From fb46d5df49d5e1b081507d639f028fd2fda0d267 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Wed, 12 Nov 2025 11:16:19 +0100 Subject: [PATCH 1/4] mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode --- httpd-2.4.65-sslvhostsnipolicy.patch | 41 ++++++++++++++-------------- httpd.spec | 5 +++- 2 files changed, 25 insertions(+), 21 deletions(-) diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch index 6767cbc..0831efc 100644 --- a/httpd-2.4.65-sslvhostsnipolicy.patch +++ b/httpd-2.4.65-sslvhostsnipolicy.patch @@ -1,7 +1,7 @@ -From ba168444686368377c6e69373e20e6dae8ebb702 Mon Sep 17 00:00:00 2001 +From 0263d1e290bc029c5c059fdaa4f21ca9885f9c84 Mon Sep 17 00:00:00 2001 From: Joe Orton -Date: Tue, 4 Nov 2025 12:49:36 +0100 -Subject: [PATCH] [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the +Date: Wed, 12 Nov 2025 11:11:41 +0100 +Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level required for VirtualHost matching. For "secure" and "authonly" modes, a hash of the policy-relevant vhost @@ -26,13 +26,13 @@ the runtime code complexity (and overhead). PR: 69743 GitHub: closes #561 --- - docs/manual/mod/mod_ssl.html.en | 77 +++++++++++++++++++ + docs/manual/mod/mod_ssl.html.en | 77 ++++++++++++++++++ modules/ssl/mod_ssl.c | 2 + modules/ssl/ssl_engine_config.c | 41 ++++++++++ - modules/ssl/ssl_engine_init.c | 107 ++++++++++++++++++++++++++ - modules/ssl/ssl_engine_kernel.c | 131 ++++++-------------------------- - modules/ssl/ssl_private.h | 17 +++++ - 6 files changed, 266 insertions(+), 109 deletions(-) + modules/ssl/ssl_engine_init.c | 107 +++++++++++++++++++++++++ + modules/ssl/ssl_engine_kernel.c | 133 ++++++-------------------------- + modules/ssl/ssl_private.h | 17 ++++ + 6 files changed, 267 insertions(+), 110 deletions(-) diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index e2a4a99..95f0667 100644 @@ -60,7 +60,7 @@ index e2a4a99..95f0667 100644 +Context:server config +Status:Extension +Module:mod_ssl -+Compatibility:Available in httpd 2.4.65 and later ++Compatibility:Available in httpd 2.4.65 in Fedora Linux +

