From ac146d28f9397bf803ede12450d2acead287a21d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 2 Nov 2023 14:39:09 +0000 Subject: [PATCH 01/55] add dependency on apr-util-1(dbm) so a DBM provider is present --- httpd-2.4.58-properr.patch | 30 ++++++++++++++++++++++++++++++ httpd.spec | 8 +++++++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.58-properr.patch diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch new file mode 100644 index 0000000..4071f25 --- /dev/null +++ b/httpd-2.4.58-properr.patch @@ -0,0 +1,30 @@ +--- httpd-2.4.58/modules/dav/fs/dbm.c.properr ++++ httpd-2.4.58/modules/dav/fs/dbm.c +@@ -100,7 +100,7 @@ + /* There might not be a if we had problems creating it. */ + if (db == NULL) { + errcode = 1; +- errstr = "Could not open property database."; ++ errstr = "Could not open database."; + if (APR_STATUS_IS_EDSOOPEN(status)) + ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) + "The DBM driver could not be loaded"); +@@ -147,7 +147,7 @@ + "mod_dav_fs: The DBM library '%s' could not be loaded: %s", + err->reason, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, +- "Could not load library for property database."); ++ "Could not load library for DBM database."); + } + if ((status = apr_dbm_open2(&file, driver, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, +@@ -162,6 +162,9 @@ + != APR_SUCCESS + && !ro) { + /* ### do something with 'status' */ ++ ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, ++ "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)", ++ pathname, ro ? "only" : "write"); + + /* we can't continue if we couldn't open the file + and we need to write */ diff --git a/httpd.spec b/httpd.spec index 4ff2d58..066d182 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -142,6 +142,9 @@ Provides: mod_proxy_uwsgi = %{version}-%{release} Requires: /etc/mime.types Requires: httpd-tools = %{version}-%{release} Requires: httpd-filesystem = %{version}-%{release} +%if 0%{?fedora} > 39 || 0%{?rhel} > 9 +Requires: apr-util-1(dbm)%{_isa} +%endif Requires(pre): httpd-filesystem Conflicts: apr < 1.5.0-1 Conflicts: httpd < 2.4.53-2 @@ -856,6 +859,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Nov 2 2023 Joe Orton - 2.4.58-2 +- add dependency on apr-util-1(dbm) so a DBM provider is present + * Fri Oct 20 2023 Luboš Uhliarik - 2.4.58-1 - new version 2.4.58 From d69c709d67f1668d05fe7466b677ef5923b1c1f2 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:09:28 +0000 Subject: [PATCH 02/55] Update pullrev.sh. --- pullrev.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pullrev.sh b/pullrev.sh index 87b7cd7..703d376 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -7,7 +7,7 @@ fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.51 +ver=2.4.58 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" @@ -43,7 +43,7 @@ for r in $*; do http*) curl -s "$r" | filterdiff --strip=3 ;; *) svn diff -c ${r} ${repo} ;; esac | filterdiff --remove-timestamps --clean \ - -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \ --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` if ! combinediff -w ${prev} ${this} > ${next}; then @@ -62,4 +62,4 @@ echo "+ git add ${fn}" git add "${fn}" echo "+ spec template:" echo "PatchN: ${fn}" -echo "%patchN -p1 -b .${suffix}" +echo "%patch -PN -p1 -b .${suffix}" From 5d639c7ccf9c83fe9fdbe28d95ed751f8d332620 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:11:45 +0000 Subject: [PATCH 03/55] mod_dav_fs: add DAVLockDBType, use global lock around lockdb --- httpd-2.4.58-properr.patch | 30 --- httpd-2.4.58-r1912477+.patch | 381 +++++++++++++++++++++++++++++++++++ httpd.spec | 7 +- 3 files changed, 387 insertions(+), 31 deletions(-) delete mode 100644 httpd-2.4.58-properr.patch create mode 100644 httpd-2.4.58-r1912477+.patch diff --git a/httpd-2.4.58-properr.patch b/httpd-2.4.58-properr.patch deleted file mode 100644 index 4071f25..0000000 --- a/httpd-2.4.58-properr.patch +++ /dev/null @@ -1,30 +0,0 @@ ---- httpd-2.4.58/modules/dav/fs/dbm.c.properr -+++ httpd-2.4.58/modules/dav/fs/dbm.c -@@ -100,7 +100,7 @@ - /* There might not be a if we had problems creating it. */ - if (db == NULL) { - errcode = 1; -- errstr = "Could not open property database."; -+ errstr = "Could not open database."; - if (APR_STATUS_IS_EDSOOPEN(status)) - ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) - "The DBM driver could not be loaded"); -@@ -147,7 +147,7 @@ - "mod_dav_fs: The DBM library '%s' could not be loaded: %s", - err->reason, err->msg); - return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, -- "Could not load library for property database."); -+ "Could not load library for DBM database."); - } - if ((status = apr_dbm_open2(&file, driver, pathname, - ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, -@@ -162,6 +162,9 @@ - != APR_SUCCESS - && !ro) { - /* ### do something with 'status' */ -+ ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, -+ "mod_dav_fs: apr_dbm_open() failed for %s (read-%s)", -+ pathname, ro ? "only" : "write"); - - /* we can't continue if we couldn't open the file - and we need to write */ diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch new file mode 100644 index 0000000..6458df8 --- /dev/null +++ b/httpd-2.4.58-r1912477+.patch @@ -0,0 +1,381 @@ +# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438 +http://svn.apache.org/viewvc?view=revision&revision=1912477 +http://svn.apache.org/viewvc?view=revision&revision=1912571 +http://svn.apache.org/viewvc?view=revision&revision=1912718 +http://svn.apache.org/viewvc?view=revision&revision=1913654 +http://svn.apache.org/viewvc?view=revision&revision=1914438 + +--- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/config6.m4 +@@ -20,4 +20,10 @@ + + APACHE_MODULE(dav_fs, DAV provider for the filesystem. --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav) + ++if test "x$enable_dav_fs" = "xshared"; then ++ # The only symbol which needs to be exported is the module ++ # structure, so ask libtool to hide everything else: ++ APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module]) ++fi ++ + APACHE_MODPATH_FINISH +--- httpd-2.4.58/modules/dav/fs/dbm.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/dbm.c +@@ -47,6 +47,10 @@ + #include "http_log.h" + #include "http_main.h" /* for ap_server_conf */ + ++#ifndef DEFAULT_PROPDB_DBM_TYPE ++#define DEFAULT_PROPDB_DBM_TYPE "default" ++#endif ++ + APLOG_USE_MODULE(dav_fs); + + struct dav_db { +@@ -100,7 +104,7 @@ + /* There might not be a if we had problems creating it. */ + if (db == NULL) { + errcode = 1; +- errstr = "Could not open property database."; ++ errstr = "Could not open database."; + if (APR_STATUS_IS_EDSOOPEN(status)) + ap_log_error(APLOG_MARK, APLOG_CRIT, status, ap_server_conf, APLOGNO(00576) + "The DBM driver could not be loaded"); +@@ -129,10 +133,10 @@ + /* dav_dbm_open_direct: Opens a *dbm database specified by path. + * ro = boolean read-only flag. + */ +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb) ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb) + { +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) + const apr_dbm_driver_t *driver; + const apu_err_t *err; + #endif +@@ -141,13 +145,13 @@ + + *pdb = NULL; + +-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) +- if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) { ++#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7) ++ if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) { + ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289) +- "mod_dav_fs: The DBM library '%s' could not be loaded: %s", +- err->reason, err->msg); ++ "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s", ++ err->reason, dbmtype, err->msg); + return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status, +- "Could not load library for property database."); ++ "Could not load library for database."); + } + if ((status = apr_dbm_open2(&file, driver, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, +@@ -156,7 +160,7 @@ + return dav_fs_dbm_error(NULL, p, status); + } + #else +- if ((status = apr_dbm_open(&file, pathname, ++ if ((status = apr_dbm_open_ex(&file, dbmtype, pathname, + ro ? APR_DBM_READONLY : APR_DBM_RWCREATE, + APR_OS_DEFAULT, p)) + != APR_SUCCESS +@@ -206,7 +210,7 @@ + + /* ### do we need to deal with the umask? */ + +- return dav_dbm_open_direct(p, pathname, ro, pdb); ++ return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb); + } + + void dav_dbm_close(dav_db *db) +--- httpd-2.4.58/modules/dav/fs/lock.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/lock.c +@@ -181,8 +181,7 @@ + { + request_rec *r; /* for accessing the uuid state */ + apr_pool_t *pool; /* a pool to use */ +- const char *lockdb_path; /* where is the lock database? */ +- ++ const dav_fs_server_conf *conf; /* lock database config & metadata */ + int opened; /* we opened the database */ + dav_db *db; /* if non-NULL, the lock database */ + }; +@@ -292,6 +291,19 @@ + return dav_compare_locktoken(lt1, lt2); + } + ++static apr_status_t dav_fs_lockdb_cleanup(void *data) ++{ ++ dav_lockdb *lockdb = data; ++ ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ ++ if (lockdb->info->db) { ++ dav_dbm_close(lockdb->info->db); ++ } ++ ++ return APR_SUCCESS; ++} ++ + /* + ** dav_fs_really_open_lockdb: + ** +@@ -300,15 +312,27 @@ + static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb) + { + dav_error *err; ++ apr_status_t rv; + + if (lockdb->info->opened) + return NULL; + ++ rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex); ++ if (rv) { ++ return dav_new_error(lockdb->info->pool, ++ HTTP_INTERNAL_SERVER_ERROR, ++ DAV_ERR_LOCK_OPENDB, rv, ++ "Could not lock mutex for lock database."); ++ } ++ + err = dav_dbm_open_direct(lockdb->info->pool, +- lockdb->info->lockdb_path, ++ lockdb->info->conf->lockdb_path, ++ lockdb->info->conf->lockdb_type, + lockdb->ro, + &lockdb->info->db); + if (err != NULL) { ++ apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex); ++ + return dav_push_error(lockdb->info->pool, + HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_OPENDB, +@@ -316,6 +340,10 @@ + err); + } + ++ apr_pool_cleanup_register(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup, ++ dav_fs_lockdb_cleanup); ++ + /* all right. it is opened now. */ + lockdb->info->opened = 1; + +@@ -341,9 +369,9 @@ + comb->pub.info = &comb->priv; + comb->priv.r = r; + comb->priv.pool = r->pool; +- +- comb->priv.lockdb_path = dav_get_lockdb_path(r); +- if (comb->priv.lockdb_path == NULL) { ++ comb->priv.conf = dav_fs_get_server_conf(r); ++ ++ if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) { + return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR, + DAV_ERR_LOCK_NO_DB, 0, + "A lock database was not specified with the " +@@ -369,8 +397,8 @@ + */ + static void dav_fs_close_lockdb(dav_lockdb *lockdb) + { +- if (lockdb->info->db != NULL) +- dav_dbm_close(lockdb->info->db); ++ apr_pool_cleanup_run(lockdb->info->pool, lockdb, ++ dav_fs_lockdb_cleanup); + } + + /* +--- httpd-2.4.58/modules/dav/fs/mod_dav_fs.c.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/mod_dav_fs.c +@@ -14,31 +14,35 @@ + * limitations under the License. + */ + ++#if !defined(_MSC_VER) && !defined(NETWARE) ++#include "ap_config_auto.h" ++#endif ++ + #include "httpd.h" + #include "http_config.h" ++#include "http_core.h" ++#include "http_log.h" + #include "apr_strings.h" + + #include "mod_dav.h" + #include "repos.h" + +-/* per-server configuration */ +-typedef struct { +- const char *lockdb_path; +- +-} dav_fs_server_conf; +- + extern module AP_MODULE_DECLARE_DATA dav_fs_module; + + #ifndef DEFAULT_DAV_LOCKDB + #define DEFAULT_DAV_LOCKDB "davlockdb" + #endif ++#ifndef DEFAULT_DAV_LOCKDB_TYPE ++#define DEFAULT_DAV_LOCKDB_TYPE "default" ++#endif + +-const char *dav_get_lockdb_path(const request_rec *r) +-{ +- dav_fs_server_conf *conf; ++static const char dav_fs_mutexid[] = "dav_fs-lockdb"; + +- conf = ap_get_module_config(r->server->module_config, &dav_fs_module); +- return conf->lockdb_path; ++static apr_global_mutex_t *dav_fs_lockdb_mutex; ++ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r) ++{ ++ return ap_get_module_config(r->server->module_config, &dav_fs_module); + } + + static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s) +@@ -57,15 +61,50 @@ + + newconf->lockdb_path = + child->lockdb_path ? child->lockdb_path : parent->lockdb_path; ++ newconf->lockdb_type = ++ child->lockdb_type ? child->lockdb_type : parent->lockdb_type; + + return newconf; + } + ++static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp) ++{ ++ if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0)) ++ return !OK; ++ return OK; ++} ++ ++static void dav_fs_child_init(apr_pool_t *p, server_rec *s) ++{ ++ apr_status_t rv; ++ ++ rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex, ++ apr_global_mutex_lockfile(dav_fs_lockdb_mutex), ++ p); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, ++ APLOGNO(10488) "child init failed for mutex"); ++ } ++} ++ + static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog, + apr_pool_t *ptemp, server_rec *base_server) + { + server_rec *s; ++ apr_status_t rv; + ++ /* Ignore first pass through the config. */ ++ if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) ++ return OK; ++ ++ rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL, ++ base_server, p, 0); ++ if (rv) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server, ++ APLOGNO(10489) "could not create lock mutex"); ++ return !OK; ++ } ++ + for (s = base_server; s; s = s->next) { + dav_fs_server_conf *conf; + +@@ -74,6 +113,13 @@ + if (!conf->lockdb_path) { + conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB); + } ++ if (!conf->lockdb_type) { ++ conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE; ++ } ++ ++ /* Mutex is common across all vhosts, but could have one per ++ * vhost if required. */ ++ conf->lockdb_mutex = dav_fs_lockdb_mutex; + } + + return OK; +@@ -98,19 +144,36 @@ + return NULL; + } + ++/* ++ * Command handler for the DAVLockDBType directive, which is TAKE1 ++ */ ++static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config, ++ const char *arg1) ++{ ++ dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config, ++ &dav_fs_module); ++ conf->lockdb_type = arg1; ++ ++ return NULL; ++} ++ + static const command_rec dav_fs_cmds[] = + { + /* per server */ + AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF, + "specify a lock database"), ++ AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF, ++ "specify a lock database DBM type"), + + { NULL } + }; + + static void register_hooks(apr_pool_t *p) + { ++ ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE); +- ++ ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE); ++ + dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL, + APR_HOOK_MIDDLE); + dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE); +--- httpd-2.4.58/modules/dav/fs/repos.h.r1912477+ ++++ httpd-2.4.58/modules/dav/fs/repos.h +@@ -25,6 +25,8 @@ + #ifndef _DAV_FS_REPOS_H_ + #define _DAV_FS_REPOS_H_ + ++#include "util_mutex.h" ++ + /* the subdirectory to hold all DAV-related information for a directory */ + #define DAV_FS_STATE_DIR ".DAV" + #define DAV_FS_STATE_FILE_FOR_DIR ".state_for_dir" +@@ -53,8 +55,8 @@ + /* DBM functions used by the repository and locking providers */ + extern const dav_hooks_db dav_hooks_db_dbm; + +-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro, +- dav_db **pdb); ++dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, ++ const char *dbmtype, int ro, dav_db **pdb); + void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname, + const char **state1, const char **state2); + dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key); +@@ -64,8 +66,15 @@ + int dav_dbm_exists(dav_db *db, apr_datum_t key); + void dav_dbm_close(dav_db *db); + +-/* where is the lock database located? */ +-const char *dav_get_lockdb_path(const request_rec *r); ++/* Per-server configuration. */ ++typedef struct { ++ const char *lockdb_path; ++ const char *lockdb_type; ++ apr_global_mutex_t *lockdb_mutex; ++} dav_fs_server_conf; ++ ++/* Returns server configuration for the request. */ ++const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r); + + const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r); + const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r); diff --git a/httpd.spec b/httpd.spec index 066d182..bff884c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 2%{?dist} +Release: 3%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -96,6 +96,7 @@ Patch41: httpd-2.4.43-r1861793+.patch Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch Patch46: httpd-2.4.53-separate-systemd-fns.patch +Patch47: httpd-2.4.58-r1912477+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -271,6 +272,7 @@ written in the Lua programming language. %patch -P45 -p1 -b .logjournal %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux +%patch -P47 -p1 -b .r1912477+ %patch -P60 -p1 -b .enable-sslv3 %patch -P63 -p1 -b .htcacheclean-dont-break @@ -859,6 +861,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Dec 8 2023 Joe Orton - 2.4.58-3 +- mod_dav_fs: add DAVLockDBType, use global lock around lockdb + * Thu Nov 2 2023 Joe Orton - 2.4.58-2 - add dependency on apr-util-1(dbm) so a DBM provider is present From 3d4b4777ce7dcd6b777cc57052faeb192828f618 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 8 Dec 2023 11:55:58 +0000 Subject: [PATCH 04/55] - fix build with libxml2 2.12 --- httpd-2.4.58-r1914013.patch | 14 ++++++++++++++ httpd.spec | 2 ++ 2 files changed, 16 insertions(+) create mode 100644 httpd-2.4.58-r1914013.patch diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch new file mode 100644 index 0000000..f9e0786 --- /dev/null +++ b/httpd-2.4.58-r1914013.patch @@ -0,0 +1,14 @@ +# ./pullrev.sh 1914013 +http://svn.apache.org/viewvc?view=revision&revision=1914013 + +--- httpd-2.4.58/modules/filters/mod_xml2enc.c ++++ httpd-2.4.58/modules/filters/mod_xml2enc.c +@@ -209,7 +209,7 @@ + + /* to sniff, first we look for BOM */ + if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) { +- ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf, ++ ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf, + ctx->bytes); + if (HAVE_ENCODING(ctx->xml2enc)) { + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432) diff --git a/httpd.spec b/httpd.spec index bff884c..5bd2c4d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -101,6 +101,7 @@ Patch47: httpd-2.4.58-r1912477+.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.58-r1914013.patch Patch63: httpd-2.4.46-htcacheclean-dont-break.patch Patch65: httpd-2.4.51-r1894152.patch @@ -275,6 +276,7 @@ written in the Lua programming language. %patch -P47 -p1 -b .r1912477+ %patch -P60 -p1 -b .enable-sslv3 +%patch -P61 -p1 -b .r1914013 %patch -P63 -p1 -b .htcacheclean-dont-break %patch -P65 -p1 -b .r1894152 From af4e8a43b66a9ed63903c84ca4b9be765bda87a1 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 12 Dec 2023 08:59:47 +0000 Subject: [PATCH 05/55] Note build fix. --- httpd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/httpd.spec b/httpd.spec index 5bd2c4d..f593ac4 100644 --- a/httpd.spec +++ b/httpd.spec @@ -865,6 +865,7 @@ exit $rv %changelog * Fri Dec 8 2023 Joe Orton - 2.4.58-3 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb +- fix build with libxml2 2.12 * Thu Nov 2 2023 Joe Orton - 2.4.58-2 - add dependency on apr-util-1(dbm) so a DBM provider is present From 16be14d05f9d8cf33661a58715a302be8872ce81 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 11:48:45 +0000 Subject: [PATCH 06/55] fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) mod_ssl: move to provider API for pkcs11 support (#2253014) --- httpd-2.4.58-r1913912+.patch | 847 +++++++++++++++++++++++++++++++++++ httpd-2.4.58-r1914365.patch | 219 +++++++++ httpd.spec | 10 +- pullrev.sh | 6 +- 4 files changed, 1079 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.58-r1913912+.patch create mode 100644 httpd-2.4.58-r1914365.patch diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch new file mode 100644 index 0000000..c8ea8fa --- /dev/null +++ b/httpd-2.4.58-r1913912+.patch @@ -0,0 +1,847 @@ +# ./pullrev.sh 1913912 1915067 + +http://svn.apache.org/viewvc?view=revision&revision=1913912 +http://svn.apache.org/viewvc?view=revision&revision=1915067 + +--- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 ++++ httpd-2.4.58/modules/ssl/mod_ssl.c +@@ -25,8 +25,7 @@ + */ + + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "util_md5.h" + #include "util_mutex.h" + #include "ap_provider.h" +@@ -75,11 +74,9 @@ + SSL_CMD_SRV(SessionCache, TAKE1, + "SSL Session Cache storage " + "('none', 'nonenotnull', 'dbm:/path/to/file')") +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + SSL_CMD_SRV(CryptoDevice, TAKE1, + "SSL external Crypto Device usage " + "('builtin', '...')") +-#endif + SSL_CMD_SRV(RandomSeed, TAKE23, + "SSL Pseudo Random Number Generator (PRNG) seeding source " + "('startup|connect builtin|file:/path|exec:/path [bytes]')") +--- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912 ++++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h +@@ -30,14 +30,17 @@ + + /* OpenSSL headers */ + +-#ifndef SSL_PRIVATE_H + #include +-#if (OPENSSL_VERSION_NUMBER >= 0x10001000) ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include /* for OPENSSL_API_LEVEL */ ++#endif ++#if OPENSSL_VERSION_NUMBER >= 0x10001000 + /* must be defined before including ssl.h */ + #define OPENSSL_NO_SSL_INTERN + #endif + #include +-#endif ++#include ++#include + + /** + * init_server hook -- allow SSL_CTX-specific initialization to be performed by +--- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_config.c +@@ -27,6 +27,7 @@ + damned if you don't.'' + -- Unknown */ + #include "ssl_private.h" ++ + #include "util_mutex.h" + #include "ap_provider.h" + +@@ -593,14 +594,15 @@ + return NULL; + } + +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd, + void *dcfg, + const char *arg) + { + SSLModConfigRec *mc = myModConfig(cmd->server); + const char *err; ++#if MODSSL_HAVE_ENGINE_API + ENGINE *e; ++#endif + + if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { + return err; +@@ -609,13 +611,16 @@ + if (strcEQ(arg, "builtin")) { + mc->szCryptoDevice = NULL; + } ++#if MODSSL_HAVE_ENGINE_API + else if ((e = ENGINE_by_id(arg))) { + mc->szCryptoDevice = arg; + ENGINE_free(e); + } ++#endif + else { + err = "SSLCryptoDevice: Invalid argument; must be one of: " + "'builtin' (none)"; ++#if MODSSL_HAVE_ENGINE_API + e = ENGINE_get_first(); + while (e) { + err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e), +@@ -624,12 +629,12 @@ + * on the 'old' e, per the docs in engine.h. */ + e = ENGINE_get_next(e); + } ++#endif + return err; + } + + return NULL; + } +-#endif + + const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd, + void *dcfg, +--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c +@@ -27,8 +27,7 @@ + see Recursive.'' + -- Unknown */ + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "mpm_common.h" + #include "mod_md.h" + +@@ -218,6 +217,16 @@ + } + #endif + ++static APR_INLINE unsigned long modssl_runtime_lib_version(void) ++{ ++#if MODSSL_USE_OPENSSL_PRE_1_1_API ++ return SSLeay(); ++#else ++ return OpenSSL_version_num(); ++#endif ++} ++ ++ + /* + * Per-module initialization + */ +@@ -225,18 +234,22 @@ + apr_pool_t *ptemp, + server_rec *base_server) + { ++ unsigned long runtime_lib_version = modssl_runtime_lib_version(); + SSLModConfigRec *mc = myModConfig(base_server); + SSLSrvConfigRec *sc; + server_rec *s; + apr_status_t rv; + apr_array_header_t *pphrases; + +- if (SSLeay() < MODSSL_LIBRARY_VERSION) { ++ AP_DEBUG_ASSERT(mc); ++ ++ if (runtime_lib_version < MODSSL_LIBRARY_VERSION) { + ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882) + "Init: this version of mod_ssl was compiled against " +- "a newer library (%s, version currently loaded is %s)" ++ "a newer library (%s (%s), version currently loaded is 0x%lX)" + " - may result in undefined or erroneous behavior", +- MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT); ++ MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT, ++ runtime_lib_version); + } + + /* We initialize mc->pid per-process in the child init, +@@ -313,11 +326,9 @@ + /* + * SSL external crypto device ("engine") support + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) { + return rv; + } +-#endif + + ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883) + "Init: Initialized %s library", MODSSL_LIBRARY_NAME); +@@ -473,9 +484,9 @@ + * Support for external a Crypto Device ("engine"), usually + * a hardware accelerator card for crypto operations. + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) + apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p) + { ++#if MODSSL_HAVE_ENGINE_API + SSLModConfigRec *mc = myModConfig(s); + ENGINE *e; + +@@ -507,10 +518,9 @@ + + ENGINE_free(e); + } +- ++#endif + return APR_SUCCESS; + } +-#endif + + #ifdef HAVE_TLSEXT + static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, +@@ -1320,15 +1330,6 @@ + return 0; + } + +-static APR_INLINE int modssl_DH_bits(DH *dh) +-{ +-#if OPENSSL_VERSION_NUMBER < 0x30000000L +- return DH_bits(dh); +-#else +- return BN_num_bits(DH_get0_p(dh)); +-#endif +-} +- + /* SSL_CTX_use_PrivateKey_file() can fail either because the private + * key was encrypted, or due to a mismatch between an already-loaded + * cert and the key - a common misconfiguration - from calling +@@ -1354,15 +1355,10 @@ + SSLModConfigRec *mc = myModConfig(s); + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; +- X509 *cert; +- DH *dh; ++ EVP_PKEY *pkey; + #ifdef HAVE_ECC +- EC_GROUP *ecparams = NULL; +- int nid; +- EC_KEY *eckey = NULL; +-#endif +-#ifndef HAVE_SSL_CONF_CMD +- SSL *ssl; ++ EC_GROUP *ecgroup = NULL; ++ int curve_nid = 0; + #endif + + /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ +@@ -1373,7 +1369,7 @@ + (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, + const char *)); + i++) { +- EVP_PKEY *pkey; ++ X509 *cert = NULL; + const char *engine_certfile = NULL; + + key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); +@@ -1416,8 +1412,6 @@ + if (modssl_is_engine_id(keyfile)) { + apr_status_t rv; + +- cert = NULL; +- + if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, + engine_certfile, keyfile, + &cert, &pkey))) { +@@ -1488,22 +1482,21 @@ + * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later, + * and SSL_CTX_get0_certificate is implemented.) + */ +- if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) { ++ cert = SSL_CTX_get0_certificate(mctx->ssl_ctx); + #else +- ssl = SSL_new(mctx->ssl_ctx); ++ { ++ SSL *ssl = SSL_new(mctx->ssl_ctx); + if (ssl) { + /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */ + SSL_set_connect_state(ssl); + cert = SSL_get_certificate(ssl); ++ SSL_free(ssl); ++ } + } +- if (!ssl || !cert) { + #endif ++ if (!cert) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566) + "Unable to retrieve certificate %s", key_id); +-#ifndef HAVE_SSL_CONF_CMD +- if (ssl) +- SSL_free(ssl); +-#endif + return APR_EGENERAL; + } + +@@ -1525,10 +1518,6 @@ + } + #endif + +-#ifndef HAVE_SSL_CONF_CMD +- SSL_free(ssl); +-#endif +- + ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568) + "Certificate and private key %s configured from %s and %s", + key_id, certfile, keyfile); +@@ -1538,15 +1527,33 @@ + * Try to read DH parameters from the (first) SSLCertificateFile + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); +- if (certfile && !modssl_is_engine_id(certfile) +- && (dh = ssl_dh_GetParamFromFile(certfile))) { +- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() +- * for OpenSSL 3.0+. */ ++ if (certfile && !modssl_is_engine_id(certfile)) { ++ int done = 0, num_bits = 0; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ DH *dh = modssl_dh_from_file(certfile); ++ if (dh) { ++ num_bits = DH_bits(dh); + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); ++ DH_free(dh); ++ done = 1; ++ } ++#else ++ pkey = modssl_dh_pkey_from_file(certfile); ++ if (pkey) { ++ num_bits = EVP_PKEY_get_bits(pkey); ++ if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) { ++ EVP_PKEY_free(pkey); ++ } ++ else { ++ done = 1; ++ } ++ } ++#endif ++ if (done) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", +- modssl_DH_bits(dh), vhost_id, certfile); +- DH_free(dh); ++ num_bits, vhost_id, certfile); ++ } + } + #if !MODSSL_USE_OPENSSL_PRE_1_1_API + else { +@@ -1561,13 +1568,27 @@ + * Similarly, try to read the ECDH curve name from SSLCertificateFile... + */ + if (certfile && !modssl_is_engine_id(certfile) +- && (ecparams = ssl_ec_GetParamFromFile(certfile)) +- && (nid = EC_GROUP_get_curve_name(ecparams)) +- && (eckey = EC_KEY_new_by_curve_name(nid))) { ++ && (ecgroup = modssl_ec_group_from_file(certfile)) ++ && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) { ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++ EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid); ++ if (eckey) { + SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ++ EC_KEY_free(eckey); ++ } ++ else { ++ curve_nid = 0; ++ } ++#else ++ if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) { ++ curve_nid = 0; ++ } ++#endif ++ if (curve_nid) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) + "ECDH curve %s for %s specified in %s", +- OBJ_nid2sn(nid), vhost_id, certfile); ++ OBJ_nid2sn(curve_nid), vhost_id, certfile); ++ } + } + /* + * ...otherwise, enable auto curve selection (OpenSSL 1.0.2) +@@ -1575,18 +1596,20 @@ + * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList + */ + #if MODSSL_USE_OPENSSL_PRE_1_1_API +- else { ++ if (!curve_nid) { + #if defined(SSL_CTX_set_ecdh_auto) + SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1); + #else +- eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ if (eckey) { + SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ++ EC_KEY_free(eckey); ++ } + #endif + } + #endif + /* OpenSSL assures us that _free() is NULL-safe */ +- EC_KEY_free(eckey); +- EC_GROUP_free(ecparams); ++ EC_GROUP_free(ecgroup); + #endif + + return APR_SUCCESS; +--- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_io.c +@@ -28,8 +28,7 @@ + core keeps dumping.'' + -- Unknown */ + #include "ssl_private.h" +-#include "mod_ssl.h" +-#include "mod_ssl_openssl.h" ++ + #include "apr_date.