;9 zdyH3YVL)UXvn+D8~^|S07*qoM6N<$ Ef>Uh;{Qv*} literal 0 HcmV?d00001 diff --git a/httpd.spec b/httpd.spec index 233a247..7837c37 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 10%{?dist} +Release: 11%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -60,6 +60,7 @@ Source44: httpd@.service Source45: config.layout Source46: apachectl.sh Source47: apachectl.xml +Source48: apache-poweredby.png # build/scripts patches Patch2: httpd-2.4.43-apxs.patch @@ -100,7 +101,7 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: gnupg2 -Requires: /etc/mime.types, system-logos-httpd +Requires: /etc/mime.types, system-logos-httpd >= 34.0.1 Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} @@ -270,6 +271,9 @@ if test "x${vmmn}" != "x%{mmn}"; then exit 1 fi +# A new logo which comes together with a new test page +cp %{SOURCE48} ./docs/icons/apache_pb3.png + # Provide default layout cp $RPM_SOURCE_DIR/config.layout . @@ -485,6 +489,7 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \ ln -s ../../pixmaps/poweredby.png \ $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png + # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs @@ -781,6 +786,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Mar 31 2021 Lubos Uhliarik - 2.4.46-11 +- Resolves: #1934739 - Apache trademark update - new logo + * Tue Feb 23 2021 Joe Orton - 2.4.46-10 - add Conflicts: with mod_nss - drop use of apr_ldap_rebind (r1878890, #1847585) diff --git a/welcome.conf b/welcome.conf index b279c2f..a5e221b 100644 --- a/welcome.conf +++ b/welcome.conf @@ -16,4 +16,4 @@ Alias /.noindex.html /usr/share/httpd/noindex/index.html -Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png +Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png From b4800b58926dd52e3e2a244a1c4dc8cba29b8e00 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 9 Apr 2021 09:40:47 +0100 Subject: [PATCH 019/147] use OOMPolicy=continue in httpd.service, httpd@.service (#1947475) Resolves: rhbz#1947475 --- httpd.service | 1 + httpd.service.xml | 31 +++++++++++++++++++++++++------ httpd.spec | 5 ++++- httpd@.service | 1 + 4 files changed, 31 insertions(+), 7 deletions(-) diff --git a/httpd.service b/httpd.service index 6ff4e8b..c5b5e08 100644 --- a/httpd.service +++ b/httpd.service @@ -27,6 +27,7 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful KillSignal=SIGWINCH KillMode=mixed PrivateTmp=true +OOMPolicy=continue [Install] WantedBy=multi-user.target diff --git a/httpd.service.xml b/httpd.service.xml index 243ce1e..c6bf865 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -225,15 +225,34 @@ Wants=network-online.target types. See httpd_selinux8 for more information. + - The httpd service enables PrivateTmp - by default. The /tmp and - /var/tmp directories available within the - httpd process (and CGI scripts, etc) are not shared by other - processes. See + + Process policies and restrictions + + The httpd service uses the following options: + + + PrivateTmp is enabled by + default. The /tmp and + /var/tmp directories available within the + httpd process (and CGI scripts, etc) are not shared by other + processes. + + OOMPolicy is set to + continue by default. Under the default + Out-of-Memory policy, the entire service will be terminated if + any process is killed by the kernel OOM killer. By setting + the policy to continue, httpd will + continue to run (and recover) if a single child is terminated + because of excess memory consumption. + + + See systemd.exec5 + and + systemd.service5 for more information. - diff --git a/httpd.spec b/httpd.spec index 7837c37..df03cee 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 11%{?dist} +Release: 12%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -786,6 +786,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Apr 9 2021 Joe Orton - 2.4.46-12 +- use OOMPolicy=continue in httpd.service, httpd@.service (#1947475) + * Wed Mar 31 2021 Lubos Uhliarik - 2.4.46-11 - Resolves: #1934739 - Apache trademark update - new logo diff --git a/httpd@.service b/httpd@.service index 7649dff..84424fb 100644 --- a/httpd@.service +++ b/httpd@.service @@ -20,6 +20,7 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf KillSignal=SIGWINCH KillMode=mixed PrivateTmp=true +OOMPolicy=continue [Install] WantedBy=multi-user.target From 8bb6632217f7d76ec777cbe805057d6d9c2b2fb1 Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Mon, 3 May 2021 12:36:09 +0200 Subject: [PATCH 020/147] Related: #1934739 - Apache trademark update - new logo --- httpd.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index df03cee..06d743d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 12%{?dist} +Release: 13%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -101,7 +101,7 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: gnupg2 -Requires: /etc/mime.types, system-logos-httpd >= 34.0.1 +Requires: /etc/mime.types, system-logos(httpd-logo-ng) Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} @@ -460,7 +460,7 @@ EOF # Handle contentdir mkdir $RPM_BUILD_ROOT%{contentdir}/noindex \ $RPM_BUILD_ROOT%{contentdir}/server-status -ln -s ../../fedora-testpage/index.html \ +ln -s ../../testpage/index.html \ $RPM_BUILD_ROOT%{contentdir}/noindex/index.html install -m 644 -p docs/server-status/* \ $RPM_BUILD_ROOT%{contentdir}/server-status @@ -786,6 +786,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon May 03 2021 Lubos Uhliarik - 2.4.46-13 +- Related: #1934739 - Apache trademark update - new logo + * Fri Apr 9 2021 Joe Orton - 2.4.46-12 - use OOMPolicy=continue in httpd.service, httpd@.service (#1947475) From cd47f2b89285e14cc949ed2634f150774e6a16dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 2 Jun 2021 13:49:32 +0200 Subject: [PATCH 021/147] new version 2.4.48 Resolves: #1964746 - httpd-2.4.48 is available --- .gitignore | 1 + httpd-2.4.43-r1870095+.patch | 115 ----------- httpd-2.4.43-sslcoalesce.patch | 192 ------------------ httpd-2.4.46-lua-resume.patch | 119 ----------- ...-export.patch => httpd-2.4.48-export.patch | 6 +- ...929+.patch => httpd-2.4.48-r1842929+.patch | 27 +-- ...78890.patch => httpd-2.4.48-r1878890.patch | 32 +-- httpd.spec | 20 +- sources | 6 +- 9 files changed, 46 insertions(+), 472 deletions(-) delete mode 100644 httpd-2.4.43-r1870095+.patch delete mode 100644 httpd-2.4.43-sslcoalesce.patch delete mode 100644 httpd-2.4.46-lua-resume.patch rename httpd-2.4.43-export.patch => httpd-2.4.48-export.patch (93%) rename httpd-2.4.43-r1842929+.patch => httpd-2.4.48-r1842929+.patch (91%) rename httpd-2.4.46-r1878890.patch => httpd-2.4.48-r1878890.patch (80%) diff --git a/.gitignore b/.gitignore index 09a5a07..ea4148c 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ x86_64 /httpd-2.4.43.tar.bz2.asc /KEYS /httpd-2.4.46.tar.bz2.asc +/httpd-2.4.48.tar.bz2.asc diff --git a/httpd-2.4.43-r1870095+.patch b/httpd-2.4.43-r1870095+.patch deleted file mode 100644 index 3fc8dfb..0000000 --- a/httpd-2.4.43-r1870095+.patch +++ /dev/null @@ -1,115 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index cbab6a3..765aa4b 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -114,6 +114,45 @@ static int has_buffered_data(request_rec *r) - return result; - } - -+/* If a renegotiation is required for the location, and the request -+ * includes a message body (and the client has not requested a "100 -+ * Continue" response), then the client will be streaming the request -+ * body over the wire already. In that case, it is not possible to -+ * stop and perform a new SSL handshake immediately; once the SSL -+ * library moves to the "accept" state, it will reject the SSL packets -+ * which the client is sending for the request body. -+ * -+ * To allow authentication to complete in the hook, the solution used -+ * here is to fill a (bounded) buffer with the request body, and then -+ * to reinject that request body later. -+ * -+ * This function is called to fill the renegotiation buffer for the -+ * location as required, or fail. Returns zero on success or HTTP_ -+ * error code on failure. -+ */ -+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc) -+{ -+ int rv; -+ apr_size_t rsize; -+ -+ /* ### this is HTTP/1.1 specific, special case for protocol? */ -+ if (r->expecting_100 || !ap_request_has_body(r)) { -+ return 0; -+ } -+ -+ rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize; -+ if (rsize > 0) { -+ /* Fill the I/O buffer with the request body if possible. */ -+ rv = ssl_io_buffer_fill(r, rsize); -+ } -+ else { -+ /* If the reneg buffer size is set to zero, just fail. */ -+ rv = HTTP_REQUEST_ENTITY_TOO_LARGE; -+ } -+ -+ return rv; -+} -+ - #ifdef HAVE_TLSEXT - static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2) - { -@@ -814,41 +853,14 @@ static int ssl_hook_Access_classic(request_rec *r, SSLSrvConfigRec *sc, SSLDirCo - } - } - -- /* If a renegotiation is now required for this location, and the -- * request includes a message body (and the client has not -- * requested a "100 Continue" response), then the client will be -- * streaming the request body over the wire already. In that -- * case, it is not possible to stop and perform a new SSL -- * handshake immediately; once the SSL library moves to the -- * "accept" state, it will reject the SSL packets which the client -- * is sending for the request body. -- * -- * To allow authentication to complete in this auth hook, the -- * solution used here is to fill a (bounded) buffer with the -- * request body, and then to reinject that request body later. -- */ -- if (renegotiate && !renegotiate_quick -- && !r->expecting_100 -- && ap_request_has_body(r)) { -- int rv; -- apr_size_t rsize; -- -- rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : -- dc->nRenegBufferSize; -- if (rsize > 0) { -- /* Fill the I/O buffer with the request body if possible. */ -- rv = ssl_io_buffer_fill(r, rsize); -- } -- else { -- /* If the reneg buffer size is set to zero, just fail. */ -- rv = HTTP_REQUEST_ENTITY_TOO_LARGE; -- } -- -- if (rv) { -+ /* Fill reneg buffer if required. */ -+ if (renegotiate && !renegotiate_quick) { -+ rc = fill_reneg_buffer(r, dc); -+ if (rc) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257) - "could not buffer message body to allow " - "SSL renegotiation to proceed"); -- return rv; -+ return rc; - } - } - -@@ -1132,6 +1144,17 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon - } - } - -+ /* Fill reneg buffer if required. */ -+ if (change_vmode) { -+ rc = fill_reneg_buffer(r, dc); -+ if (rc) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228) -+ "could not buffer message body to allow " -+ "TLS Post-Handshake Authentication to proceed"); -+ return rc; -+ } -+ } -+ - if (change_vmode) { - char peekbuf[1]; - diff --git a/httpd-2.4.43-sslcoalesce.patch b/httpd-2.4.43-sslcoalesce.patch deleted file mode 100644 index ef1f728..0000000 --- a/httpd-2.4.43-sslcoalesce.patch +++ /dev/null @@ -1,192 +0,0 @@ - -http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1836237&r2=1836236&pathrev=1836237&view=patch -http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_io.c?r1=1873985&r2=1876037&view=patch - ---- httpd-2.4.43/modules/ssl/ssl_engine_io.c.sslcoalesce -+++ httpd-2.4.43/modules/ssl/ssl_engine_io.c -@@ -1585,18 +1585,32 @@ - } - - --/* ssl_io_filter_output() produces one SSL/TLS message per bucket -+/* ssl_io_filter_output() produces one SSL/TLS record per bucket - * passed down the output filter stack. This results in a high -- * overhead (network packets) for any output comprising many small -- * buckets. SSI page applied through the HTTP chunk filter, for -- * example, may produce many brigades containing small buckets - -- * [chunk-size CRLF] [chunk-data] [CRLF]. -+ * overhead (more network packets & TLS processing) for any output -+ * comprising many small buckets. SSI output passed through the HTTP -+ * chunk filter, for example, may produce many brigades containing -+ * small buckets - [chunk-size CRLF] [chunk-data] [CRLF]. - * -- * The coalescing filter merges many small buckets into larger buckets -- * where possible, allowing the SSL I/O output filter to handle them -- * more efficiently. */ -+ * Sending HTTP response headers as a separate TLS record to the -+ * response body also reveals information to a network observer (the -+ * size of headers) which can be significant. -+ * -+ * The coalescing filter merges data buckets with the aim of producing -+ * fewer, larger TLS records - without copying/buffering all content -+ * and introducing unnecessary overhead. -+ * -+ * ### This buffering could be probably be done more comprehensively -+ * ### in ssl_io_filter_output itself. -+ * -+ * ### Another possible performance optimisation in particular for the -+ * ### [HEAP] [FILE] HTTP response case is using a brigade rather than -+ * ### a char array to buffer; using apr_brigade_write() to append -+ * ### will use already-allocated memory from the HEAP, reducing # of -+ * ### copies. -+ */ - --#define COALESCE_BYTES (2048) -+#define COALESCE_BYTES (AP_IOBUFSIZE) - - struct coalesce_ctx { - char buffer[COALESCE_BYTES]; -@@ -1609,11 +1623,12 @@ - apr_bucket *e, *upto; - apr_size_t bytes = 0; - struct coalesce_ctx *ctx = f->ctx; -+ apr_size_t buffered = ctx ? ctx->bytes : 0; /* space used on entry */ - unsigned count = 0; - - /* The brigade consists of zero-or-more small data buckets which -- * can be coalesced (the prefix), followed by the remainder of the -- * brigade. -+ * can be coalesced (referred to as the "prefix"), followed by the -+ * remainder of the brigade. - * - * Find the last bucket - if any - of that prefix. count gives - * the number of buckets in the prefix. The "prefix" must contain -@@ -1628,24 +1643,97 @@ - e != APR_BRIGADE_SENTINEL(bb) - && !APR_BUCKET_IS_METADATA(e) - && e->length != (apr_size_t)-1 -- && e->length < COALESCE_BYTES -- && (bytes + e->length) < COALESCE_BYTES -- && (ctx == NULL -- || bytes + ctx->bytes + e->length < COALESCE_BYTES); -+ && e->length <= COALESCE_BYTES -+ && (buffered + bytes + e->length) <= COALESCE_BYTES; - e = APR_BUCKET_NEXT(e)) { -- if (e->length) count++; /* don't count zero-length buckets */ -- bytes += e->length; -+ /* don't count zero-length buckets */ -+ if (e->length) { -+ bytes += e->length; -+ count++; -+ } - } -+ -+ /* If there is room remaining and the next bucket is a data -+ * bucket, try to include it in the prefix to coalesce. For a -+ * typical [HEAP] [FILE] HTTP response brigade, this handles -+ * merging the headers and the start of the body into a single TLS -+ * record. */ -+ if (bytes + buffered > 0 -+ && bytes + buffered < COALESCE_BYTES -+ && e != APR_BRIGADE_SENTINEL(bb) -+ && !APR_BUCKET_IS_METADATA(e)) { -+ apr_status_t rv = APR_SUCCESS; -+ -+ /* For an indeterminate length bucket (PIPE/CGI/...), try a -+ * non-blocking read to have it morph into a HEAP. If the -+ * read fails with EAGAIN, it is harmless to try a split -+ * anyway, split is ENOTIMPL for most PIPE-like buckets. */ -+ if (e->length == (apr_size_t)-1) { -+ const char *discard; -+ apr_size_t ignore; -+ -+ rv = apr_bucket_read(e, &discard, &ignore, APR_NONBLOCK_READ); -+ if (rv != APR_SUCCESS && !APR_STATUS_IS_EAGAIN(rv)) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10232) -+ "coalesce failed to read from %s bucket", -+ e->type->name); -+ return AP_FILTER_ERROR; -+ } -+ } -+ -+ if (rv == APR_SUCCESS) { -+ /* If the read above made the bucket morph, it may now fit -+ * entirely within the buffer. Otherwise, split it so it does -+ * fit. */ -+ if (e->length > COALESCE_BYTES -+ || e->length + buffered + bytes > COALESCE_BYTES) { -+ rv = apr_bucket_split(e, COALESCE_BYTES - (buffered + bytes)); -+ } -+ -+ if (rv == APR_SUCCESS && e->length == 0) { -+ /* As above, don't count in the prefix if the bucket is -+ * now zero-length. */ -+ } -+ else if (rv == APR_SUCCESS) { -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c, -+ "coalesce: adding %" APR_SIZE_T_FMT " bytes " -+ "from split %s bucket, total %" APR_SIZE_T_FMT, -+ e->length, e->type->name, bytes + buffered); -+ -+ count++; -+ bytes += e->length; -+ e = APR_BUCKET_NEXT(e); -+ } -+ else if (rv != APR_ENOTIMPL) { -+ ap_log_cerror(APLOG_MARK, APLOG_ERR, rv, f->c, APLOGNO(10233) -+ "coalesce: failed to split data bucket"); -+ return AP_FILTER_ERROR; -+ } -+ } -+ } -+ - upto = e; - -- /* Coalesce the prefix, if: -- * a) more than one bucket is found to coalesce, or -- * b) the brigade contains only a single data bucket, or -- * c) the data bucket is not last but we have buffered data already. -+ /* Coalesce the prefix, if any of the following are true: -+ * -+ * a) the prefix is more than one bucket -+ * OR -+ * b) the prefix is the entire brigade, which is a single bucket -+ * AND the prefix length is smaller than the buffer size, -+ * OR -+ * c) the prefix is a single bucket -+ * AND there is buffered data from a previous pass. -+ * -+ * The aim with (b) is to buffer a small bucket so it can be -+ * coalesced with future invocations of this filter. e.g. three -+ * calls each with a single 100 byte HEAP bucket should get -+ * coalesced together. But an invocation with a 8192 byte HEAP -+ * should pass through untouched. - */ - if (bytes > 0 - && (count > 1 -- || (upto == APR_BRIGADE_SENTINEL(bb)) -+ || (upto == APR_BRIGADE_SENTINEL(bb) -+ && bytes < COALESCE_BYTES) - || (ctx && ctx->bytes > 0))) { - /* If coalescing some bytes, ensure a context has been - * created. */ -@@ -1656,7 +1744,8 @@ - - ap_log_cerror(APLOG_MARK, APLOG_TRACE4, 0, f->c, - "coalesce: have %" APR_SIZE_T_FMT " bytes, " -- "adding %" APR_SIZE_T_FMT " more", ctx->bytes, bytes); -+ "adding %" APR_SIZE_T_FMT " more (buckets=%u)", -+ ctx->bytes, bytes, count); - - /* Iterate through the prefix segment. For non-fatal errors - * in this loop it is safe to break out and fall back to the -@@ -1671,7 +1760,8 @@ - if (APR_BUCKET_IS_METADATA(e) - || e->length == (apr_size_t)-1) { - ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(02012) -- "unexpected bucket type during coalesce"); -+ "unexpected %s bucket during coalesce", -+ e->type->name); - break; /* non-fatal error; break out */ - } - diff --git a/httpd-2.4.46-lua-resume.patch b/httpd-2.4.46-lua-resume.patch deleted file mode 100644 index 1a22008..0000000 --- a/httpd-2.4.46-lua-resume.patch +++ /dev/null @@ -1,119 +0,0 @@ -diff --git a/modules/lua/config.m4 b/modules/lua/config.m4 -index 29fd563..abeba1c 100644 ---- a/modules/lua/config.m4 -+++ b/modules/lua/config.m4 -@@ -34,7 +34,7 @@ AC_DEFUN([CHECK_LUA_PATH], [dnl - fi - ]) - --dnl Check for Lua 5.3/5.2/5.1 Libraries -+dnl Check for Lua Libraries - dnl CHECK_LUA(ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND]) - dnl Sets: - dnl LUA_CFLAGS -@@ -44,7 +44,7 @@ AC_DEFUN([CHECK_LUA], - - AC_ARG_WITH( - lua, -- [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua 5.3/5.2/5.1 prefix])], -+ [AC_HELP_STRING([--with-lua=PATH],[Path to the Lua installation prefix])], - lua_path="$withval", - :) - -diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c -index 05f1e44..18b628c 100644 ---- a/modules/lua/mod_lua.c -+++ b/modules/lua/mod_lua.c -@@ -342,7 +342,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil - { - apr_pool_t *pool; - ap_lua_vm_spec *spec; -- int n, rc; -+ int n, rc, nres; - lua_State *L; - lua_filter_ctx *ctx; - ap_lua_server_cfg *server_cfg = ap_get_module_config(r->server->module_config, -@@ -410,7 +410,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil - /* If a Lua filter is interested in filtering a request, it must first do a yield, - * otherwise we'll assume that it's not interested and pretend we didn't find it. - */ -- rc = lua_resume(L, 1); -+ rc = lua_resume(L, 1, &nres); - if (rc == LUA_YIELD) { - if (f->frec->providers == NULL) { - /* Not wired by mod_filter */ -@@ -432,7 +432,7 @@ static apr_status_t lua_setup_filter_ctx(ap_filter_t* f, request_rec* r, lua_fil - static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade *pbbIn) - { - request_rec *r = f->r; -- int rc; -+ int rc, nres; - lua_State *L; - lua_filter_ctx* ctx; - conn_rec *c = r->connection; -@@ -492,7 +492,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade - lua_setglobal(L, "bucket"); - - /* If Lua yielded, it means we have something to pass on */ -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); - if (olen > 0) { -@@ -524,7 +524,7 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade - apr_bucket *pbktEOS; - lua_pushnil(L); - lua_setglobal(L, "bucket"); -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - apr_bucket *pbktOut; - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); -@@ -558,7 +558,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f, - apr_off_t nBytes) - { - request_rec *r = f->r; -- int rc, lastCall = 0; -+ int rc, lastCall = 0, nres; - lua_State *L; - lua_filter_ctx* ctx; - conn_rec *c = r->connection; -@@ -621,7 +621,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f, - lua_setglobal(L, "bucket"); - - /* If Lua yielded, it means we have something to pass on */ -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); - pbktOut = apr_bucket_heap_create(output, olen, 0, c->bucket_alloc); -@@ -643,7 +643,7 @@ static apr_status_t lua_input_filter_handle(ap_filter_t *f, - apr_bucket *pbktEOS = apr_bucket_eos_create(c->bucket_alloc); - lua_pushnil(L); - lua_setglobal(L, "bucket"); -- if (lua_resume(L, 0) == LUA_YIELD) { -+ if (lua_resume(L, 0, &nres) == LUA_YIELD && nres == 1) { - apr_bucket *pbktOut; - size_t olen; - const char* output = lua_tolstring(L, 1, &olen); -diff --git a/modules/lua/mod_lua.h b/modules/lua/mod_lua.h -index 0e49cdc..72b4de7 100644 ---- a/modules/lua/mod_lua.h -+++ b/modules/lua/mod_lua.h -@@ -48,7 +48,15 @@ - #if LUA_VERSION_NUM > 501 - /* Load mode for lua_load() */ - #define lua_load(a,b,c,d) lua_load(a,b,c,d,NULL) --#define lua_resume(a,b) lua_resume(a, NULL, b) -+ -+#if LUA_VERSION_NUM > 503 -+#define lua_resume(a,b,c) lua_resume(a, NULL, b, c) -+#else -+/* ### For version < 5.4, assume that exactly one stack item is on the -+ * stack, which is what the code did before but seems dubious. */ -+#define lua_resume(a,b,c) (*(c) = 1, lua_resume(a, NULL, b)) -+#endif -+ - #define luaL_setfuncs_compat(a,b) luaL_setfuncs(a,b,0) - #else - #define lua_rawlen(L,i) lua_objlen(L, (i)) diff --git a/httpd-2.4.43-export.patch b/httpd-2.4.48-export.patch similarity index 93% rename from httpd-2.4.43-export.patch rename to httpd-2.4.48-export.patch index 0d9fd72..439f768 100644 --- a/httpd-2.4.43-export.patch +++ b/httpd-2.4.48-export.patch @@ -6,7 +6,7 @@ to do so indirectly. Upstream: https://svn.apache.org/r1861685 (as new default-off configure option) diff --git a/Makefile.in b/Makefile.in -index 9eeb5c7..8746a10 100644 +index 40c7076..ac98e5f 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test @@ -27,7 +27,7 @@ index 9eeb5c7..8746a10 100644 server/libmain.la \ $(BUILTIN_LIBS) \ diff --git a/server/Makefile.in b/server/Makefile.in -index 1fa3344..116850b 100644 +index 8111877..f00bb3f 100644 --- a/server/Makefile.in +++ b/server/Makefile.in @@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \ @@ -36,7 +36,7 @@ index 1fa3344..116850b 100644 util_charset.c util_cookies.c util_debug.c util_xml.c \ - util_filter.c util_pcre.c util_regex.c exports.c \ + util_filter.c util_pcre.c util_regex.c \ - scoreboard.c error_bucket.c protocol.c core.c request.c provider.c \ + scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \ eoc_bucket.c eor_bucket.c core_filters.c \ util_expr_parse.c util_expr_scan.c util_expr_eval.c diff --git a/server/main.c b/server/main.c diff --git a/httpd-2.4.43-r1842929+.patch b/httpd-2.4.48-r1842929+.patch similarity index 91% rename from httpd-2.4.43-r1842929+.patch rename to httpd-2.4.48-r1842929+.patch index b926195..f83a21d 100644 --- a/httpd-2.4.43-r1842929+.patch +++ b/httpd-2.4.48-r1842929+.patch @@ -1,8 +1,8 @@ diff --git a/Makefile.in b/Makefile.in -index 06b8c5a..9eeb5c7 100644 +index 6747aea..40c7076 100644 --- a/Makefile.in +++ b/Makefile.in -@@ -213,6 +213,7 @@ install-cgi: +@@ -233,6 +233,7 @@ install-cgi: install-other: @test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir) @test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir) @@ -11,7 +11,7 @@ index 06b8c5a..9eeb5c7 100644 file=apachecore.$$ext; \ if test -f $$file; then \ diff --git a/acinclude.m4 b/acinclude.m4 -index 95232f5..5d9d669 100644 +index b6ef442..98f1441 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[ @@ -22,7 +22,7 @@ index 95232f5..5d9d669 100644 APACHE_SUBST(other_targets) APACHE_SUBST(progname) APACHE_SUBST(prefix) -@@ -688,6 +689,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ +@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[ APACHE_SUBST_EXPANDED_ARG(runtimedir) APACHE_SUBST_EXPANDED_ARG(logfiledir) APACHE_SUBST_EXPANDED_ARG(proxycachedir) @@ -31,7 +31,7 @@ index 95232f5..5d9d669 100644 dnl diff --git a/configure.in b/configure.in -index a63eada..c8f9aa2 100644 +index 37346b2..f303784 100644 --- a/configure.in +++ b/configure.in @@ -41,7 +41,7 @@ dnl Something seems broken here. @@ -56,7 +56,7 @@ index 2b4a70c..e076f41 100644 #endif /* AP_CONFIG_LAYOUT_H */ diff --git a/include/http_config.h b/include/http_config.h -index f9c2d77..c229bc9 100644 +index 77657ae..384a90f 100644 --- a/include/http_config.h +++ b/include/http_config.h @@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname); @@ -124,10 +124,10 @@ index addfd7e..2389f8f 100644 APR_HOOK_MIDDLE); dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); diff --git a/server/core.c b/server/core.c -index 3db9d61..79b2a82 100644 +index d135764..c2176b9 100644 --- a/server/core.c +++ b/server/core.c -@@ -129,6 +129,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; +@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP; AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN; AP_DECLARE_DATA int ap_config_generation = 0; @@ -136,7 +136,7 @@ index 3db9d61..79b2a82 100644 static void *create_core_dir_config(apr_pool_t *a, char *dir) { core_dir_config *conf; -@@ -1409,12 +1411,15 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) +@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word) return res_buf; } @@ -147,6 +147,7 @@ index 3db9d61..79b2a82 100644 ap_server_config_defines = saved_server_config_defines; saved_server_config_defines = NULL; server_config_defined_vars = NULL; + ap_runtime_dir = NULL; - return OK; + core_state_dir = NULL; + @@ -154,7 +155,7 @@ index 3db9d61..79b2a82 100644 } /* -@@ -3120,6 +3125,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) +@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg) return NULL; } @@ -179,7 +180,7 @@ index 3db9d61..79b2a82 100644 static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg) { const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT); -@@ -4414,6 +4437,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, +@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ, "Common directory of server-related files (logs, confs, etc.)"), AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ, "Common directory for run-time files (shared memory, locks, etc.)"), @@ -188,7 +189,7 @@ index 3db9d61..79b2a82 100644 AP_INIT_TAKE1("ErrorLog", set_server_string_slot, (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF, "The filename of the error log"), -@@ -4941,8 +4966,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem +@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem if (!saved_server_config_defines) init_config_defines(pconf); @@ -198,7 +199,7 @@ index 3db9d61..79b2a82 100644 ap_regcomp_set_default_cflags(AP_REG_DEFAULT); -@@ -5170,6 +5194,27 @@ AP_DECLARE(int) ap_state_query(int query) +@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query) } } diff --git a/httpd-2.4.46-r1878890.patch b/httpd-2.4.48-r1878890.patch similarity index 80% rename from httpd-2.4.46-r1878890.patch rename to httpd-2.4.48-r1878890.patch index b75d53e..7f8ca57 100644 --- a/httpd-2.4.46-r1878890.patch +++ b/httpd-2.4.48-r1878890.patch @@ -1,9 +1,7 @@ -# ./pullrev.sh 1878890 - -http://svn.apache.org/viewvc?view=revision&revision=1878890 - ---- httpd-2.4.46/include/util_ldap.h.r1878890 -+++ httpd-2.4.46/include/util_ldap.h +diff --git a/include/util_ldap.h b/include/util_ldap.h +index 28e0760..edb8a81 100644 +--- a/include/util_ldap.h ++++ b/include/util_ldap.h @@ -32,7 +32,6 @@ #if APR_MAJOR_VERSION < 2 /* The LDAP API is currently only present in APR 1.x */ @@ -12,9 +10,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890 #else #define APR_HAS_LDAP 0 #endif ---- httpd-2.4.46/modules/ldap/util_ldap.c.r1878890 -+++ httpd-2.4.46/modules/ldap/util_ldap.c -@@ -140,6 +140,38 @@ +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index 120f268..a5f7995 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r) return OK; } @@ -53,7 +53,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890 /* ------------------------------------------------------------------ */ -@@ -181,6 +213,13 @@ +@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param) util_ldap_connection_t *ldc = param; if (ldc) { @@ -67,7 +67,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890 if (ldc->ldap) { if (ldc->r) { ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); -@@ -189,12 +228,6 @@ +@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param) ldc->ldap = NULL; } ldc->bound = 0; @@ -80,7 +80,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890 } return APR_SUCCESS; -@@ -330,7 +363,7 @@ +@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r, if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { /* Now that we have an ldap struct, add it to the referral list for rebinds. */ @@ -89,7 +89,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890 if (rc != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277) "LDAP: Unable to add rebind cross reference entry. Out of memory?"); -@@ -855,6 +888,7 @@ +@@ -856,6 +889,7 @@ static util_ldap_connection_t * /* whether or not to keep this connection in the pool when it's returned */ l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; @@ -97,15 +97,15 @@ http://svn.apache.org/viewvc?view=revision&revision=1878890 if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) { ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286) -@@ -865,6 +899,7 @@ - return NULL; +@@ -867,6 +901,7 @@ static util_ldap_connection_t * } + apr_pool_tag(l->rebind_pool, "util_ldap_rebind"); } +#endif if (p) { p->next = l; -@@ -3051,7 +3086,7 @@ +@@ -3054,7 +3089,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog, } /* Initialize the rebind callback's cross reference list. */ diff --git a/httpd.spec b/httpd.spec index 06d743d..17d0745 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.46 -Release: 13%{?dist} +Version: 2.4.48 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -68,9 +68,9 @@ Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch Patch19: httpd-2.4.43-detect-systemd.patch # Features/functional changes -Patch21: httpd-2.4.43-r1842929+.patch +Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.43-export.patch +Patch23: httpd-2.4.48-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch @@ -82,15 +82,12 @@ Patch39: httpd-2.4.43-sslprotdefault.patch Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.43-r1828172+.patch -Patch43: httpd-2.4.43-sslcoalesce.patch -Patch44: httpd-2.4.46-lua-resume.patch Patch45: httpd-2.4.43-logjournal.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.46-r1878890.patch -Patch62: httpd-2.4.43-r1870095+.patch +Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch # Security fixes @@ -237,13 +234,10 @@ written in the Lua programming language. %patch40 -p1 -b .r1861269 %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ -%patch43 -p1 -b .sslcoalesce -%patch44 -p1 -b .luaresume %patch45 -p1 -b .logjournal %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 -%patch62 -p1 -b .r1870095 %patch63 -p1 -b .htcacheclean-dont-break # Patch in the vendor string @@ -786,6 +780,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jun 02 2021 Luboš Uhliarik - 2.4.48-1 +- new version 2.4.48 +- Resolves: #1964746 - httpd-2.4.48 is available + * Mon May 03 2021 Lubos Uhliarik - 2.4.46-13 - Related: #1934739 - Apache trademark update - new logo diff --git a/sources b/sources index a7871fb..5e6cb0c 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.46.tar.bz2) = 5936784bb662e9d8a4f7fe38b70c043b468114d931cd10ea831bfe74461ea5856b64f88f42c567ab791fc8907640a99884ba4b6a600f86d661781812735b6f13 -SHA512 (httpd-2.4.46.tar.bz2.asc) = 1f54c20d1aeedb7c745eb72acd79e1ed61d547b22c3dbe53cd3274ed3d897543cd8c49181d4b15d79c12755746cf0a2464d620f69e254ac3f998760133094df0 -SHA512 (KEYS) = b776ca20863f8d9e4f66e8b56cbe020de34af5b268e93776d482392171f0e0aeee4f8d74477d128dc9fd24b30bbe33b39439964f1bd22a99782f1e4a08c85056 +SHA512 (httpd-2.4.48.tar.bz2) = 6c250626f1e7d10428a92d984fd48ff841effcc8705f7816ab71b681bbd51d0012ad158dcd13763fe7d630311f2de258b27574603140d648be42796ab8326724 +SHA512 (httpd-2.4.48.tar.bz2.asc) = 9f125de75107b04dd01f71e9e233b1602658b49e38371931b98dc1092be8df05cf7243b5564fa2f56f46544bef61a54a721dee5ca17ce823a2302a7c3698a195 +SHA512 (KEYS) = 7ab66c64eaa4a152e88a913993c8ea0d9c46fd5865788e7b32a9619784d245cef8bddd9700368e3d63ce88ed94df8933e5892878523dc0fce697331136bb829e From f518496d8ff918bf8423efb92452650d4d400374 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 15 Apr 2021 10:30:33 +0100 Subject: [PATCH 022/147] Note that changing Listen may break if httpd.service is enabled at boot time. --- httpd.conf | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/httpd.conf b/httpd.conf index 6ab68cb..609b2e2 100644 --- a/httpd.conf +++ b/httpd.conf @@ -38,8 +38,10 @@ ServerRoot "/etc/httpd" # ports, instead of the default. See also the # directive. # -# Change this to Listen on specific IP addresses as shown below to -# prevent Apache from glomming onto all bound IP addresses. +# Change this to Listen on a specific IP address, but note that if +# httpd.service is enabled to run at boot time, the address may not be +# available when the service starts. See the httpd.service(8) man +# page for more information. # #Listen 12.34.56.78:80 Listen 80 From e7a3b438f271241697f035185b686bb592f42cb3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 16 Jul 2021 17:02:03 +0100 Subject: [PATCH 023/147] mod_cgi/mod_cgid: update to unification from trunk --- ...172+.patch => httpd-2.4.48-r1828172+.patch | 1146 +++++++++++++++-- httpd.spec | 8 +- 2 files changed, 1058 insertions(+), 96 deletions(-) rename httpd-2.4.43-r1828172+.patch => httpd-2.4.48-r1828172+.patch (54%) diff --git a/httpd-2.4.43-r1828172+.patch b/httpd-2.4.48-r1828172+.patch similarity index 54% rename from httpd-2.4.43-r1828172+.patch rename to httpd-2.4.48-r1828172+.patch index 3487600..37f1855 100644 --- a/httpd-2.4.43-r1828172+.patch +++ b/httpd-2.4.48-r1828172+.patch @@ -1,9 +1,12 @@ + +https://github.com/apache/httpd/pull/209 + diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 -index 0000000..85c9685 +index 0000000000..69df73ce68 --- /dev/null +++ b/modules/generators/cgi_common.h -@@ -0,0 +1,359 @@ +@@ -0,0 +1,629 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -33,6 +36,22 @@ index 0000000..85c9685 +#include "httpd.h" +#include "util_filter.h" + ++static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv; ++static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps; ++ ++/* These functions provided by mod_cgi.c/mod_cgid.c still. */ ++static int log_script(request_rec *r, cgi_server_conf * conf, int ret, ++ char *dbuf, const char *sbuf, apr_bucket_brigade *bb, ++ apr_file_t *script_err); ++static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, ++ apr_bucket_brigade *bb, char *s); ++static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, ++ apr_bucket_brigade *bb, const char *command); ++ ++/* Read and discard all output from the brigade. Note that with the ++ * CGI bucket, the brigade will become empty once the script's stdout ++ * is closed (or on error/timeout), but the stderr output may not have ++ * been entirely captured at this point. */ +static void discard_script_output(apr_bucket_brigade *bb) +{ + apr_bucket *e; @@ -50,6 +69,166 @@ index 0000000..85c9685 + } +} + ++static int log_scripterror(request_rec *r, cgi_server_conf *conf, int ret, ++ apr_status_t rv, const char *logno, ++ const char *error) ++{ ++ apr_file_t *f = NULL; ++ apr_finfo_t finfo; ++ char time_str[APR_CTIME_LEN]; ++ ++ /* Intentional no APLOGNO */ ++ /* Callee provides APLOGNO in error text */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, ++ "%sstderr from %s: %s", logno ? logno : "", r->filename, error); ++ ++ /* XXX Very expensive mainline case! Open, then getfileinfo! */ ++ if (!conf->logname || ++ ((apr_stat(&finfo, conf->logname, ++ APR_FINFO_SIZE, r->pool) == APR_SUCCESS) && ++ (finfo.size > conf->logbytes)) || ++ (apr_file_open(&f, conf->logname, ++ APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, ++ r->pool) != APR_SUCCESS)) { ++ return ret; ++ } ++ ++ /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */ ++ apr_ctime(time_str, apr_time_now()); ++ apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri, ++ r->args ? "?" : "", r->args ? r->args : "", r->protocol); ++ /* "%% 500 /usr/local/apache/cgi-bin */ ++ apr_file_printf(f, "%%%% %d %s\n", ret, r->filename); ++ ++ apr_file_printf(f, "%%error\n%s\n", error); ++ ++ apr_file_close(f); ++ return ret; ++} ++ ++/* Soak up stderr from a script and redirect it to the error log. ++ */ ++static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err) ++{ ++ char argsbuffer[HUGE_STRING_LEN]; ++ char *newline; ++ apr_status_t rv; ++ cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module); ++ ++ while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN, ++ script_err)) == APR_SUCCESS) { ++ ++ newline = strchr(argsbuffer, '\n'); ++ if (newline) { ++ char *prev = newline - 1; ++ if (prev >= argsbuffer && *prev == '\r') { ++ newline = prev; ++ } ++ ++ *newline = '\0'; ++ } ++ log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer); ++ } ++ ++ return rv; ++} ++ ++static apr_status_t cgi_handle_exec(include_ctx_t *ctx, ap_filter_t *f, ++ apr_bucket_brigade *bb) ++{ ++ char *tag = NULL; ++ char *tag_val = NULL; ++ request_rec *r = f->r; ++ char *file = r->filename; ++ char parsed_string[MAX_STRING_LEN]; ++ ++ if (!ctx->argc) { ++ ap_log_rerror(APLOG_MARK, ++ (ctx->flags & SSI_FLAG_PRINTING) ++ ? APLOG_ERR : APLOG_WARNING, ++ 0, r, APLOGNO(03195) ++ "missing argument for exec element in %s", r->filename); ++ } ++ ++ if (!