This directive sets the policy applied when checking whether the +<VirtualHost> +identified by the Host request header in an HTTP request @@ -334,7 +334,7 @@ index 2fbd076..1bf6ac4 100644 /* diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index 33aa1f7..a6af633 100644 +index 33aa1f7..83ae90e 100644 --- a/modules/ssl/ssl_engine_kernel.c +++ b/modules/ssl/ssl_engine_kernel.c @@ -101,112 +101,28 @@ static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc) @@ -371,7 +371,10 @@ index 33aa1f7..a6af633 100644 - } - return 1; -} -- ++ /* Policy: strict => fail for any vhost transition. */ ++ if (policy == MODSSL_SNIVH_STRICT) ++ return sc1 == sc2; + -static int ssl_pk_server_compatible(modssl_pk_server_t *pks1, - modssl_pk_server_t *pks2) -{ @@ -395,7 +398,10 @@ index 33aa1f7..a6af633 100644 - } - return 1; -} -- ++ /* For authonly/secure policy, compare the hash. */ ++ AP_DEBUG_ASSERT(sc1->sni_policy_hash); ++ AP_DEBUG_ASSERT(sc2->sni_policy_hash); + -static int ssl_auth_compatible(modssl_auth_ctx_t *a1, - modssl_auth_ctx_t *a2) -{ @@ -440,21 +446,16 @@ index 33aa1f7..a6af633 100644 - || (ctx1->protocol != ctx2->protocol) - || !ssl_auth_compatible(&ctx1->auth, &ctx2->auth) - || !ssl_pk_server_compatible(ctx1->pks, ctx2->pks)) { -+ /* Policy: strict => fail for any vhost transition. */ -+ if (policy == MODSSL_SNIVH_STRICT && sc1 != sc2) - return 0; +- return 0; - } - return 1; -} - +- -static int ssl_server_compatible(server_rec *s1, server_rec *s2) -{ - SSLSrvConfigRec *sc1 = s1? mySrvConfig(s1) : NULL; - SSLSrvConfigRec *sc2 = s2? mySrvConfig(s2) : NULL; -+ /* For authonly/secure policy, compare the hash. */ -+ AP_DEBUG_ASSERT(sc1->sni_policy_hash); -+ AP_DEBUG_ASSERT(sc2->sni_policy_hash); - +- - /* both use the same TLS protocol? */ - if (!sc1 || !sc2 - || !ssl_ctx_compatible(sc1->server, sc2->server)) { diff --git a/httpd.spec b/httpd.spec index 6d06795..9d762d8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -31,7 +31,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.65 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -847,6 +847,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Nov 12 2025 Luboš Uhliarik - 2.4.65-3 +- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode + * Tue Nov 04 2025 Luboš Uhliarik - 2.4.65-2 - mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level required for VirtualHost matching. From f3e631b085b7583155b87f52d5f6b3096d3d4ffd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 27 Nov 2025 16:40:28 +0100 Subject: [PATCH 2/4] Improve default httpd LogFormats for better support diagnostics --- httpd.conf | 4 ++-- httpd.spec | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/httpd.conf b/httpd.conf index e49ab6a..2be277d 100644 --- a/httpd.conf +++ b/httpd.conf @@ -198,8 +198,8 @@ LogLevel warn # The following directives define some format nicknames for use with # a CustomLog directive (see below). # - LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined - LogFormat "%h %l %u %t \"%r\" %>s %b" common + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined + LogFormat "%h %l %u %t \"%r\" %>s %b PID: %P %{tid}P %T" common # You need to enable mod_logio.c to use %I and %O diff --git a/httpd.spec b/httpd.spec index 9d762d8..151bac6 100644 --- a/httpd.spec +++ b/httpd.spec @@ -31,7 +31,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.65 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -847,6 +847,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Nov 27 2025 Luboš Uhliarik - 2.4.65-4 +- Improve default httpd LogFormats for better support diagnostics + * Wed Nov 12 2025 Luboš Uhliarik - 2.4.65-3 - mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode From 0914a96ecc2516806333cb0e8b11cce87eb07110 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Mon, 1 Dec 2025 12:58:07 +0100 Subject: [PATCH 3/4] Improve default httpd LogFormats for better support diagnostics --- httpd.conf | 12 +++++++----- httpd.spec | 4 ++-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/httpd.conf b/httpd.conf index 2be277d..ad5c7ee 100644 --- a/httpd.conf +++ b/httpd.conf @@ -198,8 +198,9 @@ LogLevel warn # The following directives define some format nicknames for use with # a CustomLog directive (see below). # - LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined - LogFormat "%h %l %u %t \"%r\" %>s %b PID: %P %{tid}P %T" common + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext + LogFormat "%h %l %u %t \"%r\" %>s %b" common # You need to enable mod_logio.c to use %I and %O @@ -216,10 +217,11 @@ LogLevel warn #CustomLog "logs/access_log" common # - # If you prefer a logfile with access, agent, and referer information - # (Combined Logfile Format) you can use the following directive. + # If you prefer a logfile with access, agent, referer, and process/thread + # information (an extended Combined Logfile Format), you can use the + # following directive. # - CustomLog "logs/access_log" combined + CustomLog "logs/access_log" combined_ext diff --git a/httpd.spec b/httpd.spec index 151bac6..91c8d2f 100644 --- a/httpd.spec +++ b/httpd.spec @@ -31,7 +31,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.65 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -847,7 +847,7 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Thu Nov 27 2025 Luboš Uhliarik - 2.4.65-4 +* Thu Nov 27 2025 Luboš Uhliarik - 2.4.65-5 - Improve default httpd LogFormats for better support diagnostics * Wed Nov 12 2025 Luboš Uhliarik - 2.4.65-3 From 0c203aeed682395c663f7afef328f754fa629b6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 9 Dec 2025 12:48:50 +0100 Subject: [PATCH 4/4] new version 2.4.66 --- .gitignore | 1 + httpd-2.4.65-sslvhostsnipolicy.patch | 554 --------------------------- httpd.spec | 8 +- sources | 4 +- 4 files changed, 8 insertions(+), 559 deletions(-) delete mode 100644 httpd-2.4.65-sslvhostsnipolicy.patch diff --git a/.gitignore b/.gitignore index f2fccfd..8df7f18 100644 --- a/.gitignore +++ b/.gitignore @@ -55,3 +55,4 @@ x86_64 /httpd-2.4.63.tar.bz2.asc /httpd-2.4.64.tar.bz2.asc /httpd-2.4.65.tar.bz2.asc +/httpd-2.4.66.tar.bz2.asc diff --git a/httpd-2.4.65-sslvhostsnipolicy.patch b/httpd-2.4.65-sslvhostsnipolicy.patch deleted file mode 100644 index 0831efc..0000000 --- a/httpd-2.4.65-sslvhostsnipolicy.patch +++ /dev/null @@ -1,554 +0,0 @@ -From 0263d1e290bc029c5c059fdaa4f21ca9885f9c84 Mon Sep 17 00:00:00 2001 -From: Joe Orton -Date: Wed, 12 Nov 2025 11:11:41 +0100 -Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the - compatibility level required for VirtualHost matching. - -For "secure" and "authonly" modes, a hash of the policy-relevant vhost -configuration is created and stored in the post_config hooks, reducing -the runtime code complexity (and overhead). - -* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New - function, replacing ssl_server_compatible et al. - -* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New - function. - -* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash, - hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash): - New functions. - (ssl_init_Module): Invoke create_sni_policy_hash to store the hash - for every SSLSrvConfigRec. - -* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field. - (SSLSrvConfigRec): Add sni_policy_hash field. - -PR: 69743 -GitHub: closes #561 ---- - docs/manual/mod/mod_ssl.html.en | 77 ++++++++++++++++++ - modules/ssl/mod_ssl.c | 2 + - modules/ssl/ssl_engine_config.c | 41 ++++++++++ - modules/ssl/ssl_engine_init.c | 107 +++++++++++++++++++++++++ - modules/ssl/ssl_engine_kernel.c | 133 ++++++-------------------------- - modules/ssl/ssl_private.h | 17 ++++ - 6 files changed, 267 insertions(+), 110 deletions(-) - -diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en -index e2a4a99..95f0667 100644 ---- a/docs/manual/mod/mod_ssl.html.en -+++ b/docs/manual/mod/mod_ssl.html.en -@@ -125,6 +125,7 @@ to provide the cryptography engine.

-
  • SSLUseStapling
    • -
  • SSLVerifyClient
    • -
  • SSLVerifyDepth
    • -+
  • SSLVHostSNIPolicy
    • - -

    Bugfix checklist

    See also

    -