From 4dd12eb4e7e94e173b98f40aa170dd1ee5621cc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 12 Feb 2021 12:53:10 +0100 Subject: [PATCH 1/4] php test replaced with simplier smoke --- tests/httpd-php-mysql-sanity-test/PURPOSE | 3 - .../httpd-php-mysql-sanity-test/new_mysql.php | 12 --- .../httpd-php-mysql-sanity-test/old_mysql.php | 12 --- .../php_mysql_test.conf | 5 - .../php_mysql_test.sql | 6 -- tests/httpd-php-mysql-sanity-test/runtest.sh | 102 ------------------ .../Makefile | 24 ++--- tests/smoke/PURPOSE | 3 + tests/smoke/runtest.sh | 64 +++++++++++ tests/tests.yml | 2 +- 10 files changed, 79 insertions(+), 154 deletions(-) delete mode 100644 tests/httpd-php-mysql-sanity-test/PURPOSE delete mode 100644 tests/httpd-php-mysql-sanity-test/new_mysql.php delete mode 100644 tests/httpd-php-mysql-sanity-test/old_mysql.php delete mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.conf delete mode 100644 tests/httpd-php-mysql-sanity-test/php_mysql_test.sql delete mode 100755 tests/httpd-php-mysql-sanity-test/runtest.sh rename tests/{httpd-php-mysql-sanity-test => smoke}/Makefile (65%) create mode 100644 tests/smoke/PURPOSE create mode 100755 tests/smoke/runtest.sh diff --git a/tests/httpd-php-mysql-sanity-test/PURPOSE b/tests/httpd-php-mysql-sanity-test/PURPOSE deleted file mode 100644 index 59b3931..0000000 --- a/tests/httpd-php-mysql-sanity-test/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test -Description: test fetching data from mysqldb/mariadb through php -Author: Karel Srot diff --git a/tests/httpd-php-mysql-sanity-test/new_mysql.php b/tests/httpd-php-mysql-sanity-test/new_mysql.php deleted file mode 100644 index 6087b11..0000000 --- a/tests/httpd-php-mysql-sanity-test/new_mysql.php +++ /dev/null @@ -1,12 +0,0 @@ - diff --git a/tests/httpd-php-mysql-sanity-test/old_mysql.php b/tests/httpd-php-mysql-sanity-test/old_mysql.php deleted file mode 100644 index 8904c58..0000000 --- a/tests/httpd-php-mysql-sanity-test/old_mysql.php +++ /dev/null @@ -1,12 +0,0 @@ - diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf deleted file mode 100644 index d03c3c3..0000000 --- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf +++ /dev/null @@ -1,5 +0,0 @@ - -Alias /php_mysql_test /var/www/php_mysql_test - - - diff --git a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql deleted file mode 100644 index ad931ac..0000000 --- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql +++ /dev/null @@ -1,6 +0,0 @@ - -CREATE DATABASE php_mysql_test; -USE php_mysql_test; - -CREATE TABLE foobar (name VARCHAR(10), value INTEGER); -INSERT INTO foobar VALUES("fish", 42); diff --git a/tests/httpd-php-mysql-sanity-test/runtest.sh b/tests/httpd-php-mysql-sanity-test/runtest.sh deleted file mode 100755 index 6fa8315..0000000 --- a/tests/httpd-php-mysql-sanity-test/runtest.sh +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test -# Description: test fetching data from mysqldb/mariadb through php -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGES="${PACKAGES:-httpd}" -REQUIRES="${REQUIRES:-php $DB}" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport httpd/http" 0 "Import httpd library" - if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then - DB="mysql-server" - rlRun "rlImport mysql/basic" 0 "Import mysqld library" - SERVICE=${mysqlServiceName} - else - DB="mariadb-server" - rlRun "rlImport mariadb55/basic" 0 "Import mariadb library" - SERVICE=${mariadbServiceName} - fi - # install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7) - rlRun "rlImport php/utils" - phpPdoPhpMysqlSetup - rlAssertRpm --all - rlRun "rlServiceStart $SERVICE" 0 - rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1 - rlRun "mysql --verbose -u root < php_mysql_test.sql" - rlRun "httpStop" 0 "Stop httpd if running" - rlRun "> $httpLOGDIR/error_log" - rlRun "rm -rvf $httpROOTDIR/php_mysql_test" - rlRun "mkdir -v $httpROOTDIR/php_mysql_test" - rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/" - php_version=`rlCheckRpm php` - if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then - rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php" - else - rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php" - fi - rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf" - rlRun "chown -R apache: $httpROOTDIR/php_mysql_test" - #rlRun "restorecon $httpROOTDIR/php_mysql_test" - selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test" - rlRun "httpStart" 0 "Start