(ctx->flags & SSI_FLAG_PRINTING)) { ++ return APR_SUCCESS; ++ } ++ ++ if (!ctx->argc) { ++ SSI_CREATE_ERROR_BUCKET(ctx, f, bb); ++ return APR_SUCCESS; ++ } ++ ++ if (ctx->flags & SSI_FLAG_NO_EXEC) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed " ++ "in %s", r->filename); ++ SSI_CREATE_ERROR_BUCKET(ctx, f, bb); ++ return APR_SUCCESS; ++ } ++ ++ while (1) { ++ cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED); ++ if (!tag || !tag_val) { ++ break; ++ } ++ ++ if (!strcmp(tag, "cmd")) { ++ apr_status_t rv; ++ ++ cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string), ++ SSI_EXPAND_LEAVE_NAME); ++ ++ rv = include_cmd(ctx, f, bb, parsed_string); ++ if (rv != APR_SUCCESS) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure " ++ "for parameter \"%s\" to tag exec in file %s", ++ tag, r->filename); ++ SSI_CREATE_ERROR_BUCKET(ctx, f, bb); ++ break; ++ } ++ } ++ else if (!strcmp(tag, "cgi")) { ++ apr_status_t rv; ++ ++ cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string), ++ SSI_EXPAND_DROP_NAME); ++ ++ rv = include_cgi(ctx, f, bb, parsed_string); ++ if (rv != APR_SUCCESS) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref " ++ "\"%s\" in %s", tag_val, file); ++ SSI_CREATE_ERROR_BUCKET(ctx, f, bb); ++ break; ++ } ++ } ++ else { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter " ++ "\"%s\" to tag exec in %s", tag, file); ++ SSI_CREATE_ERROR_BUCKET(ctx, f, bb); ++ break; ++ } ++ } ++ ++ return APR_SUCCESS; ++} ++ ++/* Hook to register exec= handling with mod_include. */ ++static void cgi_optfns_retrieve(void) ++{ ++ APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi; ++ ++ cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler); ++ cgi_pfn_gtv = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value); ++ cgi_pfn_ps = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string); ++ ++ if (cgi_pfn_reg_with_ssi && cgi_pfn_gtv && cgi_pfn_ps) { ++ /* Required by mod_include filter. This is how mod_cgi registers ++ * with mod_include to provide processing of the exec directive. ++ */ ++ cgi_pfn_reg_with_ssi("exec", cgi_handle_exec); ++ } ++} ++ +#ifdef WANT_CGI_BUCKET +/* A CGI bucket type is needed to catch any output to stderr from the + * script; see PR 22030. */ @@ -261,6 +440,13 @@ index 0000000..85c9685 + if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, + APLOG_MODULE_INDEX))) + { ++ /* In the case of a timeout reading script output, clear ++ * the brigade to avoid a second attempt to read the ++ * output. */ ++ if (ret == HTTP_GATEWAY_TIME_OUT) { ++ apr_brigade_cleanup(bb); ++ } ++ + ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err); + + /* @@ -363,8 +549,95 @@ index 0000000..85c9685 + + return OK; /* NOT r->status, even if it has changed. */ +} ++ ++/* Read the request body and write it to fd 'script_out', using 'bb' ++ * as temporary bucket brigade. If 'logbuf' is non-NULL, the first ++ * logbufbytes of stdout are stored in logbuf. */ ++static apr_status_t cgi_handle_request(request_rec *r, apr_file_t *script_out, ++ apr_bucket_brigade *bb, ++ char *logbuf, apr_size_t logbufbytes) ++{ ++ int seen_eos = 0; ++ int child_stopped_reading = 0; ++ apr_status_t rv; ++ int dbpos = 0; ++ ++ do { ++ apr_bucket *bucket; ++ ++ rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, ++ APR_BLOCK_READ, HUGE_STRING_LEN); ++ ++ if (rv != APR_SUCCESS) { ++ return rv; ++ } ++ ++ for (bucket = APR_BRIGADE_FIRST(bb); ++ bucket != APR_BRIGADE_SENTINEL(bb); ++ bucket = APR_BUCKET_NEXT(bucket)) ++ { ++ const char *data; ++ apr_size_t len; ++ ++ if (APR_BUCKET_IS_EOS(bucket)) { ++ seen_eos = 1; ++ break; ++ } ++ ++ /* We can't do much with this. */ ++ if (APR_BUCKET_IS_FLUSH(bucket)) { ++ continue; ++ } ++ ++ /* If the child stopped, we still must read to EOS. */ ++ if (child_stopped_reading) { ++ continue; ++ } ++ ++ /* read */ ++ rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ); ++ if (rv) { ++ return rv; ++ } ++ ++ if (logbufbytes && dbpos < logbufbytes) { ++ int cursize; ++ ++ if ((dbpos + len) > logbufbytes) { ++ cursize = logbufbytes - dbpos; ++ } ++ else { ++ cursize = len; ++ } ++ memcpy(logbuf + dbpos, data, cursize); ++ dbpos += cursize; ++ } ++ ++ /* Keep writing data to the child until done or too much time ++ * elapses with no progress or an error occurs. ++ */ ++ rv = apr_file_write_full(script_out, data, len, NULL); ++ ++ if (rv != APR_SUCCESS) { ++ /* silly script stopped reading, soak up remaining message */ ++ child_stopped_reading = 1; ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02651) ++ "Error writing request body to script %s", ++ r->filename); ++ } ++ } ++ apr_brigade_cleanup(bb); ++ } ++ while (!seen_eos); ++ ++ if (logbuf) { ++ logbuf[dbpos] = '\0'; ++ } ++ ++ return APR_SUCCESS; ++} diff --git a/modules/generators/config5.m4 b/modules/generators/config5.m4 -index bf29521..0863553 100644 +index bf295217e0..086355353b 100644 --- a/modules/generators/config5.m4 +++ b/modules/generators/config5.m4 @@ -78,4 +78,15 @@ fi @@ -384,21 +657,36 @@ index bf29521..0863553 100644 + APACHE_MODPATH_FINISH diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c -index 7e4b126..f438b35 100644 +index 7e4b126c10..421124a0cb 100644 --- a/modules/generators/mod_cgi.c +++ b/modules/generators/mod_cgi.c -@@ -92,6 +92,10 @@ typedef struct { +@@ -61,9 +61,6 @@ + + module AP_MODULE_DECLARE_DATA cgi_module; + +-static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi; +-static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv; +-static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps; + static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command; + + /* Read and discard the data in the brigade produced by a CGI script */ +@@ -92,6 +89,15 @@ typedef struct { apr_size_t bufbytes; } cgi_server_conf; +typedef struct { + apr_interval_time_t timeout; +} cgi_dirconf; ++ ++#if APR_FILES_AS_SOCKETS ++#define WANT_CGI_BUCKET ++#endif ++#include "cgi_common.h" + static void *create_cgi_config(apr_pool_t *p, server_rec *s) { cgi_server_conf *c = -@@ -112,6 +116,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv) +@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv) return overrides->logname ? overrides : base; } @@ -411,7 +699,7 @@ index 7e4b126..f438b35 100644 static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) { server_rec *s = cmd->server; -@@ -150,6 +160,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy, +@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy, return NULL; } @@ -429,7 +717,7 @@ index 7e4b126..f438b35 100644 static const command_rec cgi_cmds[] = { AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, -@@ -158,6 +179,9 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, +@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, "the maximum length (in bytes) of the script debug log"), AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, "the maximum size (in bytes) to record of a POST request"), @@ -439,7 +727,68 @@ index 7e4b126..f438b35 100644 {NULL} }; -@@ -466,23 +490,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out, +-static int log_scripterror(request_rec *r, cgi_server_conf * conf, int ret, +- apr_status_t rv, char *logno, char *error) +-{ +- apr_file_t *f = NULL; +- apr_finfo_t finfo; +- char time_str[APR_CTIME_LEN]; +- int log_flags = rv ? APLOG_ERR : APLOG_ERR; +- +- /* Intentional no APLOGNO */ +- /* Callee provides APLOGNO in error text */ +- ap_log_rerror(APLOG_MARK, log_flags, rv, r, +- "%s%s: %s", logno ? logno : "", error, r->filename); +- +- /* XXX Very expensive mainline case! Open, then getfileinfo! */ +- if (!conf->logname || +- ((apr_stat(&finfo, conf->logname, +- APR_FINFO_SIZE, r->pool) == APR_SUCCESS) && +- (finfo.size > conf->logbytes)) || +- (apr_file_open(&f, conf->logname, +- APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, +- r->pool) != APR_SUCCESS)) { +- return ret; +- } +- +- /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */ +- apr_ctime(time_str, apr_time_now()); +- apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri, +- r->args ? "?" : "", r->args ? r->args : "", r->protocol); +- /* "%% 500 /usr/local/apache/cgi-bin */ +- apr_file_printf(f, "%%%% %d %s\n", ret, r->filename); +- +- apr_file_printf(f, "%%error\n%s\n", error); +- +- apr_file_close(f); +- return ret; +-} +- +-/* Soak up stderr from a script and redirect it to the error log. +- */ +-static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err) +-{ +- char argsbuffer[HUGE_STRING_LEN]; +- char *newline; +- apr_status_t rv; +- cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module); +- +- while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN, +- script_err)) == APR_SUCCESS) { +- newline = strchr(argsbuffer, '\n'); +- if (newline) { +- *newline = '\0'; +- } +- log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer); +- } +- +- return rv; +-} +- + static int log_script(request_rec *r, cgi_server_conf * conf, int ret, + char *dbuf, const char *sbuf, apr_bucket_brigade *bb, + apr_file_t *script_err) +@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out, apr_filepath_name_get(r->filename)); } else { @@ -469,7 +818,7 @@ index 7e4b126..f438b35 100644 } } } -@@ -536,209 +563,12 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, +@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, return APR_SUCCESS; } @@ -490,7 +839,7 @@ index 7e4b126..f438b35 100644 - } -} - - #if APR_FILES_AS_SOCKETS +-#if APR_FILES_AS_SOCKETS - -/* A CGI bucket type is needed to catch any output to stderr from the - * script; see PR 22030. */ @@ -674,24 +1023,139 @@ index 7e4b126..f438b35 100644 - apr_bucket_copy_notimpl -}; - -+#define WANT_CGI_BUCKET - #endif - -+#include "cgi_common.h" -+ +-#endif +- static int cgi_handler(request_rec *r) { int nph; -@@ -757,6 +587,8 @@ static int cgi_handler(request_rec *r) +- apr_size_t dbpos = 0; ++ apr_size_t dbufsize; + const char *argv0; + const char *command; + const char **argv; + char *dbuf = NULL; + apr_file_t *script_out = NULL, *script_in = NULL, *script_err = NULL; +- apr_bucket_brigade *bb; ++ conn_rec *c = r->connection; ++ apr_bucket_brigade *bb = apr_brigade_create(r->pool, c->bucket_alloc); + apr_bucket *b; + int is_included; +- int seen_eos, child_stopped_reading; + apr_pool_t *p; + cgi_server_conf *conf; apr_status_t rv; cgi_exec_info_t e_info; - conn_rec *c; +- conn_rec *c; + cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); + apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -916,10 +748,7 @@ static int cgi_handler(request_rec *r) + } + +- c = r->connection; +- + is_included = !strcmp(r->protocol, "INCLUDED"); + + p = r->main ? r->main->pool : r->pool; +@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r) + return HTTP_INTERNAL_SERVER_ERROR; + } + +- /* Transfer any put/post args, CERN style... +- * Note that we already ignore SIGPIPE in the core server. +- */ +- bb = apr_brigade_create(r->pool, c->bucket_alloc); +- seen_eos = 0; +- child_stopped_reading = 0; ++ /* Buffer for logging script stdout. */ + if (conf->logname) { +- dbuf = apr_palloc(r->pool, conf->bufbytes + 1); +- dbpos = 0; ++ dbufsize = conf->bufbytes; ++ dbuf = apr_palloc(r->pool, dbufsize + 1); + } +- do { +- apr_bucket *bucket; +- +- rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, +- APR_BLOCK_READ, HUGE_STRING_LEN); +- +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225) +- "Error reading request entity data"); +- return ap_map_http_request_error(rv, HTTP_BAD_REQUEST); +- } +- +- for (bucket = APR_BRIGADE_FIRST(bb); +- bucket != APR_BRIGADE_SENTINEL(bb); +- bucket = APR_BUCKET_NEXT(bucket)) +- { +- const char *data; +- apr_size_t len; +- +- if (APR_BUCKET_IS_EOS(bucket)) { +- seen_eos = 1; +- break; +- } +- +- /* We can't do much with this. */ +- if (APR_BUCKET_IS_FLUSH(bucket)) { +- continue; +- } +- +- /* If the child stopped, we still must read to EOS. */ +- if (child_stopped_reading) { +- continue; +- } +- +- /* read */ +- apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ); +- +- if (conf->logname && dbpos < conf->bufbytes) { +- int cursize; +- +- if ((dbpos + len) > conf->bufbytes) { +- cursize = conf->bufbytes - dbpos; +- } +- else { +- cursize = len; +- } +- memcpy(dbuf + dbpos, data, cursize); +- dbpos += cursize; +- } +- +- /* Keep writing data to the child until done or too much time +- * elapses with no progress or an error occurs. +- */ +- rv = apr_file_write_full(script_out, data, len, NULL); +- +- if (rv != APR_SUCCESS) { +- /* silly script stopped reading, soak up remaining message */ +- child_stopped_reading = 1; +- } +- } +- apr_brigade_cleanup(bb); ++ else { ++ dbufsize = 0; ++ dbuf = NULL; + } +- while (!seen_eos); + +- if (conf->logname) { +- dbuf[dbpos] = '\0'; ++ /* Read the request body. */ ++ rv = cgi_handle_request(r, script_out, bb, dbuf, dbufsize); ++ if (rv) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225) ++ "Error reading request entity data"); ++ return ap_map_http_request_error(rv, HTTP_BAD_REQUEST); + } ++ + /* Is this flush really needed? */ + apr_file_flush(script_out); + apr_file_close(script_out); +@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r) AP_DEBUG_ASSERT(script_in != NULL); #if APR_FILES_AS_SOCKETS @@ -703,7 +1167,7 @@ index 7e4b126..f438b35 100644 if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -929,111 +758,7 @@ static int cgi_handler(request_rec *r) +@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r) b = apr_bucket_eos_create(c->bucket_alloc); APR_BRIGADE_INSERT_TAIL(bb, b); @@ -816,7 +1280,121 @@ index 7e4b126..f438b35 100644 } /*============================================================================ -@@ -1268,7 +993,7 @@ static void register_hooks(apr_pool_t *p) +@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, + return APR_SUCCESS; + } + +-static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f, +- apr_bucket_brigade *bb) +-{ +- char *tag = NULL; +- char *tag_val = NULL; +- request_rec *r = f->r; +- char *file = r->filename; +- char parsed_string[MAX_STRING_LEN]; +- +- if (!ctx->argc) { +- ap_log_rerror(APLOG_MARK, +- (ctx->flags & SSI_FLAG_PRINTING) +- ? APLOG_ERR : APLOG_WARNING, +- 0, r, APLOGNO(03195) +- "missing argument for exec element in %s", r->filename); +- } +- +- if (!(ctx->flags & SSI_FLAG_PRINTING)) { +- return APR_SUCCESS; +- } +- +- if (!ctx->argc) { +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- return APR_SUCCESS; +- } +- +- if (ctx->flags & SSI_FLAG_NO_EXEC) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed " +- "in %s", r->filename); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- return APR_SUCCESS; +- } +- +- while (1) { +- cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED); +- if (!tag || !tag_val) { +- break; +- } +- +- if (!strcmp(tag, "cmd")) { +- apr_status_t rv; +- +- cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string), +- SSI_EXPAND_LEAVE_NAME); +- +- rv = include_cmd(ctx, f, bb, parsed_string); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure " +- "for parameter \"%s\" to tag exec in file %s", +- tag, r->filename); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- break; +- } +- } +- else if (!strcmp(tag, "cgi")) { +- apr_status_t rv; +- +- cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string), +- SSI_EXPAND_DROP_NAME); +- +- rv = include_cgi(ctx, f, bb, parsed_string); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref " +- "\"%s\" in %s", tag_val, file); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- break; +- } +- } +- else { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter " +- "\"%s\" to tag exec in %s", tag, file); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- break; +- } +- } +- +- return APR_SUCCESS; +-} +- +- +-/*============================================================================ +- *============================================================================ +- * This is the end of the cgi filter code moved from mod_include. +- *============================================================================ +- *============================================================================*/ +- +- + static int cgi_post_config(apr_pool_t *p, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *s) + { +- cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler); +- cgi_pfn_gtv = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value); +- cgi_pfn_ps = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string); +- +- if ((cgi_pfn_reg_with_ssi) && (cgi_pfn_gtv) && (cgi_pfn_ps)) { +- /* Required by mod_include filter. This is how mod_cgi registers +- * with mod_include to provide processing of the exec directive. +- */ +- cgi_pfn_reg_with_ssi("exec", handle_exec); +- } +- + /* This is the means by which unusual (non-unix) os's may find alternate + * means to run a given command (e.g. shebang/registry parsing on Win32) + */ +@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p) + static const char * const aszPre[] = { "mod_include.c", NULL }; + ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST); ++ ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE); + } + AP_DECLARE_MODULE(cgi) = { STANDARD20_MODULE_STUFF, @@ -826,10 +1404,38 @@ index 7e4b126..f438b35 100644 create_cgi_config, /* server config */ merge_cgi_config, /* merge server config */ diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c -index 9f4282c..102d2b3 100644 +index 2258a683b7..dddfb25254 100644 --- a/modules/generators/mod_cgid.c +++ b/modules/generators/mod_cgid.c -@@ -342,15 +342,19 @@ static apr_status_t close_unix_socket(void *thefd) +@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; + + static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew); + static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server); +-static int handle_exec(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb); +- +-static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgid_pfn_reg_with_ssi; +-static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgid_pfn_gtv; +-static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgid_pfn_ps; + + static apr_pool_t *pcgi = NULL; + static pid_t daemon_pid; +@@ -220,6 +215,15 @@ typedef struct { + #endif + } cgid_req_t; + ++#define cgi_server_conf cgid_server_conf ++#define cgi_module cgid_module ++ ++#ifdef HAVE_CGID_FDPASSING ++/* Pull in CGI bucket implementation. */ ++#define WANT_CGI_BUCKET ++#endif ++#include "cgi_common.h" ++ + /* This routine is called to create the argument list to be passed + * to the CGI script. When suexec is enabled, the suexec path, user, and + * group are the first three arguments to be passed; if not, all three +@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd) return close(fd); } @@ -854,7 +1460,7 @@ index 9f4282c..102d2b3 100644 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +369,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) +@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) } } while (bytes_read < buf_size); @@ -915,7 +1521,7 @@ index 9f4282c..102d2b3 100644 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +439,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) +@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) return APR_SUCCESS; } @@ -924,7 +1530,7 @@ index 9f4282c..102d2b3 100644 { va_list ap; int rc; -@@ -399,9 +454,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } va_end(ap); @@ -964,7 +1570,7 @@ index 9f4282c..102d2b3 100644 if (rc < 0) { return errno; } -@@ -410,7 +495,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -973,7 +1579,7 @@ index 9f4282c..102d2b3 100644 { int i; char **environ; -@@ -421,7 +506,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -982,14 +1588,29 @@ index 9f4282c..102d2b3 100644 if (stat != APR_SUCCESS) { return stat; } -@@ -479,14 +564,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, + return APR_SUCCESS; + } + ++ /* Sanity check the structure received. */ ++ if (req->env_count < 0 || req->uri_len == 0 ++ || req->filename_len > APR_PATH_MAX || req->filename_len == 0 ++ || req->argv0_len > APR_PATH_MAX || req->argv0_len == 0 ++ || req->loglevel > APLOG_TRACE8) { ++ return APR_EINVAL; ++ } ++ + /* handle module indexes and such */ + rconf = (void **)ap_create_request_config(r->pool); + +@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } -static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, - int req_type) +static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r, -+ char *argv0, char **env, int req_type) ++ const char *argv0, char **env, int req_type) { int i; cgid_req_t req = {0}; @@ -1000,7 +1621,7 @@ index 9f4282c..102d2b3 100644 if (ugid == NULL) { -@@ -507,16 +593,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -1024,7 +1645,7 @@ index 9f4282c..102d2b3 100644 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +622,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -1033,7 +1654,7 @@ index 9f4282c..102d2b3 100644 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +673,34 @@ static void daemon_signal_handler(int sig) +@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig) } } @@ -1076,7 +1697,7 @@ index 9f4282c..102d2b3 100644 } static int cgid_server(void *data) -@@ -669,7 +774,7 @@ static int cgid_server(void *data) +@@ -670,7 +787,7 @@ static int cgid_server(void *data) } while (!daemon_should_exit) { @@ -1085,7 +1706,7 @@ index 9f4282c..102d2b3 100644 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -709,7 +814,7 @@ static int cgid_server(void *data) +@@ -710,7 +827,7 @@ static int cgid_server(void *data) r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -1094,7 +1715,7 @@ index 9f4282c..102d2b3 100644 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -741,6 +846,16 @@ static int cgid_server(void *data) +@@ -742,6 +859,16 @@ static int cgid_server(void *data) continue; } @@ -1111,7 +1732,7 @@ index 9f4282c..102d2b3 100644 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -800,7 +915,10 @@ static int cgid_server(void *data) +@@ -801,7 +928,10 @@ static int cgid_server(void *data) close(sd2); } else { @@ -1123,55 +1744,103 @@ index 9f4282c..102d2b3 100644 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -1099,6 +1217,33 @@ static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret, +@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, + if (ret != OK ) { + return ret; + } +- cgid_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler); +- cgid_pfn_gtv = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value); +- cgid_pfn_ps = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string); +- +- if ((cgid_pfn_reg_with_ssi) && (cgid_pfn_gtv) && (cgid_pfn_ps)) { +- /* Required by mod_include filter. This is how mod_cgid registers +- * with mod_include to provide processing of the exec directive. +- */ +- cgid_pfn_reg_with_ssi("exec", handle_exec); +- } + } return ret; } +@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] = + {NULL} + }; -+/* Soak up stderr from a script and redirect it to the error log. -+ * TODO: log_scripterror() and this could move to cgi_common.h. */ -+static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err) -+{ -+ char argsbuffer[HUGE_STRING_LEN]; -+ char *newline; -+ apr_status_t rv; -+ cgid_server_conf *conf = ap_get_module_config(r->server->module_config, &cgid_module); -+ -+ while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN, -+ script_err)) == APR_SUCCESS) { -+ -+ newline = strchr(argsbuffer, '\n'); -+ if (newline) { -+ char *prev = newline - 1; -+ if (prev >= argsbuffer && *prev == '\r') { -+ newline = prev; -+ } -+ -+ *newline = '\0'; -+ } -+ log_scripterror(r, conf, r->status, 0, argsbuffer); -+ } -+ -+ return rv; -+} -+ +-static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret, +- apr_status_t rv, char *error) +-{ +- apr_file_t *f = NULL; +- struct stat finfo; +- char time_str[APR_CTIME_LEN]; +- int log_flags = rv ? APLOG_ERR : APLOG_ERR; +- +- /* Intentional no APLOGNO */ +- /* Callee provides APLOGNO in error text */ +- ap_log_rerror(APLOG_MARK, log_flags, rv, r, +- "%s: %s", error, r->filename); +- +- /* XXX Very expensive mainline case! Open, then getfileinfo! */ +- if (!conf->logname || +- ((stat(conf->logname, &finfo) == 0) +- && (finfo.st_size > conf->logbytes)) || +- (apr_file_open(&f, conf->logname, +- APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, r->pool) != APR_SUCCESS)) { +- return ret; +- } +- +- /* "%% [Wed Jun 19 10:53:21 1996] GET /cgid-bin/printenv HTTP/1.0" */ +- apr_ctime(time_str, apr_time_now()); +- apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri, +- r->args ? "?" : "", r->args ? r->args : "", r->protocol); +- /* "%% 500 /usr/local/apache/cgid-bin */ +- apr_file_printf(f, "%%%% %d %s\n", ret, r->filename); +- +- apr_file_printf(f, "%%error\n%s\n", error); +- +- apr_file_close(f); +- return ret; +-} +- static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1204,6 +1349,13 @@ static int log_script(request_rec *r, cgid_server_conf * conf, int ret, - return ret; - } +@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, + ++connect_tries; + if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) { + return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno, +- APLOGNO(01255) "unable to create socket to cgi daemon"); ++ APLOGNO(01255), "unable to create socket to cgi daemon"); + } + if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) { + /* Save errno for later */ +@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, + } + else { + close(sd); +- return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257) ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257), + "unable to connect to cgi daemon after multiple tries"); + } + } +@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, + if (connect_errno == ENOENT && + apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > + DEFAULT_CONNECT_STARTUP_DELAY) { +- return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, +- apr_pstrcat(r->pool, APLOGNO(02833) "ScriptSock ", sockname, " does not exist", NULL)); ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, ++ APLOGNO(02833), ++ apr_pstrcat(r->pool, ++ "ScriptSock ", sockname, " does not exist", NULL)); + } -+/* Pull in CGI bucket implementation. */ -+#define cgi_server_conf cgid_server_conf -+#ifdef HAVE_CGID_FDPASSING -+#define WANT_CGI_BUCKET -+#endif -+#include "cgi_common.h" -+ - static int connect_to_daemon(int *sdptr, request_rec *r, - cgid_server_conf *conf) - { -@@ -1270,23 +1422,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, + /* gotta try again, but make sure the cgid daemon is still around */ + if (connect_errno != ENOENT && kill(daemon_pid, 0) != 0) { +- return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258) ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258), + "cgid daemon is gone; is Apache terminating?"); + } + } +@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, return OK; } @@ -1195,16 +1864,32 @@ index 9f4282c..102d2b3 100644 /**************************************************************** * * Actual cgid handling... -@@ -1391,6 +1526,7 @@ static apr_status_t cleanup_script(void *vptr) +@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * + return stat; + } + +- if (pid == 0) { ++ /* Don't accept zero as a pid here, calling kill(0, SIGTERM) etc ++ * later is unpleasant. */ ++ if (*pid == 0) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261) + "daemon couldn't find CGI process for connection %lu", + r->connection->id); +@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr) static int cgid_handler(request_rec *r) { +- int retval, nph, dbpos; + conn_rec *c = r->connection; - int retval, nph, dbpos; ++ int retval, nph; char *argv0, *dbuf; - apr_bucket_brigade *bb; -@@ -1400,10 +1536,11 @@ static int cgid_handler(request_rec *r) - int seen_eos, child_stopped_reading; +- apr_bucket_brigade *bb; ++ apr_size_t dbufsize; ++ apr_bucket_brigade *bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); + apr_bucket *b; + cgid_server_conf *conf; + int is_included; +- int seen_eos, child_stopped_reading; int sd; char **env; - apr_file_t *tempsock; @@ -1216,7 +1901,7 @@ index 9f4282c..102d2b3 100644 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1412,7 +1549,7 @@ static int cgid_handler(request_rec *r) +@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r) conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -1225,14 +1910,53 @@ index 9f4282c..102d2b3 100644 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1465,6 +1602,17 @@ static int cgid_handler(request_rec *r) +@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r) + argv0 = r->filename; + + if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) { +- return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262) ++ return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262), + "Options ExecCGI is off in this directory"); + } + + if (nph && is_included) { +- return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263) ++ return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263), + "attempt to include NPH CGI script"); + } + +@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r) + #error at mod_cgi.c for required code in this path. + #else + if (r->finfo.filetype == APR_NOFILE) { +- return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264) ++ return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264), + "script not found or unable to stat"); + } + #endif + if (r->finfo.filetype == APR_DIR) { +- return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265) ++ return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265), + "attempt to invoke directory as script"); + } + +@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r) + r->path_info && *r->path_info) + { + /* default to accept */ +- return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266) ++ return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266), + "AcceptPathInfo off disallows user's path"); + } + /* +@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r) } */ +#ifdef HAVE_CGID_FDPASSING + rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool); + if (rv) { -+ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176) ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176), + "could not create pipe for stderr"); + } +#else @@ -1243,15 +1967,17 @@ index 9f4282c..102d2b3 100644 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1477,12 +1625,16 @@ static int cgid_handler(request_rec *r) +@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r) return retval; } - rv = send_req(sd, r, argv0, env, CGI_REQ); + rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ); if (rv != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268) - "write to cgi daemon process"); +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268) +- "write to cgi daemon process"); ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10245), ++ "could not send request to cgi daemon"); } + /* The write-end of the pipe is only used by the server, so close @@ -1261,7 +1987,23 @@ index 9f4282c..102d2b3 100644 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; info->r = r; -@@ -1504,12 +1656,7 @@ static int cgid_handler(request_rec *r) + rv = get_cgi_pid(r, conf, &(info->pid)); + +- if (APR_SUCCESS == rv){ ++ if (rv == APR_SUCCESS) { + apr_pool_cleanup_register(r->pool, info, +- cleanup_script, +- apr_pool_cleanup_null); ++ cleanup_script, apr_pool_cleanup_null); + } + else { +- ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, "error determining cgi PID"); ++ return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10246), ++ "failed reading PID from cgi daemon"); + } + + /* We are putting the socket discriptor into an apr_file_t so that we can +@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r) */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -1274,8 +2016,103 @@ index 9f4282c..102d2b3 100644 + apr_file_pipe_timeout_set(tempsock, timeout); apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket); - /* Transfer any put/post args, CERN style... -@@ -1601,114 +1748,19 @@ static int cgid_handler(request_rec *r) +- /* Transfer any put/post args, CERN style... +- * Note that we already ignore SIGPIPE in the core server. +- */ +- bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); +- seen_eos = 0; +- child_stopped_reading = 0; +- dbuf = NULL; +- dbpos = 0; ++ /* Buffer for logging script stdout. */ + if (conf->logname) { +- dbuf = apr_palloc(r->pool, conf->bufbytes + 1); ++ dbufsize = conf->bufbytes; ++ dbuf = apr_palloc(r->pool, dbufsize + 1); + } +- do { +- apr_bucket *bucket; +- +- rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES, +- APR_BLOCK_READ, HUGE_STRING_LEN); +- +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270) +- "Error reading request entity data"); +- return ap_map_http_request_error(rv, HTTP_BAD_REQUEST); +- } +- +- for (bucket = APR_BRIGADE_FIRST(bb); +- bucket != APR_BRIGADE_SENTINEL(bb); +- bucket = APR_BUCKET_NEXT(bucket)) +- { +- const char *data; +- apr_size_t len; +- +- if (APR_BUCKET_IS_EOS(bucket)) { +- seen_eos = 1; +- break; +- } +- +- /* We can't do much with this. */ +- if (APR_BUCKET_IS_FLUSH(bucket)) { +- continue; +- } +- +- /* If the child stopped, we still must read to EOS. */ +- if (child_stopped_reading) { +- continue; +- } +- +- /* read */ +- apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ); +- +- if (conf->logname && dbpos < conf->bufbytes) { +- int cursize; +- +- if ((dbpos + len) > conf->bufbytes) { +- cursize = conf->bufbytes - dbpos; +- } +- else { +- cursize = len; +- } +- memcpy(dbuf + dbpos, data, cursize); +- dbpos += cursize; +- } +- +- /* Keep writing data to the child until done or too much time +- * elapses with no progress or an error occurs. +- */ +- rv = apr_file_write_full(tempsock, data, len, NULL); +- +- if (rv != APR_SUCCESS) { +- /* silly script stopped reading, soak up remaining message */ +- child_stopped_reading = 1; +- ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02651) +- "Error writing request body to script %s", +- r->filename); +- +- } +- } +- apr_brigade_cleanup(bb); ++ else { ++ dbuf = NULL; ++ dbufsize = 0; + } +- while (!seen_eos); + +- if (conf->logname) { +- dbuf[dbpos] = '\0'; ++ /* Read the request body. */ ++ rv = cgi_handle_request(r, tempsock, bb, dbuf, dbufsize); ++ if (rv) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270) ++ "Error reading request entity data"); ++ return ap_map_http_request_error(rv, HTTP_BAD_REQUEST); + } + + /* we're done writing, or maybe we didn't write at all; +@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r) */ shutdown(sd, 1); @@ -1401,8 +2238,29 @@ index 9f4282c..102d2b3 100644 + return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err); } +- +- +- +-/*============================================================================ +- *============================================================================ +- * This is the beginning of the cgi filter code moved from mod_include. This +- * is the code required to handle the "exec" SSI directive. +- *============================================================================ +- *============================================================================*/ ++/* Handling include= for mod_include. */ + static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + apr_bucket_brigade *bb, char *s) + { +@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r) + } -@@ -1825,7 +1877,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, + static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +- apr_bucket_brigade *bb, char *command) ++ apr_bucket_brigade *bb, const char *command) + { + char **env; + int sd; +@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return retval; } @@ -1411,3 +2269,103 @@ index 9f4282c..102d2b3 100644 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; +@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, + return APR_SUCCESS; + } + +-static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f, +- apr_bucket_brigade *bb) +-{ +- char *tag = NULL; +- char *tag_val = NULL; +- request_rec *r = f->r; +- char *file = r->filename; +- char parsed_string[MAX_STRING_LEN]; +- +- if (!ctx->argc) { +- ap_log_rerror(APLOG_MARK, +- (ctx->flags & SSI_FLAG_PRINTING) +- ? APLOG_ERR : APLOG_WARNING, +- 0, r, APLOGNO(03196) +- "missing argument for exec element in %s", r->filename); +- } +- +- if (!(ctx->flags & SSI_FLAG_PRINTING)) { +- return APR_SUCCESS; +- } +- +- if (!ctx->argc) { +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- return APR_SUCCESS; +- } +- +- if (ctx->flags & SSI_FLAG_NO_EXEC) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01271) "exec used but not allowed " +- "in %s", r->filename); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- return APR_SUCCESS; +- } +- +- while (1) { +- cgid_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED); +- if (!tag || !tag_val) { +- break; +- } +- +- if (!strcmp(tag, "cmd")) { +- apr_status_t rv; +- +- cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string), +- SSI_EXPAND_LEAVE_NAME); +- +- rv = include_cmd(ctx, f, bb, parsed_string); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01272) +- "execution failure for parameter \"%s\" " +- "to tag exec in file %s", tag, r->filename); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- break; +- } +- } +- else if (!strcmp(tag, "cgi")) { +- apr_status_t rv; +- +- cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string), +- SSI_EXPAND_DROP_NAME); +- +- rv = include_cgi(ctx, f, bb, parsed_string); +- if (rv != APR_SUCCESS) { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01273) "invalid CGI ref " +- "\"%s\" in %s", tag_val, file); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- break; +- } +- } +- else { +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01274) "unknown parameter " +- "\"%s\" to tag exec in %s", tag, file); +- SSI_CREATE_ERROR_BUCKET(ctx, f, bb); +- break; +- } +- } +- +- return APR_SUCCESS; +-} +-/*============================================================================ +- *============================================================================ +- * This is the end of the cgi filter code moved from mod_include. +- *============================================================================ +- *============================================================================*/ +- +- + static void register_hook(apr_pool_t *p) + { + static const char * const aszPre[] = { "mod_include.c", NULL }; +@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p) + ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE); + ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE); ++ ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE); + } + + AP_DECLARE_MODULE(cgid) = { diff --git a/httpd.spec b/httpd.spec index 17d0745..dca53b0 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -81,7 +81,7 @@ Patch38: httpd-2.4.43-sslciphdefault.patch Patch39: httpd-2.4.43-sslprotdefault.patch Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch -Patch42: httpd-2.4.43-r1828172+.patch +Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch # Bug fixes @@ -780,6 +780,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jul 16 2021 Joe Orton - 2.4.48-2 +- mod_cgi/mod_cgid: update to unification from trunk +- httpd.conf: add note on care with Listen and starting at boot + * Wed Jun 02 2021 Luboš Uhliarik - 2.4.48-1 - new version 2.4.48 - Resolves: #1964746 - httpd-2.4.48 is available From a9fdea6de3cb29bdfaeb1f33e0889abb16e83c09 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 07:46:13 +0000 Subject: [PATCH 024/147] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index dca53b0..d701c35 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -780,6 +780,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 2.4.48-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Fri Jul 16 2021 Joe Orton - 2.4.48-2 - mod_cgi/mod_cgid: update to unification from trunk - httpd.conf: add note on care with Listen and starting at boot From aee92c2c6a96e3d21560bdd5de702534dd68e323 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 6 Aug 2021 13:28:05 +0100 Subject: [PATCH 025/147] add OpenSSL 3.x compatibility patch --- httpd-2.4.48-openssl3.patch | 505 ++++++++++++++++++++++++++++++++++++ httpd.spec | 7 +- pullrev.sh | 4 +- 3 files changed, 513 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.48-openssl3.patch diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.48-openssl3.patch new file mode 100644 index 0000000..f218d16 --- /dev/null +++ b/httpd-2.4.48-openssl3.patch @@ -0,0 +1,505 @@ + +https://github.com/apache/httpd/pull/258 + +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index 4da24eddcc..5d199cddaf 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) + + return 1; + } +-#endif + + /* + * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* +@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen) + + return NULL; /* impossible to reach. */ + } ++#endif + + static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, + server_rec *s) +@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, + + modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ + ++#if MODSSL_USE_OPENSSL_PRE_1_1_API + init_dh_params(); +-#if !MODSSL_USE_OPENSSL_PRE_1_1_API ++#else + init_bio_methods(); + #endif + +@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s, + { + SSL_CTX *ctx = mctx->ssl_ctx; + ++#if MODSSL_USE_OPENSSL_PRE_1_1_API + SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); ++#else ++ SSL_CTX_set_dh_auto(ctx, 1); ++#endif + + SSL_CTX_set_info_callback(ctx, ssl_callback_Info); + +@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s, + #endif + } + ++static APR_INLINE ++int modssl_CTX_load_verify_locations(SSL_CTX *ctx, ++ const char *file, ++ const char *path) ++{ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ if (!SSL_CTX_load_verify_locations(ctx, file, path)) ++ return 0; ++#else ++ if (file && !SSL_CTX_load_verify_file(ctx, file)) ++ return 0; ++ if (path && !SSL_CTX_load_verify_dir(ctx, path)) ++ return 0; ++#endif ++ return 1; ++} ++ + static apr_status_t ssl_init_ctx_verify(server_rec *s, + apr_pool_t *p, + apr_pool_t *ptemp, +@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, + ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, + "Configuring client authentication"); + +- if (!SSL_CTX_load_verify_locations(ctx, +- mctx->auth.ca_cert_file, +- mctx->auth.ca_cert_path)) +- { ++ if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, ++ mctx->auth.ca_cert_path)) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) + "Unable to configure verify locations " + "for client authentication"); +@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, + return APR_SUCCESS; + } + ++static APR_INLINE ++int modssl_X509_STORE_load_locations(X509_STORE *store, ++ const char *file, ++ const char *path) ++{ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ if (!X509_STORE_load_locations(store, file, path)) ++ return 0; ++#else ++ if (file && !X509_STORE_load_file(store, file)) ++ return 0; ++ if (path && !X509_STORE_load_path(store, path)) ++ return 0; ++#endif ++ return 1; ++} ++ + static apr_status_t ssl_init_ctx_crl(server_rec *s, + apr_pool_t *p, + apr_pool_t *ptemp, +@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) + "Configuring certificate revocation facility"); + +- if (!store || !X509_STORE_load_locations(store, mctx->crl_file, +- mctx->crl_path)) { ++ if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file, ++ mctx->crl_path)) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) + "Host %s: unable to configure X.509 CRL storage " + "for certificate revocation", mctx->sc->vhost_id); +@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag, + return 0; + } + ++static APR_INLINE int modssl_DH_bits(DH *dh) ++{ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ return DH_bits(dh); ++#else ++ return BN_num_bits(DH_get0_p(dh)); ++#endif ++} ++ ++/* SSL_CTX_use_PrivateKey_file() can fail either because the private ++ * key was encrypted, or due to a mismatch between an already-loaded ++ * cert and the key - a common misconfiguration - from calling ++ * X509_check_private_key(). This macro is passed the last error code ++ * off the OpenSSL stack and evaluates to true only for the first ++ * case. With OpenSSL < 3 the second case is identifiable by the ++ * function code, but function codes are not used from 3.0. */ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY) ++#else ++#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509 \ ++ || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \ ++ && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \ ++ && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE)) ++#endif ++ + static apr_status_t ssl_init_server_certs(server_rec *s, + apr_pool_t *p, + apr_pool_t *ptemp, +@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; + X509 *cert; +- DH *dhparams; ++ DH *dh; + #ifdef HAVE_ECC + EC_GROUP *ecparams = NULL; + int nid; +@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, + } + else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, + SSL_FILETYPE_PEM) < 1) +- && (ERR_GET_FUNC(ERR_peek_last_error()) +- != X509_F_X509_CHECK_PRIVATE_KEY)) { ++ && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) { + ssl_asn1_t *asn1; + const unsigned char *ptr; + +@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s, + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); + if (certfile && !modssl_is_engine_id(certfile) +- && (dhparams = ssl_dh_GetParamFromFile(certfile))) { +- SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); ++ && (dh = ssl_dh_GetParamFromFile(certfile))) { ++ SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", +- DH_bits(dhparams), vhost_id, certfile); +- DH_free(dhparams); ++ modssl_DH_bits(dh), vhost_id, certfile); ++ DH_free(dh); + } + + #ifdef HAVE_ECC +@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, + char buf[TLSEXT_TICKET_KEY_LEN]; + char *path; + modssl_ticket_key_t *ticket_key = mctx->ticket_key; ++ int res; + + if (!ticket_key->file_path) { + return APR_SUCCESS; +@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, + } + + memcpy(ticket_key->key_name, buf, 16); +- memcpy(ticket_key->hmac_secret, buf + 16, 16); + memcpy(ticket_key->aes_key, buf + 32, 16); +- +- if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, +- ssl_callback_SessionTicket)) { ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ memcpy(ticket_key->hmac_secret, buf + 16, 16); ++ res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, ++ ssl_callback_SessionTicket); ++#else ++ ticket_key->mac_params[0] = ++ OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16); ++ ticket_key->mac_params[1] = ++ OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); ++ ticket_key->mac_params[2] = ++ OSSL_PARAM_construct_end(); ++ res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx, ++ ssl_callback_SessionTicket); ++#endif ++ if (!res) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) + "Unable to initialize TLS session ticket key callback " + "(incompatible OpenSSL version?)"); +@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, + return ssl_die(s); + } + +- X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); ++ modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); + + for (n = 0; n < ncerts; n++) { + int i; +@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data) + + } + +-#if !MODSSL_USE_OPENSSL_PRE_1_1_API ++#if MODSSL_USE_OPENSSL_PRE_1_1_API ++ free_dh_params(); ++#else + free_bio_methods(); + #endif +- free_dh_params(); + + return APR_SUCCESS; + } +diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c +index cabf753790..3db7077f1e 100644 +--- a/modules/ssl/ssl_engine_io.c ++++ b/modules/ssl/ssl_engine_io.c +@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio) + static int bio_filter_out_read(BIO *bio, char *out, int outl) + { + /* this is never called */ ++ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, ++ "BUG: %s() should not be called", "bio_filter_out_read"); ++ AP_DEBUG_ASSERT(0); + return -1; + } + +@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr) + static int bio_filter_out_gets(BIO *bio, char *buf, int size) + { + /* this is never called */ ++ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, ++ "BUG: %s() should not be called", "bio_filter_out_gets"); ++ AP_DEBUG_ASSERT(0); + return -1; + } + + static int bio_filter_out_puts(BIO *bio, const char *str) + { + /* this is never called */ ++ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, ++ "BUG: %s() should not be called", "bio_filter_out_puts"); ++ AP_DEBUG_ASSERT(0); + return -1; + } + +@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) + + static int bio_filter_in_write(BIO *bio, const char *in, int inl) + { ++ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, ++ "BUG: %s() should not be called", "bio_filter_in_write"); ++ AP_DEBUG_ASSERT(0); + return -1; + } + + static int bio_filter_in_puts(BIO *bio, const char *str) + { ++ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, ++ "BUG: %s() should not be called", "bio_filter_in_puts"); ++ AP_DEBUG_ASSERT(0); + return -1; + } + + static int bio_filter_in_gets(BIO *bio, char *buf, int size) + { ++ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, ++ "BUG: %s() should not be called", "bio_filter_in_gets"); ++ AP_DEBUG_ASSERT(0); + return -1; + } + + static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr) + { +- return -1; ++ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); ++ switch (cmd) { ++#ifdef BIO_CTRL_EOF ++ case BIO_CTRL_EOF: ++ return inctx->rc == APR_EOF; ++#endif ++ default: ++ break; ++ } ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, ++ "BUG: bio_filter_in_ctrl() should not be called with cmd=%i", ++ cmd); ++ AP_DEBUG_ASSERT(0); ++ return 0; + } + + #if MODSSL_USE_OPENSSL_PRE_1_1_API +@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = { + bio_filter_in_read, + bio_filter_in_puts, /* puts is never called */ + bio_filter_in_gets, /* gets is never called */ +- bio_filter_in_ctrl, /* ctrl is never called */ ++ bio_filter_in_ctrl, /* ctrl is called for EOF check */ + bio_filter_create, + bio_filter_destroy, + NULL +diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c +index b99dcf19d4..aced92d2d0 100644 +--- a/modules/ssl/ssl_engine_kernel.c ++++ b/modules/ssl/ssl_engine_kernel.c +@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client = + ** _________________________________________________________________ + */ + ++#if MODSSL_USE_OPENSSL_PRE_1_1_API + /* + * Hand out standard DH parameters, based on the authentication strength + */ +@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen) + + return modssl_get_dh_params(keylen); + } ++#endif + + /* + * This OpenSSL callback function is called when OpenSSL +@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl, + unsigned char *keyname, + unsigned char *iv, + EVP_CIPHER_CTX *cipher_ctx, +- HMAC_CTX *hctx, ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ HMAC_CTX *hmac_ctx, ++#else ++ EVP_MAC_CTX *mac_ctx, ++#endif + int mode) + { + conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); +@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl, + } + EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, + ticket_key->aes_key, iv); +- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); ++ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, ++ tlsext_tick_md(), NULL); ++#else ++ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); ++#endif + + ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) + "TLS session ticket key for %s successfully set, " +@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl, + + EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, + ticket_key->aes_key, iv); +- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); ++ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, ++ tlsext_tick_md(), NULL); ++#else ++ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); ++#endif + + ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) + "TLS session ticket key for %s successfully set, " +diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c +index 7dbbbdb55e..3b3ceacf0a 100644 +--- a/modules/ssl/ssl_engine_log.c ++++ b/modules/ssl/ssl_engine_log.c +@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s) + return APR_EGENERAL; + } + ++static APR_INLINE ++unsigned long modssl_ERR_peek_error_data(const char **data, int *flags) ++{ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ return ERR_peek_error_line_data(NULL, NULL, data, flags); ++#else ++ return ERR_peek_error_data(data, flags); ++#endif ++} ++ + /* + * Prints the SSL library error information. + */ +@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s) + const char *data; + int flags; + +- while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) { ++ while ((e = modssl_ERR_peek_error_data(&data, &flags))) { + const char *annotation; + char err[256]; + +diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h +index a6fc7513a2..b091c58c94 100644 +--- a/modules/ssl/ssl_private.h ++++ b/modules/ssl/ssl_private.h +@@ -89,6 +89,9 @@ + /* must be defined before including ssl.h */ + #define OPENSSL_NO_SSL_INTERN + #endif ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include ++#endif + #include + #include + #include +@@ -134,13 +137,12 @@ + SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) + #define SSL_CTX_set_max_proto_version(ctx, version) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) +-#elif LIBRESSL_VERSION_NUMBER < 0x2070000f ++#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ + /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not + * include most changes from OpenSSL >= 1.1 (new functions, macros, + * deprecations, ...), so we have to work around this... + */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (1) +-#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ ++#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) + #else /* defined(LIBRESSL_VERSION_NUMBER) */ + #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) + #endif +@@ -674,7 +676,11 @@ typedef struct { + typedef struct { + const char *file_path; + unsigned char key_name[16]; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L + unsigned char hmac_secret[16]; ++#else ++ OSSL_PARAM mac_params[3]; ++#endif + unsigned char aes_key[16]; + } modssl_ticket_key_t; + #endif +@@ -938,8 +944,16 @@ int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); + int ssl_callback_ClientHello(SSL *, int *, void *); + #endif + #ifdef HAVE_TLS_SESSION_TICKETS +-int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *, +- EVP_CIPHER_CTX *, HMAC_CTX *, int); ++int ssl_callback_SessionTicket(SSL *ssl, ++ unsigned char *keyname, ++ unsigned char *iv, ++ EVP_CIPHER_CTX *cipher_ctx, ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ HMAC_CTX *hmac_ctx, ++#else ++ EVP_MAC_CTX *mac_ctx, ++#endif ++ int mode); + #endif + + #ifdef HAVE_TLS_ALPN +@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx); + + #endif + ++#if MODSSL_USE_OPENSSL_PRE_1_1_API + /* Retrieve DH parameters for given key length. Return value should + * be treated as unmutable, since it is stored in process-global + * memory. */ + DH *modssl_get_dh_params(unsigned keylen); ++#endif + + /* Returns non-zero if the request was made over SSL/TLS. If sslconn + * is non-NULL and the request is using SSL/TLS, sets *sslconn to the diff --git a/httpd.spec b/httpd.spec index d701c35..91e0ce6 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -75,6 +75,7 @@ Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch +Patch28: httpd-2.4.48-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -227,6 +228,7 @@ written in the Lua programming language. %patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons +%patch28 -p1 -b .openssl3 %patch30 -p1 -b .cachehardmax %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault @@ -780,6 +782,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Aug 6 2021 Joe Orton - 2.4.48-4 +- add OpenSSL 3.x compatibility patch + * Thu Jul 22 2021 Fedora Release Engineering - 2.4.48-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/pullrev.sh b/pullrev.sh index 27bbcb3..f7fb600 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.46 +repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +ver=2.4.48 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From f4a1af86c2020b698821d9061d1c3f40bfad81e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 6 Aug 2021 16:57:00 +0200 Subject: [PATCH 026/147] add symlink to system logo for noindex test page --- httpd.spec | 8 +++++++- welcome.conf | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 91e0ce6..cb5e9d6 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -485,6 +485,9 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \ ln -s ../../pixmaps/poweredby.png \ $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png +# Symlink for the system logo +ln -s ../../pixmaps/system_noindex_logo.png \ + $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} @@ -782,6 +785,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-5 +- add symlink to system logo for noindex test page + * Fri Aug 6 2021 Joe Orton - 2.4.48-4 - add OpenSSL 3.x compatibility patch diff --git a/welcome.conf b/welcome.conf index a5e221b..232c251 100644 --- a/welcome.conf +++ b/welcome.conf @@ -17,3 +17,4 @@ Alias /.noindex.html /usr/share/httpd/noindex/index.html Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png +Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png From 6739add2357fcf8acdfc5cbbc41d0659f63e4034 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Mon, 9 Aug 2021 14:30:36 +0200 Subject: [PATCH 027/147] - fix testpage's symlink location --- httpd.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index cb5e9d6..6e0b078 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -486,7 +486,7 @@ ln -s ../../pixmaps/poweredby.png \ $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png # Symlink for the system logo -ln -s ../../pixmaps/system_noindex_logo.png \ +ln -s ../../pixmaps/system-noindex-logo.png \ $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png # symlinks for /etc/httpd @@ -785,7 +785,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-5 +* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-6 - add symlink to system logo for noindex test page * Fri Aug 6 2021 Joe Orton - 2.4.48-4 From 6622f1845a81159896cc0fb21aa743ef11298f08 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Mon, 9 Aug 2021 16:11:37 +0200 Subject: [PATCH 028/147] - Use symlink pointing to system logo only for RHEL for now, so we have no dangling links on Fedora and others. --- httpd.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 6e0b078..48079c8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -486,8 +486,10 @@ ln -s ../../pixmaps/poweredby.png \ $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png # Symlink for the system logo +%if 0%{?rhel} >= 9 ln -s ../../pixmaps/system-noindex-logo.png \ $RPM_BUILD_ROOT%{contentdir}/icons/system_noindex_logo.png +%endif # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} @@ -785,7 +787,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-6 +* Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-7 - add symlink to system logo for noindex test page * Fri Aug 6 2021 Joe Orton - 2.4.48-4 From ed175de6b24b14b90d5454d0cf9bc218f0cddef8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 1 Jul 2021 17:42:02 +0200 Subject: [PATCH 029/147] Adding test plan with tier1 tests --- plans/tier1-public.fmf | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 plans/tier1-public.fmf diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf new file mode 100644 index 0000000..c181caa --- /dev/null +++ b/plans/tier1-public.fmf @@ -0,0 +1,7 @@ +summary: Public (Fedora) Tier1 beakerlib tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/httpd.git + filter: 'tier: 1' +execute: + how: tmt From e7917f9dac2c67c64f1d5154619536cd08d97e78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 1 Jul 2021 18:04:27 +0200 Subject: [PATCH 030/147] Report separate results --- ci.fmf | 1 + 1 file changed, 1 insertion(+) create mode 100644 ci.fmf diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate From dc18834d53d3db121b9db562d362c0c703ee71c5 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:04:25 +0200 Subject: [PATCH 031/147] Rebuilt with OpenSSL 3.0.0 --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 48079c8..fa2a75d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.48 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Sep 14 2021 Sahana Prasad - 2.4.48-8 +- Rebuilt with OpenSSL 3.0.0 + * Fri Aug 06 2021 Luboš Uhliarik - 2.4.48-7 - add symlink to system logo for noindex test page From 817ac0a9a475f26768e49342e055307368258b74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 17 Sep 2021 15:04:41 +0200 Subject: [PATCH 032/147] new version 2.4.49 (#2004776) --- .gitignore | 1 + httpd.spec | 7 +++++-- sources | 6 +++--- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index ea4148c..13567f6 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ x86_64 /KEYS /httpd-2.4.46.tar.bz2.asc /httpd-2.4.48.tar.bz2.asc +/httpd-2.4.49.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index fa2a75d..bf19f96 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.48 -Release: 8%{?dist} +Version: 2.4.49 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Sep 16 2021 Luboš Uhliarik - 2.4.49-1 +- new version 2.4.49 (#2004776) + * Tue Sep 14 2021 Sahana Prasad - 2.4.48-8 - Rebuilt with OpenSSL 3.0.0 diff --git a/sources b/sources index 5e6cb0c..8d356ef 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.48.tar.bz2) = 6c250626f1e7d10428a92d984fd48ff841effcc8705f7816ab71b681bbd51d0012ad158dcd13763fe7d630311f2de258b27574603140d648be42796ab8326724 -SHA512 (httpd-2.4.48.tar.bz2.asc) = 9f125de75107b04dd01f71e9e233b1602658b49e38371931b98dc1092be8df05cf7243b5564fa2f56f46544bef61a54a721dee5ca17ce823a2302a7c3698a195 -SHA512 (KEYS) = 7ab66c64eaa4a152e88a913993c8ea0d9c46fd5865788e7b32a9619784d245cef8bddd9700368e3d63ce88ed94df8933e5892878523dc0fce697331136bb829e +SHA512 (httpd-2.4.49.tar.bz2) = 418e277232cf30a81d02b8554e31aaae6433bbea842bdb81e47a609469395cc4891183fb6ee02bd669edb2392c2007869b19da29f5998b8fd5c7d3142db310dd +SHA512 (httpd-2.4.49.tar.bz2.asc) = f3d31cea838c2f965c6f7bea85afb85e4a12fbbcc5162fb8eebf2ba1e808326f99401e0c7f36bd4cb2f32bbac3c206d0bcb5f5b1b15237cb651c3b43d39f4cf4 +SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 006b900bcd24ff22bae2f37d62fb423ddab71bc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Tue, 21 Sep 2021 12:04:37 +0200 Subject: [PATCH 033/147] Adding gating configuration --- gating.yaml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 gating.yaml diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..d899fa6 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,7 @@ +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_testing] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier1-public.functional} From f359686a9f13791c7b48f1050829e615a7f44f6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Tue, 21 Sep 2021 13:13:25 +0200 Subject: [PATCH 034/147] Fixing plan name --- gating.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gating.yaml b/gating.yaml index d899fa6..c7a9f0c 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,4 +4,4 @@ product_versions: decision_contexts: [bodhi_update_push_testing] subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier1-public.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} From 59e7f24546153ddcf1351be5e67a0040a79051aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 22 Sep 2021 13:08:13 +0200 Subject: [PATCH 035/147] Rebuilt for CI testing --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index bf19f96..81df51e 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.49 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Sep 22 2021 Luboš Uhliarik - 2.4.49-2 +- Rebuilt for CI testing + * Thu Sep 16 2021 Luboš Uhliarik - 2.4.49-1 - new version 2.4.49 (#2004776) From cd5aa0e938eef8e98eef9c9d163b8302e3c0296d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Wed, 22 Sep 2021 17:22:22 +0200 Subject: [PATCH 036/147] Use bodhi_update_push_stable decision context --- gating.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gating.yaml b/gating.yaml index c7a9f0c..ce08116 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,7 +1,7 @@ --- !Policy product_versions: - fedora-* -decision_contexts: [bodhi_update_push_testing] +decision_contexts: [bodhi_update_push_stable] subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} From 71e41b5352bad307bab532adfab65bff4e312789 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 22 Sep 2021 18:35:12 +0200 Subject: [PATCH 037/147] Rebuilt for CI testing --- httpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 81df51e..db5971d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.49 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,7 +787,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Wed Sep 22 2021 Luboš Uhliarik - 2.4.49-2 +* Wed Sep 22 2021 Luboš Uhliarik - 2.4.49-3 - Rebuilt for CI testing * Thu Sep 16 2021 Luboš Uhliarik - 2.4.49-1 From cbf5ce7a7e23fa2ff6bb3906c2f716045e1eddce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 5 Oct 2021 11:54:24 +0200 Subject: [PATCH 038/147] new version 2.4.50 --- .gitignore | 1 + httpd.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 13567f6..af7dee4 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ x86_64 /httpd-2.4.46.tar.bz2.asc /httpd-2.4.48.tar.bz2.asc /httpd-2.4.49.tar.bz2.asc +/httpd-2.4.50.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index db5971d..d15c8bb 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.49 -Release: 3%{?dist} +Version: 2.4.50 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Oct 05 2021 Luboš Uhliarik - 2.4.50-1 +- new version 2.4.50 + * Wed Sep 22 2021 Luboš Uhliarik - 2.4.49-3 - Rebuilt for CI testing diff --git a/sources b/sources index 8d356ef..63a8c16 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.49.tar.bz2) = 418e277232cf30a81d02b8554e31aaae6433bbea842bdb81e47a609469395cc4891183fb6ee02bd669edb2392c2007869b19da29f5998b8fd5c7d3142db310dd -SHA512 (httpd-2.4.49.tar.bz2.asc) = f3d31cea838c2f965c6f7bea85afb85e4a12fbbcc5162fb8eebf2ba1e808326f99401e0c7f36bd4cb2f32bbac3c206d0bcb5f5b1b15237cb651c3b43d39f4cf4 +SHA512 (httpd-2.4.50.tar.bz2) = b1afbaf44e503b822ff2b443881dcb44a93aa55d496f88ae399a2e7def05f78590f266a16da1f2c0aac88e463b76fba20843b1e20a102e76c8269de6fae3e158 +SHA512 (httpd-2.4.50.tar.bz2.asc) = 31ec3cbf342905f63fc070ae51103a695736a0fc5689d38845a7802fa6b48d86bafd5afcf57f7bbee4435691093326ec5f07a904fd3fa877e0453a3830425776 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 9c327bba1d45d53ebce3ba96c03d273b34f2ed93 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Thu, 7 Oct 2021 20:34:53 +0200 Subject: [PATCH 039/147] new version 2.4.51 --- .gitignore | 1 + httpd.spec | 5 ++++- sources | 5 ++--- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index af7dee4..bd6e204 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ x86_64 /httpd-2.4.48.tar.bz2.asc /httpd-2.4.49.tar.bz2.asc /httpd-2.4.50.tar.bz2.asc +/httpd-2.4.51.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index d15c8bb..77b51a8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,7 +12,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.50 +Version: 2.4.51 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 +- new version 2.4.51 + * Tue Oct 05 2021 Luboš Uhliarik - 2.4.50-1 - new version 2.4.50 diff --git a/sources b/sources index 63a8c16..a3daaf4 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (httpd-2.4.50.tar.bz2) = b1afbaf44e503b822ff2b443881dcb44a93aa55d496f88ae399a2e7def05f78590f266a16da1f2c0aac88e463b76fba20843b1e20a102e76c8269de6fae3e158 -SHA512 (httpd-2.4.50.tar.bz2.asc) = 31ec3cbf342905f63fc070ae51103a695736a0fc5689d38845a7802fa6b48d86bafd5afcf57f7bbee4435691093326ec5f07a904fd3fa877e0453a3830425776 -SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 +SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce From a8ac1433954955b14afb16e5d8e94026fe51496f Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Thu, 7 Oct 2021 20:39:11 +0200 Subject: [PATCH 040/147] Re-add KEYS file --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index a3daaf4..edbf616 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce +SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 0da20265b49dee20822800585b9c12cc439fdf27 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Oct 2021 08:49:54 +0100 Subject: [PATCH 041/147] Add comment on differences with upstream apachectl, no functional change. --- apachectl.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/apachectl.sh b/apachectl.sh index 766cfba..823db3b 100755 --- a/apachectl.sh +++ b/apachectl.sh @@ -15,6 +15,13 @@ # See the License for the specific language governing permissions and # limitations under the License. +### +### NOTE: This is a replacement version of the "apachectl" script with +### some differences in behaviour to the version distributed with +### Apache httpd. Please read the apachectl(8) man page for more +### information. +### + if [ "x$1" = "x-k" ]; then shift fi From 485637a10d7dcace7c60e54f5df10cf824dc421a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 13:53:59 +0100 Subject: [PATCH 042/147] mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) --- ...nssl3.patch => httpd-2.4.51-openssl3.patch | 104 +++++++++--------- httpd.spec | 7 +- 2 files changed, 57 insertions(+), 54 deletions(-) rename httpd-2.4.48-openssl3.patch => httpd-2.4.51-openssl3.patch (83%) diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.51-openssl3.patch similarity index 83% rename from httpd-2.4.48-openssl3.patch rename to httpd-2.4.51-openssl3.patch index f218d16..a4423c7 100644 --- a/httpd-2.4.48-openssl3.patch +++ b/httpd-2.4.51-openssl3.patch @@ -1,11 +1,9 @@ https://github.com/apache/httpd/pull/258 -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 4da24eddcc..5d199cddaf 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) +--- httpd-2.4.51/modules/ssl/ssl_engine_init.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_init.c +@@ -91,7 +91,6 @@ return 1; } @@ -13,7 +11,7 @@ index 4da24eddcc..5d199cddaf 100644 /* * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* -@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen) +@@ -171,6 +170,7 @@ return NULL; /* impossible to reach. */ } @@ -21,7 +19,7 @@ index 4da24eddcc..5d199cddaf 100644 static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, server_rec *s) -@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, +@@ -440,8 +440,9 @@ modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ @@ -32,19 +30,19 @@ index 4da24eddcc..5d199cddaf 100644 init_bio_methods(); #endif -@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s, +@@ -862,7 +863,11 @@ { SSL_CTX *ctx = mctx->ssl_ctx; +#if MODSSL_USE_OPENSSL_PRE_1_1_API ++ /* Note that for OpenSSL>=1.1, auto selection is enabled via ++ * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */ SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); -+#else -+ SSL_CTX_set_dh_auto(ctx, 1); +#endif SSL_CTX_set_info_callback(ctx, ssl_callback_Info); -@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s, +@@ -871,6 +876,23 @@ #endif } @@ -68,7 +66,7 @@ index 4da24eddcc..5d199cddaf 100644 static apr_status_t ssl_init_ctx_verify(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, -@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, +@@ -911,10 +933,8 @@ ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, "Configuring client authentication"); @@ -81,7 +79,7 @@ index 4da24eddcc..5d199cddaf 100644 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) "Unable to configure verify locations " "for client authentication"); -@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, +@@ -999,6 +1019,23 @@ return APR_SUCCESS; } @@ -105,7 +103,7 @@ index 4da24eddcc..5d199cddaf 100644 static apr_status_t ssl_init_ctx_crl(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, -@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, +@@ -1037,8 +1074,8 @@ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) "Configuring certificate revocation facility"); @@ -116,7 +114,7 @@ index 4da24eddcc..5d199cddaf 100644 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) "Host %s: unable to configure X.509 CRL storage " "for certificate revocation", mctx->sc->vhost_id); -@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag, +@@ -1267,6 +1304,31 @@ return 0; } @@ -148,7 +146,7 @@ index 4da24eddcc..5d199cddaf 100644 static apr_status_t ssl_init_server_certs(server_rec *s, apr_pool_t *p, apr_pool_t *ptemp, -@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, +@@ -1277,7 +1339,7 @@ const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; int i; X509 *cert; @@ -157,7 +155,7 @@ index 4da24eddcc..5d199cddaf 100644 #ifdef HAVE_ECC EC_GROUP *ecparams = NULL; int nid; -@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, +@@ -1372,8 +1434,7 @@ } else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, SSL_FILETYPE_PEM) < 1) @@ -167,13 +165,15 @@ index 4da24eddcc..5d199cddaf 100644 ssl_asn1_t *asn1; const unsigned char *ptr; -@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s, +@@ -1462,13 +1523,22 @@ */ certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); if (certfile && !modssl_is_engine_id(certfile) - && (dhparams = ssl_dh_GetParamFromFile(certfile))) { - SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); + && (dh = ssl_dh_GetParamFromFile(certfile))) { ++ /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() ++ * for OpenSSL 3.0+. */ + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) "Custom DH parameters (%d bits) for %s loaded from %s", @@ -182,9 +182,17 @@ index 4da24eddcc..5d199cddaf 100644 + modssl_DH_bits(dh), vhost_id, certfile); + DH_free(dh); } ++#if !MODSSL_USE_OPENSSL_PRE_1_1_API ++ else { ++ /* If no parameter is manually configured, enable auto ++ * selection. */ ++ SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); ++ } ++#endif #ifdef HAVE_ECC -@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, + /* +@@ -1518,6 +1588,7 @@ char buf[TLSEXT_TICKET_KEY_LEN]; char *path; modssl_ticket_key_t *ticket_key = mctx->ticket_key; @@ -192,7 +200,7 @@ index 4da24eddcc..5d199cddaf 100644 if (!ticket_key->file_path) { return APR_SUCCESS; -@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, +@@ -1545,11 +1616,22 @@ } memcpy(ticket_key->key_name, buf, 16); @@ -219,7 +227,7 @@ index 4da24eddcc..5d199cddaf 100644 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) "Unable to initialize TLS session ticket key callback " "(incompatible OpenSSL version?)"); -@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, +@@ -1680,7 +1762,7 @@ return ssl_die(s); } @@ -228,7 +236,7 @@ index 4da24eddcc..5d199cddaf 100644 for (n = 0; n < ncerts; n++) { int i; -@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data) +@@ -2277,10 +2359,11 @@ } @@ -242,11 +250,9 @@ index 4da24eddcc..5d199cddaf 100644 return APR_SUCCESS; } -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index cabf753790..3db7077f1e 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio) +--- httpd-2.4.51/modules/ssl/ssl_engine_io.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_io.c +@@ -194,6 +194,10 @@ static int bio_filter_out_read(BIO *bio, char *out, int outl) { /* this is never called */ @@ -257,7 +263,7 @@ index cabf753790..3db7077f1e 100644 return -1; } -@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr) +@@ -293,12 +297,20 @@ static int bio_filter_out_gets(BIO *bio, char *buf, int size) { /* this is never called */ @@ -278,7 +284,7 @@ index cabf753790..3db7077f1e 100644 return -1; } -@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) +@@ -533,22 +545,47 @@ static int bio_filter_in_write(BIO *bio, const char *in, int inl) { @@ -327,7 +333,7 @@ index cabf753790..3db7077f1e 100644 } #if MODSSL_USE_OPENSSL_PRE_1_1_API -@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = { +@@ -573,7 +610,7 @@ bio_filter_in_read, bio_filter_in_puts, /* puts is never called */ bio_filter_in_gets, /* gets is never called */ @@ -336,11 +342,9 @@ index cabf753790..3db7077f1e 100644 bio_filter_create, bio_filter_destroy, NULL -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index b99dcf19d4..aced92d2d0 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client = +--- httpd-2.4.51/modules/ssl/ssl_engine_kernel.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_kernel.c +@@ -1685,6 +1685,7 @@ ** _________________________________________________________________ */ @@ -348,7 +352,7 @@ index b99dcf19d4..aced92d2d0 100644 /* * Hand out standard DH parameters, based on the authentication strength */ -@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen) +@@ -1730,6 +1731,7 @@ return modssl_get_dh_params(keylen); } @@ -356,7 +360,7 @@ index b99dcf19d4..aced92d2d0 100644 /* * This OpenSSL callback function is called when OpenSSL -@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl, +@@ -2614,7 +2616,11 @@ unsigned char *keyname, unsigned char *iv, EVP_CIPHER_CTX *cipher_ctx, @@ -369,7 +373,7 @@ index b99dcf19d4..aced92d2d0 100644 int mode) { conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl, +@@ -2640,7 +2646,13 @@ } EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, ticket_key->aes_key, iv); @@ -384,7 +388,7 @@ index b99dcf19d4..aced92d2d0 100644 ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) "TLS session ticket key for %s successfully set, " -@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl, +@@ -2661,7 +2673,13 @@ EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, ticket_key->aes_key, iv); @@ -399,11 +403,9 @@ index b99dcf19d4..aced92d2d0 100644 ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) "TLS session ticket key for %s successfully set, " -diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c -index 7dbbbdb55e..3b3ceacf0a 100644 ---- a/modules/ssl/ssl_engine_log.c -+++ b/modules/ssl/ssl_engine_log.c -@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s) +--- httpd-2.4.51/modules/ssl/ssl_engine_log.c.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_engine_log.c +@@ -78,6 +78,16 @@ return APR_EGENERAL; } @@ -420,7 +422,7 @@ index 7dbbbdb55e..3b3ceacf0a 100644 /* * Prints the SSL library error information. */ -@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s) +@@ -87,7 +97,7 @@ const char *data; int flags; @@ -429,10 +431,8 @@ index 7dbbbdb55e..3b3ceacf0a 100644 const char *annotation; char err[256]; -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index a6fc7513a2..b091c58c94 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h +--- httpd-2.4.51/modules/ssl/ssl_private.h.openssl3 ++++ httpd-2.4.51/modules/ssl/ssl_private.h @@ -89,6 +89,9 @@ /* must be defined before including ssl.h */ #define OPENSSL_NO_SSL_INTERN @@ -459,7 +459,7 @@ index a6fc7513a2..b091c58c94 100644 #else /* defined(LIBRESSL_VERSION_NUMBER) */ #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) #endif -@@ -674,7 +676,11 @@ typedef struct { +@@ -681,7 +683,11 @@ typedef struct { const char *file_path; unsigned char key_name[16]; @@ -471,7 +471,7 @@ index a6fc7513a2..b091c58c94 100644 unsigned char aes_key[16]; } modssl_ticket_key_t; #endif -@@ -938,8 +944,16 @@ int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); +@@ -945,8 +951,16 @@ int ssl_callback_ClientHello(SSL *, int *, void *); #endif #ifdef HAVE_TLS_SESSION_TICKETS @@ -490,7 +490,7 @@ index a6fc7513a2..b091c58c94 100644 #endif #ifdef HAVE_TLS_ALPN -@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx); +@@ -1124,10 +1138,12 @@ #endif diff --git a/httpd.spec b/httpd.spec index 77b51a8..0cd12da 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.51 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -75,7 +75,7 @@ Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.48-openssl3.patch +Patch28: httpd-2.4.51-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Oct 12 2021 Joe Orton - 2.4.51-2 +- mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) + * Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 - new version 2.4.51 From 331f0eab0a43fa1bf94ad70189f5443e3607d0f0 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 13:54:10 +0100 Subject: [PATCH 043/147] Add rpminspect waivers. --- rpminspect.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..1b4f2fe --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,6 @@ +--- +badfuncs: + # mod_proxy uses inet_ntoa (safely) for IPv4 address matching, + # and APR interfaces for IPv6 addresses. + ignore: + - /usr/lib*/httpd/modules/mod_proxy.so From 913d808969a8223ce7c7c242305fabc7c5eeed9e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 14:01:42 +0100 Subject: [PATCH 044/147] Bump to .51. --- pullrev.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pullrev.sh b/pullrev.sh index f7fb600..87b7cd7 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.48 +#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +ver=2.4.51 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From 923974e191bcfae8a714c666e7ba75566c72aeb3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Oct 2021 14:01:48 +0100 Subject: [PATCH 045/147] - mod_deflate/core: add two brigade handling correctness fixes --- httpd-2.4.51-r1894150.patch | 17 +++++++++++++++++ httpd-2.4.51-r1894152.patch | 36 ++++++++++++++++++++++++++++++++++++ httpd.spec | 5 +++++ 3 files changed, 58 insertions(+) create mode 100644 httpd-2.4.51-r1894150.patch create mode 100644 httpd-2.4.51-r1894152.patch diff --git a/httpd-2.4.51-r1894150.patch b/httpd-2.4.51-r1894150.patch new file mode 100644 index 0000000..c8acff9 --- /dev/null +++ b/httpd-2.4.51-r1894150.patch @@ -0,0 +1,17 @@ +# ./pullrev.sh 1894150 +http://svn.apache.org/viewvc?view=revision&revision=1894150 + +--- httpd-2.4.51/server/util_filter.c ++++ httpd-2.4.51/server/util_filter.c +@@ -565,8 +565,9 @@ + apr_bucket_brigade *bb) + { + if (next) { +- apr_bucket *e; +- if ((e = APR_BRIGADE_LAST(bb)) && APR_BUCKET_IS_EOS(e) && next->r) { ++ apr_bucket *e = APR_BRIGADE_LAST(bb); ++ ++ if (e != APR_BRIGADE_SENTINEL(bb) && APR_BUCKET_IS_EOS(e) && next->r) { + /* This is only safe because HTTP_HEADER filter is always in + * the filter stack. This ensures that there is ALWAYS a + * request-based filter that we can attach this to. If the diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch new file mode 100644 index 0000000..95f5081 --- /dev/null +++ b/httpd-2.4.51-r1894152.patch @@ -0,0 +1,36 @@ +# ./pullrev.sh 1894152 +http://svn.apache.org/viewvc?view=revision&revision=1894152 + +--- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 ++++ httpd-2.4.51/modules/filters/mod_deflate.c +@@ -835,6 +835,7 @@ + while (!APR_BRIGADE_EMPTY(bb)) + { + apr_bucket *b; ++ apr_status_t rv; + + /* + * Optimization: If we are a HEAD request and bytes_sent is not zero +@@ -914,8 +915,6 @@ + } + + if (APR_BUCKET_IS_FLUSH(e)) { +- apr_status_t rv; +- + /* flush the remaining data from the zlib buffers */ + zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate, + Z_SYNC_FLUSH, NO_UPDATE_CRC); +@@ -947,7 +946,12 @@ + } + + /* read */ +- apr_bucket_read(e, &data, &len, APR_BLOCK_READ); ++ rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ); ++ if (rv) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298) ++ "failed reading from %s bucket", e->type->name); ++ return rv; ++ } + if (!len) { + apr_bucket_delete(e); + continue; diff --git a/httpd.spec b/httpd.spec index 0cd12da..9c21ef8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -90,6 +90,8 @@ Patch45: httpd-2.4.43-logjournal.patch Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch +Patch64: httpd-2.4.51-r1894150.patch +Patch65: httpd-2.4.51-r1894152.patch # Security fixes @@ -241,6 +243,8 @@ written in the Lua programming language. %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break +%patch64 -p1 -b .r1894150 +%patch65 -p1 -b .r1894152 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -789,6 +793,7 @@ exit $rv %changelog * Tue Oct 12 2021 Joe Orton - 2.4.51-2 - mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) +- mod_deflate/core: add two brigade handling correctness fixes * Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 - new version 2.4.51 From 34c723953e0376307087f3d5eaa2149f7c421d5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 15 Oct 2021 16:31:44 +0200 Subject: [PATCH 046/147] Added gating for 'testing' --- gating.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gating.yaml b/gating.yaml index ce08116..e4c04e7 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,4 +1,13 @@ --- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_testing] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rawhide +--- !Policy product_versions: - fedora-* decision_contexts: [bodhi_update_push_stable] From 4916eeea5bf7043cec58d0b56ac1c8de2ff1bdcf Mon Sep 17 00:00:00 2001 From: Neal Gompa Date: Mon, 6 Dec 2021 19:35:37 -0500 Subject: [PATCH 047/147] Use NAME from os-release(5) for vendor string Related: #2029071 httpd on CentOS identifies as RHEL --- httpd.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 9c21ef8..31ff412 100644 --- a/httpd.spec +++ b/httpd.spec @@ -3,7 +3,7 @@ %define suexec_caller apache %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} -%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT}) +%define vstring %(source /etc/os-release; echo ${NAME}) %if 0%{?fedora} > 26 || 0%{?rhel} > 7 %global mpm event %else @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.51 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -791,6 +791,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Dec 06 2021 Neal Gompa - 2.4.51-3 +- Use NAME from os-release(5) for vendor string + Related: #2029071 - httpd on CentOS identifies as RHEL + * Tue Oct 12 2021 Joe Orton - 2.4.51-2 - mod_ssl: updated patch for OpenSSL 3.0 compatibility (#2007178) - mod_deflate/core: add two brigade handling correctness fixes From 47d608302424bd85de32bdd0f405fb217c8d1950 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 22 Dec 2021 08:13:43 +0000 Subject: [PATCH 048/147] update to 2.4.52 Resolves: rhbz#2034673 Resolves: rhbz#2034675 --- .gitignore | 1 + httpd-2.4.51-openssl3.patch | 505 ------------------------------------ httpd-2.4.51-r1894150.patch | 17 -- httpd.spec | 11 +- sources | 4 +- 5 files changed, 8 insertions(+), 530 deletions(-) delete mode 100644 httpd-2.4.51-openssl3.patch delete mode 100644 httpd-2.4.51-r1894150.patch diff --git a/.gitignore b/.gitignore index bd6e204..a6fac0d 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ x86_64 /httpd-2.4.49.tar.bz2.asc /httpd-2.4.50.tar.bz2.asc /httpd-2.4.51.tar.bz2.asc +/httpd-2.4.52.tar.bz2.asc diff --git a/httpd-2.4.51-openssl3.patch b/httpd-2.4.51-openssl3.patch deleted file mode 100644 index a4423c7..0000000 --- a/httpd-2.4.51-openssl3.patch +++ /dev/null @@ -1,505 +0,0 @@ - -https://github.com/apache/httpd/pull/258 - ---- httpd-2.4.51/modules/ssl/ssl_engine_init.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_init.c -@@ -91,7 +91,6 @@ - - return 1; - } --#endif - - /* - * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* -@@ -171,6 +170,7 @@ - - return NULL; /* impossible to reach. */ - } -+#endif - - static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, - server_rec *s) -@@ -440,8 +440,9 @@ - - modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - init_dh_params(); --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#else - init_bio_methods(); - #endif - -@@ -862,7 +863,11 @@ - { - SSL_CTX *ctx = mctx->ssl_ctx; - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ /* Note that for OpenSSL>=1.1, auto selection is enabled via -+ * SSL_CTX_set_dh_auto(,1) if no parameter is configured. */ - SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); -+#endif - - SSL_CTX_set_info_callback(ctx, ssl_callback_Info); - -@@ -871,6 +876,23 @@ - #endif - } - -+static APR_INLINE -+int modssl_CTX_load_verify_locations(SSL_CTX *ctx, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!SSL_CTX_load_verify_locations(ctx, file, path)) -+ return 0; -+#else -+ if (file && !SSL_CTX_load_verify_file(ctx, file)) -+ return 0; -+ if (path && !SSL_CTX_load_verify_dir(ctx, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_verify(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -911,10 +933,8 @@ - ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, - "Configuring client authentication"); - -- if (!SSL_CTX_load_verify_locations(ctx, -- mctx->auth.ca_cert_file, -- mctx->auth.ca_cert_path)) -- { -+ if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, -+ mctx->auth.ca_cert_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) - "Unable to configure verify locations " - "for client authentication"); -@@ -999,6 +1019,23 @@ - return APR_SUCCESS; - } - -+static APR_INLINE -+int modssl_X509_STORE_load_locations(X509_STORE *store, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!X509_STORE_load_locations(store, file, path)) -+ return 0; -+#else -+ if (file && !X509_STORE_load_file(store, file)) -+ return 0; -+ if (path && !X509_STORE_load_path(store, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_crl(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1037,8 +1074,8 @@ - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) - "Configuring certificate revocation facility"); - -- if (!store || !X509_STORE_load_locations(store, mctx->crl_file, -- mctx->crl_path)) { -+ if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file, -+ mctx->crl_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) - "Host %s: unable to configure X.509 CRL storage " - "for certificate revocation", mctx->sc->vhost_id); -@@ -1267,6 +1304,31 @@ - return 0; - } - -+static APR_INLINE int modssl_DH_bits(DH *dh) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return DH_bits(dh); -+#else -+ return BN_num_bits(DH_get0_p(dh)); -+#endif -+} -+ -+/* SSL_CTX_use_PrivateKey_file() can fail either because the private -+ * key was encrypted, or due to a mismatch between an already-loaded -+ * cert and the key - a common misconfiguration - from calling -+ * X509_check_private_key(). This macro is passed the last error code -+ * off the OpenSSL stack and evaluates to true only for the first -+ * case. With OpenSSL < 3 the second case is identifiable by the -+ * function code, but function codes are not used from 3.0. */ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY) -+#else -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509 \ -+ || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE)) -+#endif -+ - static apr_status_t ssl_init_server_certs(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1277,7 +1339,7 @@ - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; - X509 *cert; -- DH *dhparams; -+ DH *dh; - #ifdef HAVE_ECC - EC_GROUP *ecparams = NULL; - int nid; -@@ -1372,8 +1434,7 @@ - } - else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, - SSL_FILETYPE_PEM) < 1) -- && (ERR_GET_FUNC(ERR_peek_last_error()) -- != X509_F_X509_CHECK_PRIVATE_KEY)) { -+ && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) { - ssl_asn1_t *asn1; - const unsigned char *ptr; - -@@ -1462,13 +1523,22 @@ - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); - if (certfile && !modssl_is_engine_id(certfile) -- && (dhparams = ssl_dh_GetParamFromFile(certfile))) { -- SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); -+ && (dh = ssl_dh_GetParamFromFile(certfile))) { -+ /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() -+ * for OpenSSL 3.0+. */ -+ SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- DH_bits(dhparams), vhost_id, certfile); -- DH_free(dhparams); -+ modssl_DH_bits(dh), vhost_id, certfile); -+ DH_free(dh); - } -+#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+ else { -+ /* If no parameter is manually configured, enable auto -+ * selection. */ -+ SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); -+ } -+#endif - - #ifdef HAVE_ECC - /* -@@ -1518,6 +1588,7 @@ - char buf[TLSEXT_TICKET_KEY_LEN]; - char *path; - modssl_ticket_key_t *ticket_key = mctx->ticket_key; -+ int res; - - if (!ticket_key->file_path) { - return APR_SUCCESS; -@@ -1545,11 +1616,22 @@ - } - - memcpy(ticket_key->key_name, buf, 16); -- memcpy(ticket_key->hmac_secret, buf + 16, 16); - memcpy(ticket_key->aes_key, buf + 32, 16); -- -- if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -- ssl_callback_SessionTicket)) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ memcpy(ticket_key->hmac_secret, buf + 16, 16); -+ res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#else -+ ticket_key->mac_params[0] = -+ OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16); -+ ticket_key->mac_params[1] = -+ OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); -+ ticket_key->mac_params[2] = -+ OSSL_PARAM_construct_end(); -+ res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#endif -+ if (!res) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) - "Unable to initialize TLS session ticket key callback " - "(incompatible OpenSSL version?)"); -@@ -1680,7 +1762,7 @@ - return ssl_die(s); - } - -- X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); -+ modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); - - for (n = 0; n < ncerts; n++) { - int i; -@@ -2277,10 +2359,11 @@ - - } - --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ free_dh_params(); -+#else - free_bio_methods(); - #endif -- free_dh_params(); - - return APR_SUCCESS; - } ---- httpd-2.4.51/modules/ssl/ssl_engine_io.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_io.c -@@ -194,6 +194,10 @@ - static int bio_filter_out_read(BIO *bio, char *out, int outl) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_read"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -293,12 +297,20 @@ - static int bio_filter_out_gets(BIO *bio, char *buf, int size) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_out_puts(BIO *bio, const char *str) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -533,22 +545,47 @@ - - static int bio_filter_in_write(BIO *bio, const char *in, int inl) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_write"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_puts(BIO *bio, const char *str) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_gets(BIO *bio, char *buf, int size) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr) - { -- return -1; -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ switch (cmd) { -+#ifdef BIO_CTRL_EOF -+ case BIO_CTRL_EOF: -+ return inctx->rc == APR_EOF; -+#endif -+ default: -+ break; -+ } -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: bio_filter_in_ctrl() should not be called with cmd=%i", -+ cmd); -+ AP_DEBUG_ASSERT(0); -+ return 0; - } - - #if MODSSL_USE_OPENSSL_PRE_1_1_API -@@ -573,7 +610,7 @@ - bio_filter_in_read, - bio_filter_in_puts, /* puts is never called */ - bio_filter_in_gets, /* gets is never called */ -- bio_filter_in_ctrl, /* ctrl is never called */ -+ bio_filter_in_ctrl, /* ctrl is called for EOF check */ - bio_filter_create, - bio_filter_destroy, - NULL ---- httpd-2.4.51/modules/ssl/ssl_engine_kernel.