diff --git a/.gitignore b/.gitignore index bd6e204..5713602 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ x86_64 /httpd-2.4.49.tar.bz2.asc /httpd-2.4.50.tar.bz2.asc /httpd-2.4.51.tar.bz2.asc +/httpd-2.4.53.tar.bz2.asc diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.48-openssl3.patch deleted file mode 100644 index f218d16..0000000 --- a/httpd-2.4.48-openssl3.patch +++ /dev/null @@ -1,505 +0,0 @@ - -https://github.com/apache/httpd/pull/258 - -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 4da24eddcc..5d199cddaf 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) - - return 1; - } --#endif - - /* - * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* -@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen) - - return NULL; /* impossible to reach. */ - } -+#endif - - static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, - server_rec *s) -@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, - - modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - init_dh_params(); --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#else - init_bio_methods(); - #endif - -@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s, - { - SSL_CTX *ctx = mctx->ssl_ctx; - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); -+#else -+ SSL_CTX_set_dh_auto(ctx, 1); -+#endif - - SSL_CTX_set_info_callback(ctx, ssl_callback_Info); - -@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s, - #endif - } - -+static APR_INLINE -+int modssl_CTX_load_verify_locations(SSL_CTX *ctx, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!SSL_CTX_load_verify_locations(ctx, file, path)) -+ return 0; -+#else -+ if (file && !SSL_CTX_load_verify_file(ctx, file)) -+ return 0; -+ if (path && !SSL_CTX_load_verify_dir(ctx, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_verify(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, - ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, - "Configuring client authentication"); - -- if (!SSL_CTX_load_verify_locations(ctx, -- mctx->auth.ca_cert_file, -- mctx->auth.ca_cert_path)) -- { -+ if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, -+ mctx->auth.ca_cert_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) - "Unable to configure verify locations " - "for client authentication"); -@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, - return APR_SUCCESS; - } - -+static APR_INLINE -+int modssl_X509_STORE_load_locations(X509_STORE *store, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!X509_STORE_load_locations(store, file, path)) -+ return 0; -+#else -+ if (file && !X509_STORE_load_file(store, file)) -+ return 0; -+ if (path && !X509_STORE_load_path(store, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_crl(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) - "Configuring certificate revocation facility"); - -- if (!store || !X509_STORE_load_locations(store, mctx->crl_file, -- mctx->crl_path)) { -+ if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file, -+ mctx->crl_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) - "Host %s: unable to configure X.509 CRL storage " - "for certificate revocation", mctx->sc->vhost_id); -@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag, - return 0; - } - -+static APR_INLINE int modssl_DH_bits(DH *dh) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return DH_bits(dh); -+#else -+ return BN_num_bits(DH_get0_p(dh)); -+#endif -+} -+ -+/* SSL_CTX_use_PrivateKey_file() can fail either because the private -+ * key was encrypted, or due to a mismatch between an already-loaded -+ * cert and the key - a common misconfiguration - from calling -+ * X509_check_private_key(). This macro is passed the last error code -+ * off the OpenSSL stack and evaluates to true only for the first -+ * case. With OpenSSL < 3 the second case is identifiable by the -+ * function code, but function codes are not used from 3.0. */ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY) -+#else -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509 \ -+ || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE)) -+#endif -+ - static apr_status_t ssl_init_server_certs(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; - X509 *cert; -- DH *dhparams; -+ DH *dh; - #ifdef HAVE_ECC - EC_GROUP *ecparams = NULL; - int nid; -@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - } - else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, - SSL_FILETYPE_PEM) < 1) -- && (ERR_GET_FUNC(ERR_peek_last_error()) -- != X509_F_X509_CHECK_PRIVATE_KEY)) { -+ && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) { - ssl_asn1_t *asn1; - const unsigned char *ptr; - -@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); - if (certfile && !modssl_is_engine_id(certfile) -- && (dhparams = ssl_dh_GetParamFromFile(certfile))) { -- SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); -+ && (dh = ssl_dh_GetParamFromFile(certfile))) { -+ SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- DH_bits(dhparams), vhost_id, certfile); -- DH_free(dhparams); -+ modssl_DH_bits(dh), vhost_id, certfile); -+ DH_free(dh); - } - - #ifdef HAVE_ECC -@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, - char buf[TLSEXT_TICKET_KEY_LEN]; - char *path; - modssl_ticket_key_t *ticket_key = mctx->ticket_key; -+ int res; - - if (!ticket_key->file_path) { - return APR_SUCCESS; -@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, - } - - memcpy(ticket_key->key_name, buf, 16); -- memcpy(ticket_key->hmac_secret, buf + 16, 16); - memcpy(ticket_key->aes_key, buf + 32, 16); -- -- if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -- ssl_callback_SessionTicket)) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ memcpy(ticket_key->hmac_secret, buf + 16, 16); -+ res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#else -+ ticket_key->mac_params[0] = -+ OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16); -+ ticket_key->mac_params[1] = -+ OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); -+ ticket_key->mac_params[2] = -+ OSSL_PARAM_construct_end(); -+ res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#endif -+ if (!res) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) - "Unable to initialize TLS session ticket key callback " - "(incompatible OpenSSL version?)"); -@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, - return ssl_die(s); - } - -- X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); -+ modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); - - for (n = 0; n < ncerts; n++) { - int i; -@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data) - - } - --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ free_dh_params(); -+#else - free_bio_methods(); - #endif -- free_dh_params(); - - return APR_SUCCESS; - } -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index cabf753790..3db7077f1e 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio) - static int bio_filter_out_read(BIO *bio, char *out, int outl) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_read"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr) - static int bio_filter_out_gets(BIO *bio, char *buf, int size) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_out_puts(BIO *bio, const char *str) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) - - static int bio_filter_in_write(BIO *bio, const char *in, int inl) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_write"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_puts(BIO *bio, const char *str) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_gets(BIO *bio, char *buf, int size) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr) - { -- return -1; -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ switch (cmd) { -+#ifdef BIO_CTRL_EOF -+ case BIO_CTRL_EOF: -+ return inctx->rc == APR_EOF; -+#endif -+ default: -+ break; -+ } -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: bio_filter_in_ctrl() should not be called with cmd=%i", -+ cmd); -+ AP_DEBUG_ASSERT(0); -+ return 0; - } - - #if MODSSL_USE_OPENSSL_PRE_1_1_API -@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = { - bio_filter_in_read, - bio_filter_in_puts, /* puts is never called */ - bio_filter_in_gets, /* gets is never called */ -- bio_filter_in_ctrl, /* ctrl is never called */ -+ bio_filter_in_ctrl, /* ctrl is called for EOF check */ - bio_filter_create, - bio_filter_destroy, - NULL -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index b99dcf19d4..aced92d2d0 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client = - ** _________________________________________________________________ - */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* - * Hand out standard DH parameters, based on the authentication strength - */ -@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen) - - return modssl_get_dh_params(keylen); - } -+#endif - - /* - * This OpenSSL callback function is called when OpenSSL -@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl, - unsigned char *keyname, - unsigned char *iv, - EVP_CIPHER_CTX *cipher_ctx, -- HMAC_CTX *hctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif - int mode) - { - conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl, - } - EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) - "TLS session ticket key for %s successfully set, " -@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl, - - EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) - "TLS session ticket key for %s successfully set, " -diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c -index 7dbbbdb55e..3b3ceacf0a 100644 ---- a/modules/ssl/ssl_engine_log.c -+++ b/modules/ssl/ssl_engine_log.c -@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s) - return APR_EGENERAL; - } - -+static APR_INLINE -+unsigned long modssl_ERR_peek_error_data(const char **data, int *flags) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return ERR_peek_error_line_data(NULL, NULL, data, flags); -+#else -+ return ERR_peek_error_data(data, flags); -+#endif -+} -+ - /* - * Prints the SSL library error information. - */ -@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s) - const char *data; - int flags; - -- while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) { -+ while ((e = modssl_ERR_peek_error_data(&data, &flags))) { - const char *annotation; - char err[256]; - -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index a6fc7513a2..b091c58c94 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h -@@ -89,6 +89,9 @@ - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - #include - #include - #include -@@ -134,13 +137,12 @@ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) - #define SSL_CTX_set_max_proto_version(ctx, version) \ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) --#elif LIBRESSL_VERSION_NUMBER < 0x2070000f -+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ - /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (1) --#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ -+#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) - #else /* defined(LIBRESSL_VERSION_NUMBER) */ - #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) - #endif -@@ -674,7 +676,11 @@ typedef struct { - typedef struct { - const char *file_path; - unsigned char key_name[16]; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - unsigned char hmac_secret[16]; -+#else -+ OSSL_PARAM mac_params[3]; -+#endif - unsigned char aes_key[16]; - } modssl_ticket_key_t; - #endif -@@ -938,8 +944,16 @@ int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); - int ssl_callback_ClientHello(SSL *, int *, void *); - #endif - #ifdef HAVE_TLS_SESSION_TICKETS --int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *, -- EVP_CIPHER_CTX *, HMAC_CTX *, int); -+int ssl_callback_SessionTicket(SSL *ssl, -+ unsigned char *keyname, -+ unsigned char *iv, -+ EVP_CIPHER_CTX *cipher_ctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif -+ int mode); - #endif - - #ifdef HAVE_TLS_ALPN -@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx); - - #endif - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* Retrieve DH parameters for given key length. Return value should - * be treated as unmutable, since it is stored in process-global - * memory. */ - DH *modssl_get_dh_params(unsigned keylen); -+#endif - - /* Returns non-zero if the request was made over SSL/TLS. If sslconn - * is non-NULL and the request is using SSL/TLS, sets *sslconn to the diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch similarity index 76% rename from httpd-2.4.43-detect-systemd.patch rename to httpd-2.4.53-detect-systemd.patch index 540687f..d501b06 100644 --- a/httpd-2.4.43-detect-systemd.patch +++ b/httpd-2.4.53-detect-systemd.patch @@ -1,5 +1,5 @@ diff --git a/Makefile.in b/Makefile.in -index 0b088ac..9eeb5c7 100644 +index a2e9c82..bd8045c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test @@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644 PROGRAM_DEPENDENCIES = \ server/libmain.la \ diff --git a/acinclude.m4 b/acinclude.m4 -index 2a7e5d1..eb28321 100644 +index 97484c9..05abe18 100644 --- a/acinclude.m4 +++ b/acinclude.m4 -@@ -624,6 +624,7 @@ case $host in +@@ -631,6 +631,7 @@ case $host in if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then AC_MSG_WARN([Your system does not support systemd.]) else @@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644 fi fi diff --git a/configure.in b/configure.in -index 3618a5a..74a782b 100644 +index cf437fe..521fc45 100644 --- a/configure.in +++ b/configure.in -@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then +@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) - APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`]) + APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`]) + APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) else - AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/]) + AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/]) fi -@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR) +@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR) APACHE_SUBST(BUILTIN_LIBS) APACHE_SUBST(SHLIBPATH_VAR) APACHE_SUBST(OS_SPECIFIC_VARS) diff --git a/httpd-2.4.48-export.patch b/httpd-2.4.53-export.patch similarity index 83% rename from httpd-2.4.48-export.patch rename to httpd-2.4.53-export.patch index 439f768..d240360 100644 --- a/httpd-2.4.48-export.patch +++ b/httpd-2.4.53-export.patch @@ -1,12 +1,5 @@ - -Reduce size of httpd binary by telling linker to export all symbols -from libmain.a, rather than bloating the symbol table with ap_hack_* -to do so indirectly. - -Upstream: https://svn.apache.org/r1861685 (as new default-off configure option) - diff --git a/Makefile.in b/Makefile.in -index 40c7076..ac98e5f 100644 +index bd8045c..d6733a5 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test @@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644 eoc_bucket.c eor_bucket.c core_filters.c \ util_expr_parse.c util_expr_scan.c util_expr_eval.c diff --git a/server/main.c b/server/main.c -index 62e06df..17c09ee 100644 +index 7da7aa2..e63d2eb 100644 --- a/server/main.c +++ b/server/main.c -@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[]) +@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[]) return !OK; } diff --git a/httpd.spec b/httpd.spec index 77b51a8..ab61f45 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,7 +12,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.51 +Version: 2.4.53 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -66,16 +66,15 @@ Source48: apache-poweredby.png Patch2: httpd-2.4.43-apxs.patch Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.43-detect-systemd.patch +Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.48-export.patch +Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.48-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -228,7 +227,6 @@ written in the Lua programming language. %patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons -%patch28 -p1 -b .openssl3 %patch30 -p1 -b .cachehardmax %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault @@ -787,6 +785,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 +- new version 2.4.53 +- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 + * Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 - new version 2.4.51 diff --git a/sources b/sources index edbf616..36266ed 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 -SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce +SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756 +SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192