httpd" - rlPhaseEnd - - rlPhaseStartTest - URL="http://localhost/php_mysql_test/" - RETVAL=0 - tries=`seq 1 10` - - for n in ${tries}; do - output=`curl -s $URL/mysql.php` - rv=$? - echo "PHP output ${n}: ${rv} x${output}y" - [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66 - done - - if [ $RETVAL -ne 0 ]; then - rlFail - else - rlPass - fi - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf" - rlRun "rm -rf $httpROOTDIR/php_mysql_test" - rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" - rlRun "rlServiceRestore ${SERVICE}" 0 - rlRun "httpStop" 0 "Stop httpd if running" - # uninstall php-mysql on rhel-6 if it was installed during setup - phpPdoPhpMysqlCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/tests/httpd-php-mysql-sanity-test/Makefile b/tests/smoke/Makefile similarity index 65% rename from tests/httpd-php-mysql-sanity-test/Makefile rename to tests/smoke/Makefile index a688236..6abde94 100644 --- a/tests/httpd-php-mysql-sanity-test/Makefile +++ b/tests/smoke/Makefile @@ -1,12 +1,12 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test -# Description: test fetching data from mysqldb/mariadb through php -# Author: Karel Srot +# Makefile of /CoreOS/httpd/Sanity/smoke +# Description: Simple check of httpd test page +# Author: Branislav Nater # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# Copyright (c) 2021 Red Hat, Inc. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms @@ -24,12 +24,12 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test +export TEST=/CoreOS/httpd/Sanity/smoke export TESTVERSION=1.0 BUILT_FILES= -FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf +FILES=$(METADATA) runtest.sh Makefile PURPOSE .PHONY: all install download clean @@ -43,25 +43,23 @@ clean: rm -f *~ $(BUILT_FILES) --include /usr/share/rhts/lib/rhts-make.include +include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile - @echo "Owner: Karel Srot " > $(METADATA) + @echo "Owner: Branislav Nater " > $(METADATA) @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: test fetching data from mysqldb/mariadb through php" >> $(METADATA) + @echo "Description: Simple check of httpd test page" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: httpd" >> $(METADATA) - @echo "Requires: httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA) + @echo "Requires: httpd mod_ssl" >> $(METADATA) @echo "RhtsRequires: library(httpd/http)" >> $(METADATA) - @echo "RhtsRequires: library(mysql/basic)" >> $(METADATA) - @echo "RhtsRequires: library(mariadb55/basic)" >> $(METADATA) - @echo "RhtsRequires: library(php/utils)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) rhts-lint $(METADATA) diff --git a/tests/smoke/PURPOSE b/tests/smoke/PURPOSE new file mode 100644 index 0000000..510e749 --- /dev/null +++ b/tests/smoke/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/httpd/Sanity/smoke +Description: Simple check of httpd +Author: Branislav Nater diff --git a/tests/smoke/runtest.sh b/tests/smoke/runtest.sh new file mode 100755 index 0000000..f65c8ba --- /dev/null +++ b/tests/smoke/runtest.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Sanity/smoke +# Description: Simple check of httpd test page +# Author: Branislav Nater +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-httpd}" +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie + rlAssertRpm --all + rlFileBackup --clean ${httpCONFDIR}/conf/ + rlFileBackup --clean ${httpCONFDIR}/conf.d/ + rlFileBackup --clean ${httpCONFDIR}/conf.modules.d/ + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun "httpStart" 0 "Start httpd" + rlRun "httpStatus" 0 "Check status" + rlRun "httpStop" 0 "Stop httpd" + + rlRun "httpSecureStart" 0 "Start httpd with ssl" + rlRun "httpInstallCa $(hostname)" 0 "Install CA" + rlRun "httpSecureStatus" 0 "Check status" + rlRun "httpRemoveCa" 0 "Remove CA" + rlRun "httpSecureStop" 0 "Stop httpd with ssl" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rlFileRestore" 0 "Restoring original configuration" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalEnd +rlJournalPrintText diff --git a/tests/tests.yml b/tests/tests.yml index e0ef0be..802bea0 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -6,7 +6,7 @@ tags: - classic tests: - - httpd-php-mysql-sanity-test + - smoke required_packages: - findutils # beakerlib needs find command - which # smoke requires which command From 1a7eb209d80eeab5ca615ab182a8e4be7c12cd0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 15 Feb 2021 13:58:24 +0100 Subject: [PATCH 2/4] Skip STI tests in favour of TMT tests (fedora-ci issue#206) --- tests/{tests.yml => ignore_tests.