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_kernel.c -@@ -1685,6 +1685,7 @@ - ** _________________________________________________________________ - */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* - * Hand out standard DH parameters, based on the authentication strength - */ -@@ -1730,6 +1731,7 @@ - - return modssl_get_dh_params(keylen); - } -+#endif - - /* - * This OpenSSL callback function is called when OpenSSL -@@ -2614,7 +2616,11 @@ - unsigned char *keyname, - unsigned char *iv, - EVP_CIPHER_CTX *cipher_ctx, -- HMAC_CTX *hctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif - int mode) - { - conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -@@ -2640,7 +2646,13 @@ - } - EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) - "TLS session ticket key for %s successfully set, " -@@ -2661,7 +2673,13 @@ - - EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) - "TLS session ticket key for %s successfully set, " ---- httpd-2.4.51/modules/ssl/ssl_engine_log.c.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_engine_log.c -@@ -78,6 +78,16 @@ - return APR_EGENERAL; - } - -+static APR_INLINE -+unsigned long modssl_ERR_peek_error_data(const char **data, int *flags) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return ERR_peek_error_line_data(NULL, NULL, data, flags); -+#else -+ return ERR_peek_error_data(data, flags); -+#endif -+} -+ - /* - * Prints the SSL library error information. - */ -@@ -87,7 +97,7 @@ - const char *data; - int flags; - -- while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) { -+ while ((e = modssl_ERR_peek_error_data(&data, &flags))) { - const char *annotation; - char err[256]; - ---- httpd-2.4.51/modules/ssl/ssl_private.h.openssl3 -+++ httpd-2.4.51/modules/ssl/ssl_private.h -@@ -89,6 +89,9 @@ - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - #include - #include - #include -@@ -134,13 +137,12 @@ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) - #define SSL_CTX_set_max_proto_version(ctx, version) \ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) --#elif LIBRESSL_VERSION_NUMBER < 0x2070000f -+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ - /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (1) --#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ -+#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) - #else /* defined(LIBRESSL_VERSION_NUMBER) */ - #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) - #endif -@@ -681,7 +683,11 @@ - typedef struct { - const char *file_path; - unsigned char key_name[16]; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - unsigned char hmac_secret[16]; -+#else -+ OSSL_PARAM mac_params[3]; -+#endif - unsigned char aes_key[16]; - } modssl_ticket_key_t; - #endif -@@ -945,8 +951,16 @@ - int ssl_callback_ClientHello(SSL *, int *, void *); - #endif - #ifdef HAVE_TLS_SESSION_TICKETS --int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *, -- EVP_CIPHER_CTX *, HMAC_CTX *, int); -+int ssl_callback_SessionTicket(SSL *ssl, -+ unsigned char *keyname, -+ unsigned char *iv, -+ EVP_CIPHER_CTX *cipher_ctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif -+ int mode); - #endif - - #ifdef HAVE_TLS_ALPN -@@ -1124,10 +1138,12 @@ - - #endif - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* Retrieve DH parameters for given key length. Return value should - * be treated as unmutable, since it is stored in process-global - * memory. */ - DH *modssl_get_dh_params(unsigned keylen); -+#endif - - /* Returns non-zero if the request was made over SSL/TLS. If sslconn - * is non-NULL and the request is using SSL/TLS, sets *sslconn to the diff --git a/httpd-2.4.51-r1894150.patch b/httpd-2.4.51-r1894150.patch deleted file mode 100644 index c8acff9..0000000 --- a/httpd-2.4.51-r1894150.patch +++ /dev/null @@ -1,17 +0,0 @@ -# ./pullrev.sh 1894150 -http://svn.apache.org/viewvc?view=revision&revision=1894150 - ---- httpd-2.4.51/server/util_filter.c -+++ httpd-2.4.51/server/util_filter.c -@@ -565,8 +565,9 @@ - apr_bucket_brigade *bb) - { - if (next) { -- apr_bucket *e; -- if ((e = APR_BRIGADE_LAST(bb)) && APR_BUCKET_IS_EOS(e) && next->r) { -+ apr_bucket *e = APR_BRIGADE_LAST(bb); -+ -+ if (e != APR_BRIGADE_SENTINEL(bb) && APR_BUCKET_IS_EOS(e) && next->r) { - /* This is only safe because HTTP_HEADER filter is always in - * the filter stack. This ensures that there is ALWAYS a - * request-based filter that we can attach this to. If the diff --git a/httpd.spec b/httpd.spec index 31ff412..7c583c1 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.51 -Release: 3%{?dist} +Version: 2.4.52 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -75,7 +75,6 @@ Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.51-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -90,7 +89,6 @@ Patch45: httpd-2.4.43-logjournal.patch Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch -Patch64: httpd-2.4.51-r1894150.patch Patch65: httpd-2.4.51-r1894152.patch # Security fixes @@ -230,7 +228,6 @@ written in the Lua programming language. %patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons -%patch28 -p1 -b .openssl3 %patch30 -p1 -b .cachehardmax %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault @@ -243,7 +240,6 @@ written in the Lua programming language. %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break -%patch64 -p1 -b .r1894150 %patch65 -p1 -b .r1894152 # Patch in the vendor string @@ -791,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Dec 22 2021 Joe Orton - 2.4.52-1 +- update to 2.4.52 + * Mon Dec 06 2021 Neal Gompa - 2.4.51-3 - Use NAME from os-release(5) for vendor string Related: #2029071 - httpd on CentOS identifies as RHEL diff --git a/sources b/sources index edbf616..ccf6e13 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 -SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6 +SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05 From d5e28192c4045e2a9b78f51ed763fe7b05386893 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 12:29:29 +0000 Subject: [PATCH 049/147] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 7c583c1..c5b0b35 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -787,6 +787,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 2.4.52-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Wed Dec 22 2021 Joe Orton - 2.4.52-1 - update to 2.4.52 From 545b11ecf3afe92e32207d094d9d539807c9b4c5 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 28 Jan 2022 12:02:05 +0000 Subject: [PATCH 050/147] use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk --- httpd.spec | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index c5b0b35..6eed48d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -553,9 +553,12 @@ sed -i '/instdso/s,top_srcdir,top_builddir,' \ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk -# Sanitize CFLAGS in standard config_vars.mk -sed '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ +# Sanitize CFLAGS & LIBTOOL in standard config_vars.mk +sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ + -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \ -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk +diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \ + $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk || true sed 's/config_vars.mk/vendor_config_vars.mk/' \ $RPM_BUILD_ROOT%{_bindir}/apxs \ @@ -787,6 +790,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jan 28 2022 Joe Orton - 2.4.52-3 +- use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk + * Thu Jan 20 2022 Fedora Release Engineering - 2.4.52-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 98c306e3f2467bdb17e9664f4e1a7803105098a8 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 31 Jan 2022 08:23:58 +0000 Subject: [PATCH 051/147] add libtool to Requires: for httpd-devel (#2048281) Resolves: rhbz#2048281 --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 6eed48d..dab255b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -120,7 +120,7 @@ web server. %package devel Summary: Development interfaces for the Apache HTTP Server -Requires: apr-devel, apr-util-devel, pkgconfig +Requires: apr-devel, apr-util-devel, pkgconfig, libtool Requires: httpd = %{version}-%{release} %description devel @@ -790,6 +790,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jan 31 2022 Joe Orton - 2.4.52-4 +- add libtool to Requires: for httpd-devel (#2048281) + * Fri Jan 28 2022 Joe Orton - 2.4.52-3 - use LIBTOOL=/usr/bin/libtool in the non-vendor config_vars.mk From af43dc5b98bddfb6c0e9d366b330b07b17f92f62 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 1 Feb 2022 08:59:37 +0000 Subject: [PATCH 052/147] rebuild for new OpenLDAP (#2032699) Resolves: rhbz#2032699 --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index dab255b..95dca7d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.52 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -790,6 +790,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Feb 1 2022 Joe Orton - 2.4.52-5 +- rebuild for new OpenLDAP (#2032699) + * Mon Jan 31 2022 Joe Orton - 2.4.52-4 - add libtool to Requires: for httpd-devel (#2048281) From cd09c3e5ec09991525f4223c7b03eb5ede6b1d37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 17 Mar 2022 15:44:05 +0100 Subject: [PATCH 053/147] new version 2.4.53 fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 --- .gitignore | 1 + ...md.patch => httpd-2.4.53-detect-systemd.patch | 16 ++++++++-------- ....48-export.patch => httpd-2.4.53-export.patch | 13 +++---------- httpd.spec | 12 ++++++++---- sources | 4 ++-- 5 files changed, 22 insertions(+), 24 deletions(-) rename httpd-2.4.43-detect-systemd.patch => httpd-2.4.53-detect-systemd.patch (76%) rename httpd-2.4.48-export.patch => httpd-2.4.53-export.patch (83%) diff --git a/.gitignore b/.gitignore index a6fac0d..64b8899 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ x86_64 /httpd-2.4.50.tar.bz2.asc /httpd-2.4.51.tar.bz2.asc /httpd-2.4.52.tar.bz2.asc +/httpd-2.4.53.tar.bz2.asc diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch similarity index 76% rename from httpd-2.4.43-detect-systemd.patch rename to httpd-2.4.53-detect-systemd.patch index 540687f..d501b06 100644 --- a/httpd-2.4.43-detect-systemd.patch +++ b/httpd-2.4.53-detect-systemd.patch @@ -1,5 +1,5 @@ diff --git a/Makefile.in b/Makefile.in -index 0b088ac..9eeb5c7 100644 +index a2e9c82..bd8045c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test @@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644 PROGRAM_DEPENDENCIES = \ server/libmain.la \ diff --git a/acinclude.m4 b/acinclude.m4 -index 2a7e5d1..eb28321 100644 +index 97484c9..05abe18 100644 --- a/acinclude.m4 +++ b/acinclude.m4 -@@ -624,6 +624,7 @@ case $host in +@@ -631,6 +631,7 @@ case $host in if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then AC_MSG_WARN([Your system does not support systemd.]) else @@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644 fi fi diff --git a/configure.in b/configure.in -index 3618a5a..74a782b 100644 +index cf437fe..521fc45 100644 --- a/configure.in +++ b/configure.in -@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then +@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) - APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`]) + APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`]) + APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) else - AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/]) + AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/]) fi -@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR) +@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR) APACHE_SUBST(BUILTIN_LIBS) APACHE_SUBST(SHLIBPATH_VAR) APACHE_SUBST(OS_SPECIFIC_VARS) diff --git a/httpd-2.4.48-export.patch b/httpd-2.4.53-export.patch similarity index 83% rename from httpd-2.4.48-export.patch rename to httpd-2.4.53-export.patch index 439f768..d240360 100644 --- a/httpd-2.4.48-export.patch +++ b/httpd-2.4.53-export.patch @@ -1,12 +1,5 @@ - -Reduce size of httpd binary by telling linker to export all symbols -from libmain.a, rather than bloating the symbol table with ap_hack_* -to do so indirectly. - -Upstream: https://svn.apache.org/r1861685 (as new default-off configure option) - diff --git a/Makefile.in b/Makefile.in -index 40c7076..ac98e5f 100644 +index bd8045c..d6733a5 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test @@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644 eoc_bucket.c eor_bucket.c core_filters.c \ util_expr_parse.c util_expr_scan.c util_expr_eval.c diff --git a/server/main.c b/server/main.c -index 62e06df..17c09ee 100644 +index 7da7aa2..e63d2eb 100644 --- a/server/main.c +++ b/server/main.c -@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[]) +@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[]) return !OK; } diff --git a/httpd.spec b/httpd.spec index 95dca7d..713b5f9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.52 -Release: 5%{?dist} +Version: 2.4.53 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -66,11 +66,11 @@ Source48: apache-poweredby.png Patch2: httpd-2.4.43-apxs.patch Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.43-detect-systemd.patch +Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.48-export.patch +Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch @@ -790,6 +790,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 +- new version 2.4.53 +- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 + * Tue Feb 1 2022 Joe Orton - 2.4.52-5 - rebuild for new OpenLDAP (#2032699) diff --git a/sources b/sources index ccf6e13..36266ed 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ +SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756 +SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 -SHA512 (httpd-2.4.52.tar.bz2) = 97c021c576022a9d32f4a390f62e07b5f550973aef2f299fd52defce1a9fa5d27bd4a676e7bf214373ba46063d34aecce42de62fdd93678a4e925cfcbb2afdf6 -SHA512 (httpd-2.4.52.tar.bz2.asc) = 59b8b86a9626525868ef72cfd8192102db0dc1e6a257040331b4a9abb872cbeace2fbc5c961c5dc35e7900eef987107ed3732e6527eb289fc9cf47654eec3f05 From d9ddc5dc92dab5509d5c763fd25ff7bfcd55b322 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 30 Mar 2022 19:33:41 +0200 Subject: [PATCH 054/147] Try to minimize httpd dependencies - essential binaries moved to httpd-core package - mod_brotli and mod_systemd are now in httpd main package together with .service files - httpd is no longer linked (-lsystemd), all systemd functions moved to mod_systemd module which is now shipped in main httpd package --- 00-base.conf | 1 - 00-brotli.conf | 1 + httpd-2.4.53-separate-systemd-fns.patch | 264 ++++++++++++++++++++++++ httpd.spec | 60 ++++-- 4 files changed, 307 insertions(+), 19 deletions(-) create mode 100644 00-brotli.conf create mode 100644 httpd-2.4.53-separate-systemd-fns.patch diff --git a/00-base.conf b/00-base.conf index 7cabce0..d0123d1 100644 --- a/00-base.conf +++ b/00-base.conf @@ -23,7 +23,6 @@ LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_owner_module modules/mod_authz_owner.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule autoindex_module modules/mod_autoindex.so -LoadModule brotli_module modules/mod_brotli.so LoadModule cache_module modules/mod_cache.so LoadModule cache_disk_module modules/mod_cache_disk.so LoadModule cache_socache_module modules/mod_cache_socache.so diff --git a/00-brotli.conf b/00-brotli.conf new file mode 100644 index 0000000..c2e0e9e --- /dev/null +++ b/00-brotli.conf @@ -0,0 +1 @@ +LoadModule brotli_module modules/mod_brotli.so diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch new file mode 100644 index 0000000..14c5f70 --- /dev/null +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -0,0 +1,264 @@ +diff --git a/acinclude.m4 b/acinclude.m4 +index 05abe18..97484c9 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -631,7 +631,6 @@ case $host in + if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then + AC_MSG_WARN([Your system does not support systemd.]) + else +- APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS]) + AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) + fi + fi +diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c +index eda1272..fc059fc 100644 +--- a/modules/arch/unix/mod_systemd.c ++++ b/modules/arch/unix/mod_systemd.c +@@ -35,6 +35,15 @@ + #include + #endif + ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_journal_stream_fd, (const char *, int, int)); ++ + static char describe_listeners[30]; + + static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog, +@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s) + return DECLINED; + } + ++static int ap_find_systemd_socket(process_rec * process, apr_port_t port) { ++ int fdcount, fd; ++ int sdc = sd_listen_fds(0); ++ ++ if (sdc < 0) { ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) ++ "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", ++ sdc); ++ return -1; ++ } ++ ++ if (sdc == 0) { ++ ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) ++ "find_systemd_socket: At least one socket must be set."); ++ return -1; ++ } ++ ++ fdcount = atoi(getenv("LISTEN_FDS")); ++ for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { ++ if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { ++ return fd; ++ } ++ } ++ ++ return -1; ++} ++ ++static int ap_systemd_listen_fds(int unset_environment){ ++ return sd_listen_fds(unset_environment); ++} ++ ++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){ ++ return sd_journal_stream_fd("httpd", priority, 0); ++} ++ + static void systemd_register_hooks(apr_pool_t *p) + { ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds); ++ APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket); ++ APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ + /* Enable ap_extended_status. */ + ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST); + /* Signal service is ready. */ +diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4 +index 0848d2e..8af2299 100644 +--- a/modules/loggers/config.m4 ++++ b/modules/loggers/config.m4 +@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]]) + APACHE_MODPATH_INIT(loggers) + + APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes) +-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS]) + + APACHE_MODULE(log_debug, configurable debug logging, , , most) + APACHE_MODULE(log_forensic, forensic logging) +diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c +index 0b11f60..04f08ca 100644 +--- a/modules/loggers/mod_log_config.c ++++ b/modules/loggers/mod_log_config.c +@@ -172,14 +172,16 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" + + module AP_MODULE_DECLARE_DATA log_config_module; + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_journal_stream_fd, (const char *, int, int)); ++ ++#endif ++ + + static int xfer_flags = (APR_WRITE | APR_APPEND | APR_CREATE | APR_LARGEFILE); + static apr_fileperms_t xfer_perms = APR_OS_DEFAULT; +@@ -1640,8 +1642,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, + { + #ifdef HAVE_SYSTEMD + int fd; ++ APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd; ++ ++ systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd); ++ if (systemd_journal_stream_fd == NULL) { ++ return APR_ENOTIMPL; ++ } + +- fd = sd_journal_stream_fd("httpd", priority, 0); ++ fd = systemd_journal_stream_fd("httpd", priority, 0); ++ + if (fd < 0) return fd; + + /* This is an AF_UNIX socket fd so is more pipe-like than +diff --git a/server/listen.c b/server/listen.c +index e2e028a..217caf2 100644 +--- a/server/listen.c ++++ b/server/listen.c +@@ -34,10 +34,6 @@ + #include + #endif + +-#ifdef HAVE_SYSTEMD +-#include +-#endif +- + /* we know core's module_index is 0 */ + #undef APLOG_MODULE_INDEX + #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX +@@ -65,6 +61,12 @@ static int send_buffer_size; + static int receive_buffer_size; + #ifdef HAVE_SYSTEMD + static int use_systemd = -1; ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); + #endif + + /* TODO: make_sock is just begging and screaming for APR abstraction */ +@@ -325,34 +327,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, + } + + #ifdef HAVE_SYSTEMD +- +-static int find_systemd_socket(process_rec * process, apr_port_t port) { +- int fdcount, fd; +- int sdc = sd_listen_fds(0); +- +- if (sdc < 0) { +- ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486) +- "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d", +- sdc); +- return -1; +- } +- +- if (sdc == 0) { +- ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487) +- "find_systemd_socket: At least one socket must be set."); +- return -1; +- } +- +- fdcount = atoi(getenv("LISTEN_FDS")); +- for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) { +- if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) { +- return fd; +- } +- } +- +- return -1; +-} +- + static apr_status_t alloc_systemd_listener(process_rec * process, + int fd, const char *proto, + ap_listen_rec **out_rec) +@@ -412,6 +386,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, + { + ap_listen_rec *last, *new; + apr_status_t rv; ++ APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket; ++ ++ find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket); ++ ++ if (!find_systemd_socket) ++ return "Systemd socket activation is used, but mod_systemd is probably" ++ "not loaded"; ++ + int fd = find_systemd_socket(process, port); + if (fd < 0) { + return "Systemd socket activation is used, but this port is not " +@@ -438,7 +420,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, + + return NULL; + } +- + #endif /* HAVE_SYSTEMD */ + + static const char *alloc_listener(process_rec *process, const char *addr, +@@ -707,6 +688,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) + int num_listeners = 0; + const char* proto; + int found; ++#ifdef HAVE_SYSTEMD ++ APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds; ++#endif + + for (ls = s; ls; ls = ls->next) { + proto = ap_get_server_protocol(ls); +@@ -746,7 +730,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) + apr_pool_cleanup_null, s->process->pool); + } + else { +- sd_listen_fds(1); ++ systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); ++ if (systemd_listen_fds != NULL) { ++ systemd_listen_fds(1); ++ } + } + } + else +@@ -963,6 +950,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + apr_port_t port; + apr_status_t rv; + const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); ++#ifdef HAVE_SYSTEMD ++ APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds; ++#endif + + if (err != NULL) { + return err; +@@ -973,7 +963,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, + } + #ifdef HAVE_SYSTEMD + if (use_systemd == -1) { +- use_systemd = sd_listen_fds(0) > 0; ++ systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); ++ if (systemd_listen_fds != NULL) { ++ use_systemd = systemd_listen_fds(0) > 0; ++ } + } + #endif + diff --git a/httpd.spec b/httpd.spec index 713b5f9..e1b6162 100644 --- a/httpd.spec +++ b/httpd.spec @@ -52,6 +52,7 @@ Source31: README.confmod Source32: httpd.service.xml Source33: htcacheclean.service.xml Source34: httpd.conf.xml +Source35: 00-brotli.conf Source40: htcacheclean.service Source41: htcacheclean.sysconf Source42: httpd-init.service @@ -83,6 +84,7 @@ Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch +Patch46: httpd-2.4.53-separate-systemd-fns.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -99,25 +101,33 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: gnupg2 -Requires: /etc/mime.types, system-logos(httpd-logo-ng) +Requires: system-logos(httpd-logo-ng) Provides: webserver -Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} -Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} -Requires: httpd-tools = %{version}-%{release} -Requires: httpd-filesystem = %{version}-%{release} +Requires: httpd-core = 0:%{version}-%{release} Recommends: mod_http2, mod_lua -Requires(pre): httpd-filesystem Requires(preun): systemd-units Requires(postun): systemd-units Requires(post): systemd-units -Conflicts: apr < 1.5.0-1 -Provides: mod_proxy_uwsgi = %{version}-%{release} -Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 %description The Apache HTTP Server is a powerful, efficient, and extensible web server. +%package core +Summary: httpd minimal core +Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} +Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} +Provides: mod_proxy_uwsgi = %{version}-%{release} +Requires: /etc/mime.types +Requires: httpd-tools = %{version}-%{release} +Requires: httpd-filesystem = %{version}-%{release} +Requires(pre): httpd-filesystem +Conflicts: apr < 1.5.0-1 +Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 + +%description core +The httpd-core package contains essential httpd binaries. + %package devel Summary: Development interfaces for the Apache HTTP Server Requires: apr-devel, apr-util-devel, pkgconfig, libtool @@ -236,6 +246,7 @@ written in the Lua programming language. %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal +%patch46 -p1 -b .separatesystemd %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 @@ -372,7 +383,8 @@ install -m 644 $RPM_SOURCE_DIR/README.confmod \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/README for f in 00-base.conf 00-mpm.conf 00-lua.conf 01-cgi.conf 00-dav.conf \ 00-proxy.conf 00-ssl.conf 01-ldap.conf 00-proxyhtml.conf \ - 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf; do + 01-ldap.conf 00-systemd.conf 01-session.conf 00-optional.conf \ + 00-brotli.conf; do install -m 644 -p $RPM_SOURCE_DIR/$f \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.modules.d/$f done @@ -649,7 +661,21 @@ set -x exit $rv %files +%{_mandir}/man8/* +%{_mandir}/man5/* +%exclude %{_mandir}/man8/httpd-init.* +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf +%{_libdir}/httpd/modules/mod_brotli.so +%{_libdir}/httpd/modules/mod_systemd.so + +%{_unitdir}/httpd.service +%{_unitdir}/httpd@.service +%{_unitdir}/htcacheclean.service +%{_unitdir}/*.socket + +%files core %doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE %doc docs/conf/extra/*.conf %doc instance.conf server-status.conf @@ -659,6 +685,7 @@ exit $rv %{_sysconfdir}/httpd/state %{_sysconfdir}/httpd/run %dir %{_sysconfdir}/httpd/conf + %config(noreplace) %{_sysconfdir}/httpd/conf/httpd.conf %config(noreplace) %{_sysconfdir}/httpd/conf/magic @@ -670,7 +697,10 @@ exit $rv %dir %{_sysconfdir}/httpd/conf.modules.d %{_sysconfdir}/httpd/conf.modules.d/README + %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/*.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-brotli.conf +%exclude %{_sysconfdir}/httpd/conf.modules.d/00-systemd.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-proxyhtml.conf %exclude %{_sysconfdir}/httpd/conf.modules.d/00-lua.conf @@ -692,6 +722,8 @@ exit $rv %dir %{_libdir}/httpd %dir %{_libdir}/httpd/modules %{_libdir}/httpd/modules/mod*.so +%exclude %{_libdir}/httpd/modules/mod_brotli.so +%exclude %{_libdir}/httpd/modules/mod_systemd.so %exclude %{_libdir}/httpd/modules/mod_auth_form.so %exclude %{_libdir}/httpd/modules/mod_ssl.so %exclude %{_libdir}/httpd/modules/mod_*ldap.so @@ -718,14 +750,6 @@ exit $rv %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd %attr(0700,apache,apache) %dir %{_localstatedir}/cache/httpd/proxy -%{_mandir}/man8/* -%{_mandir}/man5/* -%exclude %{_mandir}/man8/httpd-init.* - -%{_unitdir}/httpd.service -%{_unitdir}/httpd@.service -%{_unitdir}/htcacheclean.service -%{_unitdir}/*.socket %files filesystem %dir %{_sysconfdir}/httpd From af40323aac32d8fc18f81d3d7ad398beec8ca1e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 30 Mar 2022 22:25:02 +0200 Subject: [PATCH 055/147] - bump package version --- httpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index e1b6162..74bf195 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -814,6 +814,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 +- try to minimize httpd dependencies (new httpd-core package) +- mod_systemd and mod_brotli are now in the main httpd package + * Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 - new version 2.4.53 - fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 From 72f074878a48f92d0432b8a06dca5de77f7a5073 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 31 Mar 2022 14:28:16 +0200 Subject: [PATCH 056/147] - add rhbz to ChangeLog and move OPT functions declaration - OPT functions declaration move to header files - added rhbz to ChangeLog --- httpd-2.4.53-separate-systemd-fns.patch | 88 +++++++++++++++---------- httpd.spec | 1 + 2 files changed, 55 insertions(+), 34 deletions(-) diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch index 14c5f70..f495a44 100644 --- a/httpd-2.4.53-separate-systemd-fns.patch +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -10,6 +10,34 @@ index 05abe18..97484c9 100644 AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported]) fi fi +diff --git a/include/ap_listen.h b/include/ap_listen.h +index 58c2574..d5ed968 100644 +--- a/include/ap_listen.h ++++ b/include/ap_listen.h +@@ -29,6 +29,7 @@ + #include "apr_network_io.h" + #include "httpd.h" + #include "http_config.h" ++#include "apr_optional.h" + + #ifdef __cplusplus + extern "C" { +@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd, + void *dummy, + const char *arg); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_find_systemd_socket, (process_rec *, apr_port_t)); ++ ++APR_DECLARE_OPTIONAL_FN(int, ++ ap_systemd_listen_fds, (int)); ++#endif ++ ++ + #define LISTEN_COMMANDS \ + AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \ + "Maximum length of the queue of pending connections, as used by listen(2)"), \ diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c index eda1272..fc059fc 100644 --- a/modules/arch/unix/mod_systemd.c @@ -91,10 +119,10 @@ index 0848d2e..8af2299 100644 APACHE_MODULE(log_debug, configurable debug logging, , , most) APACHE_MODULE(log_forensic, forensic logging) diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c -index 0b11f60..04f08ca 100644 +index 0b11f60..c3f0a51 100644 --- a/modules/loggers/mod_log_config.c +++ b/modules/loggers/mod_log_config.c -@@ -172,14 +172,16 @@ +@@ -172,10 +172,6 @@ #include #endif @@ -105,17 +133,7 @@ index 0b11f60..04f08ca 100644 #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b" module AP_MODULE_DECLARE_DATA log_config_module; - -+#ifdef HAVE_SYSTEMD -+APR_DECLARE_OPTIONAL_FN(int, -+ ap_systemd_journal_stream_fd, (const char *, int, int)); -+ -+#endif -+ - - static int xfer_flags = (APR_WRITE | APR_APPEND | APR_CREATE | APR_LARGEFILE); - static apr_fileperms_t xfer_perms = APR_OS_DEFAULT; -@@ -1640,8 +1642,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, +@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd, { #ifdef HAVE_SYSTEMD int fd; @@ -132,8 +150,23 @@ index 0b11f60..04f08ca 100644 if (fd < 0) return fd; /* This is an AF_UNIX socket fd so is more pipe-like than +diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h +index 877a593..bd52a98 100644 +--- a/modules/loggers/mod_log_config.h ++++ b/modules/loggers/mod_log_config.h +@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ + */ + APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func)); + ++#ifdef HAVE_SYSTEMD ++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int)); ++#endif ++ + #endif /* MOD_LOG_CONFIG */ + /** @} */ + diff --git a/server/listen.c b/server/listen.c -index e2e028a..217caf2 100644 +index e2e028a..aa6f91c 100644 --- a/server/listen.c +++ b/server/listen.c @@ -34,10 +34,6 @@ @@ -147,20 +180,7 @@ index e2e028a..217caf2 100644 /* we know core's module_index is 0 */ #undef APLOG_MODULE_INDEX #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX -@@ -65,6 +61,12 @@ static int send_buffer_size; - static int receive_buffer_size; - #ifdef HAVE_SYSTEMD - static int use_systemd = -1; -+ -+APR_DECLARE_OPTIONAL_FN(int, -+ ap_find_systemd_socket, (process_rec *, apr_port_t)); -+ -+APR_DECLARE_OPTIONAL_FN(int, -+ ap_systemd_listen_fds, (int)); - #endif - - /* TODO: make_sock is just begging and screaming for APR abstraction */ -@@ -325,34 +327,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, +@@ -325,34 +321,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to, } #ifdef HAVE_SYSTEMD @@ -195,7 +215,7 @@ index e2e028a..217caf2 100644 static apr_status_t alloc_systemd_listener(process_rec * process, int fd, const char *proto, ap_listen_rec **out_rec) -@@ -412,6 +386,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, +@@ -412,6 +380,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, { ap_listen_rec *last, *new; apr_status_t rv; @@ -210,7 +230,7 @@ index e2e028a..217caf2 100644 int fd = find_systemd_socket(process, port); if (fd < 0) { return "Systemd socket activation is used, but this port is not " -@@ -438,7 +420,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, +@@ -438,7 +414,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port, return NULL; } @@ -218,7 +238,7 @@ index e2e028a..217caf2 100644 #endif /* HAVE_SYSTEMD */ static const char *alloc_listener(process_rec *process, const char *addr, -@@ -707,6 +688,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) +@@ -707,6 +682,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) int num_listeners = 0; const char* proto; int found; @@ -228,7 +248,7 @@ index e2e028a..217caf2 100644 for (ls = s; ls; ls = ls->next) { proto = ap_get_server_protocol(ls); -@@ -746,7 +730,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) +@@ -746,7 +724,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s) apr_pool_cleanup_null, s->process->pool); } else { @@ -240,7 +260,7 @@ index e2e028a..217caf2 100644 } } else -@@ -963,6 +950,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -963,6 +944,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, apr_port_t port; apr_status_t rv; const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); @@ -250,7 +270,7 @@ index e2e028a..217caf2 100644 if (err != NULL) { return err; -@@ -973,7 +963,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -973,7 +957,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, } #ifdef HAVE_SYSTEMD if (use_systemd == -1) { diff --git a/httpd.spec b/httpd.spec index 74bf195..ffbc289 100644 --- a/httpd.spec +++ b/httpd.spec @@ -815,6 +815,7 @@ exit $rv %changelog * Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 +- Resolves: #2070517 - Allow install httpd with smaller footprint - try to minimize httpd dependencies (new httpd-core package) - mod_systemd and mod_brotli are now in the main httpd package From ee221cb72ccb1e6405dbef1634654f58d5c417a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 7 Apr 2022 14:41:27 +0200 Subject: [PATCH 057/147] Related: #2070517 - fix issue when mod_systemd is not loaded --- httpd-2.4.53-separate-systemd-fns.patch | 8 +++++--- httpd.spec | 7 +++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch index f495a44..88b99ff 100644 --- a/httpd-2.4.53-separate-systemd-fns.patch +++ b/httpd-2.4.53-separate-systemd-fns.patch @@ -166,7 +166,7 @@ index 877a593..bd52a98 100644 /** @} */ diff --git a/server/listen.c b/server/listen.c -index e2e028a..aa6f91c 100644 +index e2e028a..5d1c0e1 100644 --- a/server/listen.c +++ b/server/listen.c @@ -34,10 +34,6 @@ @@ -224,7 +224,7 @@ index e2e028a..aa6f91c 100644 + find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket); + + if (!find_systemd_socket) -+ return "Systemd socket activation is used, but mod_systemd is probably" ++ return "Systemd socket activation is used, but mod_systemd is probably " + "not loaded"; + int fd = find_systemd_socket(process, port); @@ -270,7 +270,7 @@ index e2e028a..aa6f91c 100644 if (err != NULL) { return err; -@@ -973,7 +957,10 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, +@@ -973,7 +957,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy, } #ifdef HAVE_SYSTEMD if (use_systemd == -1) { @@ -278,6 +278,8 @@ index e2e028a..aa6f91c 100644 + systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds); + if (systemd_listen_fds != NULL) { + use_systemd = systemd_listen_fds(0) > 0; ++ } else { ++ use_systemd = 0; + } } #endif diff --git a/httpd.spec b/httpd.spec index ffbc289..12b67c8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -246,7 +246,7 @@ written in the Lua programming language. %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal -%patch46 -p1 -b .separatesystemd +#patch46 -p1 -b .separatesystemd %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 @@ -814,6 +814,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Apr 07 2022 Luboš Uhliarik - 2.4.53-3 +- Related: #2070517 - fix issue when mod_systemd is not loaded + * Wed Mar 30 2022 Luboš Uhliarik - 2.4.53-2 - Resolves: #2070517 - Allow install httpd with smaller footprint - try to minimize httpd dependencies (new httpd-core package) From dd6a83760148669d65dbcc64ae5cfcd4b869d00d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 7 Apr 2022 14:44:01 +0200 Subject: [PATCH 058/147] Related: #2070517 - forgot to enable patch again --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 12b67c8..a2cafc3 100644 --- a/httpd.spec +++ b/httpd.spec @@ -246,7 +246,7 @@ written in the Lua programming language. %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal -#patch46 -p1 -b .separatesystemd +%patch46 -p1 -b .separatesystemd %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 From 617530796774531ea87471f2cf8895b6127a0732 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 20 Apr 2022 14:34:09 +0100 Subject: [PATCH 059/147] switch to PCRE2 for new releases --- httpd.spec | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index a2cafc3..cf612b8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -10,10 +10,18 @@ %global mpm prefork %endif +%if 0%{?fedora} > 36 || 0%{?rhel} > 9 +%bcond_without pcre2 +%bcond_with pcre +%else +%bcond_with pcre2 +%bcond_without pcre +%endif + Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -99,7 +107,13 @@ License: ASL 2.0 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel -BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 +BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0 +%if %{with pcre2} +BuildRequires: pcre2-devel +%endif +%if %{with pcre} +BuildRequires: pcre-devel > 5.0 +%endif BuildRequires: gnupg2 Requires: system-logos(httpd-logo-ng) Provides: webserver @@ -300,6 +314,7 @@ xmlto man %{SOURCE47} : Building with MMN %{mmn}, MMN-ISA %{mmnisa} : Default MPM is %{mpm}, vendor string is '%{vstring}' +: Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2} %build # forcibly prevent use of bundled apr, apr-util, pcre @@ -344,7 +359,12 @@ export LYNX_PATH=/usr/bin/links --with-suexec-uidmin=1000 --with-suexec-gidmin=1000 \ --with-brotli \ --enable-pie \ +%if %{with pcre2} + --with-pcre2 \ +%endif +%if %{with pcre} --with-pcre \ +%endif --enable-mods-shared=all \ --enable-ssl --with-ssl --disable-distcache \ --enable-proxy --enable-proxy-fdpass \ @@ -814,6 +834,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Apr 20 2022 Joe Orton - 2.4.53-4 +- switch to PCRE2 for new releases + * Thu Apr 07 2022 Luboš Uhliarik - 2.4.53-3 - Related: #2070517 - fix issue when mod_systemd is not loaded From 431047787e0c7db54ea8a8a1ea14676f8ad8b942 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 22 Apr 2022 13:16:56 +0200 Subject: [PATCH 060/147] don't use bomb.gif icon for all files/dirs ending with core --- httpd-2.4.43-icons.patch | 22 ---------------------- httpd.spec | 7 +++++-- 2 files changed, 5 insertions(+), 24 deletions(-) delete mode 100644 httpd-2.4.43-icons.patch diff --git a/httpd-2.4.43-icons.patch b/httpd-2.4.43-icons.patch deleted file mode 100644 index 21518d7..0000000 --- a/httpd-2.4.43-icons.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in -index 51b02ed..0e8b626 100644 ---- a/docs/conf/extra/httpd-autoindex.conf.in -+++ b/docs/conf/extra/httpd-autoindex.conf.in -@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort - Alias /icons/ "@exp_iconsdir@/" - - -- Options Indexes MultiViews -+ Options Indexes MultiViews FollowSymlinks - AllowOverride None - Require all granted - -@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi - AddIcon /icons/uuencoded.gif .uu - AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl - AddIcon /icons/tex.gif .tex --AddIcon /icons/bomb.gif core -+AddIcon /icons/bomb.gif core. - - AddIcon /icons/back.gif .. - AddIcon /icons/hand.right.gif README diff --git a/httpd.spec b/httpd.spec index cf612b8..804746d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -21,7 +21,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -83,7 +83,7 @@ Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch -Patch27: httpd-2.4.43-icons.patch +Patch27: httpd-2.4.53-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -834,6 +834,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 +- don't use bomb.gif icon for all files/dirs ending with core + * Wed Apr 20 2022 Joe Orton - 2.4.53-4 - switch to PCRE2 for new releases From 0a3bbfb33ab78b0980b94f7b5fdf7714a0be0283 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 22 Apr 2022 13:19:04 +0200 Subject: [PATCH 061/147] Add forgoten patch related to autoindex --- httpd-2.4.53-icons.patch | 50 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 httpd-2.4.53-icons.patch diff --git a/httpd-2.4.53-icons.patch b/httpd-2.4.53-icons.patch new file mode 100644 index 0000000..cd125b3 --- /dev/null +++ b/httpd-2.4.53-icons.patch @@ -0,0 +1,50 @@ +diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in +index 51b02ed..93a2b87 100644 +--- a/docs/conf/extra/httpd-autoindex.conf.in ++++ b/docs/conf/extra/httpd-autoindex.conf.in +@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort + Alias /icons/ "@exp_iconsdir@/" + + +- Options Indexes MultiViews ++ Options Indexes MultiViews FollowSymlinks + AllowOverride None + Require all granted + +@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/* + AddIconByType (IMG,/icons/image2.gif) image/* + AddIconByType (SND,/icons/sound2.gif) audio/* + AddIconByType (VID,/icons/movie.gif) video/* ++AddIconByType /icons/bomb.gif application/x-coredump + + AddIcon /icons/binary.gif .bin .exe + AddIcon /icons/binhex.gif .hqx +@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi + AddIcon /icons/uuencoded.gif .uu + AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl + AddIcon /icons/tex.gif .tex +-AddIcon /icons/bomb.gif core + + AddIcon /icons/back.gif .. + AddIcon /icons/hand.right.gif README +diff --git a/docs/conf/magic b/docs/conf/magic +index bc891d9..6402b59 100644 +--- a/docs/conf/magic ++++ b/docs/conf/magic +@@ -383,3 +383,16 @@ + 4 string moov video/quicktime + 4 string mdat video/quicktime + ++AddIconByType /icons/bomb.gif application/x-coredump ++ ++#------------------------------------------------------------------------------ ++# application/x-coredump for LE/BE ELF ++# ++0 string \177ELF ++>5 byte 1 ++>16 leshort 4 application/x-coredump ++ ++0 string \177ELF ++>5 byte 2 ++>16 beshort 4 application/x-coredump ++ From 95aba987928cc886fb5acad00694c32da878174c Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 13 May 2022 15:52:12 +0100 Subject: [PATCH 062/147] use %set_build_flags macro (closes #20) --- httpd.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 804746d..4a997dd 100644 --- a/httpd.spec +++ b/httpd.spec @@ -327,8 +327,7 @@ autoheader && autoconf || exit 1 %{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \ support/apxs.in -export CFLAGS=$RPM_OPT_FLAGS -export LDFLAGS="-Wl,-z,relro,-z,now" +%set_build_flags # Hard-code path to links to avoid unnecessary builddep export LYNX_PATH=/usr/bin/links @@ -834,6 +833,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri May 13 2022 Joe Orton - 2.4.53-5 +- use %%set_build_flags macro + * Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 - don't use bomb.gif icon for all files/dirs ending with core From d72d3ea9004ce84445c702b0f416abf530a6efd5 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 13 May 2022 15:55:18 +0100 Subject: [PATCH 063/147] fix NVR. --- httpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 4a997dd..9ae15fc 100644 --- a/httpd.spec +++ b/httpd.spec @@ -21,7 +21,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -833,7 +833,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Fri May 13 2022 Joe Orton - 2.4.53-5 +* Fri May 13 2022 Joe Orton - 2.4.53-6 - use %%set_build_flags macro * Thu Apr 21 2022 Luboš Uhliarik - 2.4.53-5 From c2f1d6bf301e548fb3fe066802a7b45f4b59a1a8 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 16 May 2022 08:27:06 +0100 Subject: [PATCH 064/147] disable package notes --- httpd.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 9ae15fc..2f6caaf 100644 --- a/httpd.spec +++ b/httpd.spec @@ -18,10 +18,13 @@ %bcond_without pcre %endif +# Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092 +%undefine _package_note_flags + Summary: Apache HTTP Server Name: httpd Version: 2.4.53 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -833,6 +836,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon May 16 2022 Joe Orton - 2.4.53-7 +- disable package notes + * Fri May 13 2022 Joe Orton - 2.4.53-6 - use %%set_build_flags macro From 589318da661951c3153a52c0294a66724ebadf75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 10 Jun 2022 00:05:19 +0200 Subject: [PATCH 065/147] new version 2.4.54 --- .gitignore | 1 + ....4.43-selinux.patch => httpd-2.4.54-selinux.patch | 12 ++++++------ httpd.spec | 9 ++++++--- sources | 4 ++-- 4 files changed, 15 insertions(+), 11 deletions(-) rename httpd-2.4.43-selinux.patch => httpd-2.4.54-selinux.patch (85%) diff --git a/.gitignore b/.gitignore index 64b8899..aa90701 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ x86_64 /httpd-2.4.51.tar.bz2.asc /httpd-2.4.52.tar.bz2.asc /httpd-2.4.53.tar.bz2.asc +/httpd-2.4.54.tar.bz2.asc diff --git a/httpd-2.4.43-selinux.patch b/httpd-2.4.54-selinux.patch similarity index 85% rename from httpd-2.4.43-selinux.patch rename to httpd-2.4.54-selinux.patch index 3c3176f..3868b3b 100644 --- a/httpd-2.4.43-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,8 +1,8 @@ diff --git a/configure.in b/configure.in -index c8f9aa2..cb43246 100644 +index 74015ca..8c0ee10 100644 --- a/configure.in +++ b/configure.in -@@ -484,6 +484,11 @@ getloadavg +@@ -508,6 +508,11 @@ getloadavg dnl confirm that a void pointer is large enough to store a long integer APACHE_CHECK_VOID_PTR_LEN @@ -15,10 +15,10 @@ index c8f9aa2..cb43246 100644 [AC_TRY_RUN(#define _GNU_SOURCE #include diff --git a/server/core.c b/server/core.c -index dc0f17a..7ed9527 100644 +index a6fa2fb..cf4cba4 100644 --- a/server/core.c +++ b/server/core.c -@@ -59,6 +59,10 @@ +@@ -65,6 +65,10 @@ #include #endif @@ -28,8 +28,8 @@ index dc0f17a..7ed9527 100644 + /* LimitRequestBody handling */ #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) - #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 0) -@@ -5015,6 +5019,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte + #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */ +@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte } #endif diff --git a/httpd.spec b/httpd.spec index 2f6caaf..80492b2 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.53 -Release: 7%{?dist} +Version: 2.4.54 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -84,7 +84,7 @@ Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch -Patch25: httpd-2.4.43-selinux.patch +Patch25: httpd-2.4.54-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.53-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch @@ -836,6 +836,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-1 +- new version 2.4.54 + * Mon May 16 2022 Joe Orton - 2.4.53-7 - disable package notes diff --git a/sources b/sources index 36266ed..93b0ebf 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756 -SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686 +SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18 +SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From eeff44363350896ad4bfa111a0c097665dfa6af9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 16 Jun 2022 18:11:29 +0200 Subject: [PATCH 066/147] Fix bug in patched magic file for core files recognition --- httpd-2.4.53-icons.patch => httpd-2.4.54-icons.patch | 5 ++--- httpd.spec | 6 +++--- 2 files changed, 5 insertions(+), 6 deletions(-) rename httpd-2.4.53-icons.patch => httpd-2.4.54-icons.patch (93%) diff --git a/httpd-2.4.53-icons.patch b/httpd-2.4.54-icons.patch similarity index 93% rename from httpd-2.4.53-icons.patch rename to httpd-2.4.54-icons.patch index cd125b3..efc0c4d 100644 --- a/httpd-2.4.53-icons.patch +++ b/httpd-2.4.54-icons.patch @@ -28,14 +28,13 @@ index 51b02ed..93a2b87 100644 AddIcon /icons/back.gif .. AddIcon /icons/hand.right.gif README diff --git a/docs/conf/magic b/docs/conf/magic -index bc891d9..6402b59 100644 +index bc891d9..9a41b44 100644 --- a/docs/conf/magic +++ b/docs/conf/magic -@@ -383,3 +383,16 @@ +@@ -383,3 +383,15 @@ 4 string moov video/quicktime 4 string mdat video/quicktime -+AddIconByType /icons/bomb.gif application/x-coredump + +#------------------------------------------------------------------------------ +# application/x-coredump for LE/BE ELF diff --git a/httpd.spec b/httpd.spec index 80492b2..1c6b205 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -86,7 +86,7 @@ Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.54-selinux.patch Patch26: httpd-2.4.43-gettid.patch -Patch27: httpd-2.4.53-icons.patch +Patch27: httpd-2.4.54-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -836,7 +836,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-1 +* Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-2 - new version 2.4.54 * Mon May 16 2022 Joe Orton - 2.4.53-7 From e4ec9394be6afb68e49645cbd187fbd23667ba4d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jun 2022 11:39:49 +0100 Subject: [PATCH 067/147] update PCRE config selection Although PCRE 2 was only supposed to be used for Fedora > 36 it has always been configured for Fedora 36 as well due to autoconf weirdness. --- httpd.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/httpd.spec b/httpd.spec index 1c6b205..2038893 100644 --- a/httpd.spec +++ b/httpd.spec @@ -10,7 +10,7 @@ %global mpm prefork %endif -%if 0%{?fedora} > 36 || 0%{?rhel} > 9 +%if 0%{?fedora} > 35 || 0%{?rhel} > 9 %bcond_without pcre2 %bcond_with pcre %else @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -362,10 +362,10 @@ export LYNX_PATH=/usr/bin/links --with-brotli \ --enable-pie \ %if %{with pcre2} - --with-pcre2 \ + --with-pcre2=%{_bindir}/pcre2-config \ %endif %if %{with pcre} - --with-pcre \ + --with-pcre=%{_bindir}/pcre-config \ %endif --enable-mods-shared=all \ --enable-ssl --with-ssl --disable-distcache \ @@ -836,6 +836,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 17 2022 Joe Orton - 2.4.54-3 +- update PCRE config selection + * Thu Jun 09 2022 Luboš Uhliarik - 2.4.54-2 - new version 2.4.54 From bdfad1ea95e7f8710aeb124f918c68e9efb9f1b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Mon, 27 Jun 2022 11:21:54 +0200 Subject: [PATCH 068/147] fix downgrade/upgrade issues mod_ssl and other modules should depend only on httpd-core package --- httpd.spec | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/httpd.spec b/httpd.spec index 2038893..1533131 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -140,6 +140,7 @@ Requires: httpd-tools = %{version}-%{release} Requires: httpd-filesystem = %{version}-%{release} Requires(pre): httpd-filesystem Conflicts: apr < 1.5.0-1 +Conflicts: httpd < 2.4.53-2 Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2 %description core @@ -148,7 +149,7 @@ The httpd-core package contains essential httpd binaries. %package devel Summary: Development interfaces for the Apache HTTP Server Requires: apr-devel, apr-util-devel, pkgconfig, libtool -Requires: httpd = %{version}-%{release} +Requires: httpd-core = %{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files @@ -161,7 +162,7 @@ to install this package. %package manual Summary: Documentation for the Apache HTTP Server -Requires: httpd = %{version}-%{release} +Requires: httpd-core = 0:%{version}-%{release} BuildArch: noarch %description manual @@ -191,7 +192,7 @@ Summary: SSL/TLS module for the Apache HTTP Server Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: sscg >= 2.2.0, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 @@ -205,7 +206,7 @@ Security (TLS) protocols. %package -n mod_proxy_html Summary: HTML and XML content filters for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} BuildRequires: libxml2-devel BuildRequires: make Epoch: 1 @@ -217,7 +218,7 @@ transform and modify HTML and XML content. %package -n mod_ldap Summary: LDAP authentication modules for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} Requires: apr-util-ldap %description -n mod_ldap @@ -226,7 +227,7 @@ authentication to the Apache HTTP Server. %package -n mod_session Summary: Session interface for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_session The mod_session module and associated backends provide an abstract @@ -234,7 +235,7 @@ interface for storing and accessing per-user session data. %package -n mod_lua Summary: Lua scripting support for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_lua The mod_lua module allows the server to be extended with scripts @@ -836,6 +837,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 24 2022 Luboš Uhliarik - 2.4.54-4 +- fix downgrade/upgrade issues +- mod_ssl and other modules should depend only on httpd-core package + * Fri Jun 17 2022 Joe Orton - 2.4.54-3 - update PCRE config selection From b4890cc0cc98a70762d115b1f7a580808cbb9c7b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 13:48:08 +0000 Subject: [PATCH 069/147] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 1533131..ba6a0c5 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -837,6 +837,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 2.4.54-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Fri Jun 24 2022 Luboš Uhliarik - 2.4.54-4 - fix downgrade/upgrade issues - mod_ssl and other modules should depend only on httpd-core package From 54cb3fa126b5f8f8dbff7297c840646b19ec0567 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 18 Oct 2022 02:37:04 +0200 Subject: [PATCH 070/147] Provide a sysusers.d file to get user() and group() provides (#2134430) --- httpd.spec | 23 +++++++++++++---------- httpd.sysusers | 2 ++ 2 files changed, 15 insertions(+), 10 deletions(-) create mode 100644 httpd.sysusers diff --git a/httpd.spec b/httpd.spec index ba6a0c5..3ab8372 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -73,6 +73,7 @@ Source45: config.layout Source46: apachectl.sh Source47: apachectl.xml Source48: apache-poweredby.png +Source49: httpd.sysusers # build/scripts patches Patch2: httpd-2.4.43-apxs.patch @@ -111,6 +112,7 @@ BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0 +BuildRequires: systemd-rpm-macros %if %{with pcre2} BuildRequires: pcre2-devel %endif @@ -122,9 +124,7 @@ Requires: system-logos(httpd-logo-ng) Provides: webserver Requires: httpd-core = 0:%{version}-%{release} Recommends: mod_http2, mod_lua -Requires(preun): systemd-units -Requires(postun): systemd-units -Requires(post): systemd-units +%{?systemd_requires} %description The Apache HTTP Server is a powerful, efficient, and extensible @@ -173,7 +173,7 @@ also be found at https://httpd.apache.org/docs/2.4/. %package filesystem Summary: The basic directory layout for the Apache HTTP Server BuildArch: noarch -Requires(pre): /usr/sbin/useradd +%{?sysusers_requires_compat} %description filesystem The httpd-filesystem package contains the basic directory layout @@ -602,6 +602,9 @@ touch -r $RPM_BUILD_ROOT%{_bindir}/apxs \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs chmod 755 $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor-apxs +# Fix content dir in sysusers file and install it +install -p -D -m 0644 %{SOURCE49} %{buildroot}%{_sysusersdir}/httpd.conf + # Remove unpackaged files rm -vf \ $RPM_BUILD_ROOT%{_libdir}/*.exp \ @@ -617,11 +620,7 @@ rm -vf \ rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra} %pre filesystem -getent group apache >/dev/null || groupadd -g 48 -r apache -getent passwd apache >/dev/null || \ - useradd -r -u 48 -g apache -s /sbin/nologin \ - -d %{contentdir} -c "Apache" apache -exit 0 +%sysusers_create_compat %{SOURCE49} %post %systemd_post httpd.service htcacheclean.service httpd.socket @@ -785,6 +784,7 @@ exit $rv %dir %{contentdir}/icons %attr(755,root,root) %dir %{_unitdir}/httpd.service.d %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d +%{_sysusersdir}/httpd.conf %files tools %{_bindir}/* @@ -837,6 +837,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Oct 13 2022 Luboš Uhliarik - 2.4.54-6 +- Provide a sysusers.d file to get user() and group() provides (#2134430) + * Thu Jul 21 2022 Fedora Release Engineering - 2.4.54-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/httpd.sysusers b/httpd.sysusers new file mode 100644 index 0000000..26fe0e4 --- /dev/null +++ b/httpd.sysusers @@ -0,0 +1,2 @@ +g apache 48 +u apache 48 "Apache" /usr/share/httpd /sbin/nologin From 654ce8a373d1970c517a37c92c537ff7f86d2f39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 30 Nov 2022 14:25:15 +0100 Subject: [PATCH 071/147] reduce AH03408 level to INFO in proxy_util.c --- httpd-2.4.54-proxy-util-loglevel.patch | 13 +++++++++++++ httpd.spec | 7 ++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.54-proxy-util-loglevel.patch diff --git a/httpd-2.4.54-proxy-util-loglevel.patch b/httpd-2.4.54-proxy-util-loglevel.patch new file mode 100644 index 0000000..e4db49e --- /dev/null +++ b/httpd-2.4.54-proxy-util-loglevel.patch @@ -0,0 +1,13 @@ +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index e488aa6..8267f1b 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -3121,7 +3121,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_check_connection(const char *scheme, + "%s: backend socket is disconnected.", scheme); + } + else { +- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, server, APLOGNO(03408) ++ ap_log_error(APLOG_MARK, APLOG_INFO, 0, server, APLOGNO(03408) + "%s: reusable backend connection is not empty: " + "forcibly closed", scheme); + } diff --git a/httpd.spec b/httpd.spec index 3ab8372..de6cd05 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -104,6 +104,7 @@ Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch +Patch66: httpd-2.4.54-proxy-util-loglevel.patch # Security fixes @@ -270,6 +271,7 @@ written in the Lua programming language. %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break %patch65 -p1 -b .r1894152 +%patch66 -p1 -b .proxyutil-loglevel # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -837,6 +839,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Nov 30 2022 Luboš Uhliarik - 2.4.54-7 +- reduce AH03408 level to INFO in proxy_util.c + * Thu Oct 13 2022 Luboš Uhliarik - 2.4.54-6 - Provide a sysusers.d file to get user() and group() provides (#2134430) From b0e7cd798ea4f3e364b1f2c4cbe768298705dc4d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 19 Dec 2022 14:49:23 +0000 Subject: [PATCH 072/147] define _httpd_statedir macro --- httpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index de6cd05..c2c75ee 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -488,6 +488,7 @@ cat > $RPM_BUILD_ROOT%{_rpmconfigdir}/macros.d/macros.httpd < - 2.4.54-8 +- define _httpd_statedir macro + * Wed Nov 30 2022 Luboš Uhliarik - 2.4.54-7 - reduce AH03408 level to INFO in proxy_util.c From 8c54e332bbb7b718fffccdd9340bca2ae5ec9b3a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jun 2022 12:21:04 +0100 Subject: [PATCH 073/147] - move SELinux context logging to mod_systemd from httpd binary --- ...-gettid.patch => httpd-2.4.54-gettid.patch | 18 ++-- httpd-2.4.54-selinux.patch | 97 ++++++++++--------- httpd.spec | 18 +++- 3 files changed, 71 insertions(+), 62 deletions(-) rename httpd-2.4.43-gettid.patch => httpd-2.4.54-gettid.patch (90%) diff --git a/httpd-2.4.43-gettid.patch b/httpd-2.4.54-gettid.patch similarity index 90% rename from httpd-2.4.43-gettid.patch rename to httpd-2.4.54-gettid.patch index f80b3a7..dfc447b 100644 --- a/httpd-2.4.43-gettid.patch +++ b/httpd-2.4.54-gettid.patch @@ -14,9 +14,9 @@ Subject: [PATCH] Check and use gettid() directly with glibc 2.30+. diff --git a/configure.in b/configure.in index 423d58d4b9a..60cbf7b7f81 100644 ---- httpd-2.4.43/configure.in.gettid -+++ httpd-2.4.43/configure.in -@@ -478,7 +500,8 @@ +--- httpd-2.4.54/configure.in.gettid ++++ httpd-2.4.54/configure.in +@@ -502,22 +502,26 @@ timegm \ getpgid \ fopen64 \ @@ -26,9 +26,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 ) dnl confirm that a void pointer is large enough to store a long integer -@@ -489,16 +512,19 @@ - APR_ADDTO(HTTPD_LIBS, [-lselinux]) - ]) + APACHE_CHECK_VOID_PTR_LEN -AC_CACHE_CHECK([for gettid()], ac_cv_gettid, +if test $ac_cv_func_gettid = no; then @@ -50,8 +48,8 @@ index 423d58d4b9a..60cbf7b7f81 100644 fi dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs ---- httpd-2.4.43/server/log.c.gettid -+++ httpd-2.4.43/server/log.c +--- httpd-2.4.54/server/log.c.gettid ++++ httpd-2.4.54/server/log.c @@ -55,7 +55,7 @@ #include "ap_mpm.h" #include "ap_listen.h" @@ -61,7 +59,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 #include #include #endif -@@ -625,14 +625,18 @@ +@@ -627,14 +627,18 @@ #if APR_HAS_THREADS int result; #endif @@ -82,7 +80,7 @@ index 423d58d4b9a..60cbf7b7f81 100644 #if APR_HAS_THREADS if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS && result != AP_MPMQ_NOT_SUPPORTED) -@@ -966,7 +970,7 @@ +@@ -968,7 +972,7 @@ #if APR_HAS_THREADS field_start = len; len += cpystrn(buf + len, ":tid ", buflen - len); diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch index 3868b3b..4d66bd8 100644 --- a/httpd-2.4.54-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,24 +1,22 @@ diff --git a/configure.in b/configure.in index 74015ca..8c0ee10 100644 ---- a/configure.in -+++ b/configure.in -@@ -508,6 +508,11 @@ getloadavg - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - -+AC_CHECK_LIB(selinux, is_selinux_enabled, [ -+ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) -+ APR_ADDTO(HTTPD_LIBS, [-lselinux]) -+]) -+ - AC_CACHE_CHECK([for gettid()], ac_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include -diff --git a/server/core.c b/server/core.c -index a6fa2fb..cf4cba4 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -65,6 +65,10 @@ +--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux ++++ httpd-2.4.54/modules/arch/unix/config5.m4 +@@ -23,6 +23,11 @@ + AC_MSG_WARN([Your system does not support systemd.]) + enable_systemd="no" + else ++ AC_CHECK_LIB(selinux, is_selinux_enabled, [ ++ AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported]) ++ APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux]) ++ ]) ++ + APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS]) + fi + ]) +--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux ++++ httpd-2.4.54/modules/arch/unix/mod_systemd.c +@@ -35,6 +35,10 @@ #include #endif @@ -26,35 +24,38 @@ index a6fa2fb..cf4cba4 100644 +#include +#endif + - /* LimitRequestBody handling */ - #define AP_LIMIT_REQ_BODY_UNSET ((apr_off_t) -1) - #define AP_DEFAULT_LIMIT_REQ_BODY ((apr_off_t) 1<<30) /* 1GB */ -@@ -5150,6 +5154,28 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte - } - #endif + APR_DECLARE_OPTIONAL_FN(int, + ap_find_systemd_socket, (process_rec *, apr_port_t)); -+#ifdef HAVE_SELINUX -+ { -+ static int already_warned = 0; -+ int is_enabled = is_selinux_enabled() > 0; -+ -+ if (is_enabled && !already_warned) { -+ security_context_t con; -+ -+ if (getcon(&con) == 0) { -+ -+ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, -+ "SELinux policy enabled; " -+ "httpd running as context %s", con); -+ -+ already_warned = 1; -+ -+ freecon(con); -+ } -+ } -+ } -+#endif -+ - return OK; +@@ -70,6 +74,20 @@ + return apr_psprintf(p, "%s port %u", addr, sa->port); } ++#ifdef HAVE_SELINUX ++static void log_selinux_context(void) ++{ ++ char *con; ++ ++ if (is_selinux_enabled() && getcon(&con) == 0) { ++ ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, ++ "SELinux policy enabled; " ++ "httpd running as context %s", con); ++ freecon(con); ++ } ++} ++#endif ++ + /* Report the service is ready in post_config, which could be during + * startup or after a reload. The server could still hit a fatal + * startup error after this point during ap_run_mpm(), so this is +@@ -87,6 +105,10 @@ + if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) + return OK; + ++#ifdef HAVE_SELINUX ++ log_selinux_context(); ++#endif ++ + for (lr = ap_listeners; lr; lr = lr->next) { + char *s = dump_listener(lr, ptemp); + diff --git a/httpd.spec b/httpd.spec index c2c75ee..6908087 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 8%{?dist} +Release: 9%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -86,7 +86,7 @@ Patch22: httpd-2.4.43-mod_systemd.patch Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.54-selinux.patch -Patch26: httpd-2.4.43-gettid.patch +Patch26: httpd-2.4.54-gettid.patch Patch27: httpd-2.4.54-icons.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch @@ -150,7 +150,7 @@ The httpd-core package contains essential httpd binaries. %package devel Summary: Development interfaces for the Apache HTTP Server Requires: apr-devel, apr-util-devel, pkgconfig, libtool -Requires: httpd-core = %{version}-%{release} +Requires: httpd-core = 0:%{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files @@ -254,7 +254,6 @@ written in the Lua programming language. %patch22 -p1 -b .mod_systemd %patch23 -p1 -b .export %patch24 -p1 -b .corelimit -%patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons %patch30 -p1 -b .cachehardmax @@ -266,6 +265,7 @@ written in the Lua programming language. %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal %patch46 -p1 -b .separatesystemd +%patch25 -p1 -b .selinux %patch60 -p1 -b .enable-sslv3 %patch61 -p1 -b .r1878890 @@ -384,6 +384,13 @@ export LYNX_PATH=/usr/bin/links --disable-http2 \ --disable-md \ $* + +if grep -q ac_cv_have_threadsafe_pollset=no config.log; then + cat config.log + : Failed to find thread-safe APR. + exit 1 +fi + %make_build %install @@ -840,6 +847,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Dec 19 2022 Joe Orton - 2.4.54-9 +- move SELinux context logging to mod_systemd + * Mon Dec 19 2022 Joe Orton - 2.4.54-8 - define _httpd_statedir macro From f5d2d48e1d86aaa0427d1b311d052d59a1c5d258 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 19 Dec 2022 16:46:44 +0000 Subject: [PATCH 074/147] Work around aarch64 build failures. --- httpd.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/httpd.spec b/httpd.spec index 6908087..b990f77 100644 --- a/httpd.spec +++ b/httpd.spec @@ -338,6 +338,13 @@ autoheader && autoconf || exit 1 # Hard-code path to links to avoid unnecessary builddep export LYNX_PATH=/usr/bin/links +%ifarch aarch64 +# The configure check for epoll_create() is failing. httpd/apr only +# actually uses epoll_create1() so this test could be smarter. Work +# around it for now. +export ac_cv_func_epoll_create=yes +%endif + # Build the daemon ./configure \ --prefix=%{_sysconfdir}/httpd \ From b568e5c39d5688ba45b3de376c25d56c4c385594 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 20 Dec 2022 09:43:24 +0000 Subject: [PATCH 075/147] htcacheclean.service: add [Install] section, PrivateTmp=yes, Environment=LANG=C (#2149714) --- htcacheclean.service | 5 +++++ httpd.spec | 6 +++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/htcacheclean.service b/htcacheclean.service index d1e9d60..e3eeef9 100644 --- a/htcacheclean.service +++ b/htcacheclean.service @@ -7,5 +7,10 @@ Documentation=man:htcacheclean.service(8) Type=forking User=apache PIDFile=/run/httpd/htcacheclean/pid +Environment=LANG=C EnvironmentFile=/etc/sysconfig/htcacheclean ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS +PrivateTmp=true + +[Install] +WantedBy=multi-user.target diff --git a/httpd.spec b/httpd.spec index b990f77..7271d9f 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 9%{?dist} +Release: 10%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -854,6 +854,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Dec 20 2022 Joe Orton - 2.4.54-10 +- htcacheclean.service: add [Install] section, PrivateTmp=yes, + Environment=LANG=C (#2149714) + * Mon Dec 19 2022 Joe Orton - 2.4.54-9 - move SELinux context logging to mod_systemd From 24cb4dd8699242dfdb5c2c11c0be3fbc620800e1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 12:17:03 +0000 Subject: [PATCH 076/147] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 7271d9f..24b1365 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 10%{?dist} +Release: 11%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -854,6 +854,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 2.4.54-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Dec 20 2022 Joe Orton - 2.4.54-10 - htcacheclean.service: add [Install] section, PrivateTmp=yes, Environment=LANG=C (#2149714) From a97f2e349c41c1599563dfb88056b807b5627e47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 24 Jan 2023 16:50:25 +0100 Subject: [PATCH 077/147] prevent sscg writing /dhparams.pem --- httpd-init.service | 1 + httpd-ssl-gencerts | 1 + httpd.spec | 7 +++++-- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/httpd-init.service b/httpd-init.service index 3074778..704c314 100644 --- a/httpd-init.service +++ b/httpd-init.service @@ -8,5 +8,6 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key [Service] Type=oneshot RemainAfterExit=no +PrivateTmp=true ExecStart=/usr/libexec/httpd-ssl-gencerts diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts index 350f5b5..5c271f7 100755 --- a/httpd-ssl-gencerts +++ b/httpd-ssl-gencerts @@ -33,6 +33,7 @@ sscg -q \ --cert-file /etc/pki/tls/certs/localhost.crt \ --cert-key-file /etc/pki/tls/private/localhost.key \ --ca-file /etc/pki/tls/certs/localhost.crt \ + --dhparams-file /tmp/dhparams.pem \ --lifetime 365 \ --hostname $FQDN \ --email root@$FQDN diff --git a/httpd.spec b/httpd.spec index 24b1365..d398834 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.54 -Release: 11%{?dist} +Release: 12%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -194,7 +194,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 2.2.0, /usr/bin/hostname +Requires: sscg >= 3.0.0-7, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 # mod_ssl/mod_nss cannot both be loaded simultaneously @@ -854,6 +854,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Jan 24 2023 Luboš Uhliarik - 2.4.54-12 +- prevent sscg writing /dhparams.pem + * Thu Jan 19 2023 Fedora Release Engineering - 2.4.54-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From a9ebcc1200eda8cb7895d7bde559e5da3645fd2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 24 Jan 2023 17:33:11 +0100 Subject: [PATCH 078/147] sscg in Fedora has --dhparams-file option available since 3.0.3 --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index d398834..9a9fde7 100644 --- a/httpd.spec +++ b/httpd.spec @@ -194,7 +194,7 @@ Epoch: 1 BuildRequires: openssl-devel Requires(pre): httpd-filesystem Requires: httpd-core = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 3.0.0-7, /usr/bin/hostname +Requires: sscg >= 3.0.3, /usr/bin/hostname # Require an OpenSSL which supports PROFILE=SYSTEM Conflicts: openssl-libs < 1:1.0.1h-4 # mod_ssl/mod_nss cannot both be loaded simultaneously From 85bd0d7cb0ee0834161ffe8b80f11067b099a2d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 25 Jan 2023 16:15:14 +0100 Subject: [PATCH 079/147] new version 2.4.55 --- .gitignore | 1 + httpd-2.4.43-r1861269.patch | 20 -------------------- httpd-2.4.54-proxy-util-loglevel.patch | 13 ------------- httpd.spec | 11 +++++------ sources | 4 ++-- 5 files changed, 8 insertions(+), 41 deletions(-) delete mode 100644 httpd-2.4.43-r1861269.patch delete mode 100644 httpd-2.4.54-proxy-util-loglevel.patch diff --git a/.gitignore b/.gitignore index aa90701..65a4add 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,4 @@ x86_64 /httpd-2.4.52.tar.bz2.asc /httpd-2.4.53.tar.bz2.asc /httpd-2.4.54.tar.bz2.asc +/httpd-2.4.55.tar.bz2.asc diff --git a/httpd-2.4.43-r1861269.patch b/httpd-2.4.43-r1861269.patch deleted file mode 100644 index 9bff242..0000000 --- a/httpd-2.4.43-r1861269.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c -index b53f3f8..979489c 100644 ---- a/modules/ssl/ssl_engine_config.c -+++ b/modules/ssl/ssl_engine_config.c -@@ -812,8 +812,14 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd, - static const char *ssl_cmd_check_file(cmd_parms *parms, - const char **file) - { -- const char *filepath = ap_server_root_relative(parms->pool, *file); -+ const char *filepath; - -+ /* If only dumping the config, don't verify the paths */ -+ if (ap_state_query(AP_SQ_RUN_MODE) == AP_SQ_RM_CONFIG_DUMP) { -+ return NULL; -+ } -+ -+ filepath = ap_server_root_relative(parms->pool, *file); - if (!filepath) { - return apr_pstrcat(parms->pool, parms->cmd->name, - ": Invalid file path ", *file, NULL); diff --git a/httpd-2.4.54-proxy-util-loglevel.patch b/httpd-2.4.54-proxy-util-loglevel.patch deleted file mode 100644 index e4db49e..0000000 --- a/httpd-2.4.54-proxy-util-loglevel.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c -index e488aa6..8267f1b 100644 ---- a/modules/proxy/proxy_util.c -+++ b/modules/proxy/proxy_util.c -@@ -3121,7 +3121,7 @@ PROXY_DECLARE(apr_status_t) ap_proxy_check_connection(const char *scheme, - "%s: backend socket is disconnected.", scheme); - } - else { -- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, server, APLOGNO(03408) -+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, server, APLOGNO(03408) - "%s: reusable backend connection is not empty: " - "forcibly closed", scheme); - } diff --git a/httpd.spec b/httpd.spec index 9a9fde7..b1d332c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.54 -Release: 12%{?dist} +Version: 2.4.55 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -92,7 +92,6 @@ Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch Patch39: httpd-2.4.43-sslprotdefault.patch -Patch40: httpd-2.4.43-r1861269.patch Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch @@ -104,7 +103,6 @@ Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch -Patch66: httpd-2.4.54-proxy-util-loglevel.patch # Security fixes @@ -260,7 +258,6 @@ written in the Lua programming language. %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault %patch39 -p1 -b .sslprotdefault -%patch40 -p1 -b .r1861269 %patch41 -p1 -b .r1861793+ %patch42 -p1 -b .r1828172+ %patch45 -p1 -b .logjournal @@ -271,7 +268,6 @@ written in the Lua programming language. %patch61 -p1 -b .r1878890 %patch63 -p1 -b .htcacheclean-dont-break %patch65 -p1 -b .r1894152 -%patch66 -p1 -b .proxyutil-loglevel # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -854,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jan 25 2023 Luboš Uhliarik - 2.4.55-1 +- new version 2.4.55 + * Tue Jan 24 2023 Luboš Uhliarik - 2.4.54-12 - prevent sscg writing /dhparams.pem diff --git a/sources b/sources index 93b0ebf..042ceab 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.54.tar.bz2) = 228493b2ff32c4142c6e484d304f2ea12e467498605fe12adce2b61388d8efe7b2e96ae2fd0abd1dc88a5f12d625e007d8da0ae5628cff2a5272806754f41e18 -SHA512 (httpd-2.4.54.tar.bz2.asc) = 90a582b10bbcd054f62b6961194f7d97b1f0f56286cfd89e0a5c36248808365b4defade068340a1e9deeaee09dcd3e88810bee8951f9840fe666dab8861b757b +SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb +SHA512 (httpd-2.4.55.tar.bz2.asc) = 7e9f946a72a9106325ca1479123e9320e6749ba304d945ce48f4eb816710ad7fe6a2e0a9108c98d36a99eacd70c4984a1b5cb1b7e6690cdff77039c4a2732328 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From f03a62dad53d0b50a0818d6da0c289a5617e1e21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 3 Feb 2023 14:50:41 +0100 Subject: [PATCH 080/147] rebuilt with new apr/apr-util --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index b1d332c..a2ce930 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.55 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Feb 03 2023 Luboš Uhliarik - 2.4.55-2 +- rebuilt with new apr/apr-util + * Wed Jan 25 2023 Luboš Uhliarik - 2.4.55-1 - new version 2.4.55 From 47674d08007e376a740a9e48fdc6c70ec23a7ea3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 7 Mar 2023 14:20:57 +0000 Subject: [PATCH 081/147] build and load mod_authnz_fcgi --- 00-base.conf | 1 + httpd.spec | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/00-base.conf b/00-base.conf index d0123d1..bae2bf6 100644 --- a/00-base.conf +++ b/00-base.conf @@ -15,6 +15,7 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_socache_module modules/mod_authn_socache.so +LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule authz_dbd_module modules/mod_authz_dbd.so LoadModule authz_dbm_module modules/mod_authz_dbm.so diff --git a/httpd.spec b/httpd.spec index a2ce930..819fe22 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.55 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -379,7 +379,7 @@ export ac_cv_func_epoll_create=yes --enable-cache \ --enable-disk-cache \ --enable-ldap --enable-authnz-ldap \ - --enable-cgid --enable-cgi \ + --enable-cgid --enable-cgi --enable-authnz-fcgi \ --enable-cgid-fdpassing \ --enable-authn-anon --enable-authn-alias \ --enable-systemd \ @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Mar 7 2023 Joe Orton - 2.4.55-3 +- build and load mod_authnz_fcgi + * Fri Feb 03 2023 Luboš Uhliarik - 2.4.55-2 - rebuilt with new apr/apr-util From 92c4708891a48466340a415d244738573376d98e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 9 Mar 2023 13:02:14 +0100 Subject: [PATCH 082/147] new version 2.4.56 --- .gitignore | 1 + httpd.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 65a4add..4001074 100644 --- a/.gitignore +++ b/.gitignore @@ -46,3 +46,4 @@ x86_64 /httpd-2.4.53.tar.bz2.asc /httpd-2.4.54.tar.bz2.asc /httpd-2.4.55.tar.bz2.asc +/httpd-2.4.56.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index 819fe22..c885e82 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.55 -Release: 3%{?dist} +Version: 2.4.56 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Mar 09 2023 Luboš Uhliarik - 2.4.56-1 +- new version 2.4.56 + * Tue Mar 7 2023 Joe Orton - 2.4.55-3 - build and load mod_authnz_fcgi diff --git a/sources b/sources index 042ceab..290079d 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.55.tar.bz2) = 94982f7a1fedac8961fc17b5a22cf763ac28cb27ee6facab2e6a15b249b927773667493fd3f7354fb13fcb34a6f1afc1bdd5cf4b7be030cba1dfb523e40d43fb -SHA512 (httpd-2.4.55.tar.bz2.asc) = 7e9f946a72a9106325ca1479123e9320e6749ba304d945ce48f4eb816710ad7fe6a2e0a9108c98d36a99eacd70c4984a1b5cb1b7e6690cdff77039c4a2732328 +SHA512 (httpd-2.4.56.tar.bz2) = 5f12cd9878d822384b1bb163fea4d8edee5e7a0dd8b2389264387971268145cccc6a5a27ddf0436c5f1f631acc5fdc4874da2a47911483e421ca40bf783e0e12 +SHA512 (httpd-2.4.56.tar.bz2.asc) = 50f5e1f52e4a9a2f98d6831bc908e74a9d008978572246f668f2a1c6977014f30e77a8197f5db20a3500323f35e3d7d1a38b270cd0b7122aafc58d2df8132d4a SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 4b92db25395917df048cf176d36b9d0e28b625d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 11 Apr 2023 13:10:55 +0200 Subject: [PATCH 083/147] new version 2.4.57 --- .gitignore | 1 + httpd.spec | 5 ++++- sources | 4 ++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4001074..275485b 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ x86_64 /httpd-2.4.54.tar.bz2.asc /httpd-2.4.55.tar.bz2.asc /httpd-2.4.56.tar.bz2.asc +/httpd-2.4.57.tar.bz2.asc diff --git a/httpd.spec b/httpd.spec index c885e82..8e8ee8b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,7 +23,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.56 +Version: 2.4.57 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 +- new version 2.4.57 + * Thu Mar 09 2023 Luboš Uhliarik - 2.4.56-1 - new version 2.4.56 diff --git a/sources b/sources index 290079d..ceb40e4 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.56.tar.bz2) = 5f12cd9878d822384b1bb163fea4d8edee5e7a0dd8b2389264387971268145cccc6a5a27ddf0436c5f1f631acc5fdc4874da2a47911483e421ca40bf783e0e12 -SHA512 (httpd-2.4.56.tar.bz2.asc) = 50f5e1f52e4a9a2f98d6831bc908e74a9d008978572246f668f2a1c6977014f30e77a8197f5db20a3500323f35e3d7d1a38b270cd0b7122aafc58d2df8132d4a +SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155 +SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From 8d5ccc86d7ffe25b7942d624dcf79810d59c599d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 25 May 2023 08:39:00 +0100 Subject: [PATCH 084/147] - document that "apachectl -t" is supported (#2180884) --- apachectl.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apachectl.xml b/apachectl.xml index 5e40832..34da42c 100644 --- a/apachectl.xml +++ b/apachectl.xml @@ -160,7 +160,7 @@ - + | Run a configuration file syntax test. It parses the configuration files and either reports Syntax OK From 3dbb71b2491f2f8384f5fdba9b8c74dd4da11a0e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 23 Jun 2023 09:59:04 +0100 Subject: [PATCH 085/147] also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 8e8ee8b..06173ae 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.57 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -602,7 +602,7 @@ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \ $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk # Sanitize CFLAGS & LIBTOOL in standard config_vars.mk -sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \ +sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \ -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \ -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \ @@ -850,6 +850,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 23 2023 Joe Orton - 2.4.57-2 +- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk + * Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 - new version 2.4.57 From fd06e529c2de123a89111dde2b26b713b464f017 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Jul 2023 12:13:09 +0100 Subject: [PATCH 086/147] - package /etc/systemd/httpd/httpd.service.d --- httpd.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/httpd.spec b/httpd.spec index 06173ae..bb9f422 100644 --- a/httpd.spec +++ b/httpd.spec @@ -432,8 +432,9 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \ # install systemd override drop directory # Web application packages can drop snippets into this location if # they need ExecStart[pre|post]. -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d -mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \ + $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d \ + $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf @@ -797,6 +798,7 @@ exit $rv %dir %{contentdir}/icons %attr(755,root,root) %dir %{_unitdir}/httpd.service.d %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d +%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d %{_sysusersdir}/httpd.conf %files tools @@ -850,7 +852,8 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Fri Jun 23 2023 Joe Orton - 2.4.57-2 +* Wed Jul 5 2023 Joe Orton - 2.4.57-2 +- package /etc/systemd/httpd/httpd.service.d - also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk * Tue Apr 11 2023 Luboš Uhliarik - 2.4.57-1 From 625e0ea487b869a57e56e3a9c6e846cc056e079d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Jul 2023 12:23:54 +0100 Subject: [PATCH 087/147] - fix use of %patchN --- httpd.spec | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/httpd.spec b/httpd.spec index bb9f422..d0cc281 100644 --- a/httpd.spec +++ b/httpd.spec @@ -243,31 +243,31 @@ written in the Lua programming language. %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %setup -q -%patch2 -p1 -b .apxs -%patch3 -p1 -b .deplibs +%patch -P2 -p1 -b .apxs +%patch -P3 -p1 -b .deplibs -%patch19 -p1 -b .detectsystemd +%patch -P19 -p1 -b .detectsystemd -%patch21 -p1 -b .r1842929+ -%patch22 -p1 -b .mod_systemd -%patch23 -p1 -b .export -%patch24 -p1 -b .corelimit -%patch26 -p1 -b .gettid -%patch27 -p1 -b .icons -%patch30 -p1 -b .cachehardmax -%patch34 -p1 -b .socketactivation -%patch38 -p1 -b .sslciphdefault -%patch39 -p1 -b .sslprotdefault -%patch41 -p1 -b .r1861793+ -%patch42 -p1 -b .r1828172+ -%patch45 -p1 -b .logjournal -%patch46 -p1 -b .separatesystemd -%patch25 -p1 -b .selinux +%patch -P21 -p1 -b .r1842929+ +%patch -P22 -p1 -b .mod_systemd +%patch -P23 -p1 -b .export +%patch -P24 -p1 -b .corelimit +%patch -P26 -p1 -b .gettid +%patch -P27 -p1 -b .icons +%patch -P30 -p1 -b .cachehardmax +%patch -P34 -p1 -b .socketactivation +%patch -P38 -p1 -b .sslciphdefault +%patch -P39 -p1 -b .sslprotdefault +%patch -P41 -p1 -b .r1861793+ +%patch -P42 -p1 -b .r1828172+ +%patch -P45 -p1 -b .logjournal +%patch -P46 -p1 -b .separatesystemd +%patch -P25 -p1 -b .selinux -%patch60 -p1 -b .enable-sslv3 -%patch61 -p1 -b .r1878890 -%patch63 -p1 -b .htcacheclean-dont-break -%patch65 -p1 -b .r1894152 +%patch -P60 -p1 -b .enable-sslv3 +%patch -P61 -p1 -b .r1878890 +%patch -P63 -p1 -b .htcacheclean-dont-break +%patch -P65 -p1 -b .r1894152 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h From e2a22401edb396b1067848a7fc2ecbe7370646fe Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Jul 2023 12:25:22 +0100 Subject: [PATCH 088/147] - fix httpd.service.d creation --- httpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index d0cc281..69027a9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -433,8 +433,8 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \ # Web application packages can drop snippets into this location if # they need ExecStart[pre|post]. mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \ - $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d \ - $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d + $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf From e930ce73066ccc729792fecc7e728c731758842b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 06:29:23 +0000 Subject: [PATCH 089/147] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 69027a9..1048d64 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.57 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -852,6 +852,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 2.4.57-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jul 5 2023 Joe Orton - 2.4.57-2 - package /etc/systemd/httpd/httpd.service.d - also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk From 454bf03452b41ccec6468e89a976d11d4bd2897f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 6 Oct 2023 15:47:34 +0200 Subject: [PATCH 090/147] SPDX migration --- httpd.spec | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index 1048d64..7b322c1 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.57 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -105,8 +105,14 @@ Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch # Security fixes +# Patch200: ... + +# Apache-2.0: everything +# BSD-3-Clause: util_pcre.c, ap_regex.h +# metamail AND HPND-sell-variant:: server/util_md5.c: +# Spencer-94: modules/metadata/mod_mime_magic.c +License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94) -License: ASL 2.0 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel @@ -852,6 +858,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Oct 06 2023 Luboš Uhliarik - 2.4.57-4 +- SPDX migration + * Thu Jul 20 2023 Fedora Release Engineering - 2.4.57-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From cdf2aaf5d2118d1c772052db35067ed8a7ab207e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 18 Oct 2023 09:15:16 +0100 Subject: [PATCH 091/147] Minor wording tweaks. --- httpd.service.xml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/httpd.service.xml b/httpd.service.xml index c6bf865..7dfdb97 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -175,7 +175,7 @@ Wants=network-online.target System packages (including the httpd package itself) may restart the httpd service automatically after packages are upgraded, installed, or removed. This is done using the - systemctl try-restart httpd.service, which + systemctl try-restart httpd.service command, which stops then starts the service if it is running. To disable automatic restarts, create the file @@ -183,8 +183,9 @@ Wants=network-online.target When httpd interfaces are added in an update, it may not be safe to reload a running service after upgrading, if updated modules require interfaces - only available in the updated httpd. It is recommended to allow - automatic restarts for this reason. + only available in the updated httpd binary. + It is recommended to allow automatic restarts for this + reason. From c9253b5bbf710374a7cf1e91af75841ffc474d67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 20 Oct 2023 14:13:15 +0200 Subject: [PATCH 092/147] new version 2.4.58 --- .gitignore | 1 + httpd-2.4.48-r1878890.patch | 116 ------------------------------------ httpd.spec | 9 +-- sources | 4 +- 4 files changed, 8 insertions(+), 122 deletions(-) delete mode 100644 httpd-2.4.48-r1878890.patch diff --git a/.gitignore b/.gitignore index 275485b..cc7babc 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ x86_64 /httpd-2.4.55.tar.bz2.asc /httpd-2.4.56.tar.bz2.asc /httpd-2.4.57.tar.bz2.asc +/httpd-2.4.58.tar.bz2.asc diff --git a/httpd-2.4.48-r1878890.patch b/httpd-2.4.48-r1878890.patch deleted file mode 100644 index 7f8ca57..0000000 --- a/httpd-2.4.48-r1878890.patch +++ /dev/null @@ -1,116 +0,0 @@ -diff --git a/include/util_ldap.h b/include/util_ldap.h -index 28e0760..edb8a81 100644 ---- a/include/util_ldap.h -+++ b/include/util_ldap.h -@@ -32,7 +32,6 @@ - #if APR_MAJOR_VERSION < 2 - /* The LDAP API is currently only present in APR 1.x */ - #include "apr_ldap.h" --#include "apr_ldap_rebind.h" - #else - #define APR_HAS_LDAP 0 - #endif -diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c -index 120f268..a5f7995 100644 ---- a/modules/ldap/util_ldap.c -+++ b/modules/ldap/util_ldap.c -@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r) - return OK; - } - -+/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use -+ * a simpler rebind callback than the implementation in APR-util. -+ * Testing for API version >= 3001 appears safe although OpenLDAP -+ * 2.1.x (API version = 2004) also has the 3-arg API. */ -+#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001 -+ -+#define uldap_rebind_init(p) APR_SUCCESS /* noop */ -+ -+static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request, -+ ber_int_t msgid, void *params) -+{ -+ util_ldap_connection_t *ldc = params; -+ -+ return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE); -+} -+ -+static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc) -+{ -+ ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc); -+ return APR_SUCCESS; -+} -+ -+#else /* !APR_HAS_OPENLDAP_LDAPSDK */ -+ -+#define USE_APR_LDAP_REBIND -+#include -+ -+#define uldap_rebind_init(p) apr_ldap_rebind_init(p) -+#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \ -+ (ldc)->ldap, (ldc)->binddn, \ -+ (ldc)->bindpw) -+#endif - - - /* ------------------------------------------------------------------ */ -@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param) - util_ldap_connection_t *ldc = param; - - if (ldc) { -+#ifdef USE_APR_LDAP_REBIND -+ /* forget the rebind info for this conn */ -+ if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { -+ apr_pool_clear(ldc->rebind_pool); -+ } -+#endif -+ - if (ldc->ldap) { - if (ldc->r) { - ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); -@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param) - ldc->ldap = NULL; - } - ldc->bound = 0; -- -- /* forget the rebind info for this conn */ -- if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { -- apr_ldap_rebind_remove(ldc->ldap); -- apr_pool_clear(ldc->rebind_pool); -- } - } - - return APR_SUCCESS; -@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r, - - if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { - /* Now that we have an ldap struct, add it to the referral list for rebinds. */ -- rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw); -+ rc = uldap_rebind_add(ldc); - if (rc != APR_SUCCESS) { - ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277) - "LDAP: Unable to add rebind cross reference entry. Out of memory?"); -@@ -856,6 +889,7 @@ static util_ldap_connection_t * - /* whether or not to keep this connection in the pool when it's returned */ - l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; - -+#ifdef USE_APR_LDAP_REBIND - if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) { - if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) { - ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286) -@@ -867,6 +901,7 @@ static util_ldap_connection_t * - } - apr_pool_tag(l->rebind_pool, "util_ldap_rebind"); - } -+#endif - - if (p) { - p->next = l; -@@ -3054,7 +3089,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog, - } - - /* Initialize the rebind callback's cross reference list. */ -- apr_ldap_rebind_init (p); -+ (void) uldap_rebind_init(p); - - #ifdef AP_LDAP_OPT_DEBUG - if (st->debug_level > 0) { diff --git a/httpd.spec b/httpd.spec index 7b322c1..4ff2d58 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.57 -Release: 4%{?dist} +Version: 2.4.58 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -100,7 +100,6 @@ Patch46: httpd-2.4.53-separate-systemd-fns.