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/{tests.yml => ignore_tests.yml} (100%) diff --git a/tests/tests.yml b/tests/ignore_tests.yml similarity index 100% rename from tests/tests.yml rename to tests/ignore_tests.yml From 29e98b0c619d7a5404b2d11e013cc79d9492ad92 Mon Sep 17 00:00:00 2001 From: Lubos Uhliarik Date: Wed, 31 Mar 2021 14:11:00 +0200 Subject: [PATCH 3/4] Resolves: #1934739 - Apache trademark update - new logo --- apache-poweredby.png | Bin 0 -> 5714 bytes httpd.spec | 12 ++++++++++-- welcome.conf | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 apache-poweredby.png diff --git a/apache-poweredby.png b/apache-poweredby.png new file mode 100644 index 0000000000000000000000000000000000000000..5663a23ad527e8983d82529485a0dc7f33230a08 GIT binary patch literal 5714 zcmV-Y7Om-tP)pF8FWQhbW?9;ba!ELWdL_~cP?peYja~^aAhuUa%Y?FJQ@H172ioj zK~#9!R9BkDPP&uK={cS0nPjHBllTy15k(W++ZY{VToSiHRlQe$;)X_9L}gbj zcX5wVBSvFP;u4JezAHgRM8ySn5djq!RB&J5pZi_vm9L5_EsA<3>3QeeBlXt%zW3jM z|9@Rve#Na@aPZq&t-hUB6eF}cX_iK(-=@(?N7*>f#!WUJ8OKfIJ{;SMa|3izcz{m# ziAJM&%jN&e)~Qpce+$s*y98+UUmC$EXM?Ia%8mD$t`Wt~4A3|Jr9d+n41dsQq!t>T zn8IGN#0h}CXxwKMnyS@Gofw#}{BD5@2?=?fEwcd(xZD@Lv_7aiMMe##UVZvnJ>ET} z7wyZ)p!FLz(zgq~qlm~Td%@hCumsG2%0tfYs$NLkz!)w`7r=GVdA9c1IgwRpp}MT zZog^p__EPS7i>}4wCOV_JNpRz@Z%!BZ)kKZ9XfQ_bdIPGqSL3(P~z|;vunqU9Z%b~ z?=byd_VaR@F>@CGd-w}Cb?ett z?u84Ky6k5fFfiN<)S{vyv-9VEGmloRTxGUz_SbW$xVV^3o;<}rz~Ss{3hvR99|KTD zSFdvL!3OXg0QdrmT>ZITU-P#@bzO~WhRq3QA2~t^!-kuF_y1xb^$G3I|1Kyf0+tJCk`_mPfPoSeq6Me&Ye3)gNMf0%O6Xa)YkoK zz;)=*;WeW=Vm2{Q!i=wG(ym>*O)oQb`j@nm{hmB^8XY`zh*ME?Y#cuZ-lqf?Kwv2E zxn;{%8aE-?^n1 zEX~XVS(Ki>hw}6DsdwLgrsMlFGbw4r$m*y*dzi}e*O$fb{%%xU%_afrI(Pm&h4vp{ z;(hrA1#Ed%@G7Vvkf8GUVEzy$5D=M}2RPrGkUWutZHt%U-UGuU%mf6^zjpmPr~GQ_ zk0%(2@2Lu&za)9F2jyFv0G7|?%a`d3CM2NGWn}Ei!x{U_GctdcFQXI(P2%?{FCS>-Dt)M6o%uZhErw$Fq@UbTp^|Vvf^zA|#Zhzz7SE zr1R%^&S(C8bm$JB7#IT837vwfGq26iflqO{j3 z(wV6$Gc9kvX6-uqB|V)}7nnLIQ8uk)Wq9$DrMA?DeejyV$>3xb^A|RsSoVw}XMxB* z%#7+yN)!W>H-z#F&>#iV_w1z|J9lwP91P$vbcU0?SD}VupM?d$B*gOkEW!i7oT8 zisP0;LWNzp#+oh$3j1#14<^uHS^T_w1s%xBGP4dUhW?^PBQ;YCBqEm@_fy=X?#*;x zRx-`4gOyWiusK9lTi7t$xoUh*r|+V?L64rjO{xbd50oYw>;N$<>!6wBH8SB{UAu<7 zsTz1w-+ANVH*Tp9=DN|n*=}@ax_ep4BsbAIHNv6$e0$xFrQFGG$!4kVZD&*mB^gu( z{SM9m{5^8i7&HH#VysltiAjc5uRcg|TLfxImq&1Th-=w47_jdr&NH)Mj89N z{O(uoR65n2ZcV7&(l%cVa<@lH+cFEaq8Rl;H@q!RG8EyXM~_ipa1WE49SXAiTh^V_ z_WItMT-u#_+3S!@|kV*n<*^?1H;(Kogwp|O%SZrV(bA3x^Kk1uD;v^?k1 zb9KXt7{;>;VBqggOQW&lCUDgSu5<7|tKMF%bQO*UHNm?YQ@iceSdUW1^R5HHdns-? z@-pUp@Jn~PJ;_}g6&3Zyph1J)WV+^`5LmJdE-@Z2S_2RSq1*su9}9y(s}=j(j-FWr zfB+QY78^EhU1HgBim%3b(2bF`cQNUEl7U!i0&tGo zqmn7^=WmU7Zxt36^Y@5|sL+Ur!HHp!gEe7cLn=840z_%PC4g|;T5eWM(DPO;C#_cB z`nghwkvF`+t5&b!u61*VfS95tcn}(w!oBuf9^^?^27A)gXwQNh2KQw*l05cYOZ3Pt ziucH8z&>T8{7Sq#541-{Mm8B38QC&CJgO6;M#1u)+{U&LDzWhi^z`Xd6L@fwnXxE& zXrzxS1E`a}Rh~2`Y6zFUM~)ulF%A5-VKd&4BfWeUA zfLe3gOr^0@oY$@2z&*y6zCQ$jEOfqWYD(P;A;RnDwRLkYNIsMoyIE z%BZowH!&ayK=P$M#Pg~x9ng+YY?bvwc!8827qj3Hbi7`DLMvT#=VU|>iL~+@B8G;r@nNyb3HoOwcd$bP2HWjVqLnRXA~LC zC=x*S;y_+3hk|W#&VJ@Q;#?O7I+v zX%zu1gC1>j->0;<>JA3|#~|MbOQ$Im$_3vov>9To(1il)sR7>J zcbfh6pj)FGY|v3ZzvDU0-=`BT>km8Gx&fW~m{DW9`gEp)FP#C9UF)7X*Uk5Br}z(b z(wHg(D2fAJDl$W#?L-z7qG^!C(1mR2elAY<>ejZbT1{qU)oMf-2i+TG9dG!->f_Dc z&&g>4AQ?4Q09k&zZT+8en$-`>Y4(A;Qvj5twhnk`zH;H-6H^{uPdaw|xXJQBrj!i; ze^CRx1Fj7{57cV>m<r@0CtvHnvDko$Y&I32IPZmk7oaHY8*vDO!hiiaZ$0!+UWNMO`q`< z&so{9aT8ZvknD4v8P&svk5JWo+wa_X*9)GlZrD5G#Oe8o_~lMv*d*rEDZ0diS4B_dT+A+f+p? z9y$tOs52*??)u@6dxRFWS7=TQNMb-{>=zoZF{8)|Aj`5`8)q{BcaRENfTI8wJ7C7d zIcw6p-CDl8Tlna4n$VJd5k4dUxld>j!GJ7NQsjOaNTKn$teSp*Qze${;1a&z0Du#n zHR6RkHxodZtS(X~2l*ZqOlsA~}P-Ken4M!$ya54O0QO%&-R6$1! zNMb-vUoQBcSRwcmsB$%~3f(f-dUR4XXfKC! zk?Z~7!2?cZGPT{jdDF}*k68Jr(PL%)*U>VtUg97Xj<9#K$(}LX0Wi@$>Z8fEqaH34 zLM|;90{1U<)z1Tvse;HTQfCCxf9Zk-A#Z|O)ulc$6Yl|U6H3VL-@ngGYuBz@Pn(%Q zk>3+_e@OK(^2A$}@*k}w+t@koFe>~XduBV|ABUH_L&}yY1%OY@8Pi@+~neN`b%S&;Q7mkEd zR3;#mnG=mD&8`j1g@1)0i#4aD_5tBRKBbp|73@w@O)+>Zj;*oD_^;$8v zR^P~p?$MgbwFl3b>@hem***Ln)dYt|^A|SvD{_e~5=bp;nNekmWCA1{J$m$r!XgG4 z-&g#wGGpiIZM?OJV<6gD2|lV$tj}oAIATB&19IsY&-hJaJY(7K7#h#U1O{xf$IvSb z$PZMdKAp5so;xzIkivKG-aYzi=Il!E){jx(v;E>(n*lX6XsAXa_HB(O*wvoNkMvA9 zGRiZa#(2gBvcI3;Z-B~xd_2Y@X5IwP*e+}dzoy>O6?<8GhcV;E^R#8uFr#%qm3^T+ z#aAa?ss@M$o+FiOBzY&bP4Y_Wl;oMX&ES<-l;k}uYJ^uJ8N3pR0Z9zVN25JsZ!sXd zsJC>bW{gno*-9or`U=W)AuuY{AZw+97nXmayG8X1Q^a&zAcp#d{xRM=Y4I@cBw|3$ zNbpX|80IychI=Z=(SR3AW~pbGxs!