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.48-r1878890.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch @@ -271,7 +270,6 @@ written in the Lua programming language. %patch -P25 -p1 -b .selinux %patch -P60 -p1 -b .enable-sslv3 -%patch -P61 -p1 -b .r1878890 %patch -P63 -p1 -b .htcacheclean-dont-break %patch -P65 -p1 -b .r1894152 @@ -858,6 +856,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Oct 20 2023 Luboš Uhliarik - 2.4.58-1 +- new version 2.4.58 + * Fri Oct 06 2023 Luboš Uhliarik - 2.4.57-4 - SPDX migration diff --git a/sources b/sources index ceb40e4..8ac3947 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155 -SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd +SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1 +SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 From ac146d28f9397bf803ede12450d2acead287a21d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 2 Nov 2023 14:39:09 +0000 Subject: [PATCH 093/147] add dependency on apr-util-1(dbm) so a DBM provider is present --- httpd-2.4.58-properr.patch | 30 ++++++++++++++++++++++++++++++ httpd.spec | 8 +++++++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.58-properr.patch diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch new file mode 100644 index 0000000..4071f25 --- /dev/null +++ b/httpd-2.4.58-properr.patch @@ -0,0 +1,30 @@ +--- httpd-2.4.58/modules/dav/fs/dbm.c.properr ++++ httpd-2.4.58/modules/dav/fs/dbm.c +@@ -100,7 +100,7 @@ + /* There might not be a if we had problems creating it. */ + if (db == NULL) { + errcode = 1; +- errstr = "Could not open property database."; ++ errstr = "Could not open database."; + if (APR_STATUS_IS_EDSOOPEN(status)) + ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) + "The DBM driver could not be loaded"); +@@ -147,7 +147,7 @@ + "mod_dav_fs: The DBM library '%s' could not be loaded: %s", + err->reason, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, +- "Could not load library for property database."); ++ "Could not load library for DBM database."); + } + if ((status = apr_dbm_open2(&file, driver, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, +@@ -162,6 +162,9 @@ + != APR_SUCCESS + && !ro) { + /* ### do something with 'status' */ ++ ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, ++ "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)", ++ pathname, ro ? "only" : "write"); + + /* we can't continue if we couldn't open the file + and we need to write */ diff --git a/httpd.spec b/httpd.spec index 4ff2d58..066d182 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -142,6 +142,9 @@ Provides: mod_proxy_uwsgi = %{version}-%{release} Requires: /etc/mime.types Requires: httpd-tools = %{version}-%{release} Requires: httpd-filesystem = %{version}-%{release} +%if 0%{?fedora} > 39 || 0%{?rhel} > 9 +Requires: apr-util-1(dbm)%{_isa} +%endif Requires(pre): httpd-filesystem Conflicts: apr < 1.5.0-1 Conflicts: httpd < 2.4.53-2 @@ -856,6 +859,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Nov 2 2023 Joe Orton - 2.4.58-2 +- add dependency on apr-util-1(dbm) so a DBM provider is present + * Fri Oct 20 2023 Luboš Uhliarik - 2.4.58-1 - new version 2.4.58 From d69c709d67f1668d05fe7466b677ef5923b1c1f2 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:09:28 +0000 Subject: [PATCH 094/147] Update pullrev.sh. --- pullrev.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pullrev.sh b/pullrev.sh index 87b7cd7..703d376 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.51 +ver=2.4.58 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" @@ -43,7 +43,7 @@ for r in $*; do http*) curl -s "$r" | filterdiff --strip=3 ;; *) svn diff -c ${r} ${repo} ;; esac | filterdiff --remove-timestamps --clean \ - -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \ --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` if ! combinediff -w ${prev} ${this} > ${next}; then @@ -62,4 +62,4 @@ echo "+ git add ${fn}" git add "${fn}" echo "+ spec template:" echo "PatchN: ${fn}" -echo "%patchN -p1 -b .${suffix}" +echo "%patch -PN -p1 -b .${suffix}" From 5d639c7ccf9c83fe9fdbe28d95ed751f8d332620 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:11:45 +0000 Subject: [PATCH 095/147] mod_dav_fs: add DAVLockDBType, use global lock around lockdb --- httpd-2.4.58-properr.patch | 30 --- httpd-2.4.58-r1912477+.patch | 381 +++++++++++++++++++++++++++++++++++ httpd.spec | 7 +- 3 files changed, 387 insertions(+), 31 deletions(-) delete mode 100644 httpd-2.4.58-properr.patch create mode 100644 httpd-2.4.58-r1912477+.patch diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch deleted file mode 100644 index 4071f25..0000000 --- a/httpd-2.4.58-properr.patch +++ /dev/null @@ -1,30 +0,0 @@ ---- httpd-2.4.58/modules/dav/fs/dbm.c.properr -+++ httpd-2.4.58/modules/dav/fs/dbm.c -@@ -100,7 +100,7 @@ - /* There might not be a if we had problems creating it. */ - if (db == NULL) { - errcode = 1; -- errstr = "Could not open property database."; -+ errstr = "Could not open database."; - if (APR_STATUS_IS_EDSOOPEN(status)) - ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) - "The DBM driver could not be loaded"); -@@ -147,7 +147,7 @@ - "mod_dav_fs: The DBM library '%s' could not be loaded: %s", - err->reason, err->msg); - return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, -- "Could not load library for property database."); -+ "Could not load library for DBM database."); - } - if ((status = apr_dbm_open2(&file, driver, pathname, - ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, -@@ -162,6 +162,9 @@ - != APR_SUCCESS - && !ro) { - /* ### do something with 'status' */ -+ ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, -+ "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)", -+ pathname, ro ? "only" : "write"); - - /* we can't continue if we couldn't open the file - and we need to write */ diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch new file mode 100644 index 0000000..6458df8 --- /dev/null +++ b/httpd-2.4.58-r1912477+.patch @@ -0,0 +1,381 @@ +# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438 +http://svn.apache.org/viewvc?view=revision&revision=1912477 +http://svn.apache.org/viewvc?view=revision&revision=1912571 +http://svn.apache.org/viewvc?view=revision&revision=1912718 +http://svn.apache.org/viewvc?view=revision&revision=1913654 +http://svn.apache.org/viewvc?view=revision&revision=1914438 + +--- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/config6.m4 +@@ -20,4 +20,10 @@ + + APACHE_MODULE(dav_fs, DAV provider for the filesystem. --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav) + ++if test "x$enable_dav_fs" = "xshared"; then ++ # The only symbol which needs to be exported is the module ++ # structure, so ask libtool to hide everything else: ++ APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module]) ++fi ++ + APACHE_MODPATH_FINISH +--- httpd-2.4.58/modules/dav/fs/dbm.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/dbm.c +@@ -47,6 +47,10 @@ + #include "http_log.h" + #include "http_main.h" /* for ap_server_conf */ + ++#ifndef DEFAULT_PROPDB_DBM_TYPE ++#define DEFAULT_PROPDB_DBM_TYPE "default" ++#endif ++ + APLOG_USE_MODULE(dav_fs); + + struct dav_db { +@@ -100,7 +104,7 @@ + /* There might not be a if we had problems creating it. */ + if (db == NULL) { + errcode = 1; +- errstr = "Could not open property database."; ++ errstr = "Could not open database."; + if (APR_STATUS_IS_EDSOOPEN(status)) + ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) + "The DBM driver could not be loaded"); +@@ -129,10 +133,10 @@ + /* dav_dbm_open_direct: Opens a *dbm database specified by path. + * ro = boolean read-only flag. + */ +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb) ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb) + { +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) + const apr_dbm_driver_t *driver; + const apu_err_t *err; + #endif +@@ -141,13 +145,13 @@ + + *pdb = NULL; + +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) +- if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) { ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++ if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289) +- "mod_dav_fs: The DBM library '%s' could not be loaded: %s", +- err->reason, err->msg); ++ "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s", ++ err->reason, dbmtype, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, +- "Could not load library for property database."); ++ "Could not load library for database."); + } + if ((status = apr_dbm_open2(&file, driver, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, +@@ -156,7 +160,7 @@ + return dav_fs_dbm_error(NULL, p, status); + } + #else +- if ((status = apr_dbm_open(&file, pathname, ++ if ((status = apr_dbm_open_ex(&file, dbmtype, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, + APR_OS_DEFAULT, p)) + != APR_SUCCESS +@@ -206,7 +210,7 @@ + + /* ### do we need to deal with the umask? */ + +- return dav_dbm_open_direct(p, pathname, ro, pdb); ++ return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb); + } + + void dav_dbm_close(dav_db *db) +--- httpd-2.4.58/modules/dav/fs/lock.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/lock.c +@@ -181,8 +181,7 @@ + { + request_rec *r; /* for accessing the uuid state */ + apr_pool_t *pool; /* a pool to use */ +- const char *lockdb_path; /* where is the lock database? */ +- ++ const dav_fs_server_conf *conf; /* lock database config & metadata */ + int opened; /* we opened the database */ + dav_db *db; /* if non-NULL, the lock database */ + }; +@@ -292,6 +291,19 @@ + return dav_compare_locktoken(lt1, lt2); + } + ++static apr_status_t dav_fs_lockdb_cleanup(void *data) ++{ ++ dav_lockdb *lockdb = data; ++ ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ ++ if (lockdb->info->db) { ++ dav_dbm_close(lockdb->info->db); ++ } ++ ++ return APR_SUCCESS; ++} ++ + /* + ** dav_fs_really_open_lockdb: + ** +@@ -300,15 +312,27 @@ + static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb) + { + dav_error *err; ++ apr_status_t rv; + + if (lockdb->info->opened) + return NULL; + ++ rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex); ++ if (rv) { ++ return dav_new_error(lockdb->info->pool, ++ HTTP_INTERNAL_SERVER_ERROR, ++ DAV_ERR_LOCK_OPENDB, rv, ++ "Could not lock mutex for lock database."); ++ } ++ + err = dav_dbm_open_direct(lockdb->info->pool, +- lockdb->info->lockdb_path, ++ lockdb->info->conf->lockdb_path, ++ lockdb->info->conf->lockdb_type, + lockdb->ro, + &lockdb->info->db); + if (err != NULL) { ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ + return dav_push_error(lockdb->info->pool, + HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_OPENDB, +@@ -316,6 +340,10 @@ + err); + } + ++ apr_pool_cleanup_register(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup, ++ dav_fs_lockdb_cleanup); ++ + /* all right. it is opened now. */ + lockdb->info->opened = 1; + +@@ -341,9 +369,9 @@ + comb->pub.info = &comb->priv; + comb->priv.r = r; + comb->priv.pool = r->pool; +- +- comb->priv.lockdb_path = dav_get_lockdb_path(r); +- if (comb->priv.lockdb_path == NULL) { ++ comb->priv.conf = dav_fs_get_server_conf(r); ++ ++ if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) { + return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_NO_DB, 0, + "A lock database was not specified with the " +@@ -369,8 +397,8 @@ + */ + static void dav_fs_close_lockdb(dav_lockdb *lockdb) + { +- if (lockdb->info->db != NULL) +- dav_dbm_close(lockdb->info->db); ++ apr_pool_cleanup_run(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup); + } + + /* +--- httpd-2.4.58/modules/dav/fs/mod_dav_fs.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/mod_dav_fs.c +@@ -14,31 +14,35 @@ + * limitations under the License. + */ + ++#if !defined(_MSC_VER) && !defined(NETWARE) ++#include "ap_config_auto.h" ++#endif ++ + #include "httpd.h" + #include "http_config.h" ++#include "http_core.h" ++#include "http_log.h" + #include "apr_strings.h" + + #include "mod_dav.h" + #include "repos.h" + +-/* per-server configuration */ +-typedef struct { +- const char *lockdb_path; +- +-} dav_fs_server_conf; +- + extern module AP_MODULE_DECLARE_DATA dav_fs_module; + + #ifndef DEFAULT_DAV_LOCKDB + #define DEFAULT_DAV_LOCKDB "davlockdb" + #endif ++#ifndef DEFAULT_DAV_LOCKDB_TYPE ++#define DEFAULT_DAV_LOCKDB_TYPE "default" ++#endif + +-const char *dav_get_lockdb_path(const request_rec *r) +-{ +- dav_fs_server_conf *conf; ++static const char dav_fs_mutexid[] = "dav_fs-lockdb"; + +- conf = ap_get_module_config(r->server->module_config, &dav_fs_module); +- return conf->lockdb_path; ++static apr_global_mutex_t *dav_fs_lockdb_mutex; ++ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r) ++{ ++ return ap_get_module_config(r->server->module_config, &dav_fs_module); + } + + static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s) +@@ -57,15 +61,50 @@ + + newconf->lockdb_path = + child->lockdb_path ? child->lockdb_path : parent->lockdb_path; ++ newconf->lockdb_type = ++ child->lockdb_type ? child->lockdb_type : parent->lockdb_type; + + return newconf; + } + ++static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp) ++{ ++ if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0)) ++ return !OK; ++ return OK; ++} ++ ++static void dav_fs_child_init(apr_pool_t *p, server_rec *s) ++{ ++ apr_status_t rv; ++ ++ rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex, ++ apr_global_mutex_lockfile(dav_fs_lockdb_mutex), ++ p); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, ++ APLOGNO(10488) "child init failed for mutex"); ++ } ++} ++ + static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *base_server) + { + server_rec *s; ++ apr_status_t rv; + ++ /* Ignore first pass through the config. */ ++ if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) ++ return OK; ++ ++ rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL, ++ base_server, p, 0); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server, ++ APLOGNO(10489) "could not create lock mutex"); ++ return !OK; ++ } ++ + for (s = base_server; s; s = s->next) { + dav_fs_server_conf *conf; + +@@ -74,6 +113,13 @@ + if (!conf->lockdb_path) { + conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB); + } ++ if (!conf->lockdb_type) { ++ conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE; ++ } ++ ++ /* Mutex is common across all vhosts, but could have one per ++ * vhost if required. */ ++ conf->lockdb_mutex = dav_fs_lockdb_mutex; + } + + return OK; +@@ -98,19 +144,36 @@ + return NULL; + } + ++/* ++ * Command handler for the DAVLockDBType directive, which is TAKE1 ++ */ ++static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config, ++ const char *arg1) ++{ ++ dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config, ++ &dav_fs_module); ++ conf->lockdb_type = arg1; ++ ++ return NULL; ++} ++ + static const command_rec dav_fs_cmds[] = + { + /* per server */ + AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF, + "specify a lock database"), ++ AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF, ++ "specify a lock database DBM type"), + + { NULL } + }; + + static void register_hooks(apr_pool_t *p) + { ++ ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE); +- ++ ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE); ++ + dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL, + APR_HOOK_MIDDLE); + dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); +--- httpd-2.4.58/modules/dav/fs/repos.h.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/repos.h +@@ -25,6 +25,8 @@ + #ifndef _DAV_FS_REPOS_H_ + #define _DAV_FS_REPOS_H_ + ++#include "util_mutex.h" ++ + /* the subdirectory to hold all DAV-related information for a directory */ + #define DAV_FS_STATE_DIR ".DAV" + #define DAV_FS_STATE_FILE_FOR_DIR ".state_for_dir" +@@ -53,8 +55,8 @@ + /* DBM functions used by the repository and locking providers */ + extern const dav_hooks_db dav_hooks_db_dbm; + +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb); ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb); + void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname, + const char **state1, const char **state2); + dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key); +@@ -64,8 +66,15 @@ + int dav_dbm_exists(dav_db *db, apr_datum_t key); + void dav_dbm_close(dav_db *db); + +-/* where is the lock database located? */ +-const char *dav_get_lockdb_path(const request_rec *r); ++/* Per-server configuration. */ ++typedef struct { ++ const char *lockdb_path; ++ const char *lockdb_type; ++ apr_global_mutex_t *lockdb_mutex; ++} dav_fs_server_conf; ++ ++/* Returns server configuration for the request. */ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r); + + const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r); + const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r); diff --git a/httpd.spec b/httpd.spec index 066d182..bff884c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -96,6 +96,7 @@ Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch Patch46: httpd-2.4.53-separate-systemd-fns.patch +Patch47: httpd-2.4.58-r1912477+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -271,6 +272,7 @@ written in the Lua programming language. %patch -P45 -p1 -b .logjournal %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux +%patch -P47 -p1 -b .r1912477+ %patch -P60 -p1 -b .enable-sslv3 %patch -P63 -p1 -b .htcacheclean-dont-break @@ -859,6 +861,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Dec 8 2023 Joe Orton - 2.4.58-3 +- mod_dav_fs: add DAVLockDBType, use global lock around lockdb + * Thu Nov 2 2023 Joe Orton - 2.4.58-2 - add dependency on apr-util-1(dbm) so a DBM provider is present From 3d4b4777ce7dcd6b777cc57052faeb192828f618 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:55:58 +0000 Subject: [PATCH 096/147] - fix build with libxml2 2.12 --- httpd-2.4.58-r1914013.patch | 14 ++++++++++++++ httpd.spec | 2 ++ 2 files changed, 16 insertions(+) create mode 100644 httpd-2.4.58-r1914013.patch diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch new file mode 100644 index 0000000..f9e0786 --- /dev/null +++ b/httpd-2.4.58-r1914013.patch @@ -0,0 +1,14 @@ +# ./pullrev.sh 1914013 +http://svn.apache.org/viewvc?view=revision&revision=1914013 + +--- httpd-2.4.58/modules/filters/mod_xml2enc.c ++++ httpd-2.4.58/modules/filters/mod_xml2enc.c +@@ -209,7 +209,7 @@ + + /* to sniff, first we look for BOM */ + if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) { +- ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf, ++ ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf, + ctx->bytes); + if (HAVE_ENCODING(ctx->xml2enc)) { + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432) diff --git a/httpd.spec b/httpd.spec index bff884c..5bd2c4d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -101,6 +101,7 @@ Patch47: httpd-2.4.58-r1912477+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.58-r1914013.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch @@ -275,6 +276,7 @@ written in the Lua programming language. %patch -P47 -p1 -b .r1912477+ %patch -P60 -p1 -b .enable-sslv3 +%patch -P61 -p1 -b .r1914013 %patch -P63 -p1 -b .htcacheclean-dont-break %patch -P65 -p1 -b .r1894152 From af4e8a43b66a9ed63903c84ca4b9be765bda87a1 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Dec 2023 08:59:47 +0000 Subject: [PATCH 097/147] Note build fix. --- httpd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/httpd.spec b/httpd.spec index 5bd2c4d..f593ac4 100644 --- a/httpd.spec +++ b/httpd.spec @@ -865,6 +865,7 @@ exit $rv %changelog * Fri Dec 8 2023 Joe Orton - 2.4.58-3 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb +- fix build with libxml2 2.12 * Thu Nov 2 2023 Joe Orton - 2.4.58-2 - add dependency on apr-util-1(dbm) so a DBM provider is present From 16be14d05f9d8cf33661a58715a302be8872ce81 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 11:48:45 +0000 Subject: [PATCH 098/147] fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) mod_ssl: move to provider API for pkcs11 support (#2253014) --- httpd-2.4.58-r1913912+.patch | 847 +++++++++++++++++++++++++++++++++++ httpd-2.4.58-r1914365.patch | 219 +++++++++ httpd.spec | 10 +- pullrev.sh | 6 +- 4 files changed, 1079 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.58-r1913912+.patch create mode 100644 httpd-2.4.58-r1914365.patch diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch new file mode 100644 index 0000000..c8ea8fa --- /dev/null +++ b/httpd-2.4.58-r1913912+.patch @@ -0,0 +1,847 @@ +# ./pullrev.sh 1913912 1915067 + +http://svn.apache.org/viewvc?view=revision&revision=1913912 +http://svn.apache.org/viewvc?view=revision&revision=1915067 + +--- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 ++++ httpd-2.4.58/modules/ssl/mod_ssl.c +@@ -25,8 +25,7 @@ + */ + + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "util_md5.h" + #include "util_mutex.h" + #include "ap_provider.h" +@@ -75,11 +74,9 @@ + SSL_CMD_SRV(SessionCache, TAKE1, + "SSL Session Cache storage " + "('none', 'nonenotnull', 'dbm:/path/to/file')") +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + SSL_CMD_SRV(CryptoDevice, TAKE1, + "SSL external Crypto Device usage " + "('builtin', '...')") +-#endif + SSL_CMD_SRV(RandomSeed, TAKE23, + "SSL Pseudo Random Number Generator (PRNG) seeding source " + "('startup|connect builtin|file:/path|exec:/path [bytes]')") +--- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912 ++++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h +@@ -30,14 +30,17 @@ + + /* OpenSSL headers */ + +-#ifndef SSL_PRIVATE_H + #include +-#if (OPENSSL_VERSION_NUMBER >= 0x10001000) ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include /* for OPENSSL_API_LEVEL */ ++#endif ++#if OPENSSL_VERSION_NUMBER >= 0x10001000 + /* must be defined before including ssl.h */ + #define OPENSSL_NO_SSL_INTERN + #endif + #include +-#endif ++#include ++#include + + /** + * init_server hook -- allow SSL_CTX-specific initialization to be performed by +--- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_config.c +@@ -27,6 +27,7 @@ + damned if you don't.'' + -- Unknown */ + #include "ssl_private.h" ++ + #include "util_mutex.h" + #include "ap_provider.h" + +@@ -593,14 +594,15 @@ + return NULL; + } + +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd, + void *dcfg, + const char *arg) + { + SSLModConfigRec *mc = myModConfig(cmd->server); + const char *err; ++#if MODSSL_HAVE_ENGINE_API + ENGINE *e; ++#endif + + if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { + return err; +@@ -609,13 +611,16 @@ + if (strcEQ(arg, "builtin")) { + mc->szCryptoDevice = NULL; + } ++#if MODSSL_HAVE_ENGINE_API + else if ((e = ENGINE_by_id(arg))) { + mc->szCryptoDevice = arg; + ENGINE_free(e); + } ++#endif + else { + err = "SSLCryptoDevice: Invalid argument; must be one of: " + "'builtin' (none)"; ++#if MODSSL_HAVE_ENGINE_API + e = ENGINE_get_first(); + while (e) { + err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e), +@@ -624,12 +629,12 @@ + * on the 'old' e, per the docs in engine.h. */ + e = ENGINE_get_next(e); + } ++#endif + return err; + } + + return NULL; + } +-#endif + + const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd, + void *dcfg, +--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c +@@ -27,8 +27,7 @@ + see Recursive.'' + -- Unknown */ + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "mpm_common.h" + #include "mod_md.h" + +@@ -218,6 +217,16 @@ + } + #endif + ++static APR_INLINE unsigned long modssl_runtime_lib_version(void) ++{ ++#if MODSSL_USE_OPENSSL_PRE_1_1_API ++ return SSLeay(); ++#else ++ return OpenSSL_version_num(); ++#endif ++} ++ ++ + /* + * Per-module initialization + */ +@@ -225,18 +234,22 @@ + apr_pool_t *ptemp, + server_rec *base_server) + { ++ unsigned long runtime_lib_version = modssl_runtime_lib_version(); + SSLModConfigRec *mc = myModConfig(base_server); + SSLSrvConfigRec *sc; + server_rec *s; + apr_status_t rv; + apr_array_header_t *pphrases; + +- if (SSLeay() < MODSSL_LIBRARY_VERSION) { ++ AP_DEBUG_ASSERT(mc); ++ ++ if (runtime_lib_version < MODSSL_LIBRARY_VERSION) { + ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882) + "Init: this version of mod_ssl was compiled against " +- "a newer library (%s, version currently loaded is %s)" ++ "a newer library (%s (%s), version currently loaded is 0x%lX)" + " - may result in undefined or erroneous behavior", +- MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT); ++ MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT, ++ runtime_lib_version); + } + + /* We initialize mc->pid per-process in the child init, +@@ -313,11 +326,9 @@ + /* + * SSL external crypto device ("engine") support + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) { + return rv; + } +-#endif + + ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883) + "Init: Initialized %s library", MODSSL_LIBRARY_NAME); +@@ -473,9 +484,9 @@ + * Support for external a Crypto Device ("engine"), usually + * a hardware accelerator card for crypto operations. + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p) + { ++#if MODSSL_HAVE_ENGINE_API + SSLModConfigRec *mc = myModConfig(s); + ENGINE *e; + +@@ -507,10 +518,9 @@ + + ENGINE_free(e); + } +- ++#endif + return APR_SUCCESS; + } +-#endif + + #ifdef HAVE_TLSEXT + static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, +@@ -1320,15 +1330,6 @@ + return 0; + } + +-static APR_INLINE int modssl_DH_bits(DH *dh) +-{ +-#if OPENSSL_VERSION_NUMBER < 0x30000000L +- return DH_bits(dh); +-#else +- return BN_num_bits(DH_get0_p(dh)); +-#endif +-} +- + /* SSL_CTX_use_PrivateKey_file() can fail either because the private + * key was encrypted, or due to a mismatch between an already-loaded + * cert and the key - a common misconfiguration - from calling +@@ -1354,15 +1355,10 @@ + SSLModConfigRec *mc = myModConfig(s); + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; +- X509 *cert; +- DH *dh; ++ EVP_PKEY *pkey; + #ifdef HAVE_ECC +- EC_GROUP *ecparams = NULL; +- int nid; +- EC_KEY *eckey = NULL; +-#endif +-#ifndef HAVE_SSL_CONF_CMD +- SSL *ssl; ++ EC_GROUP *ecgroup = NULL; ++ int curve_nid = 0; + #endif + + /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ +@@ -1373,7 +1369,7 @@ + (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, + const char *)); + i++) { +- EVP_PKEY *pkey; ++ X509 *cert = NULL; + const char *engine_certfile = NULL; + + key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); +@@ -1416,8 +1412,6 @@ + if (modssl_is_engine_id(keyfile)) { + apr_status_t rv; + +- cert = NULL; +- + if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, + engine_certfile, keyfile, + &cert, &pkey))) { +@@ -1488,22 +1482,21 @@ + * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later, + * and SSL_CTX_get0_certificate is implemented.) + */ +- if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) { ++ cert = SSL_CTX_get0_certificate(mctx->ssl_ctx); + #else +- ssl = SSL_new(mctx->ssl_ctx); ++ { ++ SSL *ssl = SSL_new(mctx->ssl_ctx); + if (ssl) { + /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */ + SSL_set_connect_state(ssl); + cert = SSL_get_certificate(ssl); ++ SSL_free(ssl); ++ } + } +- if (!ssl || !cert) { + #endif ++ if (!cert) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566) + "Unable to retrieve certificate %s", key_id); +-#ifndef HAVE_SSL_CONF_CMD +- if (ssl) +- SSL_free(ssl); +-#endif + return APR_EGENERAL; + } + +@@ -1525,10 +1518,6 @@ + } + #endif + +-#ifndef HAVE_SSL_CONF_CMD +- SSL_free(ssl); +-#endif +- + ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568) + "Certificate and private key %s configured from %s and %s", + key_id, certfile, keyfile); +@@ -1538,15 +1527,33 @@ + * Try to read DH parameters from the (first) SSLCertificateFile + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); +- if (certfile && !modssl_is_engine_id(certfile) +- && (dh = ssl_dh_GetParamFromFile(certfile))) { +- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() +- * for OpenSSL 3.0+. */ ++ if (certfile && !modssl_is_engine_id(certfile)) { ++ int done = 0, num_bits = 0; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ DH *dh = modssl_dh_from_file(certfile); ++ if (dh) { ++ num_bits = DH_bits(dh); + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); ++ DH_free(dh); ++ done = 1; ++ } ++#else ++ pkey = modssl_dh_pkey_from_file(certfile); ++ if (pkey) { ++ num_bits = EVP_PKEY_get_bits(pkey); ++ if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) { ++ EVP_PKEY_free(pkey); ++ } ++ else { ++ done = 1; ++ } ++ } ++#endif ++ if (done) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", +- modssl_DH_bits(dh), vhost_id, certfile); +- DH_free(dh); ++ num_bits, vhost_id, certfile); ++ } + } + #if !MODSSL_USE_OPENSSL_PRE_1_1_API + else { +@@ -1561,13 +1568,27 @@ + * Similarly, try to read the ECDH curve name from SSLCertificateFile... + */ + if (certfile && !modssl_is_engine_id(certfile) +- && (ecparams = ssl_ec_GetParamFromFile(certfile)) +- && (nid = EC_GROUP_get_curve_name(ecparams)) +- && (eckey = EC_KEY_new_by_curve_name(nid))) { ++ && (ecgroup = modssl_ec_group_from_file(certfile)) ++ && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) { ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid); ++ if (eckey) { + SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ++ EC_KEY_free(eckey); ++ } ++ else { ++ curve_nid = 0; ++ } ++#else ++ if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) { ++ curve_nid = 0; ++ } ++#endif ++ if (curve_nid) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) + "ECDH curve %s for %s specified in %s", +- OBJ_nid2sn(nid), vhost_id, certfile); ++ OBJ_nid2sn(curve_nid), vhost_id, certfile); ++ } + } + /* + * ...otherwise, enable auto curve selection (OpenSSL 1.0.2) +@@ -1575,18 +1596,20 @@ + * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList + */ + #if MODSSL_USE_OPENSSL_PRE_1_1_API +- else { ++ if (!curve_nid) { + #if defined(SSL_CTX_set_ecdh_auto) + SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1); + #else +- eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ if (eckey) { + SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ++ EC_KEY_free(eckey); ++ } + #endif + } + #endif + /* OpenSSL assures us that _free() is NULL-safe */ +- EC_KEY_free(eckey); +- EC_GROUP_free(ecparams); ++ EC_GROUP_free(ecgroup); + #endif + + return APR_SUCCESS; +--- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_io.c +@@ -28,8 +28,7 @@ + core keeps dumping.'' + -- Unknown */ + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "apr_date.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake, +@@ -2283,14 +2282,7 @@ + ssl_io_filter_cleanup, apr_pool_cleanup_null); + + if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) { +- BIO *rbio = SSL_get_rbio(ssl), +- *wbio = SSL_get_wbio(ssl); +- BIO_set_callback(rbio, ssl_io_data_cb); +- BIO_set_callback_arg(rbio, (void *)ssl); +- if (wbio && wbio != rbio) { +- BIO_set_callback(wbio, ssl_io_data_cb); +- BIO_set_callback_arg(wbio, (void *)ssl); +- } ++ modssl_set_io_callbacks(ssl); + } + + return; +@@ -2374,13 +2366,22 @@ + "+-------------------------------------------------------------------------+"); + } + +-long ssl_io_data_cb(BIO *bio, int cmd, +- const char *argp, ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static long modssl_io_cb(BIO *bio, int cmd, const char *argp, ++ size_t len, int argi, long argl, int rc, ++ size_t *processed) ++#else ++static long modssl_io_cb(BIO *bio, int cmd, const char *argp, + int argi, long argl, long rc) ++#endif + { + SSL *ssl; + conn_rec *c; + server_rec *s; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ (void)len; ++ (void)processed; ++#endif + + if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL) + return rc; +@@ -2402,7 +2403,7 @@ + "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s", + MODSSL_LIBRARY_NAME, + (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"), +- rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), ++ (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), + bio, argp, dump); + if (*dump != '\0' && argp != NULL) + ssl_io_data_dump(c, s, argp, rc); +@@ -2417,3 +2418,25 @@ + } + return rc; + } ++ ++static APR_INLINE void set_bio_callback(BIO *bio, void *arg) ++{ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ BIO_set_callback_ex(bio, modssl_io_cb); ++#else ++ BIO_set_callback(bio, modssl_io_cb); ++#endif ++ BIO_set_callback_arg(bio, arg); ++} ++ ++void modssl_set_io_callbacks(SSL *ssl) ++{ ++ BIO *rbio = SSL_get_rbio(ssl), ++ *wbio = SSL_get_wbio(ssl); ++ if (rbio) { ++ set_bio_callback(rbio, ssl); ++ } ++ if (wbio && wbio != rbio) { ++ set_bio_callback(wbio, ssl); ++ } ++} +--- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c +@@ -2581,6 +2581,7 @@ + sc->server->pks->service_unavailable : 0; + + ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s); ++ + /* + * There is one special filter callback, which is set + * very early depending on the base_server's log level. +@@ -2589,14 +2590,7 @@ + * we need to set that callback here. + */ + if (APLOGtrace4(s)) { +- BIO *rbio = SSL_get_rbio(ssl), +- *wbio = SSL_get_wbio(ssl); +- BIO_set_callback(rbio, ssl_io_data_cb); +- BIO_set_callback_arg(rbio, (void *)ssl); +- if (wbio && wbio != rbio) { +- BIO_set_callback(wbio, ssl_io_data_cb); +- BIO_set_callback_arg(wbio, (void *)ssl); +- } ++ modssl_set_io_callbacks(ssl); + } + + return 1; +--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c +@@ -30,6 +30,8 @@ + -- Clifford Stoll */ + #include "ssl_private.h" + ++#include ++ + typedef struct { + server_rec *s; + apr_pool_t *p; +@@ -606,8 +608,7 @@ + return (len); + } + +- +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + + /* OpenSSL UI implementation for passphrase entry; largely duplicated + * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be +@@ -831,7 +832,7 @@ + const char *certid, const char *keyid, + X509 **pubkey, EVP_PKEY **privkey) + { +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + const char *c, *scheme; + ENGINE *e; + UI_METHOD *ui_method = get_passphrase_ui(p); +--- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_private.h +@@ -83,16 +83,13 @@ + + #include "ap_expr.h" + +-/* OpenSSL headers */ +-#include +-#if (OPENSSL_VERSION_NUMBER >= 0x10001000) +-/* must be defined before including ssl.h */ +-#define OPENSSL_NO_SSL_INTERN +-#endif +-#if OPENSSL_VERSION_NUMBER >= 0x30000000 +-#include ++/* keep first for compat API */ ++#ifndef OPENSSL_API_COMPAT ++#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */ + #endif +-#include ++#include "mod_ssl_openssl.h" ++ ++/* OpenSSL headers */ + #include + #include + #include +@@ -102,12 +99,23 @@ + #include + #include + #include ++#include ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include ++#endif + + /* Avoid tripping over an engine build installed globally and detected + * when the user points at an explicit non-engine flavor of OpenSSL + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \ ++ && (OPENSSL_VERSION_NUMBER < 0x30000000 \ ++ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ ++ && !defined(OPENSSL_NO_ENGINE) + #include ++#define MODSSL_HAVE_ENGINE_API 1 ++#endif ++#ifndef MODSSL_HAVE_ENGINE_API ++#define MODSSL_HAVE_ENGINE_API 0 + #endif + + #if (OPENSSL_VERSION_NUMBER < 0x0090801f) +@@ -142,10 +150,18 @@ + * include most changes from OpenSSL >= 1.1 (new functions, macros, + * deprecations, ...), so we have to work around this... + */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) ++#if LIBRESSL_VERSION_NUMBER < 0x2070000f ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 ++#else ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 ++#endif + #else /* defined(LIBRESSL_VERSION_NUMBER) */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 ++#else ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 + #endif ++#endif /* defined(LIBRESSL_VERSION_NUMBER) */ + + #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L + #define HAVE_FIPS +@@ -211,7 +227,10 @@ + #endif + + /* Secure Remote Password */ +-#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) ++#if !defined(OPENSSL_NO_SRP) \ ++ && (OPENSSL_VERSION_NUMBER < 0x30000000L \ ++ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ ++ && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) + #define HAVE_SRP + #include + #endif +@@ -254,6 +273,14 @@ + #endif + #endif + ++/* those may be deprecated */ ++#ifndef X509_get_notBefore ++#define X509_get_notBefore X509_getm_notBefore ++#endif ++#ifndef X509_get_notAfter ++#define X509_get_notAfter X509_getm_notAfter ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) + #define HAVE_OPENSSL_KEYLOG + #endif +@@ -1019,7 +1046,7 @@ + /** I/O */ + void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); + void ssl_io_filter_register(apr_pool_t *); +-long ssl_io_data_cb(BIO *, int, const char *, int, long, long); ++void modssl_set_io_callbacks(SSL *ssl); + + /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request + * to allow an SSL renegotiation to take place. */ +@@ -1057,9 +1084,13 @@ + X509 **pubkey, EVP_PKEY **privkey); + + /** Diffie-Hellman Parameter Support */ +-DH *ssl_dh_GetParamFromFile(const char *); ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++DH *modssl_dh_from_file(const char *); ++#else ++EVP_PKEY *modssl_dh_pkey_from_file(const char *); ++#endif + #ifdef HAVE_ECC +-EC_GROUP *ssl_ec_GetParamFromFile(const char *); ++EC_GROUP *modssl_ec_group_from_file(const char *); + #endif + + /* Store the EVP_PKEY key (serialized into DER) in the hash table with +--- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util.c +@@ -476,7 +476,7 @@ + + int modssl_is_engine_id(const char *name) + { +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + /* ### Can handle any other special ENGINE key names here? */ + return strncmp(name, "pkcs11:", 7) == 0; + #else +--- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c +@@ -464,29 +464,52 @@ + ** _________________________________________________________________ + */ + +-DH *ssl_dh_GetParamFromFile(const char *file) ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++DH *modssl_dh_from_file(const char *file) + { +- DH *dh = NULL; ++ DH *dh; + BIO *bio; + + if ((bio = BIO_new_file(file, "r")) == NULL) + return NULL; + dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); + BIO_free(bio); +- return (dh); ++ ++ return dh; ++} ++#else ++EVP_PKEY *modssl_dh_pkey_from_file(const char *file) ++{ ++ EVP_PKEY *pkey; ++ BIO *bio; ++ ++ if ((bio = BIO_new_file(file, "r")) == NULL) ++ return NULL; ++ pkey = PEM_read_bio_Parameters(bio, NULL); ++ BIO_free(bio); ++ ++ return pkey; + } ++#endif + + #ifdef HAVE_ECC +-EC_GROUP *ssl_ec_GetParamFromFile(const char *file) ++EC_GROUP *modssl_ec_group_from_file(const char *file) + { +- EC_GROUP *group = NULL; ++ EC_GROUP *group; + BIO *bio; + + if ((bio = BIO_new_file(file, "r")) == NULL) + return NULL; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L + group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); ++#else ++ group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters, ++ PEM_STRING_ECPARAMETERS, bio, ++ NULL, NULL, NULL); ++#endif + BIO_free(bio); +- return (group); ++ ++ return group; + } + #endif + +--- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c +@@ -29,9 +29,9 @@ + -- Alexei Sayle */ + + #include "ssl_private.h" ++ + #include "ap_mpm.h" + #include "apr_thread_mutex.h" +-#include "mod_ssl_openssl.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, + (server_rec *s, apr_pool_t *p, +--- httpd-2.4.58/support/ab.c.r1913912 ++++ httpd-2.4.58/support/ab.c +@@ -166,13 +166,18 @@ + + #if defined(HAVE_OPENSSL) + +-#include ++#include + #include + #include + #include + #include + #include + #include ++#include ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + #define USE_SSL + + #define SK_NUM(x) sk_X509_num(x) +@@ -555,22 +560,33 @@ + * + */ + #ifdef USE_SSL +-static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret) ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static long ssl_print_cb(BIO *bio, int cmd, const char *argp, ++ size_t len, int argi, long argl, int ret, ++ size_t *processed) ++#else ++static long ssl_print_cb(BIO *bio, int cmd, const char *argp, ++ int argi, long argl, long ret) ++#endif + { + BIO *out; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ (void)len; ++ (void)processed; ++#endif + + out=(BIO *)BIO_get_callback_arg(bio); + if (out == NULL) return(ret); + + if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) { + BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n", +- bio, argp, argi, ret, ret); ++ bio, argp, argi, (long)ret, (long)ret); + BIO_dump(out,(char *)argp,(int)ret); + return(ret); + } + else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) { + BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n", +- bio, argp, argi, ret, ret); ++ bio, argp, argi, (long)ret, (long)ret); + BIO_dump(out,(char *)argp,(int)ret); + } + return ret; +@@ -765,17 +781,29 @@ + break; + #ifndef OPENSSL_NO_EC + case EVP_PKEY_EC: { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ size_t len; ++ char cname[80]; ++ if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, ++ cname, sizeof(cname), &len)) { ++ cname[0] = '?'; ++ len = 1; ++ } ++ cname[len] = '\0'; ++#else + const char *cname = NULL; + EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); + int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); + EC_KEY_free(ec); + cname = EC_curve_nid2nist(nid); +- if (!cname) ++ if (!cname) { + cname = OBJ_nid2sn(nid); +- ++ if (!cname) ++ cname = "?"; ++ } ++#endif + apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits", +- cname, +- EVP_PKEY_bits(key)); ++ cname, EVP_PKEY_bits(key)); + break; + } + #endif +@@ -1428,7 +1456,11 @@ + SSL_set_bio(c->ssl, bio, bio); + SSL_set_connect_state(c->ssl); + if (verbosity >= 4) { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ BIO_set_callback_ex(bio, ssl_print_cb); ++#else + BIO_set_callback(bio, ssl_print_cb); ++#endif + BIO_set_callback_arg(bio, (void *)bio_err); + } + #ifdef HAVE_TLSEXT diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch new file mode 100644 index 0000000..e7390eb --- /dev/null +++ b/httpd-2.4.58-r1914365.patch @@ -0,0 +1,219 @@ +# ./pullrev.sh 1914365 +http://svn.apache.org/viewvc?view=revision&revision=1914365 + +--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c +@@ -1421,8 +1421,10 @@ + if (cert) { + if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137) +- "Failed to configure engine certificate %s, check %s", +- key_id, certfile); ++ "Failed to configure certificate %s from %s, check %s", ++ key_id, mc->szCryptoDevice ? ++ mc->szCryptoDevice : "provider", ++ certfile); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return APR_EGENERAL; + } +@@ -1433,8 +1435,9 @@ + + if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130) +- "Failed to configure private key %s from engine", +- keyfile); ++ "Failed to configure private key %s from %s", ++ keyfile, mc->szCryptoDevice ? ++ mc->szCryptoDevice : "provider"); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return APR_EGENERAL; + } +--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c +@@ -31,6 +31,9 @@ + #include "ssl_private.h" + + #include ++#if MODSSL_HAVE_OPENSSL_STORE ++#include ++#endif + + typedef struct { + server_rec *s; +@@ -608,7 +611,7 @@ + return (len); + } + +-#if MODSSL_HAVE_ENGINE_API ++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE + + /* OpenSSL UI implementation for passphrase entry; largely duplicated + * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be +@@ -826,13 +829,14 @@ + } + #endif + +- +-apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, ++#if MODSSL_HAVE_ENGINE_API ++static apr_status_t modssl_load_keypair_engine(server_rec *s, apr_pool_t *p, + const char *vhostid, +- const char *certid, const char *keyid, +- X509 **pubkey, EVP_PKEY **privkey) ++ const char *certid, ++ const char *keyid, ++ X509 **pubkey, ++ EVP_PKEY **privkey) + { +-#if MODSSL_HAVE_ENGINE_API + const char *c, *scheme; + ENGINE *e; + UI_METHOD *ui_method = get_passphrase_ui(p); +@@ -906,6 +910,118 @@ + ENGINE_free(e); + + return APR_SUCCESS; ++} ++#endif ++ ++#if MODSSL_HAVE_OPENSSL_STORE ++static OSSL_STORE_INFO *modssl_load_store_uri(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *uri, int info_type) ++{ ++ OSSL_STORE_CTX *sctx; ++ UI_METHOD *ui_method = get_passphrase_ui(p); ++ pphrase_cb_arg_t ppcb; ++ OSSL_STORE_INFO *info = NULL; ++ ++ memset(&ppcb, 0, sizeof ppcb); ++ ppcb.s = s; ++ ppcb.p = p; ++ ppcb.bPassPhraseDialogOnce = TRUE; ++ ppcb.key_id = vhostid; ++ ppcb.pkey_file = uri; ++ ++ sctx = OSSL_STORE_open(uri, ui_method, &ppcb, NULL, NULL); ++ if (!sctx) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(10491) ++ "Init: OSSL_STORE_open failed for PKCS#11 URI `%s'", ++ uri); ++ return NULL; ++ } ++ ++ while (!OSSL_STORE_eof(sctx)) { ++ info = OSSL_STORE_load(sctx); ++ if (!info) ++ break; ++ ++ if (OSSL_STORE_INFO_get_type(info) == info_type) ++ break; ++ ++ OSSL_STORE_INFO_free(info); ++ info = NULL; ++ } ++ ++ OSSL_STORE_close(sctx); ++ ++ return info; ++} ++ ++static apr_status_t modssl_load_keypair_store(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *certid, ++ const char *keyid, ++ X509 **pubkey, ++ EVP_PKEY **privkey) ++{ ++ OSSL_STORE_INFO *info = NULL; ++ ++ *privkey = NULL; ++ *pubkey = NULL; ++ ++ info = modssl_load_store_uri(s, p, vhostid, keyid, OSSL_STORE_INFO_PKEY); ++ if (!info) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10492) ++ "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ *privkey = OSSL_STORE_INFO_get1_PKEY(info); ++ OSSL_STORE_INFO_free(info); ++ if (!*privkey) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10493) ++ "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ if (certid) { ++ info = modssl_load_store_uri(s, p, vhostid, certid, OSSL_STORE_INFO_CERT); ++ if (!info) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10494) ++ "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ *pubkey = OSSL_STORE_INFO_get1_CERT(info); ++ OSSL_STORE_INFO_free(info); ++ if (!*pubkey) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10495) ++ "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'", ++ certid); ++ return ssl_die(s); ++ } ++ } ++ ++ return APR_SUCCESS; ++} ++#endif ++ ++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *certid, const char *keyid, ++ X509 **pubkey, EVP_PKEY **privkey) ++{ ++#if MODSSL_HAVE_OPENSSL_STORE ++ SSLModConfigRec *mc = myModConfig(s); ++ ++ if (!mc->szCryptoDevice) ++ return modssl_load_keypair_store(s, p, vhostid, certid, keyid, ++ pubkey, privkey); ++#endif ++#if MODSSL_HAVE_ENGINE_API ++ return modssl_load_keypair_engine(s, p, vhostid, certid, keyid, ++ pubkey, privkey); + #else + return APR_ENOTIMPL; + #endif +--- httpd-2.4.58/modules/ssl/ssl_private.h.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_private.h +@@ -118,6 +118,15 @@ + #define MODSSL_HAVE_ENGINE_API 0 + #endif + ++/* Use OpenSSL 3.x STORE for loading URI keys and certificates starting with ++ * OpenSSL 3.0 ++ */ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#define MODSSL_HAVE_OPENSSL_STORE 1 ++#else ++#define MODSSL_HAVE_OPENSSL_STORE 0 ++#endif ++ + #if (OPENSSL_VERSION_NUMBER < 0x0090801f) + #error mod_ssl requires OpenSSL 0.9.8a or later + #endif +--- httpd-2.4.58/modules/ssl/ssl_util.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_util.c +@@ -476,7 +476,7 @@ + + int modssl_is_engine_id(const char *name) + { +-#if MODSSL_HAVE_ENGINE_API ++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE + /* ### Can handle any other special ENGINE key names here? */ + return strncmp(name, "pkcs11:", 7) == 0; + #else diff --git a/httpd.spec b/httpd.spec index f593ac4..8bd81c5 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -97,6 +97,8 @@ Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch Patch46: httpd-2.4.53-separate-systemd-fns.patch Patch47: httpd-2.4.58-r1912477+.patch +Patch48: httpd-2.4.58-r1913912+.patch +Patch49: httpd-2.4.58-r1914365.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -274,6 +276,8 @@ written in the Lua programming language. %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux %patch -P47 -p1 -b .r1912477+ +%patch -P48 -p1 -b .r1913912 +%patch -P49 -p1 -b .r1914365 %patch -P60 -p1 -b .enable-sslv3 %patch -P61 -p1 -b .r1914013 @@ -863,6 +867,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jan 5 2024 Joe Orton - 2.4.58-4 +- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) +- mod_ssl: move to provider API for pkcs11 support (#2253014) + * Fri Dec 8 2023 Joe Orton - 2.4.58-3 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb - fix build with libxml2 2.12 diff --git a/pullrev.sh b/pullrev.sh index 703d376..7ace161 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,7 +6,7 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" ver=2.4.58 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" @@ -43,7 +43,9 @@ for r in $*; do http*) curl -s "$r" | filterdiff --strip=3 ;; *) svn diff -c ${r} ${repo} ;; esac | filterdiff --remove-timestamps --clean \ - -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \ + -x 'CHANGES' -x 'changes-entries/*.txt' \ + -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x '.github/*' \ --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` if ! combinediff -w ${prev} ${this} > ${next}; then From fcc34b87be47c9a4d2931865ae235a7fe6743dbe Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 11:55:23 +0000 Subject: [PATCH 099/147] Fix suffix. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 8bd81c5..dc3b6e9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -276,7 +276,7 @@ written in the Lua programming language. %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux %patch -P47 -p1 -b .r1912477+ -%patch -P48 -p1 -b .r1913912 +%patch -P48 -p1 -b .r1913912+ %patch -P49 -p1 -b .r1914365 %patch -P60 -p1 -b .enable-sslv3 From ab864817dceb5ee4d715e71a70f8892ea6c53a17 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 16:21:21 +0000 Subject: [PATCH 100/147] - renumber patches to apply in numerical order - use %autosetup --- httpd.spec | 70 ++++++++++++++++-------------------------------------- 1 file changed, 21 insertions(+), 49 deletions(-) diff --git a/httpd.spec b/httpd.spec index dc3b6e9..2c71c87 100644 --- a/httpd.spec +++ b/httpd.spec @@ -81,31 +81,31 @@ Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes -Patch21: httpd-2.4.48-r1842929+.patch -Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.53-export.patch -Patch24: httpd-2.4.43-corelimit.patch -Patch25: httpd-2.4.54-selinux.patch -Patch26: httpd-2.4.54-gettid.patch -Patch27: httpd-2.4.54-icons.patch -Patch30: httpd-2.4.43-cachehardmax.patch -Patch34: httpd-2.4.43-socket-activation.patch -Patch38: httpd-2.4.43-sslciphdefault.patch -Patch39: httpd-2.4.43-sslprotdefault.patch -Patch41: httpd-2.4.43-r1861793+.patch -Patch42: httpd-2.4.48-r1828172+.patch -Patch45: httpd-2.4.43-logjournal.patch -Patch46: httpd-2.4.53-separate-systemd-fns.patch -Patch47: httpd-2.4.58-r1912477+.patch -Patch48: httpd-2.4.58-r1913912+.patch -Patch49: httpd-2.4.58-r1914365.patch +Patch20: httpd-2.4.48-r1842929+.patch +Patch21: httpd-2.4.43-mod_systemd.patch +Patch22: httpd-2.4.53-export.patch +Patch23: httpd-2.4.43-corelimit.patch +Patch24: httpd-2.4.54-gettid.patch +Patch25: httpd-2.4.54-icons.patch +Patch26: httpd-2.4.43-cachehardmax.patch +Patch27: httpd-2.4.43-socket-activation.patch +Patch28: httpd-2.4.43-sslciphdefault.patch +Patch29: httpd-2.4.43-sslprotdefault.patch +Patch30: httpd-2.4.43-r1861793+.patch +Patch31: httpd-2.4.48-r1828172+.patch +Patch32: httpd-2.4.43-logjournal.patch +Patch33: httpd-2.4.53-separate-systemd-fns.patch +Patch34: httpd-2.4.58-r1912477+.patch +Patch35: httpd-2.4.58-r1913912+.patch +Patch36: httpd-2.4.58-r1914365.patch +Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.58-r1914013.patch -Patch63: httpd-2.4.46-htcacheclean-dont-break.patch -Patch65: httpd-2.4.51-r1894152.patch +Patch62: httpd-2.4.46-htcacheclean-dont-break.patch +Patch63: httpd-2.4.51-r1894152.patch # Security fixes # Patch200: ... @@ -254,35 +254,7 @@ written in the Lua programming language. %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%setup -q -%patch -P2 -p1 -b .apxs -%patch -P3 -p1 -b .deplibs - -%patch -P19 -p1 -b .detectsystemd - -%patch -P21 -p1 -b .r1842929+ -%patch -P22 -p1 -b .mod_systemd -%patch -P23 -p1 -b .export -%patch -P24 -p1 -b .corelimit -%patch -P26 -p1 -b .gettid -%patch -P27 -p1 -b .icons -%patch -P30 -p1 -b .cachehardmax -%patch -P34 -p1 -b .socketactivation -%patch -P38 -p1 -b .sslciphdefault -%patch -P39 -p1 -b .sslprotdefault -%patch -P41 -p1 -b .r1861793+ -%patch -P42 -p1 -b .r1828172+ -%patch -P45 -p1 -b .logjournal -%patch -P46 -p1 -b .separatesystemd -%patch -P25 -p1 -b .selinux -%patch -P47 -p1 -b .r1912477+ -%patch -P48 -p1 -b .r1913912+ -%patch -P49 -p1 -b .r1914365 - -%patch -P60 -p1 -b .enable-sslv3 -%patch -P61 -p1 -b .r1914013 -%patch -P63 -p1 -b .htcacheclean-dont-break -%patch -P65 -p1 -b .r1894152 +%autosetup -p1 -S gendiff # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h From df3d3d1151513090e3ba649f03bdaa6817d87c5e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 16:21:32 +0000 Subject: [PATCH 101/147] - remove some old workarounds --- httpd.spec | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/httpd.spec b/httpd.spec index 2c71c87..a34b641 100644 --- a/httpd.spec +++ b/httpd.spec @@ -318,16 +318,6 @@ autoheader && autoconf || exit 1 %set_build_flags -# Hard-code path to links to avoid unnecessary builddep -export LYNX_PATH=/usr/bin/links - -%ifarch aarch64 -# The configure check for epoll_create() is failing. httpd/apr only -# actually uses epoll_create1() so this test could be smarter. Work -# around it for now. -export ac_cv_func_epoll_create=yes -%endif - # Build the daemon ./configure \ --prefix=%{_sysconfdir}/httpd \ From 9e93ea3734c71f5ca0d57b5a1a2bea873d0408e5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 22:15:08 +0000 Subject: [PATCH 102/147] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index a34b641..396594c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jan 5 2024 Joe Orton - 2.4.58-4 - fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) - mod_ssl: move to provider API for pkcs11 support (#2253014) From 7fa757742fa45e9f48ffb6c6d7d53bd18dfdf521 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 21:49:39 +0000 Subject: [PATCH 103/147] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 396594c..3b40eed 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 756bc47b6f56edcff7e1408b0fac760177276a7e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 11:55:21 +0000 Subject: [PATCH 104/147] Add upstream tracking notes for patches. --- httpd-2.4.43-apxs.patch | 3 +++ httpd-2.4.43-corelimit.patch | 3 +++ httpd-2.4.43-r1861793+.patch | 5 +++-- httpd-2.4.46-htcacheclean-dont-break.patch | 3 +++ httpd-2.4.48-r1828172+.patch | 2 ++ httpd-2.4.48-r1842929+.patch | 3 +++ httpd-2.4.51-r1894152.patch | 2 ++ httpd-2.4.54-gettid.patch | 3 +++ httpd-2.4.58-r1912477+.patch | 2 ++ httpd-2.4.58-r1913912+.patch | 2 ++ httpd-2.4.58-r1914013.patch | 2 ++ httpd-2.4.58-r1914365.patch | 2 ++ 12 files changed, 30 insertions(+), 2 deletions(-) diff --git a/httpd-2.4.43-apxs.patch b/httpd-2.4.43-apxs.patch index b1185b2..808d6a8 100644 --- a/httpd-2.4.43-apxs.patch +++ b/httpd-2.4.43-apxs.patch @@ -1,3 +1,6 @@ + +Upstream-Status: local customisation + diff --git a/support/apxs.in b/support/apxs.in index b2705fa..c331631 100644 --- a/support/apxs.in diff --git a/httpd-2.4.43-corelimit.patch b/httpd-2.4.43-corelimit.patch index dd4b874..8c9899c 100644 --- a/httpd-2.4.43-corelimit.patch +++ b/httpd-2.4.43-corelimit.patch @@ -1,3 +1,6 @@ + +Upstream-Status: local customisation + diff --git a/server/core.c b/server/core.c index 79b2a82..dc0f17a 100644 --- a/server/core.c diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch index 08e96cb..89d0328 100644 --- a/httpd-2.4.43-r1861793+.patch +++ b/httpd-2.4.43-r1861793+.patch @@ -1,5 +1,6 @@ -diff --git a/configure.in b/configure.in -index cb43246..0bb6b0d 100644 + +Upstream-Status: proposed for 2.4.59 + --- httpd-2.4.43/configure.in.r1861793+ +++ httpd-2.4.43/configure.in @@ -465,6 +465,28 @@ diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch index e52318a..919e9e3 100644 --- a/httpd-2.4.46-htcacheclean-dont-break.patch +++ b/httpd-2.4.46-htcacheclean-dont-break.patch @@ -1,3 +1,6 @@ + +Upstream-Status: r1915508, proposed for 2.4.59 + diff --git a/support/htcacheclean.c b/support/htcacheclean.c index 958ba6d..0a7fe3c 100644 --- a/support/htcacheclean.c diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.48-r1828172+.patch index 37f1855..5f3be4c 100644 --- a/httpd-2.4.48-r1828172+.patch +++ b/httpd-2.4.48-r1828172+.patch @@ -1,6 +1,8 @@ https://github.com/apache/httpd/pull/209 +Upstream-Status: in trunk, not proposed for 2.4.x + diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 index 0000000000..69df73ce68 diff --git a/httpd-2.4.48-r1842929+.patch b/httpd-2.4.48-r1842929+.patch index f83a21d..c1837e7 100644 --- a/httpd-2.4.48-r1842929+.patch +++ b/httpd-2.4.48-r1842929+.patch @@ -1,3 +1,6 @@ + +Upstream-Status: in trunk, not proposed for 2.4.x + diff --git a/Makefile.in b/Makefile.in index 6747aea..40c7076 100644 --- a/Makefile.in diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch index 95f5081..10c4b3f 100644 --- a/httpd-2.4.51-r1894152.patch +++ b/httpd-2.4.51-r1894152.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1894152 http://svn.apache.org/viewvc?view=revision&revision=1894152 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 +++ httpd-2.4.51/modules/filters/mod_deflate.c @@ -835,6 +835,7 @@ diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch index dfc447b..88c956d 100644 --- a/httpd-2.4.54-gettid.patch +++ b/httpd-2.4.54-gettid.patch @@ -1,3 +1,6 @@ + +Upstream-Status: everything but last hunk merged for 2.4.59 + From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 7 Jul 2020 09:48:01 +0100 diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch index 6458df8..eb3deff 100644 --- a/httpd-2.4.58-r1912477+.patch +++ b/httpd-2.4.58-r1912477+.patch @@ -5,6 +5,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1912718 http://svn.apache.org/viewvc?view=revision&revision=1913654 http://svn.apache.org/viewvc?view=revision&revision=1914438 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+ +++ httpd-2.4.58/modules/dav/fs/config6.m4 @@ -20,4 +20,10 @@ diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch index c8ea8fa..f8fd4a4 100644 --- a/httpd-2.4.58-r1913912+.patch +++ b/httpd-2.4.58-r1913912+.patch @@ -3,6 +3,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1913912 http://svn.apache.org/viewvc?view=revision&revision=1915067 +Upstream-Status: merged for 2.4.59 + --- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 +++ httpd-2.4.58/modules/ssl/mod_ssl.c @@ -25,8 +25,7 @@ diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch index f9e0786..02dcac3 100644 --- a/httpd-2.4.58-r1914013.patch +++ b/httpd-2.4.58-r1914013.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1914013 http://svn.apache.org/viewvc?view=revision&revision=1914013 +Upstream-Status: merged for 2.4.59 + --- httpd-2.4.58/modules/filters/mod_xml2enc.c +++ httpd-2.4.58/modules/filters/mod_xml2enc.c @@ -209,7 +209,7 @@ diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch index e7390eb..8512de3 100644 --- a/httpd-2.4.58-r1914365.patch +++ b/httpd-2.4.58-r1914365.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1914365 http://svn.apache.org/viewvc?view=revision&revision=1914365 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365 +++ httpd-2.4.58/modules/ssl/ssl_engine_init.c @@ -1421,8 +1421,10 @@ From dee54cd734ac9fb909a122b141005210c218dbfd Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 13:04:06 +0000 Subject: [PATCH 105/147] - Updated Systemd security settings (closes #3) (Rahul Sundaram) - updated httpd.service(5) man page (Joe Orton) --- httpd.service | 19 ++++++++++++++++++- httpd.service.xml | 24 +++++++++++++++++------- httpd.spec | 6 +++++- httpd@.service | 19 ++++++++++++++++++- 4 files changed, 58 insertions(+), 10 deletions(-) diff --git a/httpd.service b/httpd.service index c5b5e08..b75e28c 100644 --- a/httpd.service +++ b/httpd.service @@ -26,8 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed -PrivateTmp=true +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/httpd.service.xml b/httpd.service.xml index 7dfdb97..3ddbc9e 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -231,7 +231,16 @@ Wants=network-online.target Process policies and restrictions - The httpd service uses the following options: + The httpd.service unit enables a + variety of sandboxing options. Many of these prevent the service + from changing the system configuration - such as + ProtectClock and + ProtectKernelModules. See + systemd.exec5 + and + systemd.service5 + for more information on these options. Particular notice should + be taken of the following: PrivateTmp is enabled by @@ -247,13 +256,14 @@ Wants=network-online.target the policy to continue, httpd will continue to run (and recover) if a single child is terminated because of excess memory consumption. - - See - systemd.exec5 - and - systemd.service5 - for more information. + ProtectHome is set to + read-only by default. CGI scripts run via + UserDir will not be able modify any + content in /home by + default. + + diff --git a/httpd.spec b/httpd.spec index 3b40eed..b2ea95b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jan 15 2024 Rahul Sundaram - 2.4.58-7 +- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening +- updated httpd.service(5) (Joe Orton) + * Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/httpd@.service b/httpd@.service index 84424fb..8b20b90 100644 --- a/httpd@.service +++ b/httpd@.service @@ -19,8 +19,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed -PrivateTmp=true +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target From 264f63b024fd9a66004460be7ea80195c27cc33f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 17:02:24 +0000 Subject: [PATCH 106/147] - ignore source file changes in rpminspect's "upstream" module --- rpminspect.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 1b4f2fe..17e48d1 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,3 +4,18 @@ badfuncs: # and APR interfaces for IPv6 addresses. ignore: - /usr/lib*/httpd/modules/mod_proxy.so +upstream: + ignore: + - *.xml + - *.service + - *.socket + - *.conf + - *.sysconf + - *.tmpfiles + - README.* + - *.sysusers + - *.png + - httpd-ssl-* + - config.layout + - action*.sh + - apachectl.* From 5096106709c71826233d39ae724535d5795c6485 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 12:42:59 +0000 Subject: [PATCH 107/147] Add gating configuration. --- gating.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gating.yaml b/gating.yaml index e4c04e7..fb11fa9 100644 --- a/gating.yaml +++ b/gating.yaml @@ -14,3 +14,14 @@ decision_contexts: [bodhi_update_push_stable] subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} From 27131dea8da568264571886f93bc0f30ff455eb3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:23:51 +0000 Subject: [PATCH 108/147] Update tracking. --- httpd-2.4.51-r1894152.patch | 2 +- httpd-2.4.54-selinux.patch | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch index 10c4b3f..20e6784 100644 --- a/httpd-2.4.51-r1894152.patch +++ b/httpd-2.4.51-r1894152.patch @@ -1,7 +1,7 @@ # ./pullrev.sh 1894152 http://svn.apache.org/viewvc?view=revision&revision=1894152 -Upstream-Status: in trunk, not proposed for 2.4.x +Upstream-Status: merged for 2.4.59 --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 +++ httpd-2.4.51/modules/filters/mod_deflate.c diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch index 4d66bd8..661b983 100644 --- a/httpd-2.4.54-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,3 +1,6 @@ + +Upstream-Status: in trunk not in 2.4.x + diff --git a/configure.in b/configure.in index 74015ca..8c0ee10 100644 --- httpd-2.4.54/modules/arch/unix/config5.m4.selinux From 2ce898b07d9c7824441c032793f3dc1ed473088d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:23:56 +0000 Subject: [PATCH 109/147] rebuild to fix changelog ordering --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index b2ea95b..1bd5e95 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,7 +829,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Mon Jan 15 2024 Rahul Sundaram - 2.4.58-7 +* Thu Mar 28 2024 Joe Orton - 2.4.58-8 +- rebuild to fix changelog ordering + +* Mon Feb 15 2024 Rahul Sundaram - 2.4.58-7 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening - updated httpd.service(5) (Joe Orton) From 1c126ced89f57ab99219139a2ccdd2f6d657927b Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:25:42 +0000 Subject: [PATCH 110/147] really fix changelog ordering. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 1bd5e95..048057d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -832,7 +832,7 @@ exit $rv * Thu Mar 28 2024 Joe Orton - 2.4.58-8 - rebuild to fix changelog ordering -* Mon Feb 15 2024 Rahul Sundaram - 2.4.58-7 +* Thu Mar 7 2024 Rahul Sundaram - 2.4.58-7 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening - updated httpd.service(5) (Joe Orton) From 9ee4b1c3240908f7f663a0534198e600a4bc6cbc Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Apr 2024 09:22:35 +0100 Subject: [PATCH 111/147] update to 2.4.59 --- .gitignore | 1 + httpd-2.4.43-r1861793+.patch | 272 ------ httpd-2.4.46-htcacheclean-dont-break.patch | 16 - httpd-2.4.51-r1894152.patch | 38 - httpd-2.4.54-gettid.patch | 94 -- httpd-2.4.58-r1913912+.patch | 849 ------------------ httpd-2.4.58-r1914013.patch | 16 - httpd-2.4.59-gettid.patch | 14 + ...172+.patch => httpd-2.4.59-unifycgid.patch | 292 +++--- httpd.spec | 16 +- sources | 4 +- 11 files changed, 168 insertions(+), 1444 deletions(-) delete mode 100644 httpd-2.4.43-r1861793+.patch delete mode 100644 httpd-2.4.46-htcacheclean-dont-break.patch delete mode 100644 httpd-2.4.51-r1894152.patch delete mode 100644 httpd-2.4.54-gettid.patch delete mode 100644 httpd-2.4.58-r1913912+.patch delete mode 100644 httpd-2.4.58-r1914013.patch create mode 100644 httpd-2.4.59-gettid.patch rename httpd-2.4.48-r1828172+.patch => httpd-2.4.59-unifycgid.patch (91%) diff --git a/.gitignore b/.gitignore index cc7babc..bdad39b 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ x86_64 /httpd-2.4.56.tar.bz2.asc /httpd-2.4.57.tar.bz2.asc /httpd-2.4.58.tar.bz2.asc +/httpd-2.4.59.tar.bz2.asc diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch deleted file mode 100644 index 89d0328..0000000 --- a/httpd-2.4.43-r1861793+.patch +++ /dev/null @@ -1,272 +0,0 @@ - -Upstream-Status: proposed for 2.4.59 - ---- httpd-2.4.43/configure.in.r1861793+ -+++ httpd-2.4.43/configure.in -@@ -465,6 +465,28 @@ - AC_SEARCH_LIBS(crypt, crypt) - CRYPT_LIBS="$LIBS" - APACHE_SUBST(CRYPT_LIBS) -+ -+if test "$ac_cv_search_crypt" != "no"; then -+ # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt -+ AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [ -+ AC_RUN_IFELSE([AC_LANG_PROGRAM([[ -+#include -+#include -+#include -+ -+#define PASSWD_0 "Hello world!" -+#define SALT_0 "\$6\$saltstring" -+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \ -+ "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" -+]], [char *result = crypt(PASSWD_0, SALT_0); -+ if (!result) return 1; -+ if (strcmp(result, EXPECT_0)) return 2; -+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])]) -+ if test "$ap_cv_crypt_sha2" = yes; then -+ AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes]) -+ fi -+fi -+ - LIBS="$saved_LIBS" - - dnl See Comment #Spoon ---- httpd-2.4.43/docs/man/htpasswd.1.r1861793+ -+++ httpd-2.4.43/docs/man/htpasswd.1 -@@ -27,16 +27,16 @@ - .SH "SYNOPSIS" - - .PP --\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR -+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR -+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR -+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR -+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR - - - .SH "SUMMARY" -@@ -48,7 +48,7 @@ - Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&. - - .PP --\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&. -+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&. - - .PP - This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&. -@@ -73,17 +73,26 @@ - \fB-m\fR - Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&. - .TP -+\fB-2\fR -+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&. -+.TP -+\fB-5\fR -+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&. -+.TP - \fB-B\fR - Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&. - .TP - \fB-C\fR - This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&. - .TP -+\fB-r\fR -+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&. -+.TP - \fB-d\fR - Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&. - .TP - \fB-s\fR --Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&. -+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&. - .TP - \fB-p\fR - Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&. -@@ -152,10 +161,13 @@ - When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&. - - .PP --The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&. -+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&. -+ -+.PP -+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&. - - .PP --The SHA and \fBcrypt()\fR formats are insecure by today's standards\&. -+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&. - - .SH "RESTRICTIONS" - ---- httpd-2.4.43/support/htpasswd.c.r1861793+ -+++ httpd-2.4.43/support/htpasswd.c -@@ -109,17 +109,21 @@ - "for it." NL - " -i Read password from stdin without verification (for script usage)." NL - " -m Force MD5 encryption of the password (default)." NL -- " -B Force bcrypt encryption of the password (very secure)." NL -+ " -2 Force SHA-256 crypt() hash of the password (very secure)." NL -+ " -5 Force SHA-512 crypt() hash of the password (very secure)." NL -+ " -B Force bcrypt encryption of the password (very secure)." NL - " -C Set the computing time used for the bcrypt algorithm" NL - " (higher is more secure but slower, default: %d, valid: 4 to 17)." NL -+ " -r Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL -+ " (higher is more secure but slower, default: 5000)." NL - " -d Force CRYPT encryption of the password (8 chars max, insecure)." NL -- " -s Force SHA encryption of the password (insecure)." NL -+ " -s Force SHA-1 encryption of the password (insecure)." NL - " -p Do not encrypt the password (plaintext, insecure)." NL - " -D Delete the specified user." NL - " -v Verify password for the specified user." NL - "On other systems than Windows and NetWare the '-p' flag will " - "probably not work." NL -- "The SHA algorithm does not use a salt and is less secure than the " -+ "The SHA-1 algorithm does not use a salt and is less secure than the " - "MD5 algorithm." NL, - BCRYPT_DEFAULT_COST - ); -@@ -178,7 +182,7 @@ - if (rv != APR_SUCCESS) - exit(ERR_SYNTAX); - -- while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) { -+ while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) { - switch (opt) { - case 'c': - *mask |= APHTP_NEWFILE; ---- httpd-2.4.43/support/passwd_common.c.r1861793+ -+++ httpd-2.4.43/support/passwd_common.c -@@ -179,16 +179,21 @@ - int mkhash(struct passwd_ctx *ctx) - { - char *pw; -- char salt[16]; -+ char salt[17]; - apr_status_t rv; - int ret = 0; - #if CRYPT_ALGO_SUPPORTED - char *cbuf; - #endif -+#ifdef HAVE_CRYPT_SHA2 -+ const char *setting; -+ char method; -+#endif - -- if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) { -+ if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT -+ && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) { - apr_file_printf(errfile, -- "Warning: Ignoring -C argument for this algorithm." NL); -+ "Warning: Ignoring -C/-r argument for this algorithm." NL); - } - - if (ctx->passwd == NULL) { -@@ -246,6 +251,34 @@ - break; - #endif /* CRYPT_ALGO_SUPPORTED */ - -+#ifdef HAVE_CRYPT_SHA2 -+ case ALG_CRYPT_SHA256: -+ case ALG_CRYPT_SHA512: -+ ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool); -+ if (ret != 0) -+ break; -+ -+ method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6'; -+ -+ if (ctx->cost) -+ setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s", -+ method, ctx->cost, salt); -+ else -+ setting = apr_psprintf(ctx->pool, "$%c$%s", -+ method, salt); -+ -+ cbuf = crypt(pw, setting); -+ if (cbuf == NULL) { -+ rv = APR_FROM_OS_ERROR(errno); -+ ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv); -+ ret = ERR_PWMISMATCH; -+ break; -+ } -+ -+ apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1); -+ break; -+#endif /* HAVE_CRYPT_SHA2 */ -+ - #if BCRYPT_ALGO_SUPPORTED - case ALG_BCRYPT: - rv = apr_generate_random_bytes((unsigned char*)salt, 16); -@@ -294,6 +327,19 @@ - case 's': - ctx->alg = ALG_APSHA; - break; -+#ifdef HAVE_CRYPT_SHA2 -+ case '2': -+ ctx->alg = ALG_CRYPT_SHA256; -+ break; -+ case '5': -+ ctx->alg = ALG_CRYPT_SHA512; -+ break; -+#else -+ case '2': -+ case '5': -+ ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform."; -+ return ERR_ALG_NOT_SUPP; -+#endif - case 'p': - ctx->alg = ALG_PLAIN; - #if !PLAIN_ALGO_SUPPORTED -@@ -324,11 +370,12 @@ - return ERR_ALG_NOT_SUPP; - #endif - break; -- case 'C': { -+ case 'C': -+ case 'r': { - char *endptr; - long num = strtol(opt_arg, &endptr, 10); - if (*endptr != '\0' || num <= 0) { -- ctx->errstr = "argument to -C must be a positive integer"; -+ ctx->errstr = "argument to -C/-r must be a positive integer"; - return ERR_SYNTAX; - } - ctx->cost = num; ---- httpd-2.4.43/support/passwd_common.h.r1861793+ -+++ httpd-2.4.43/support/passwd_common.h -@@ -28,6 +28,8 @@ - #include "apu_version.h" - #endif - -+#include "ap_config_auto.h" -+ - #define MAX_STRING_LEN 256 - - #define ALG_PLAIN 0 -@@ -35,6 +37,8 @@ - #define ALG_APMD5 2 - #define ALG_APSHA 3 - #define ALG_BCRYPT 4 -+#define ALG_CRYPT_SHA256 5 -+#define ALG_CRYPT_SHA512 6 - - #define BCRYPT_DEFAULT_COST 5 - -@@ -84,7 +88,7 @@ - apr_size_t out_len; - char *passwd; - int alg; -- int cost; -+ int cost; /* cost for bcrypt, rounds for SHA-2 */ - enum { - PW_PROMPT = 0, - PW_ARG, diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch deleted file mode 100644 index 919e9e3..0000000 --- a/httpd-2.4.46-htcacheclean-dont-break.patch +++ /dev/null @@ -1,16 +0,0 @@ - -Upstream-Status: r1915508, proposed for 2.4.59 - -diff --git a/support/htcacheclean.c b/support/htcacheclean.c -index 958ba6d..0a7fe3c 100644 ---- a/support/htcacheclean.c -+++ b/support/htcacheclean.c -@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round) - } - } - } -- -- break; - } - } - } diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch deleted file mode 100644 index 20e6784..0000000 --- a/httpd-2.4.51-r1894152.patch +++ /dev/null @@ -1,38 +0,0 @@ -# ./pullrev.sh 1894152 -http://svn.apache.org/viewvc?view=revision&revision=1894152 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 -+++ httpd-2.4.51/modules/filters/mod_deflate.c -@@ -835,6 +835,7 @@ - while (!APR_BRIGADE_EMPTY(bb)) - { - apr_bucket *b; -+ apr_status_t rv; - - /* - * Optimization: If we are a HEAD request and bytes_sent is not zero -@@ -914,8 +915,6 @@ - } - - if (APR_BUCKET_IS_FLUSH(e)) { -- apr_status_t rv; -- - /* flush the remaining data from the zlib buffers */ - zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate, - Z_SYNC_FLUSH, NO_UPDATE_CRC); -@@ -947,7 +946,12 @@ - } - - /* read */ -- apr_bucket_read(e, &data, &len, APR_BLOCK_READ); -+ rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ); -+ if (rv) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298) -+ "failed reading from %s bucket", e->type->name); -+ return rv; -+ } - if (!len) { - apr_bucket_delete(e); - continue; diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch deleted file mode 100644 index 88c956d..0000000 --- a/httpd-2.4.54-gettid.patch +++ /dev/null @@ -1,94 +0,0 @@ - -Upstream-Status: everything but last hunk merged for 2.4.59 - -From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001 -From: Joe Orton -Date: Tue, 7 Jul 2020 09:48:01 +0100 -Subject: [PATCH] Check and use gettid() directly with glibc 2.30+. - -* configure.in: Check for gettid() and define HAVE_SYS_GETTID if - gettid() is only usable via syscall(). - -* server/log.c (log_tid): Use gettid() directly if available. ---- - configure.in | 14 +++++++++----- - server/log.c | 8 ++++++-- - 2 files changed, 15 insertions(+), 7 deletions(-) - -diff --git a/configure.in b/configure.in -index 423d58d4b9a..60cbf7b7f81 100644 ---- httpd-2.4.54/configure.in.gettid -+++ httpd-2.4.54/configure.in -@@ -502,22 +502,26 @@ - timegm \ - getpgid \ - fopen64 \ --getloadavg -+getloadavg \ -+gettid - ) - - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - --AC_CACHE_CHECK([for gettid()], ac_cv_gettid, -+if test $ac_cv_func_gettid = no; then -+ # On Linux before glibc 2.30, gettid() is only usable via syscall() -+ AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include - #include - #include - int main(int argc, char **argv) { - pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; }, --[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])]) --if test "$ac_cv_gettid" = "yes"; then -- AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()]) -+ [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])]) -+ if test "$ap_cv_gettid" = "yes"; then -+ AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()]) -+ fi - fi - - dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs ---- httpd-2.4.54/server/log.c.gettid -+++ httpd-2.4.54/server/log.c -@@ -55,7 +55,7 @@ - #include "ap_mpm.h" - #include "ap_listen.h" - --#if HAVE_GETTID -+#if HAVE_SYS_GETTID - #include - #include - #endif -@@ -627,14 +627,18 @@ - #if APR_HAS_THREADS - int result; - #endif --#if HAVE_GETTID -+#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID) - if (arg && *arg == 'g') { -+#ifdef HAVE_GETTID -+ pid_t tid = gettid(); -+#else - pid_t tid = syscall(SYS_gettid); -+#endif - if (tid == -1) - return 0; - return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid); - } --#endif -+#endif /* HAVE_GETTID || HAVE_SYS_GETTID */ - #if APR_HAS_THREADS - if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS - && result != AP_MPMQ_NOT_SUPPORTED) -@@ -968,7 +972,7 @@ - #if APR_HAS_THREADS - field_start = len; - len += cpystrn(buf + len, ":tid ", buflen - len); -- item_len = log_tid(info, NULL, buf + len, buflen - len); -+ item_len = log_tid(info, "g", buf + len, buflen - len); - if (!item_len) - len = field_start; - else diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch deleted file mode 100644 index f8fd4a4..0000000 --- a/httpd-2.4.58-r1913912+.patch +++ /dev/null @@ -1,849 +0,0 @@ -# ./pullrev.sh 1913912 1915067 - -http://svn.apache.org/viewvc?view=revision&revision=1913912 -http://svn.apache.org/viewvc?view=revision&revision=1915067 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 -+++ httpd-2.4.58/modules/ssl/mod_ssl.c -@@ -25,8 +25,7 @@ - */ - - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "util_md5.h" - #include "util_mutex.h" - #include "ap_provider.h" -@@ -75,11 +74,9 @@ - SSL_CMD_SRV(SessionCache, TAKE1, - "SSL Session Cache storage " - "('none', 'nonenotnull', 'dbm:/path/to/file')") --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - SSL_CMD_SRV(CryptoDevice, TAKE1, - "SSL external Crypto Device usage " - "('builtin', '...')") --#endif - SSL_CMD_SRV(RandomSeed, TAKE23, - "SSL Pseudo Random Number Generator (PRNG) seeding source " - "('startup|connect builtin|file:/path|exec:/path [bytes]')") ---- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912 -+++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h -@@ -30,14 +30,17 @@ - - /* OpenSSL headers */ - --#ifndef SSL_PRIVATE_H - #include --#if (OPENSSL_VERSION_NUMBER >= 0x10001000) -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include /* for OPENSSL_API_LEVEL */ -+#endif -+#if OPENSSL_VERSION_NUMBER >= 0x10001000 - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif - #include --#endif -+#include -+#include - - /** - * init_server hook -- allow SSL_CTX-specific initialization to be performed by ---- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_config.c -@@ -27,6 +27,7 @@ - damned if you don't.'' - -- Unknown */ - #include "ssl_private.h" -+ - #include "util_mutex.h" - #include "ap_provider.h" - -@@ -593,14 +594,15 @@ - return NULL; - } - --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd, - void *dcfg, - const char *arg) - { - SSLModConfigRec *mc = myModConfig(cmd->server); - const char *err; -+#if MODSSL_HAVE_ENGINE_API - ENGINE *e; -+#endif - - if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { - return err; -@@ -609,13 +611,16 @@ - if (strcEQ(arg, "builtin")) { - mc->szCryptoDevice = NULL; - } -+#if MODSSL_HAVE_ENGINE_API - else if ((e = ENGINE_by_id(arg))) { - mc->szCryptoDevice = arg; - ENGINE_free(e); - } -+#endif - else { - err = "SSLCryptoDevice: Invalid argument; must be one of: " - "'builtin' (none)"; -+#if MODSSL_HAVE_ENGINE_API - e = ENGINE_get_first(); - while (e) { - err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e), -@@ -624,12 +629,12 @@ - * on the 'old' e, per the docs in engine.h. */ - e = ENGINE_get_next(e); - } -+#endif - return err; - } - - return NULL; - } --#endif - - const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd, - void *dcfg, ---- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_init.c -@@ -27,8 +27,7 @@ - see Recursive.'' - -- Unknown */ - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "mpm_common.h" - #include "mod_md.h" - -@@ -218,6 +217,16 @@ - } - #endif - -+static APR_INLINE unsigned long modssl_runtime_lib_version(void) -+{ -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ return SSLeay(); -+#else -+ return OpenSSL_version_num(); -+#endif -+} -+ -+ - /* - * Per-module initialization - */ -@@ -225,18 +234,22 @@ - apr_pool_t *ptemp, - server_rec *base_server) - { -+ unsigned long runtime_lib_version = modssl_runtime_lib_version(); - SSLModConfigRec *mc = myModConfig(base_server); - SSLSrvConfigRec *sc; - server_rec *s; - apr_status_t rv; - apr_array_header_t *pphrases; - -- if (SSLeay() < MODSSL_LIBRARY_VERSION) { -+ AP_DEBUG_ASSERT(mc); -+ -+ if (runtime_lib_version < MODSSL_LIBRARY_VERSION) { - ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882) - "Init: this version of mod_ssl was compiled against " -- "a newer library (%s, version currently loaded is %s)" -+ "a newer library (%s (%s), version currently loaded is 0x%lX)" - " - may result in undefined or erroneous behavior", -- MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT); -+ MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT, -+ runtime_lib_version); - } - - /* We initialize mc->pid per-process in the child init, -@@ -313,11 +326,9 @@ - /* - * SSL external crypto device ("engine") support - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) { - return rv; - } --#endif - - ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883) - "Init: Initialized %s library", MODSSL_LIBRARY_NAME); -@@ -473,9 +484,9 @@ - * Support for external a Crypto Device ("engine"), usually - * a hardware accelerator card for crypto operations. - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p) - { -+#if MODSSL_HAVE_ENGINE_API - SSLModConfigRec *mc = myModConfig(s); - ENGINE *e; - -@@ -507,10 +518,9 @@ - - ENGINE_free(e); - } -- -+#endif - return APR_SUCCESS; - } --#endif - - #ifdef HAVE_TLSEXT - static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, -@@ -1320,15 +1330,6 @@ - return 0; - } - --static APR_INLINE int modssl_DH_bits(DH *dh) --{ --#if OPENSSL_VERSION_NUMBER < 0x30000000L -- return DH_bits(dh); --#else -- return BN_num_bits(DH_get0_p(dh)); --#endif --} -- - /* SSL_CTX_use_PrivateKey_file() can fail either because the private - * key was encrypted, or due to a mismatch between an already-loaded - * cert and the key - a common misconfiguration - from calling -@@ -1354,15 +1355,10 @@ - SSLModConfigRec *mc = myModConfig(s); - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; -- X509 *cert; -- DH *dh; -+ EVP_PKEY *pkey; - #ifdef HAVE_ECC -- EC_GROUP *ecparams = NULL; -- int nid; -- EC_KEY *eckey = NULL; --#endif --#ifndef HAVE_SSL_CONF_CMD -- SSL *ssl; -+ EC_GROUP *ecgroup = NULL; -+ int curve_nid = 0; - #endif - - /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ -@@ -1373,7 +1369,7 @@ - (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, - const char *)); - i++) { -- EVP_PKEY *pkey; -+ X509 *cert = NULL; - const char *engine_certfile = NULL; - - key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); -@@ -1416,8 +1412,6 @@ - if (modssl_is_engine_id(keyfile)) { - apr_status_t rv; - -- cert = NULL; -- - if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, - engine_certfile, keyfile, - &cert, &pkey))) { -@@ -1488,22 +1482,21 @@ - * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later, - * and SSL_CTX_get0_certificate is implemented.) - */ -- if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) { -+ cert = SSL_CTX_get0_certificate(mctx->ssl_ctx); - #else -- ssl = SSL_new(mctx->ssl_ctx); -+ { -+ SSL *ssl = SSL_new(mctx->ssl_ctx); - if (ssl) { - /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */ - SSL_set_connect_state(ssl); - cert = SSL_get_certificate(ssl); -+ SSL_free(ssl); -+ } - } -- if (!ssl || !cert) { - #endif -+ if (!cert) { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566) - "Unable to retrieve certificate %s", key_id); --#ifndef HAVE_SSL_CONF_CMD -- if (ssl) -- SSL_free(ssl); --#endif - return APR_EGENERAL; - } - -@@ -1525,10 +1518,6 @@ - } - #endif - --#ifndef HAVE_SSL_CONF_CMD -- SSL_free(ssl); --#endif -- - ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568) - "Certificate and private key %s configured from %s and %s", - key_id, certfile, keyfile); -@@ -1538,15 +1527,33 @@ - * Try to read DH parameters from the (first) SSLCertificateFile - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); -- if (certfile && !modssl_is_engine_id(certfile) -- && (dh = ssl_dh_GetParamFromFile(certfile))) { -- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() -- * for OpenSSL 3.0+. */ -+ if (certfile && !modssl_is_engine_id(certfile)) { -+ int done = 0, num_bits = 0; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ DH *dh = modssl_dh_from_file(certfile); -+ if (dh) { -+ num_bits = DH_bits(dh); - SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); -+ DH_free(dh); -+ done = 1; -+ } -+#else -+ pkey = modssl_dh_pkey_from_file(certfile); -+ if (pkey) { -+ num_bits = EVP_PKEY_get_bits(pkey); -+ if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) { -+ EVP_PKEY_free(pkey); -+ } -+ else { -+ done = 1; -+ } -+ } -+#endif -+ if (done) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- modssl_DH_bits(dh), vhost_id, certfile); -- DH_free(dh); -+ num_bits, vhost_id, certfile); -+ } - } - #if !MODSSL_USE_OPENSSL_PRE_1_1_API - else { -@@ -1561,13 +1568,27 @@ - * Similarly, try to read the ECDH curve name from SSLCertificateFile... - */ - if (certfile && !modssl_is_engine_id(certfile) -- && (ecparams = ssl_ec_GetParamFromFile(certfile)) -- && (nid = EC_GROUP_get_curve_name(ecparams)) -- && (eckey = EC_KEY_new_by_curve_name(nid))) { -+ && (ecgroup = modssl_ec_group_from_file(certfile)) -+ && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid); -+ if (eckey) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); -+ EC_KEY_free(eckey); -+ } -+ else { -+ curve_nid = 0; -+ } -+#else -+ if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) { -+ curve_nid = 0; -+ } -+#endif -+ if (curve_nid) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) - "ECDH curve %s for %s specified in %s", -- OBJ_nid2sn(nid), vhost_id, certfile); -+ OBJ_nid2sn(curve_nid), vhost_id, certfile); -+ } - } - /* - * ...otherwise, enable auto curve selection (OpenSSL 1.0.2) -@@ -1575,18 +1596,20 @@ - * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList - */ - #if MODSSL_USE_OPENSSL_PRE_1_1_API -- else { -+ if (!curve_nid) { - #if defined(SSL_CTX_set_ecdh_auto) - SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1); - #else -- eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ if (eckey) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); -+ EC_KEY_free(eckey); -+ } - #endif - } - #endif - /* OpenSSL assures us that _free() is NULL-safe */ -- EC_KEY_free(eckey); -- EC_GROUP_free(ecparams); -+ EC_GROUP_free(ecgroup); - #endif - - return APR_SUCCESS; ---- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_io.c -@@ -28,8 +28,7 @@ - core keeps dumping.'' - -- Unknown */ - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "apr_date.h" - - APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake, -@@ -2283,14 +2282,7 @@ - ssl_io_filter_cleanup, apr_pool_cleanup_null); - - if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) { -- BIO *rbio = SSL_get_rbio(ssl), -- *wbio = SSL_get_wbio(ssl); -- BIO_set_callback(rbio, ssl_io_data_cb); -- BIO_set_callback_arg(rbio, (void *)ssl); -- if (wbio && wbio != rbio) { -- BIO_set_callback(wbio, ssl_io_data_cb); -- BIO_set_callback_arg(wbio, (void *)ssl); -- } -+ modssl_set_io_callbacks(ssl); - } - - return; -@@ -2374,13 +2366,22 @@ - "+-------------------------------------------------------------------------+"); - } - --long ssl_io_data_cb(BIO *bio, int cmd, -- const char *argp, -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+static long modssl_io_cb(BIO *bio, int cmd, const char *argp, -+ size_t len, int argi, long argl, int rc, -+ size_t *processed) -+#else -+static long modssl_io_cb(BIO *bio, int cmd, const char *argp, - int argi, long argl, long rc) -+#endif - { - SSL *ssl; - conn_rec *c; - server_rec *s; -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ (void)len; -+ (void)processed; -+#endif - - if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL) - return rc; -@@ -2402,7 +2403,7 @@ - "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s", - MODSSL_LIBRARY_NAME, - (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"), -- rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), -+ (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), - bio, argp, dump); - if (*dump != '\0' && argp != NULL) - ssl_io_data_dump(c, s, argp, rc); -@@ -2417,3 +2418,25 @@ - } - return rc; - } -+ -+static APR_INLINE void set_bio_callback(BIO *bio, void *arg) -+{ -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ BIO_set_callback_ex(bio, modssl_io_cb); -+#else -+ BIO_set_callback(bio, modssl_io_cb); -+#endif -+ BIO_set_callback_arg(bio, arg); -+} -+ -+void modssl_set_io_callbacks(SSL *ssl) -+{ -+ BIO *rbio = SSL_get_rbio(ssl), -+ *wbio = SSL_get_wbio(ssl); -+ if (rbio) { -+ set_bio_callback(rbio, ssl); -+ } -+ if (wbio && wbio != rbio) { -+ set_bio_callback(wbio, ssl); -+ } -+} ---- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c -@@ -2581,6 +2581,7 @@ - sc->server->pks->service_unavailable : 0; - - ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s); -+ - /* - * There is one special filter callback, which is set - * very early depending on the base_server's log level. -@@ -2589,14 +2590,7 @@ - * we need to set that callback here. - */ - if (APLOGtrace4(s)) { -- BIO *rbio = SSL_get_rbio(ssl), -- *wbio = SSL_get_wbio(ssl); -- BIO_set_callback(rbio, ssl_io_data_cb); -- BIO_set_callback_arg(rbio, (void *)ssl); -- if (wbio && wbio != rbio) { -- BIO_set_callback(wbio, ssl_io_data_cb); -- BIO_set_callback_arg(wbio, (void *)ssl); -- } -+ modssl_set_io_callbacks(ssl); - } - - return 1; ---- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c -@@ -30,6 +30,8 @@ - -- Clifford Stoll */ - #include "ssl_private.h" - -+#include -+ - typedef struct { - server_rec *s; - apr_pool_t *p; -@@ -606,8 +608,7 @@ - return (len); - } - -- --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - - /* OpenSSL UI implementation for passphrase entry; largely duplicated - * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be -@@ -831,7 +832,7 @@ - const char *certid, const char *keyid, - X509 **pubkey, EVP_PKEY **privkey) - { --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - const char *c, *scheme; - ENGINE *e; - UI_METHOD *ui_method = get_passphrase_ui(p); ---- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_private.h -@@ -83,16 +83,13 @@ - - #include "ap_expr.h" - --/* OpenSSL headers */ --#include --#if (OPENSSL_VERSION_NUMBER >= 0x10001000) --/* must be defined before including ssl.h */ --#define OPENSSL_NO_SSL_INTERN --#endif --#if OPENSSL_VERSION_NUMBER >= 0x30000000 --#include -+/* keep first for compat API */ -+#ifndef OPENSSL_API_COMPAT -+#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */ - #endif --#include -+#include "mod_ssl_openssl.h" -+ -+/* OpenSSL headers */ - #include - #include - #include -@@ -102,12 +99,23 @@ - #include - #include - #include -+#include -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - - /* Avoid tripping over an engine build installed globally and detected - * when the user points at an explicit non-engine flavor of OpenSSL - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \ -+ && (OPENSSL_VERSION_NUMBER < 0x30000000 \ -+ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ -+ && !defined(OPENSSL_NO_ENGINE) - #include -+#define MODSSL_HAVE_ENGINE_API 1 -+#endif -+#ifndef MODSSL_HAVE_ENGINE_API -+#define MODSSL_HAVE_ENGINE_API 0 - #endif - - #if (OPENSSL_VERSION_NUMBER < 0x0090801f) -@@ -142,10 +150,18 @@ - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) -+#if LIBRESSL_VERSION_NUMBER < 0x2070000f -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 -+#else -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 -+#endif - #else /* defined(LIBRESSL_VERSION_NUMBER) */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) -+#if OPENSSL_VERSION_NUMBER < 0x10100000L -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 -+#else -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 - #endif -+#endif /* defined(LIBRESSL_VERSION_NUMBER) */ - - #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L - #define HAVE_FIPS -@@ -211,7 +227,10 @@ - #endif - - /* Secure Remote Password */ --#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) -+#if !defined(OPENSSL_NO_SRP) \ -+ && (OPENSSL_VERSION_NUMBER < 0x30000000L \ -+ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ -+ && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) - #define HAVE_SRP - #include - #endif -@@ -254,6 +273,14 @@ - #endif - #endif - -+/* those may be deprecated */ -+#ifndef X509_get_notBefore -+#define X509_get_notBefore X509_getm_notBefore -+#endif -+#ifndef X509_get_notAfter -+#define X509_get_notAfter X509_getm_notAfter -+#endif -+ - #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) - #define HAVE_OPENSSL_KEYLOG - #endif -@@ -1019,7 +1046,7 @@ - /** I/O */ - void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); - void ssl_io_filter_register(apr_pool_t *); --long ssl_io_data_cb(BIO *, int, const char *, int, long, long); -+void modssl_set_io_callbacks(SSL *ssl); - - /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request - * to allow an SSL renegotiation to take place. */ -@@ -1057,9 +1084,13 @@ - X509 **pubkey, EVP_PKEY **privkey); - - /** Diffie-Hellman Parameter Support */ --DH *ssl_dh_GetParamFromFile(const char *); -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+DH *modssl_dh_from_file(const char *); -+#else -+EVP_PKEY *modssl_dh_pkey_from_file(const char *); -+#endif - #ifdef HAVE_ECC --EC_GROUP *ssl_ec_GetParamFromFile(const char *); -+EC_GROUP *modssl_ec_group_from_file(const char *); - #endif - - /* Store the EVP_PKEY key (serialized into DER) in the hash table with ---- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util.c -@@ -476,7 +476,7 @@ - - int modssl_is_engine_id(const char *name) - { --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - /* ### Can handle any other special ENGINE key names here? */ - return strncmp(name, "pkcs11:", 7) == 0; - #else ---- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c -@@ -464,29 +464,52 @@ - ** _________________________________________________________________ - */ - --DH *ssl_dh_GetParamFromFile(const char *file) -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+DH *modssl_dh_from_file(const char *file) - { -- DH *dh = NULL; -+ DH *dh; - BIO *bio; - - if ((bio = BIO_new_file(file, "r")) == NULL) - return NULL; - dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); - BIO_free(bio); -- return (dh); -+ -+ return dh; -+} -+#else -+EVP_PKEY *modssl_dh_pkey_from_file(const char *file) -+{ -+ EVP_PKEY *pkey; -+ BIO *bio; -+ -+ if ((bio = BIO_new_file(file, "r")) == NULL) -+ return NULL; -+ pkey = PEM_read_bio_Parameters(bio, NULL); -+ BIO_free(bio); -+ -+ return pkey; - } -+#endif - - #ifdef HAVE_ECC --EC_GROUP *ssl_ec_GetParamFromFile(const char *file) -+EC_GROUP *modssl_ec_group_from_file(const char *file) - { -- EC_GROUP *group = NULL; -+ EC_GROUP *group; - BIO *bio; - - if ((bio = BIO_new_file(file, "r")) == NULL) - return NULL; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); -+#else -+ group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters, -+ PEM_STRING_ECPARAMETERS, bio, -+ NULL, NULL, NULL); -+#endif - BIO_free(bio); -- return (group); -+ -+ return group; - } - #endif - ---- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c -@@ -29,9 +29,9 @@ - -- Alexei Sayle */ - - #include "ssl_private.h" -+ - #include "ap_mpm.h" - #include "apr_thread_mutex.h" --#include "mod_ssl_openssl.h" - - APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, - (server_rec *s, apr_pool_t *p, ---- httpd-2.4.58/support/ab.c.r1913912 -+++ httpd-2.4.58/support/ab.c -@@ -166,13 +166,18 @@ - - #if defined(HAVE_OPENSSL) - --#include -+#include - #include - #include - #include - #include - #include - #include -+#include -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#include -+#endif -+ - #define USE_SSL - - #define SK_NUM(x) sk_X509_num(x) -@@ -555,22 +560,33 @@ - * - */ - #ifdef USE_SSL --static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret) -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+static long ssl_print_cb(BIO *bio, int cmd, const char *argp, -+ size_t len, int argi, long argl, int ret, -+ size_t *processed) -+#else -+static long ssl_print_cb(BIO *bio, int cmd, const char *argp, -+ int argi, long argl, long ret) -+#endif - { - BIO *out; -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ (void)len; -+ (void)processed; -+#endif - - out=(BIO *)BIO_get_callback_arg(bio); - if (out == NULL) return(ret); - - if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) { - BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n", -- bio, argp, argi, ret, ret); -+ bio, argp, argi, (long)ret, (long)ret); - BIO_dump(out,(char *)argp,(int)ret); - return(ret); - } - else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) { - BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n", -- bio, argp, argi, ret, ret); -+ bio, argp, argi, (long)ret, (long)ret); - BIO_dump(out,(char *)argp,(int)ret); - } - return ret; -@@ -765,17 +781,29 @@ - break; - #ifndef OPENSSL_NO_EC - case EVP_PKEY_EC: { -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ size_t len; -+ char cname[80]; -+ if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, -+ cname, sizeof(cname), &len)) { -+ cname[0] = '?'; -+ len = 1; -+ } -+ cname[len] = '\0'; -+#else - const char *cname = NULL; - EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); - int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); - EC_KEY_free(ec); - cname = EC_curve_nid2nist(nid); -- if (!cname) -+ if (!cname) { - cname = OBJ_nid2sn(nid); -- -+ if (!cname) -+ cname = "?"; -+ } -+#endif - apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits", -- cname, -- EVP_PKEY_bits(key)); -+ cname, EVP_PKEY_bits(key)); - break; - } - #endif -@@ -1428,7 +1456,11 @@ - SSL_set_bio(c->ssl, bio, bio); - SSL_set_connect_state(c->ssl); - if (verbosity >= 4) { -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ BIO_set_callback_ex(bio, ssl_print_cb); -+#else - BIO_set_callback(bio, ssl_print_cb); -+#endif - BIO_set_callback_arg(bio, (void *)bio_err); - } - #ifdef HAVE_TLSEXT diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch deleted file mode 100644 index 02dcac3..0000000 --- a/httpd-2.4.58-r1914013.patch +++ /dev/null @@ -1,16 +0,0 @@ -# ./pullrev.sh 1914013 -http://svn.apache.org/viewvc?view=revision&revision=1914013 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.58/modules/filters/mod_xml2enc.c -+++ httpd-2.4.58/modules/filters/mod_xml2enc.c -@@ -209,7 +209,7 @@ - - /* to sniff, first we look for BOM */ - if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) { -- ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf, -+ ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf, - ctx->bytes); - if (HAVE_ENCODING(ctx->xml2enc)) { - ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432) diff --git a/httpd-2.4.59-gettid.patch b/httpd-2.4.59-gettid.patch new file mode 100644 index 0000000..4857e37 --- /dev/null +++ b/httpd-2.4.59-gettid.patch @@ -0,0 +1,14 @@ + +Upstream-Status: not pushed upstream + +--- httpd-2.4.54/server/log.c.gettid ++++ httpd-2.4.54/server/log.c +@@ -968,7 +972,7 @@ + #if APR_HAS_THREADS + field_start = len; + len += cpystrn(buf + len, ":tid ", buflen - len); +- item_len = log_tid(info, NULL, buf + len, buflen - len); ++ item_len = log_tid(info, "g", buf + len, buflen - len); + if (!item_len) + len = field_start; + else diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.59-unifycgid.patch similarity index 91% rename from httpd-2.4.48-r1828172+.patch rename to httpd-2.4.59-unifycgid.patch index 5f3be4c..54216e0 100644 --- a/httpd-2.4.48-r1828172+.patch +++ b/httpd-2.4.59-unifycgid.patch @@ -1,14 +1,41 @@ https://github.com/apache/httpd/pull/209 -Upstream-Status: in trunk, not proposed for 2.4.x - +diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml +index ddacd4af19..6d4379d165 100644 +--- a/.github/workflows/linux.yml ++++ b/.github/workflows/linux.yml +@@ -48,11 +48,11 @@ jobs: + - name: Shared MPMs, all-modules + config: --enable-mods-shared=reallyall --enable-mpms-shared=all + # ------------------------------------------------------------------------- +- - name: Event MPM, all-modules, mod_cgid only +- config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi ++ - name: Event MPM, all-modules, mod_cgid fdpassing ++ config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing + # ------------------------------------------------------------------------- +- - name: Event MPM, all-modules, no CMSG_DATA +- config: --enable-mods-shared=reallyall --with-mpm=event ac_cv_have_decl_CMSG_DATA=no ++ - name: Event MPM, all-modules, mod_cgid w/o fdpassing ++ config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi + # ------------------------------------------------------------------------- + - name: Default, all-modules + install + config: --enable-mods-shared=reallyall +diff --git a/changes-entries/pr54221.txt b/changes-entries/pr54221.txt +new file mode 100644 +index 0000000000..62b75ea4dd +--- /dev/null ++++ b/changes-entries/pr54221.txt +@@ -0,0 +1,3 @@ ++ *) mod_cgid: Optional support for file descriptor passing, fixing ++ error log handling (configure --enable-cgid-fdpassing) on Unix ++ platforms. PR 54221. [Joe Orton] diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 -index 0000000000..69df73ce68 +index 0000000000..66f9418f21 --- /dev/null +++ b/modules/generators/cgi_common.h -@@ -0,0 +1,629 @@ +@@ -0,0 +1,639 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -37,6 +64,7 @@ index 0000000000..69df73ce68 + +#include "httpd.h" +#include "util_filter.h" ++#include "util_script.h" + +static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv; +static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps; @@ -439,9 +467,18 @@ index 0000000000..69df73ce68 + char sbuf[MAX_STRING_LEN]; + int ret; + -+ if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -+ APLOG_MODULE_INDEX))) -+ { ++ ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX); ++ ++ /* xCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ ++ if (ret != OK) { + /* In the case of a timeout reading script output, clear + * the brigade to avoid a second attempt to read the + * output. */ @@ -659,10 +696,18 @@ index bf295217e0..086355353b 100644 + APACHE_MODPATH_FINISH diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c -index 7e4b126c10..421124a0cb 100644 +index 1f7778617e..3799b06ce3 100644 --- a/modules/generators/mod_cgi.c +++ b/modules/generators/mod_cgi.c -@@ -61,9 +61,6 @@ +@@ -48,7 +48,6 @@ + #include "http_protocol.h" + #include "http_main.h" + #include "http_log.h" +-#include "util_script.h" + #include "ap_mpm.h" + #include "mod_core.h" + #include "mod_cgi.h" +@@ -61,9 +60,6 @@ module AP_MODULE_DECLARE_DATA cgi_module; @@ -672,14 +717,10 @@ index 7e4b126c10..421124a0cb 100644 static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command; /* Read and discard the data in the brigade produced by a CGI script */ -@@ -92,6 +89,15 @@ typedef struct { - apr_size_t bufbytes; - } cgi_server_conf; +@@ -96,6 +92,11 @@ typedef struct { + apr_interval_time_t timeout; + } cgi_dirconf; -+typedef struct { -+ apr_interval_time_t timeout; -+} cgi_dirconf; -+ +#if APR_FILES_AS_SOCKETS +#define WANT_CGI_BUCKET +#endif @@ -688,44 +729,7 @@ index 7e4b126c10..421124a0cb 100644 static void *create_cgi_config(apr_pool_t *p, server_rec *s) { cgi_server_conf *c = -@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv) - return overrides->logname ? overrides : base; - } - -+static void *create_cgi_dirconf(apr_pool_t *p, char *dummy) -+{ -+ cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf)); -+ return c; -+} -+ - static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) - { - server_rec *s = cmd->server; -@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy, - return NULL; - } - -+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg) -+{ -+ cgi_dirconf *dc = dummy; -+ -+ if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { -+ return "CGIScriptTimeout has wrong format"; -+ } -+ -+ return NULL; -+} -+ - static const command_rec cgi_cmds[] = - { - AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, -@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, - "the maximum length (in bytes) of the script debug log"), - AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, - "the maximum size (in bytes) to record of a POST request"), -+AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, -+ "The amount of time to wait between successful reads from " -+ "the CGI script, in seconds."), +@@ -185,64 +186,6 @@ AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_C {NULL} }; @@ -790,37 +794,7 @@ index 7e4b126c10..421124a0cb 100644 static int log_script(request_rec *r, cgi_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out, - apr_filepath_name_get(r->filename)); - } - else { -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; -+ - apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT); - - *script_in = procnew->out; - if (!*script_in) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_in, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_in, timeout); - - if (e_info->prog_type == RUN_AS_CGI) { - *script_out = procnew->in; - if (!*script_out) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_out, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_out, timeout); - - *script_err = procnew->err; - if (!*script_err) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_err, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_err, timeout); - } - } - } -@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, +@@ -563,230 +506,23 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, return APR_SUCCESS; } @@ -963,11 +937,14 @@ index 7e4b126c10..421124a0cb 100644 - apr_size_t *len, apr_read_type_e block) -{ - struct cgi_bucket_data *data = b->data; -- apr_interval_time_t timeout; +- apr_interval_time_t timeout = 0; - apr_status_t rv; - int gotdata = 0; +- cgi_dirconf *dc = ap_get_module_config(data->r->per_dir_config, &cgi_module); - -- timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout; +- if (block != APR_NONBLOCK_READ) { +- timeout = dc->timeout > 0 ? dc->timeout : data->r->server->timeout; +- } - - do { - const apr_pollfd_t *results; @@ -1048,10 +1025,10 @@ index 7e4b126c10..421124a0cb 100644 apr_status_t rv; cgi_exec_info_t e_info; - conn_rec *c; -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; + cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); + apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; - if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { +@@ -794,8 +530,6 @@ static int cgi_handler(request_rec *r) return DECLINED; } @@ -1060,7 +1037,7 @@ index 7e4b126c10..421124a0cb 100644 is_included = !strcmp(r->protocol, "INCLUDED"); p = r->main ? r->main->pool : r->pool; -@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r) +@@ -864,83 +598,24 @@ static int cgi_handler(request_rec *r) return HTTP_INTERNAL_SERVER_ERROR; } @@ -1157,7 +1134,7 @@ index 7e4b126c10..421124a0cb 100644 /* Is this flush really needed? */ apr_file_flush(script_out); apr_file_close(script_out); -@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r) +@@ -948,10 +623,7 @@ static int cgi_handler(request_rec *r) AP_DEBUG_ASSERT(script_in != NULL); #if APR_FILES_AS_SOCKETS @@ -1169,7 +1146,7 @@ index 7e4b126c10..421124a0cb 100644 if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r) +@@ -961,120 +633,7 @@ static int cgi_handler(request_rec *r) b = apr_bucket_eos_create(c->bucket_alloc); APR_BRIGADE_INSERT_TAIL(bb, b); @@ -1179,9 +1156,18 @@ index 7e4b126c10..421124a0cb 100644 - char sbuf[MAX_STRING_LEN]; - int ret; - -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { +- ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX); +- +- /* xCGI has its own body framing mechanism which we don't +- * match against any provided Content-Length, so let the +- * core determine C-L vs T-E based on what's actually sent. +- */ +- if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) +- apr_table_unset(r->headers_out, "Content-Length"); +- apr_table_unset(r->headers_out, "Transfer-Encoding"); +- +- if (ret != OK) { - ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); - - /* @@ -1220,7 +1206,7 @@ index 7e4b126c10..421124a0cb 100644 - * stderr output, as normal. */ - discard_script_output(bb); - apr_brigade_destroy(bb); -- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - @@ -1271,7 +1257,7 @@ index 7e4b126c10..421124a0cb 100644 - * connection drops or we stopped sending output for some other - * reason */ - if (rv == APR_SUCCESS && !r->connection->aborted) { -- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - @@ -1282,7 +1268,7 @@ index 7e4b126c10..421124a0cb 100644 } /*============================================================================ -@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1188,107 +747,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, return APR_SUCCESS; } @@ -1390,7 +1376,7 @@ index 7e4b126c10..421124a0cb 100644 /* This is the means by which unusual (non-unix) os's may find alternate * means to run a given command (e.g. shebang/registry parsing on Win32) */ -@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p) +@@ -1304,6 +765,7 @@ static void register_hooks(apr_pool_t *p) static const char * const aszPre[] = { "mod_include.c", NULL }; ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST); @@ -1398,18 +1384,19 @@ index 7e4b126c10..421124a0cb 100644 } AP_DECLARE_MODULE(cgi) = - { - STANDARD20_MODULE_STUFF, -- NULL, /* dir config creater */ -+ create_cgi_dirconf, /* dir config creater */ - NULL, /* dir merger --- default is to override */ - create_cgi_config, /* server config */ - merge_cgi_config, /* merge server config */ diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c -index 2258a683b7..dddfb25254 100644 +index 4bab59f932..1d55b8dc48 100644 --- a/modules/generators/mod_cgid.c +++ b/modules/generators/mod_cgid.c -@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; +@@ -57,7 +57,6 @@ + #include "http_protocol.h" + #include "http_main.h" + #include "http_log.h" +-#include "util_script.h" + #include "ap_mpm.h" + #include "mpm_common.h" + #include "mod_suexec.h" +@@ -80,11 +79,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew); static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server); @@ -1421,7 +1408,7 @@ index 2258a683b7..dddfb25254 100644 static apr_pool_t *pcgi = NULL; static pid_t daemon_pid; -@@ -220,6 +215,15 @@ typedef struct { +@@ -220,6 +214,15 @@ typedef struct { #endif } cgid_req_t; @@ -1437,7 +1424,7 @@ index 2258a683b7..dddfb25254 100644 /* This routine is called to create the argument list to be passed * to the CGI script. When suexec is enabled, the suexec path, user, and * group are the first three arguments to be passed; if not, all three -@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd) +@@ -342,15 +345,19 @@ static apr_status_t close_unix_socket(void *thefd) return close(fd); } @@ -1462,7 +1449,7 @@ index 2258a683b7..dddfb25254 100644 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) +@@ -365,9 +372,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) } } while (bytes_read < buf_size); @@ -1523,7 +1510,7 @@ index 2258a683b7..dddfb25254 100644 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) +@@ -384,7 +442,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) return APR_SUCCESS; } @@ -1532,7 +1519,7 @@ index 2258a683b7..dddfb25254 100644 { va_list ap; int rc; -@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -399,9 +457,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } va_end(ap); @@ -1572,7 +1559,7 @@ index 2258a683b7..dddfb25254 100644 if (rc < 0) { return errno; } -@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -410,7 +498,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -1581,7 +1568,7 @@ index 2258a683b7..dddfb25254 100644 { int i; char **environ; -@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -421,7 +509,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -1590,7 +1577,7 @@ index 2258a683b7..dddfb25254 100644 if (stat != APR_SUCCESS) { return stat; } -@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -431,6 +519,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } @@ -1605,7 +1592,7 @@ index 2258a683b7..dddfb25254 100644 /* handle module indexes and such */ rconf = (void **)ap_create_request_config(r->pool); -@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -479,14 +575,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } @@ -1623,7 +1610,7 @@ index 2258a683b7..dddfb25254 100644 if (ugid == NULL) { -@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -507,16 +604,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -1647,7 +1634,7 @@ index 2258a683b7..dddfb25254 100644 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -531,7 +633,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -1656,7 +1643,7 @@ index 2258a683b7..dddfb25254 100644 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig) +@@ -582,20 +684,34 @@ static void daemon_signal_handler(int sig) } } @@ -1699,7 +1686,7 @@ index 2258a683b7..dddfb25254 100644 } static int cgid_server(void *data) -@@ -670,7 +787,7 @@ static int cgid_server(void *data) +@@ -670,7 +786,7 @@ static int cgid_server(void *data) } while (!daemon_should_exit) { @@ -1708,7 +1695,7 @@ index 2258a683b7..dddfb25254 100644 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -710,7 +827,7 @@ static int cgid_server(void *data) +@@ -710,7 +826,7 @@ static int cgid_server(void *data) r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -1717,7 +1704,7 @@ index 2258a683b7..dddfb25254 100644 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -742,6 +859,16 @@ static int cgid_server(void *data) +@@ -742,6 +858,16 @@ static int cgid_server(void *data) continue; } @@ -1734,7 +1721,7 @@ index 2258a683b7..dddfb25254 100644 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -801,7 +928,10 @@ static int cgid_server(void *data) +@@ -801,7 +927,10 @@ static int cgid_server(void *data) close(sd2); } else { @@ -1746,7 +1733,7 @@ index 2258a683b7..dddfb25254 100644 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, +@@ -946,16 +1075,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, if (ret != OK ) { return ret; } @@ -1763,7 +1750,7 @@ index 2258a683b7..dddfb25254 100644 } return ret; } -@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] = +@@ -1066,41 +1185,6 @@ static const command_rec cgid_cmds[] = {NULL} }; @@ -1805,7 +1792,7 @@ index 2258a683b7..dddfb25254 100644 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1221,7 +1305,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, ++connect_tries; if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) { return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno, @@ -1814,7 +1801,7 @@ index 2258a683b7..dddfb25254 100644 } if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) { /* Save errno for later */ -@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1242,7 +1326,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, } else { close(sd); @@ -1823,7 +1810,7 @@ index 2258a683b7..dddfb25254 100644 "unable to connect to cgi daemon after multiple tries"); } } -@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1258,13 +1342,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, if (connect_errno == ENOENT && apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > DEFAULT_CONNECT_STARTUP_DELAY) { @@ -1842,7 +1829,7 @@ index 2258a683b7..dddfb25254 100644 "cgid daemon is gone; is Apache terminating?"); } } -@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1272,23 +1358,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, return OK; } @@ -1866,7 +1853,7 @@ index 2258a683b7..dddfb25254 100644 /**************************************************************** * * Actual cgid handling... -@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * +@@ -1374,7 +1443,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * return stat; } @@ -1877,7 +1864,7 @@ index 2258a683b7..dddfb25254 100644 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261) "daemon couldn't find CGI process for connection %lu", r->connection->id); -@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr) +@@ -1393,19 +1464,21 @@ static apr_status_t cleanup_script(void *vptr) static int cgid_handler(request_rec *r) { @@ -1903,7 +1890,7 @@ index 2258a683b7..dddfb25254 100644 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r) +@@ -1414,7 +1487,7 @@ static int cgid_handler(request_rec *r) conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -1912,7 +1899,7 @@ index 2258a683b7..dddfb25254 100644 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r) +@@ -1429,12 +1502,12 @@ static int cgid_handler(request_rec *r) argv0 = r->filename; if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) { @@ -1927,7 +1914,7 @@ index 2258a683b7..dddfb25254 100644 "attempt to include NPH CGI script"); } -@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r) +@@ -1443,12 +1516,12 @@ static int cgid_handler(request_rec *r) #error at mod_cgi.c for required code in this path. #else if (r->finfo.filetype == APR_NOFILE) { @@ -1942,7 +1929,7 @@ index 2258a683b7..dddfb25254 100644 "attempt to invoke directory as script"); } -@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r) +@@ -1456,7 +1529,7 @@ static int cgid_handler(request_rec *r) r->path_info && *r->path_info) { /* default to accept */ @@ -1951,7 +1938,7 @@ index 2258a683b7..dddfb25254 100644 "AcceptPathInfo off disallows user's path"); } /* -@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r) +@@ -1467,6 +1540,17 @@ static int cgid_handler(request_rec *r) } */ @@ -1969,7 +1956,7 @@ index 2258a683b7..dddfb25254 100644 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r) +@@ -1479,24 +1563,28 @@ static int cgid_handler(request_rec *r) return retval; } @@ -2005,7 +1992,7 @@ index 2258a683b7..dddfb25254 100644 } /* We are putting the socket discriptor into an apr_file_t so that we can -@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r) +@@ -1506,95 +1594,25 @@ static int cgid_handler(request_rec *r) */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -2114,7 +2101,7 @@ index 2258a683b7..dddfb25254 100644 } /* we're done writing, or maybe we didn't write at all; -@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r) +@@ -1603,134 +1621,22 @@ static int cgid_handler(request_rec *r) */ shutdown(sd, 1); @@ -2131,9 +2118,18 @@ index 2258a683b7..dddfb25254 100644 - b = apr_bucket_eos_create(c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(bb, b); - -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { +- ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX); +- +- /* xCGI has its own body framing mechanism which we don't +- * match against any provided Content-Length, so let the +- * core determine C-L vs T-E based on what's actually sent. +- */ +- if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) +- apr_table_unset(r->headers_out, "Content-Length"); +- apr_table_unset(r->headers_out, "Transfer-Encoding"); +- +- if (ret != OK) { - ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); - - /* @@ -2253,7 +2249,7 @@ index 2258a683b7..dddfb25254 100644 static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb, char *s) { -@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r) +@@ -1815,7 +1721,7 @@ static void add_ssi_vars(request_rec *r) } static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, @@ -2262,7 +2258,7 @@ index 2258a683b7..dddfb25254 100644 { char **env; int sd; -@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1836,7 +1742,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return retval; } @@ -2271,7 +2267,7 @@ index 2258a683b7..dddfb25254 100644 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; -@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1881,91 +1787,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return APR_SUCCESS; } @@ -2363,7 +2359,7 @@ index 2258a683b7..dddfb25254 100644 static void register_hook(apr_pool_t *p) { static const char * const aszPre[] = { "mod_include.c", NULL }; -@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p) +@@ -1973,6 +1794,7 @@ static void register_hook(apr_pool_t *p) ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE); ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE); diff --git a/httpd.spec b/httpd.spec index 048057d..7bb8b5a 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.58 -Release: 8%{?dist} +Version: 2.4.59 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -85,27 +85,22 @@ Patch20: httpd-2.4.48-r1842929+.patch Patch21: httpd-2.4.43-mod_systemd.patch Patch22: httpd-2.4.53-export.patch Patch23: httpd-2.4.43-corelimit.patch -Patch24: httpd-2.4.54-gettid.patch +Patch24: httpd-2.4.59-gettid.patch Patch25: httpd-2.4.54-icons.patch Patch26: httpd-2.4.43-cachehardmax.patch Patch27: httpd-2.4.43-socket-activation.patch Patch28: httpd-2.4.43-sslciphdefault.patch Patch29: httpd-2.4.43-sslprotdefault.patch -Patch30: httpd-2.4.43-r1861793+.patch -Patch31: httpd-2.4.48-r1828172+.patch +Patch31: httpd-2.4.59-unifycgid.patch Patch32: httpd-2.4.43-logjournal.patch Patch33: httpd-2.4.53-separate-systemd-fns.patch Patch34: httpd-2.4.58-r1912477+.patch -Patch35: httpd-2.4.58-r1913912+.patch Patch36: httpd-2.4.58-r1914365.patch Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.58-r1914013.patch -Patch62: httpd-2.4.46-htcacheclean-dont-break.patch -Patch63: httpd-2.4.51-r1894152.patch # Security fixes # Patch200: ... @@ -829,6 +824,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Apr 5 2024 Joe Orton - 2.4.59-1 +- update to 2.4.59 + * Thu Mar 28 2024 Joe Orton - 2.4.58-8 - rebuild to fix changelog ordering diff --git a/sources b/sources index 8ac3947..e8e92fb 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1 -SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.59.tar.bz2) = 209da0bbac5e2564d4590302515b35495be6402273ff4024aa93e85e44554c95e053201d606383936425a41e1b5b97e6b40055dcbb385eb691a5029a6f3158c2 +SHA512 (httpd-2.4.59.tar.bz2.asc) = 85237e204e57d930e2b7a85a21f8d593e81895f96350c3a345978538a536f3c0614ba89256905c0aa558880fc6fb10608b8dd7cbd026af326b1d83601c267f2d From 26cf4a8749501f156c4984ec9c4f6f17449ee09a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 15 Apr 2024 09:03:50 +0100 Subject: [PATCH 112/147] mod_ssl: add DH param handling fix (r1916863) --- httpd-2.4.59-r1916863.patch | 54 +++++++++++++++++++++++++++++++++++++ httpd.spec | 6 ++++- pullrev.sh | 4 +-- 3 files changed, 61 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.59-r1916863.patch diff --git a/httpd-2.4.59-r1916863.patch b/httpd-2.4.59-r1916863.patch new file mode 100644 index 0000000..162662c --- /dev/null +++ b/httpd-2.4.59-r1916863.patch @@ -0,0 +1,54 @@ +# ./pullrev.sh 1916863 +http://svn.apache.org/viewvc?view=revision&revision=1916863 + +Upstream-Status: in trunk, not proposed for 2.4.x + +--- httpd-2.4.59/modules/ssl/ssl_engine_init.c ++++ httpd-2.4.59/modules/ssl/ssl_engine_init.c +@@ -1416,6 +1416,7 @@ + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; + EVP_PKEY *pkey; ++ int custom_dh_done = 0; + #ifdef HAVE_ECC + EC_GROUP *ecgroup = NULL; + int curve_nid = 0; +@@ -1591,14 +1592,14 @@ + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); + if (certfile && !modssl_is_engine_id(certfile)) { +- int done = 0, num_bits = 0; ++ int num_bits = 0; + #if OPENSSL_VERSION_NUMBER < 0x30000000L + DH *dh = modssl_dh_from_file(certfile); + if (dh) { + num_bits = DH_bits(dh); + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); + DH_free(dh); +- done = 1; ++ custom_dh_done = 1; + } + #else + pkey = modssl_dh_pkey_from_file(certfile); +@@ -1608,18 +1609,18 @@ + EVP_PKEY_free(pkey); + } + else { +- done = 1; ++ custom_dh_done = 1; + } + } + #endif +- if (done) { ++ if (custom_dh_done) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", + num_bits, vhost_id, certfile); + } + } + #if !MODSSL_USE_OPENSSL_PRE_1_1_API +- else { ++ if (!custom_dh_done) { + /* If no parameter is manually configured, enable auto + * selection. */ + SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); diff --git a/httpd.spec b/httpd.spec index 7bb8b5a..864c8b7 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.59 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -101,6 +101,7 @@ Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.59-r1916863.patch # Security fixes # Patch200: ... @@ -824,6 +825,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Apr 15 2024 Joe Orton - 2.4.59-2 +- mod_ssl: add DH param handling fix (r1916863) + * Fri Apr 5 2024 Joe Orton - 2.4.59-1 - update to 2.4.59 diff --git a/pullrev.sh b/pullrev.sh index 7ace161..f21a7fb 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.58 +#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +ver=2.4.59 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From c83c1cdcee789c8f509204448b8b1f7c62295c49 Mon Sep 17 00:00:00 2001 From: Michal Srb Date: Wed, 17 Apr 2024 15:36:18 +0000 Subject: [PATCH 113/147] Fix rpminspect.yaml syntax Any entries in the upstream inspection block that contain wildcards for glob(7) specification need to be wrapped in single quotes. We are also changing the badfuncs block to allow the specific function in mod_proxy.so rather than ignoring the entire file. Thanks to David Cantrell who discovered this problem (in OSCI-6724) and proposed the fix. --- rpminspect.yaml | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 17e48d1..7696d42 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -2,20 +2,21 @@ badfuncs: # mod_proxy uses inet_ntoa (safely) for IPv4 address matching, # and APR interfaces for IPv6 addresses. - ignore: - - /usr/lib*/httpd/modules/mod_proxy.so + allowed: + /usr/lib*/httpd/modules/mod_proxy.so: + - inet_ntoa upstream: ignore: - - *.xml - - *.service - - *.socket - - *.conf - - *.sysconf - - *.tmpfiles - - README.* - - *.sysusers - - *.png - - httpd-ssl-* + - '*.xml' + - '*.service' + - '*.socket' + - '*.conf' + - '*.sysconf' + - '*.tmpfiles' + - 'README.*' + - '*.sysusers' + - '*.png' + - 'httpd-ssl-*' - config.layout - - action*.sh - - apachectl.* + - 'action*.sh' + - 'apachectl.*' From 53ecf37db77bbc8f033dfabe31590005d2c666f9 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 3 May 2024 08:59:53 +0100 Subject: [PATCH 114/147] apachectl(8): use BUG_REPORT_URL from /etc/os-release apachectl(8): fix grammar (#2278748) httpd.service.xml(8): mention ProtectSystem= setting --- apachectl.xml | 5 +++-- httpd.service.xml | 11 +++++++++-- httpd.spec | 13 +++++++++---- 3 files changed, 21 insertions(+), 8 deletions(-) diff --git a/apachectl.xml b/apachectl.xml index 34da42c..fb3a86d 100644 --- a/apachectl.xml +++ b/apachectl.xml @@ -5,6 +5,7 @@ ]>