-u>EP)<6x zD;vY8(p-2^7CUkWp>$f$UeIr|ED0D=&)^m9Gb$<8dt_w1_lULeK8ApJZ^Pn5FGFae zcTzWlui#&gcuUApnSoH=|QWUa~@ zO7X3x!Rn+v%A|9RCe@Va9b3n+K;x47N=%)R@rG80S6x)zj2gx*%W_?0VW9p6?FP`E z06g$Hj)RU>;}u$IwY3|K7&)p^BDR%s08;`c_gE;l@b|~PHPmPH1pc@CjMoM=FubWE zc5Jnq4|(3Gq{lv_u|Q2hHkyrIGvIwI9MO~Bv;1lphEby{0f;Ug&sp+M z*cd5ivJUbYJ228`d?U4~4h7nBlnqM|`W!NBk^2Y`l~NYTcUq#emutn9@;S3S;C)>J}u!s6Bf9*P!08@tme8Z8e8wN!;SQ0k)pLH*`e|PHFG--uKlG=xchW^o+z@a?=dqyH} zA7GJL3n#(gA<=ft5rT2z1%WdX5;yC<%R*t1Pt>zC67#vB&u0(;&qYLp>tsJ`vMh#xc z0MYu3VngsSczjVZD@oFS>vTFdCXiYN=%haE9+Qk8^@-)Z;7I|WR+?!~o;)%2cd#7D z1%e;YV*fEvv>IW*JV(Lv4+x|VO~N3^>1kFDBvHY2W!4Ns ztp+?AO^_$ALU-WB+O`cUZ`Y>#DElK`dYesl;2B2VHmXMffU@-B#*G`i-yk}NpzE8w zOaUyC=9T@mz{9a0$K?upM(G}^st3l5_9ImVuvya{R{})o2Yb(lx`C!W%6)TE=Fp^rAyqJfTE1+zgzgdsdNpwkEp;zqYNm}09%o^m*cRy;vi47 zTd??RBx>BKN2a}#r?~iM?V*Oo#BqyE0huwRRaJ+X;nbV-Y71n+qZA?4ob?dzUXCRR#By33nmI=D$`5jcU7atz|ZVy zd;GkCWmi~O$W5=kd-rjMk7_CTIH*r9(#j}WE{Hj92IaI0l;}TnxZrB133NFkrYmH>*&YRDdv-}&q zYiyU}qu-bQd!rw+hReUw#)DRj2N~_*!^m)Qg5beD4zV!>UgO`@GOg~0dRr9vAyE;9 zdyH3YVL)UXvn+D8~^|S07*qoM6N<$ Ef>Uh;{Qv*} literal 0 HcmV?d00001 diff --git a/httpd.spec b/httpd.spec index 6f5ef66..5731fe5 100644 --- a/httpd.spec +++ b/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.46 -Release: 9%{?dist} +Release: 10%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -60,6 +60,7 @@ Source44: httpd@.service Source45: config.layout Source46: apachectl.sh Source47: apachectl.xml +Source48: apache-poweredby.png # build/scripts patches Patch2: httpd-2.4.43-apxs.patch @@ -100,7 +101,7 @@ BuildRequires: perl-interpreter, perl-generators, systemd-devel BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: gnupg2 -Requires: /etc/mime.types, system-logos-httpd +Requires: /etc/mime.types, system-logos-httpd >= 34.0.1 Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa} @@ -268,6 +269,9 @@ if test "x${vmmn}" != "x%{mmn}"; then exit 1 fi +# A new logo which comes together with a new test page +cp %{SOURCE48} ./docs/icons/apache_pb3.png + # Provide default layout cp $RPM_SOURCE_DIR/config.layout . @@ -483,6 +487,7 @@ rm -v $RPM_BUILD_ROOT%{docroot}/html/*.html \ ln -s ../../pixmaps/poweredby.png \ $RPM_BUILD_ROOT%{contentdir}/icons/poweredby.png + # symlinks for /etc/httpd rmdir $RPM_BUILD_ROOT/etc/httpd/{state,run} ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs @@ -779,6 +784,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Mar 31 2021 Lubos Uhliarik - 2.4.46-10 +- Resolves: #1934739 - Apache trademark update - new logo + * Mon Feb 01 2021 Lubos Uhliarik - 2.4.46-9 - Resolves: #1914182 - RFE: CustomLog should be able to use journald diff --git a/welcome.conf b/welcome.conf index b279c2f..a5e221b 100644 --- a/welcome.conf +++ b/welcome.conf @@ -16,4 +16,4 @@ Alias /.noindex.html /usr/share/httpd/noindex/index.html -Alias /poweredby.png /usr/share/httpd/icons/apache_pb2.png +Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png From c3fb846a0cb2e84bcea841b92f3a3faad9f402a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Thu, 17 Mar 2022 17:26:25 +0100 Subject: [PATCH 4/4] new version 2.4.53 fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 --- .gitignore | 1 + httpd-2.4.48-openssl3.patch | 505 ------------------ ...patch => httpd-2.4.53-detect-systemd.patch | 16 +- ...-export.patch => httpd-2.4.53-export.patch | 13 +- httpd.spec | 12 +- sources | 4 +- 6 files changed, 21 insertions(+), 530 deletions(-) delete mode 100644 httpd-2.4.48-openssl3.patch rename httpd-2.4.43-detect-systemd.patch => httpd-2.4.53-detect-systemd.patch (76%) rename httpd-2.4.48-export.patch => httpd-2.4.53-export.patch (83%) diff --git a/.gitignore b/.gitignore index bd6e204..5713602 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ x86_64 /httpd-2.4.49.tar.bz2.asc /httpd-2.4.50.tar.bz2.asc /httpd-2.4.51.tar.bz2.asc +/httpd-2.4.53.tar.bz2.asc diff --git a/httpd-2.4.48-openssl3.patch b/httpd-2.4.48-openssl3.patch deleted file mode 100644 index f218d16..0000000 --- a/httpd-2.4.48-openssl3.patch +++ /dev/null @@ -1,505 +0,0 @@ - -https://github.com/apache/httpd/pull/258 - -diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c -index 4da24eddcc..5d199cddaf 100644 ---- a/modules/ssl/ssl_engine_init.c -+++ b/modules/ssl/ssl_engine_init.c -@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) - - return 1; - } --#endif - - /* - * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc* -@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen) - - return NULL; /* impossible to reach. */ - } -+#endif - - static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf, - server_rec *s) -@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, - - modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - init_dh_params(); --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#else - init_bio_methods(); - #endif - -@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s, - { - SSL_CTX *ctx = mctx->ssl_ctx; - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH); -+#else -+ SSL_CTX_set_dh_auto(ctx, 1); -+#endif - - SSL_CTX_set_info_callback(ctx, ssl_callback_Info); - -@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s, - #endif - } - -+static APR_INLINE -+int modssl_CTX_load_verify_locations(SSL_CTX *ctx, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!SSL_CTX_load_verify_locations(ctx, file, path)) -+ return 0; -+#else -+ if (file && !SSL_CTX_load_verify_file(ctx, file)) -+ return 0; -+ if (path && !SSL_CTX_load_verify_dir(ctx, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_verify(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s, - ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, - "Configuring client authentication"); - -- if (!SSL_CTX_load_verify_locations(ctx, -- mctx->auth.ca_cert_file, -- mctx->auth.ca_cert_path)) -- { -+ if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, -+ mctx->auth.ca_cert_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) - "Unable to configure verify locations " - "for client authentication"); -@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, - return APR_SUCCESS; - } - -+static APR_INLINE -+int modssl_X509_STORE_load_locations(X509_STORE *store, -+ const char *file, -+ const char *path) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ if (!X509_STORE_load_locations(store, file, path)) -+ return 0; -+#else -+ if (file && !X509_STORE_load_file(store, file)) -+ return 0; -+ if (path && !X509_STORE_load_path(store, path)) -+ return 0; -+#endif -+ return 1; -+} -+ - static apr_status_t ssl_init_ctx_crl(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s, - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900) - "Configuring certificate revocation facility"); - -- if (!store || !X509_STORE_load_locations(store, mctx->crl_file, -- mctx->crl_path)) { -+ if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file, -+ mctx->crl_path)) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901) - "Host %s: unable to configure X.509 CRL storage " - "for certificate revocation", mctx->sc->vhost_id); -@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag, - return 0; - } - -+static APR_INLINE int modssl_DH_bits(DH *dh) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return DH_bits(dh); -+#else -+ return BN_num_bits(DH_get0_p(dh)); -+#endif -+} -+ -+/* SSL_CTX_use_PrivateKey_file() can fail either because the private -+ * key was encrypted, or due to a mismatch between an already-loaded -+ * cert and the key - a common misconfiguration - from calling -+ * X509_check_private_key(). This macro is passed the last error code -+ * off the OpenSSL stack and evaluates to true only for the first -+ * case. With OpenSSL < 3 the second case is identifiable by the -+ * function code, but function codes are not used from 3.0. */ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY) -+#else -+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509 \ -+ || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \ -+ && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE)) -+#endif -+ - static apr_status_t ssl_init_server_certs(server_rec *s, - apr_pool_t *p, - apr_pool_t *ptemp, -@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; - X509 *cert; -- DH *dhparams; -+ DH *dh; - #ifdef HAVE_ECC - EC_GROUP *ecparams = NULL; - int nid; -@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - } - else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile, - SSL_FILETYPE_PEM) < 1) -- && (ERR_GET_FUNC(ERR_peek_last_error()) -- != X509_F_X509_CHECK_PRIVATE_KEY)) { -+ && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) { - ssl_asn1_t *asn1; - const unsigned char *ptr; - -@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s, - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); - if (certfile && !modssl_is_engine_id(certfile) -- && (dhparams = ssl_dh_GetParamFromFile(certfile))) { -- SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); -+ && (dh = ssl_dh_GetParamFromFile(certfile))) { -+ SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- DH_bits(dhparams), vhost_id, certfile); -- DH_free(dhparams); -+ modssl_DH_bits(dh), vhost_id, certfile); -+ DH_free(dh); - } - - #ifdef HAVE_ECC -@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, - char buf[TLSEXT_TICKET_KEY_LEN]; - char *path; - modssl_ticket_key_t *ticket_key = mctx->ticket_key; -+ int res; - - if (!ticket_key->file_path) { - return APR_SUCCESS; -@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s, - } - - memcpy(ticket_key->key_name, buf, 16); -- memcpy(ticket_key->hmac_secret, buf + 16, 16); - memcpy(ticket_key->aes_key, buf + 32, 16); -- -- if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -- ssl_callback_SessionTicket)) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ memcpy(ticket_key->hmac_secret, buf + 16, 16); -+ res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#else -+ ticket_key->mac_params[0] = -+ OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16); -+ ticket_key->mac_params[1] = -+ OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0); -+ ticket_key->mac_params[2] = -+ OSSL_PARAM_construct_end(); -+ res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx, -+ ssl_callback_SessionTicket); -+#endif -+ if (!res) { - ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913) - "Unable to initialize TLS session ticket key callback " - "(incompatible OpenSSL version?)"); -@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, - return ssl_die(s); - } - -- X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); -+ modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL); - - for (n = 0; n < ncerts; n++) { - int i; -@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data) - - } - --#if !MODSSL_USE_OPENSSL_PRE_1_1_API -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ free_dh_params(); -+#else - free_bio_methods(); - #endif -- free_dh_params(); - - return APR_SUCCESS; - } -diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c -index cabf753790..3db7077f1e 100644 ---- a/modules/ssl/ssl_engine_io.c -+++ b/modules/ssl/ssl_engine_io.c -@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio) - static int bio_filter_out_read(BIO *bio, char *out, int outl) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_read"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr) - static int bio_filter_out_gets(BIO *bio, char *buf, int size) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_out_puts(BIO *bio, const char *str) - { - /* this is never called */ -+ bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c, -+ "BUG: %s() should not be called", "bio_filter_out_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - -@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen) - - static int bio_filter_in_write(BIO *bio, const char *in, int inl) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_write"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_puts(BIO *bio, const char *str) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_puts"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static int bio_filter_in_gets(BIO *bio, char *buf, int size) - { -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: %s() should not be called", "bio_filter_in_gets"); -+ AP_DEBUG_ASSERT(0); - return -1; - } - - static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr) - { -- return -1; -+ bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio); -+ switch (cmd) { -+#ifdef BIO_CTRL_EOF -+ case BIO_CTRL_EOF: -+ return inctx->rc == APR_EOF; -+#endif -+ default: -+ break; -+ } -+ ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c, -+ "BUG: bio_filter_in_ctrl() should not be called with cmd=%i", -+ cmd); -+ AP_DEBUG_ASSERT(0); -+ return 0; - } - - #if MODSSL_USE_OPENSSL_PRE_1_1_API -@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = { - bio_filter_in_read, - bio_filter_in_puts, /* puts is never called */ - bio_filter_in_gets, /* gets is never called */ -- bio_filter_in_ctrl, /* ctrl is never called */ -+ bio_filter_in_ctrl, /* ctrl is called for EOF check */ - bio_filter_create, - bio_filter_destroy, - NULL -diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c -index b99dcf19d4..aced92d2d0 100644 ---- a/modules/ssl/ssl_engine_kernel.c -+++ b/modules/ssl/ssl_engine_kernel.c -@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client = - ** _________________________________________________________________ - */ - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* - * Hand out standard DH parameters, based on the authentication strength - */ -@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen) - - return modssl_get_dh_params(keylen); - } -+#endif - - /* - * This OpenSSL callback function is called when OpenSSL -@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl, - unsigned char *keyname, - unsigned char *iv, - EVP_CIPHER_CTX *cipher_ctx, -- HMAC_CTX *hctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif - int mode) - { - conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); -@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl, - } - EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289) - "TLS session ticket key for %s successfully set, " -@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl, - - EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL, - ticket_key->aes_key, iv); -- HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL); -+ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16, -+ tlsext_tick_md(), NULL); -+#else -+ EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params); -+#endif - - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290) - "TLS session ticket key for %s successfully set, " -diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c -index 7dbbbdb55e..3b3ceacf0a 100644 ---- a/modules/ssl/ssl_engine_log.c -+++ b/modules/ssl/ssl_engine_log.c -@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s) - return APR_EGENERAL; - } - -+static APR_INLINE -+unsigned long modssl_ERR_peek_error_data(const char **data, int *flags) -+{ -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ return ERR_peek_error_line_data(NULL, NULL, data, flags); -+#else -+ return ERR_peek_error_data(data, flags); -+#endif -+} -+ - /* - * Prints the SSL library error information. - */ -@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s) - const char *data; - int flags; - -- while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) { -+ while ((e = modssl_ERR_peek_error_data(&data, &flags))) { - const char *annotation; - char err[256]; - -diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h -index a6fc7513a2..b091c58c94 100644 ---- a/modules/ssl/ssl_private.h -+++ b/modules/ssl/ssl_private.h -@@ -89,6 +89,9 @@ - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - #include - #include - #include -@@ -134,13 +137,12 @@ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) - #define SSL_CTX_set_max_proto_version(ctx, version) \ - SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) --#elif LIBRESSL_VERSION_NUMBER < 0x2070000f -+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ - /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (1) --#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ -+#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) - #else /* defined(LIBRESSL_VERSION_NUMBER) */ - #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) - #endif -@@ -674,7 +676,11 @@ typedef struct { - typedef struct { - const char *file_path; - unsigned char key_name[16]; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - unsigned char hmac_secret[16]; -+#else -+ OSSL_PARAM mac_params[3]; -+#endif - unsigned char aes_key[16]; - } modssl_ticket_key_t; - #endif -@@ -938,8 +944,16 @@ int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); - int ssl_callback_ClientHello(SSL *, int *, void *); - #endif - #ifdef HAVE_TLS_SESSION_TICKETS --int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *, -- EVP_CIPHER_CTX *, HMAC_CTX *, int); -+int ssl_callback_SessionTicket(SSL *ssl, -+ unsigned char *keyname, -+ unsigned char *iv, -+ EVP_CIPHER_CTX *cipher_ctx, -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ HMAC_CTX *hmac_ctx, -+#else -+ EVP_MAC_CTX *mac_ctx, -+#endif -+ int mode); - #endif - - #ifdef HAVE_TLS_ALPN -@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx); - - #endif - -+#if MODSSL_USE_OPENSSL_PRE_1_1_API - /* Retrieve DH parameters for given key length. Return value should - * be treated as unmutable, since it is stored in process-global - * memory. */ - DH *modssl_get_dh_params(unsigned keylen); -+#endif - - /* Returns non-zero if the request was made over SSL/TLS. If sslconn - * is non-NULL and the request is using SSL/TLS, sets *sslconn to the diff --git a/httpd-2.4.43-detect-systemd.patch b/httpd-2.4.53-detect-systemd.patch similarity index 76% rename from httpd-2.4.43-detect-systemd.patch rename to httpd-2.4.53-detect-systemd.patch index 540687f..d501b06 100644 --- a/httpd-2.4.43-detect-systemd.patch +++ b/httpd-2.4.53-detect-systemd.patch @@ -1,5 +1,5 @@ diff --git a/Makefile.in b/Makefile.in -index 0b088ac..9eeb5c7 100644 +index a2e9c82..bd8045c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test @@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644 PROGRAM_DEPENDENCIES = \ server/libmain.la \ diff --git a/acinclude.m4 b/acinclude.m4 -index 2a7e5d1..eb28321 100644 +index 97484c9..05abe18 100644 --- a/acinclude.m4 +++ b/acinclude.m4 -@@ -624,6 +624,7 @@ case $host in +@@ -631,6 +631,7 @@ case $host in if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then AC_MSG_WARN([Your system does not support systemd.]) else @@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644 fi fi diff --git a/configure.in b/configure.in -index 3618a5a..74a782b 100644 +index cf437fe..521fc45 100644 --- a/configure.in +++ b/configure.in -@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then +@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG]) APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`]) - APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`]) + APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`]) + APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)]) else - AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/]) + AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/]) fi -@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR) +@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR) APACHE_SUBST(BUILTIN_LIBS) APACHE_SUBST(SHLIBPATH_VAR) APACHE_SUBST(OS_SPECIFIC_VARS) diff --git a/httpd-2.4.48-export.patch b/httpd-2.4.53-export.patch similarity index 83% rename from httpd-2.4.48-export.patch rename to httpd-2.4.53-export.patch index 439f768..d240360 100644 --- a/httpd-2.4.48-export.patch +++ b/httpd-2.4.53-export.patch @@ -1,12 +1,5 @@ - -Reduce size of httpd binary by telling linker to export all symbols -from libmain.a, rather than bloating the symbol table with ap_hack_* -to do so indirectly. - -Upstream: https://svn.apache.org/r1861685 (as new default-off configure option) - diff --git a/Makefile.in b/Makefile.in -index 40c7076..ac98e5f 100644 +index bd8045c..d6733a5 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test @@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644 eoc_bucket.c eor_bucket.c core_filters.c \ util_expr_parse.c util_expr_scan.c util_expr_eval.c diff --git a/server/main.c b/server/main.c -index 62e06df..17c09ee 100644 +index 7da7aa2..e63d2eb 100644 --- a/server/main.c +++ b/server/main.c -@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[]) +@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[]) return !OK; } diff --git a/httpd.spec b/httpd.spec index 77b51a8..ab61f45 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,7 +12,7 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.51 +Version: 2.4.53 Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -66,16 +66,15 @@ Source48: apache-poweredby.png Patch2: httpd-2.4.43-apxs.patch Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.43-detect-systemd.patch +Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes Patch21: httpd-2.4.48-r1842929+.patch Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.48-export.patch +Patch23: httpd-2.4.53-export.patch Patch24: httpd-2.4.43-corelimit.patch Patch25: httpd-2.4.43-selinux.patch Patch26: httpd-2.4.43-gettid.patch Patch27: httpd-2.4.43-icons.patch -Patch28: httpd-2.4.48-openssl3.patch Patch30: httpd-2.4.43-cachehardmax.patch Patch34: httpd-2.4.43-socket-activation.patch Patch38: httpd-2.4.43-sslciphdefault.patch @@ -228,7 +227,6 @@ written in the Lua programming language. %patch25 -p1 -b .selinux %patch26 -p1 -b .gettid %patch27 -p1 -b .icons -%patch28 -p1 -b .openssl3 %patch30 -p1 -b .cachehardmax %patch34 -p1 -b .socketactivation %patch38 -p1 -b .sslciphdefault @@ -787,6 +785,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Mar 17 2022 Luboš Uhliarik - 2.4.53-1 +- new version 2.4.53 +- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719 + * Thu Oct 07 2021 Patrick Uiterwijk - 2.4.51-1 - new version 2.4.51 diff --git a/sources b/sources index edbf616..36266ed 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66 -SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce +SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756 +SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192