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake, +@@ -2283,14 +2282,7 @@ + ssl_io_filter_cleanup, apr_pool_cleanup_null); + + if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) { +- BIO *rbio = SSL_get_rbio(ssl), +- *wbio = SSL_get_wbio(ssl); +- BIO_set_callback(rbio, ssl_io_data_cb); +- BIO_set_callback_arg(rbio, (void *)ssl); +- if (wbio && wbio != rbio) { +- BIO_set_callback(wbio, ssl_io_data_cb); +- BIO_set_callback_arg(wbio, (void *)ssl); +- } ++ modssl_set_io_callbacks(ssl); + } + + return; +@@ -2374,13 +2366,22 @@ + "+-------------------------------------------------------------------------+"); + } + +-long ssl_io_data_cb(BIO *bio, int cmd, +- const char *argp, ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static long modssl_io_cb(BIO *bio, int cmd, const char *argp, ++ size_t len, int argi, long argl, int rc, ++ size_t *processed) ++#else ++static long modssl_io_cb(BIO *bio, int cmd, const char *argp, + int argi, long argl, long rc) ++#endif + { + SSL *ssl; + conn_rec *c; + server_rec *s; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ (void)len; ++ (void)processed; ++#endif + + if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL) + return rc; +@@ -2402,7 +2403,7 @@ + "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s", + MODSSL_LIBRARY_NAME, + (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"), +- rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), ++ (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), + bio, argp, dump); + if (*dump != '\0' && argp != NULL) + ssl_io_data_dump(c, s, argp, rc); +@@ -2417,3 +2418,25 @@ + } + return rc; + } ++ ++static APR_INLINE void set_bio_callback(BIO *bio, void *arg) ++{ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ BIO_set_callback_ex(bio, modssl_io_cb); ++#else ++ BIO_set_callback(bio, modssl_io_cb); ++#endif ++ BIO_set_callback_arg(bio, arg); ++} ++ ++void modssl_set_io_callbacks(SSL *ssl) ++{ ++ BIO *rbio = SSL_get_rbio(ssl), ++ *wbio = SSL_get_wbio(ssl); ++ if (rbio) { ++ set_bio_callback(rbio, ssl); ++ } ++ if (wbio && wbio != rbio) { ++ set_bio_callback(wbio, ssl); ++ } ++} +--- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c +@@ -2581,6 +2581,7 @@ + sc->server->pks->service_unavailable : 0; + + ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s); ++ + /* + * There is one special filter callback, which is set + * very early depending on the base_server's log level. +@@ -2589,14 +2590,7 @@ + * we need to set that callback here. + */ + if (APLOGtrace4(s)) { +- BIO *rbio = SSL_get_rbio(ssl), +- *wbio = SSL_get_wbio(ssl); +- BIO_set_callback(rbio, ssl_io_data_cb); +- BIO_set_callback_arg(rbio, (void *)ssl); +- if (wbio && wbio != rbio) { +- BIO_set_callback(wbio, ssl_io_data_cb); +- BIO_set_callback_arg(wbio, (void *)ssl); +- } ++ modssl_set_io_callbacks(ssl); + } + + return 1; +--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c +@@ -30,6 +30,8 @@ + -- Clifford Stoll */ + #include "ssl_private.h" + ++#include ++ + typedef struct { + server_rec *s; + apr_pool_t *p; +@@ -606,8 +608,7 @@ + return (len); + } + +- +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + + /* OpenSSL UI implementation for passphrase entry; largely duplicated + * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be +@@ -831,7 +832,7 @@ + const char *certid, const char *keyid, + X509 **pubkey, EVP_PKEY **privkey) + { +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + const char *c, *scheme; + ENGINE *e; + UI_METHOD *ui_method = get_passphrase_ui(p); +--- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_private.h +@@ -83,16 +83,13 @@ + + #include "ap_expr.h" + +-/* OpenSSL headers */ +-#include +-#if (OPENSSL_VERSION_NUMBER >= 0x10001000) +-/* must be defined before including ssl.h */ +-#define OPENSSL_NO_SSL_INTERN +-#endif +-#if OPENSSL_VERSION_NUMBER >= 0x30000000 +-#include ++/* keep first for compat API */ ++#ifndef OPENSSL_API_COMPAT ++#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */ + #endif +-#include ++#include "mod_ssl_openssl.h" ++ ++/* OpenSSL headers */ + #include + #include + #include +@@ -102,12 +99,23 @@ + #include + #include + #include ++#include ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#include ++#endif + + /* Avoid tripping over an engine build installed globally and detected + * when the user points at an explicit non-engine flavor of OpenSSL + */ +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \ ++ && (OPENSSL_VERSION_NUMBER < 0x30000000 \ ++ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ ++ && !defined(OPENSSL_NO_ENGINE) + #include ++#define MODSSL_HAVE_ENGINE_API 1 ++#endif ++#ifndef MODSSL_HAVE_ENGINE_API ++#define MODSSL_HAVE_ENGINE_API 0 + #endif + + #if (OPENSSL_VERSION_NUMBER < 0x0090801f) +@@ -142,10 +150,18 @@ + * include most changes from OpenSSL >= 1.1 (new functions, macros, + * deprecations, ...), so we have to work around this... + */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) ++#if LIBRESSL_VERSION_NUMBER < 0x2070000f ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 ++#else ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 ++#endif + #else /* defined(LIBRESSL_VERSION_NUMBER) */ +-#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 ++#else ++#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 + #endif ++#endif /* defined(LIBRESSL_VERSION_NUMBER) */ + + #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L + #define HAVE_FIPS +@@ -211,7 +227,10 @@ + #endif + + /* Secure Remote Password */ +-#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) ++#if !defined(OPENSSL_NO_SRP) \ ++ && (OPENSSL_VERSION_NUMBER < 0x30000000L \ ++ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ ++ && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) + #define HAVE_SRP + #include + #endif +@@ -254,6 +273,14 @@ + #endif + #endif + ++/* those may be deprecated */ ++#ifndef X509_get_notBefore ++#define X509_get_notBefore X509_getm_notBefore ++#endif ++#ifndef X509_get_notAfter ++#define X509_get_notAfter X509_getm_notAfter ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) + #define HAVE_OPENSSL_KEYLOG + #endif +@@ -1019,7 +1046,7 @@ + /** I/O */ + void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); + void ssl_io_filter_register(apr_pool_t *); +-long ssl_io_data_cb(BIO *, int, const char *, int, long, long); ++void modssl_set_io_callbacks(SSL *ssl); + + /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request + * to allow an SSL renegotiation to take place. */ +@@ -1057,9 +1084,13 @@ + X509 **pubkey, EVP_PKEY **privkey); + + /** Diffie-Hellman Parameter Support */ +-DH *ssl_dh_GetParamFromFile(const char *); ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++DH *modssl_dh_from_file(const char *); ++#else ++EVP_PKEY *modssl_dh_pkey_from_file(const char *); ++#endif + #ifdef HAVE_ECC +-EC_GROUP *ssl_ec_GetParamFromFile(const char *); ++EC_GROUP *modssl_ec_group_from_file(const char *); + #endif + + /* Store the EVP_PKEY key (serialized into DER) in the hash table with +--- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util.c +@@ -476,7 +476,7 @@ + + int modssl_is_engine_id(const char *name) + { +-#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) ++#if MODSSL_HAVE_ENGINE_API + /* ### Can handle any other special ENGINE key names here? */ + return strncmp(name, "pkcs11:", 7) == 0; + #else +--- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c +@@ -464,29 +464,52 @@ + ** _________________________________________________________________ + */ + +-DH *ssl_dh_GetParamFromFile(const char *file) ++#if OPENSSL_VERSION_NUMBER < 0x30000000L ++DH *modssl_dh_from_file(const char *file) + { +- DH *dh = NULL; ++ DH *dh; + BIO *bio; + + if ((bio = BIO_new_file(file, "r")) == NULL) + return NULL; + dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); + BIO_free(bio); +- return (dh); ++ ++ return dh; ++} ++#else ++EVP_PKEY *modssl_dh_pkey_from_file(const char *file) ++{ ++ EVP_PKEY *pkey; ++ BIO *bio; ++ ++ if ((bio = BIO_new_file(file, "r")) == NULL) ++ return NULL; ++ pkey = PEM_read_bio_Parameters(bio, NULL); ++ BIO_free(bio); ++ ++ return pkey; + } ++#endif + + #ifdef HAVE_ECC +-EC_GROUP *ssl_ec_GetParamFromFile(const char *file) ++EC_GROUP *modssl_ec_group_from_file(const char *file) + { +- EC_GROUP *group = NULL; ++ EC_GROUP *group; + BIO *bio; + + if ((bio = BIO_new_file(file, "r")) == NULL) + return NULL; ++#if OPENSSL_VERSION_NUMBER < 0x30000000L + group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); ++#else ++ group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters, ++ PEM_STRING_ECPARAMETERS, bio, ++ NULL, NULL, NULL); ++#endif + BIO_free(bio); +- return (group); ++ ++ return group; + } + #endif + +--- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912 ++++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c +@@ -29,9 +29,9 @@ + -- Alexei Sayle */ + + #include "ssl_private.h" ++ + #include "ap_mpm.h" + #include "apr_thread_mutex.h" +-#include "mod_ssl_openssl.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, + (server_rec *s, apr_pool_t *p, +--- httpd-2.4.58/support/ab.c.r1913912 ++++ httpd-2.4.58/support/ab.c +@@ -166,13 +166,18 @@ + + #if defined(HAVE_OPENSSL) + +-#include ++#include + #include + #include + #include + #include + #include + #include ++#include ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif ++ + #define USE_SSL + + #define SK_NUM(x) sk_X509_num(x) +@@ -555,22 +560,33 @@ + * + */ + #ifdef USE_SSL +-static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret) ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static long ssl_print_cb(BIO *bio, int cmd, const char *argp, ++ size_t len, int argi, long argl, int ret, ++ size_t *processed) ++#else ++static long ssl_print_cb(BIO *bio, int cmd, const char *argp, ++ int argi, long argl, long ret) ++#endif + { + BIO *out; ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ (void)len; ++ (void)processed; ++#endif + + out=(BIO *)BIO_get_callback_arg(bio); + if (out == NULL) return(ret); + + if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) { + BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n", +- bio, argp, argi, ret, ret); ++ bio, argp, argi, (long)ret, (long)ret); + BIO_dump(out,(char *)argp,(int)ret); + return(ret); + } + else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) { + BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n", +- bio, argp, argi, ret, ret); ++ bio, argp, argi, (long)ret, (long)ret); + BIO_dump(out,(char *)argp,(int)ret); + } + return ret; +@@ -765,17 +781,29 @@ + break; + #ifndef OPENSSL_NO_EC + case EVP_PKEY_EC: { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ size_t len; ++ char cname[80]; ++ if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, ++ cname, sizeof(cname), &len)) { ++ cname[0] = '?'; ++ len = 1; ++ } ++ cname[len] = '\0'; ++#else + const char *cname = NULL; + EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); + int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); + EC_KEY_free(ec); + cname = EC_curve_nid2nist(nid); +- if (!cname) ++ if (!cname) { + cname = OBJ_nid2sn(nid); +- ++ if (!cname) ++ cname = "?"; ++ } ++#endif + apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits", +- cname, +- EVP_PKEY_bits(key)); ++ cname, EVP_PKEY_bits(key)); + break; + } + #endif +@@ -1428,7 +1456,11 @@ + SSL_set_bio(c->ssl, bio, bio); + SSL_set_connect_state(c->ssl); + if (verbosity >= 4) { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ BIO_set_callback_ex(bio, ssl_print_cb); ++#else + BIO_set_callback(bio, ssl_print_cb); ++#endif + BIO_set_callback_arg(bio, (void *)bio_err); + } + #ifdef HAVE_TLSEXT diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch new file mode 100644 index 0000000..e7390eb --- /dev/null +++ b/httpd-2.4.58-r1914365.patch @@ -0,0 +1,219 @@ +# ./pullrev.sh 1914365 +http://svn.apache.org/viewvc?view=revision&revision=1914365 + +--- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_engine_init.c +@@ -1421,8 +1421,10 @@ + if (cert) { + if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137) +- "Failed to configure engine certificate %s, check %s", +- key_id, certfile); ++ "Failed to configure certificate %s from %s, check %s", ++ key_id, mc->szCryptoDevice ? ++ mc->szCryptoDevice : "provider", ++ certfile); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return APR_EGENERAL; + } +@@ -1433,8 +1435,9 @@ + + if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) { + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130) +- "Failed to configure private key %s from engine", +- keyfile); ++ "Failed to configure private key %s from %s", ++ keyfile, mc->szCryptoDevice ? ++ mc->szCryptoDevice : "provider"); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); + return APR_EGENERAL; + } +--- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c +@@ -31,6 +31,9 @@ + #include "ssl_private.h" + + #include ++#if MODSSL_HAVE_OPENSSL_STORE ++#include ++#endif + + typedef struct { + server_rec *s; +@@ -608,7 +611,7 @@ + return (len); + } + +-#if MODSSL_HAVE_ENGINE_API ++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE + + /* OpenSSL UI implementation for passphrase entry; largely duplicated + * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be +@@ -826,13 +829,14 @@ + } + #endif + +- +-apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, ++#if MODSSL_HAVE_ENGINE_API ++static apr_status_t modssl_load_keypair_engine(server_rec *s, apr_pool_t *p, + const char *vhostid, +- const char *certid, const char *keyid, +- X509 **pubkey, EVP_PKEY **privkey) ++ const char *certid, ++ const char *keyid, ++ X509 **pubkey, ++ EVP_PKEY **privkey) + { +-#if MODSSL_HAVE_ENGINE_API + const char *c, *scheme; + ENGINE *e; + UI_METHOD *ui_method = get_passphrase_ui(p); +@@ -906,6 +910,118 @@ + ENGINE_free(e); + + return APR_SUCCESS; ++} ++#endif ++ ++#if MODSSL_HAVE_OPENSSL_STORE ++static OSSL_STORE_INFO *modssl_load_store_uri(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *uri, int info_type) ++{ ++ OSSL_STORE_CTX *sctx; ++ UI_METHOD *ui_method = get_passphrase_ui(p); ++ pphrase_cb_arg_t ppcb; ++ OSSL_STORE_INFO *info = NULL; ++ ++ memset(&ppcb, 0, sizeof ppcb); ++ ppcb.s = s; ++ ppcb.p = p; ++ ppcb.bPassPhraseDialogOnce = TRUE; ++ ppcb.key_id = vhostid; ++ ppcb.pkey_file = uri; ++ ++ sctx = OSSL_STORE_open(uri, ui_method, &ppcb, NULL, NULL); ++ if (!sctx) { ++ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(10491) ++ "Init: OSSL_STORE_open failed for PKCS#11 URI `%s'", ++ uri); ++ return NULL; ++ } ++ ++ while (!OSSL_STORE_eof(sctx)) { ++ info = OSSL_STORE_load(sctx); ++ if (!info) ++ break; ++ ++ if (OSSL_STORE_INFO_get_type(info) == info_type) ++ break; ++ ++ OSSL_STORE_INFO_free(info); ++ info = NULL; ++ } ++ ++ OSSL_STORE_close(sctx); ++ ++ return info; ++} ++ ++static apr_status_t modssl_load_keypair_store(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *certid, ++ const char *keyid, ++ X509 **pubkey, ++ EVP_PKEY **privkey) ++{ ++ OSSL_STORE_INFO *info = NULL; ++ ++ *privkey = NULL; ++ *pubkey = NULL; ++ ++ info = modssl_load_store_uri(s, p, vhostid, keyid, OSSL_STORE_INFO_PKEY); ++ if (!info) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10492) ++ "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ *privkey = OSSL_STORE_INFO_get1_PKEY(info); ++ OSSL_STORE_INFO_free(info); ++ if (!*privkey) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10493) ++ "Init: OSSL_STORE_INFO_PKEY lookup failed for private key identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ if (certid) { ++ info = modssl_load_store_uri(s, p, vhostid, certid, OSSL_STORE_INFO_CERT); ++ if (!info) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10494) ++ "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'", ++ keyid); ++ return ssl_die(s); ++ } ++ ++ *pubkey = OSSL_STORE_INFO_get1_CERT(info); ++ OSSL_STORE_INFO_free(info); ++ if (!*pubkey) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10495) ++ "Init: OSSL_STORE_INFO_CERT lookup failed for certificate identifier `%s'", ++ certid); ++ return ssl_die(s); ++ } ++ } ++ ++ return APR_SUCCESS; ++} ++#endif ++ ++apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p, ++ const char *vhostid, ++ const char *certid, const char *keyid, ++ X509 **pubkey, EVP_PKEY **privkey) ++{ ++#if MODSSL_HAVE_OPENSSL_STORE ++ SSLModConfigRec *mc = myModConfig(s); ++ ++ if (!mc->szCryptoDevice) ++ return modssl_load_keypair_store(s, p, vhostid, certid, keyid, ++ pubkey, privkey); ++#endif ++#if MODSSL_HAVE_ENGINE_API ++ return modssl_load_keypair_engine(s, p, vhostid, certid, keyid, ++ pubkey, privkey); + #else + return APR_ENOTIMPL; + #endif +--- httpd-2.4.58/modules/ssl/ssl_private.h.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_private.h +@@ -118,6 +118,15 @@ + #define MODSSL_HAVE_ENGINE_API 0 + #endif + ++/* Use OpenSSL 3.x STORE for loading URI keys and certificates starting with ++ * OpenSSL 3.0 ++ */ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000 ++#define MODSSL_HAVE_OPENSSL_STORE 1 ++#else ++#define MODSSL_HAVE_OPENSSL_STORE 0 ++#endif ++ + #if (OPENSSL_VERSION_NUMBER < 0x0090801f) + #error mod_ssl requires OpenSSL 0.9.8a or later + #endif +--- httpd-2.4.58/modules/ssl/ssl_util.c.r1914365 ++++ httpd-2.4.58/modules/ssl/ssl_util.c +@@ -476,7 +476,7 @@ + + int modssl_is_engine_id(const char *name) + { +-#if MODSSL_HAVE_ENGINE_API ++#if MODSSL_HAVE_ENGINE_API || MODSSL_HAVE_OPENSSL_STORE + /* ### Can handle any other special ENGINE key names here? */ + return strncmp(name, "pkcs11:", 7) == 0; + #else diff --git a/httpd.spec b/httpd.spec index f593ac4..8bd81c5 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 3%{?dist} +Release: 4%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -97,6 +97,8 @@ Patch42: httpd-2.4.48-r1828172+.patch Patch45: httpd-2.4.43-logjournal.patch Patch46: httpd-2.4.53-separate-systemd-fns.patch Patch47: httpd-2.4.58-r1912477+.patch +Patch48: httpd-2.4.58-r1913912+.patch +Patch49: httpd-2.4.58-r1914365.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 @@ -274,6 +276,8 @@ written in the Lua programming language. %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux %patch -P47 -p1 -b .r1912477+ +%patch -P48 -p1 -b .r1913912 +%patch -P49 -p1 -b .r1914365 %patch -P60 -p1 -b .enable-sslv3 %patch -P61 -p1 -b .r1914013 @@ -863,6 +867,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jan 5 2024 Joe Orton - 2.4.58-4 +- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) +- mod_ssl: move to provider API for pkcs11 support (#2253014) + * Fri Dec 8 2023 Joe Orton - 2.4.58-3 - mod_dav_fs: add DAVLockDBType, use global lock around lockdb - fix build with libxml2 2.12 diff --git a/pullrev.sh b/pullrev.sh index 703d376..7ace161 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,7 +6,7 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" ver=2.4.58 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" @@ -43,7 +43,9 @@ for r in $*; do http*) curl -s "$r" | filterdiff --strip=3 ;; *) svn diff -c ${r} ${repo} ;; esac | filterdiff --remove-timestamps --clean \ - -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' -x 'changes-entries/*' \ + -x 'CHANGES' -x 'changes-entries/*.txt' \ + -x '*/next-number' -x 'STATUS' -x '*.xml' \ + -x '.github/*' \ --addprefix="${prefix}/" > ${this} next=`mktemp /tmp/pullrevXXXXXX` if ! combinediff -w ${prev} ${this} > ${next}; then From fcc34b87be47c9a4d2931865ae235a7fe6743dbe Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 11:55:23 +0000 Subject: [PATCH 07/55] Fix suffix. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 8bd81c5..dc3b6e9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -276,7 +276,7 @@ written in the Lua programming language. %patch -P46 -p1 -b .separatesystemd %patch -P25 -p1 -b .selinux %patch -P47 -p1 -b .r1912477+ -%patch -P48 -p1 -b .r1913912 +%patch -P48 -p1 -b .r1913912+ %patch -P49 -p1 -b .r1914365 %patch -P60 -p1 -b .enable-sslv3 From ab864817dceb5ee4d715e71a70f8892ea6c53a17 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 16:21:21 +0000 Subject: [PATCH 08/55] - renumber patches to apply in numerical order - use %autosetup --- httpd.spec | 70 ++++++++++++++++-------------------------------------- 1 file changed, 21 insertions(+), 49 deletions(-) diff --git a/httpd.spec b/httpd.spec index dc3b6e9..2c71c87 100644 --- a/httpd.spec +++ b/httpd.spec @@ -81,31 +81,31 @@ Patch3: httpd-2.4.43-deplibs.patch # Needed for socket activation and mod_systemd patch Patch19: httpd-2.4.53-detect-systemd.patch # Features/functional changes -Patch21: httpd-2.4.48-r1842929+.patch -Patch22: httpd-2.4.43-mod_systemd.patch -Patch23: httpd-2.4.53-export.patch -Patch24: httpd-2.4.43-corelimit.patch -Patch25: httpd-2.4.54-selinux.patch -Patch26: httpd-2.4.54-gettid.patch -Patch27: httpd-2.4.54-icons.patch -Patch30: httpd-2.4.43-cachehardmax.patch -Patch34: httpd-2.4.43-socket-activation.patch -Patch38: httpd-2.4.43-sslciphdefault.patch -Patch39: httpd-2.4.43-sslprotdefault.patch -Patch41: httpd-2.4.43-r1861793+.patch -Patch42: httpd-2.4.48-r1828172+.patch -Patch45: httpd-2.4.43-logjournal.patch -Patch46: httpd-2.4.53-separate-systemd-fns.patch -Patch47: httpd-2.4.58-r1912477+.patch -Patch48: httpd-2.4.58-r1913912+.patch -Patch49: httpd-2.4.58-r1914365.patch +Patch20: httpd-2.4.48-r1842929+.patch +Patch21: httpd-2.4.43-mod_systemd.patch +Patch22: httpd-2.4.53-export.patch +Patch23: httpd-2.4.43-corelimit.patch +Patch24: httpd-2.4.54-gettid.patch +Patch25: httpd-2.4.54-icons.patch +Patch26: httpd-2.4.43-cachehardmax.patch +Patch27: httpd-2.4.43-socket-activation.patch +Patch28: httpd-2.4.43-sslciphdefault.patch +Patch29: httpd-2.4.43-sslprotdefault.patch +Patch30: httpd-2.4.43-r1861793+.patch +Patch31: httpd-2.4.48-r1828172+.patch +Patch32: httpd-2.4.43-logjournal.patch +Patch33: httpd-2.4.53-separate-systemd-fns.patch +Patch34: httpd-2.4.58-r1912477+.patch +Patch35: httpd-2.4.58-r1913912+.patch +Patch36: httpd-2.4.58-r1914365.patch +Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch Patch61: httpd-2.4.58-r1914013.patch -Patch63: httpd-2.4.46-htcacheclean-dont-break.patch -Patch65: httpd-2.4.51-r1894152.patch +Patch62: httpd-2.4.46-htcacheclean-dont-break.patch +Patch63: httpd-2.4.51-r1894152.patch # Security fixes # Patch200: ... @@ -254,35 +254,7 @@ written in the Lua programming language. %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%setup -q -%patch -P2 -p1 -b .apxs -%patch -P3 -p1 -b .deplibs - -%patch -P19 -p1 -b .detectsystemd - -%patch -P21 -p1 -b .r1842929+ -%patch -P22 -p1 -b .mod_systemd -%patch -P23 -p1 -b .export -%patch -P24 -p1 -b .corelimit -%patch -P26 -p1 -b .gettid -%patch -P27 -p1 -b .icons -%patch -P30 -p1 -b .cachehardmax -%patch -P34 -p1 -b .socketactivation -%patch -P38 -p1 -b .sslciphdefault -%patch -P39 -p1 -b .sslprotdefault -%patch -P41 -p1 -b .r1861793+ -%patch -P42 -p1 -b .r1828172+ -%patch -P45 -p1 -b .logjournal -%patch -P46 -p1 -b .separatesystemd -%patch -P25 -p1 -b .selinux -%patch -P47 -p1 -b .r1912477+ -%patch -P48 -p1 -b .r1913912+ -%patch -P49 -p1 -b .r1914365 - -%patch -P60 -p1 -b .enable-sslv3 -%patch -P61 -p1 -b .r1914013 -%patch -P63 -p1 -b .htcacheclean-dont-break -%patch -P65 -p1 -b .r1894152 +%autosetup -p1 -S gendiff # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h From df3d3d1151513090e3ba649f03bdaa6817d87c5e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Jan 2024 16:21:32 +0000 Subject: [PATCH 09/55] - remove some old workarounds --- httpd.spec | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/httpd.spec b/httpd.spec index 2c71c87..a34b641 100644 --- a/httpd.spec +++ b/httpd.spec @@ -318,16 +318,6 @@ autoheader && autoconf || exit 1 %set_build_flags -# Hard-code path to links to avoid unnecessary builddep -export LYNX_PATH=/usr/bin/links - -%ifarch aarch64 -# The configure check for epoll_create() is failing. httpd/apr only -# actually uses epoll_create1() so this test could be smarter. Work -# around it for now. -export ac_cv_func_epoll_create=yes -%endif - # Build the daemon ./configure \ --prefix=%{_sysconfdir}/httpd \ From 9e93ea3734c71f5ca0d57b5a1a2bea873d0408e5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 22:15:08 +0000 Subject: [PATCH 10/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index a34b641..396594c 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 4%{?dist} +Release: 5%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jan 5 2024 Joe Orton - 2.4.58-4 - fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067) - mod_ssl: move to provider API for pkcs11 support (#2253014) From 7fa757742fa45e9f48ffb6c6d7d53bd18dfdf521 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 21:49:39 +0000 Subject: [PATCH 11/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- httpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 396594c..3b40eed 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 5%{?dist} +Release: 6%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 2.4.58-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 756bc47b6f56edcff7e1408b0fac760177276a7e Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 11:55:21 +0000 Subject: [PATCH 12/55] Add upstream tracking notes for patches. --- httpd-2.4.43-apxs.patch | 3 +++ httpd-2.4.43-corelimit.patch | 3 +++ httpd-2.4.43-r1861793+.patch | 5 +++-- httpd-2.4.46-htcacheclean-dont-break.patch | 3 +++ httpd-2.4.48-r1828172+.patch | 2 ++ httpd-2.4.48-r1842929+.patch | 3 +++ httpd-2.4.51-r1894152.patch | 2 ++ httpd-2.4.54-gettid.patch | 3 +++ httpd-2.4.58-r1912477+.patch | 2 ++ httpd-2.4.58-r1913912+.patch | 2 ++ httpd-2.4.58-r1914013.patch | 2 ++ httpd-2.4.58-r1914365.patch | 2 ++ 12 files changed, 30 insertions(+), 2 deletions(-) diff --git a/httpd-2.4.43-apxs.patch b/httpd-2.4.43-apxs.patch index b1185b2..808d6a8 100644 --- a/httpd-2.4.43-apxs.patch +++ b/httpd-2.4.43-apxs.patch @@ -1,3 +1,6 @@ + +Upstream-Status: local customisation + diff --git a/support/apxs.in b/support/apxs.in index b2705fa..c331631 100644 --- a/support/apxs.in diff --git a/httpd-2.4.43-corelimit.patch b/httpd-2.4.43-corelimit.patch index dd4b874..8c9899c 100644 --- a/httpd-2.4.43-corelimit.patch +++ b/httpd-2.4.43-corelimit.patch @@ -1,3 +1,6 @@ + +Upstream-Status: local customisation + diff --git a/server/core.c b/server/core.c index 79b2a82..dc0f17a 100644 --- a/server/core.c diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch index 08e96cb..89d0328 100644 --- a/httpd-2.4.43-r1861793+.patch +++ b/httpd-2.4.43-r1861793+.patch @@ -1,5 +1,6 @@ -diff --git a/configure.in b/configure.in -index cb43246..0bb6b0d 100644 + +Upstream-Status: proposed for 2.4.59 + --- httpd-2.4.43/configure.in.r1861793+ +++ httpd-2.4.43/configure.in @@ -465,6 +465,28 @@ diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch index e52318a..919e9e3 100644 --- a/httpd-2.4.46-htcacheclean-dont-break.patch +++ b/httpd-2.4.46-htcacheclean-dont-break.patch @@ -1,3 +1,6 @@ + +Upstream-Status: r1915508, proposed for 2.4.59 + diff --git a/support/htcacheclean.c b/support/htcacheclean.c index 958ba6d..0a7fe3c 100644 --- a/support/htcacheclean.c diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.48-r1828172+.patch index 37f1855..5f3be4c 100644 --- a/httpd-2.4.48-r1828172+.patch +++ b/httpd-2.4.48-r1828172+.patch @@ -1,6 +1,8 @@ https://github.com/apache/httpd/pull/209 +Upstream-Status: in trunk, not proposed for 2.4.x + diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 index 0000000000..69df73ce68 diff --git a/httpd-2.4.48-r1842929+.patch b/httpd-2.4.48-r1842929+.patch index f83a21d..c1837e7 100644 --- a/httpd-2.4.48-r1842929+.patch +++ b/httpd-2.4.48-r1842929+.patch @@ -1,3 +1,6 @@ + +Upstream-Status: in trunk, not proposed for 2.4.x + diff --git a/Makefile.in b/Makefile.in index 6747aea..40c7076 100644 --- a/Makefile.in diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch index 95f5081..10c4b3f 100644 --- a/httpd-2.4.51-r1894152.patch +++ b/httpd-2.4.51-r1894152.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1894152 http://svn.apache.org/viewvc?view=revision&revision=1894152 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 +++ httpd-2.4.51/modules/filters/mod_deflate.c @@ -835,6 +835,7 @@ diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch index dfc447b..88c956d 100644 --- a/httpd-2.4.54-gettid.patch +++ b/httpd-2.4.54-gettid.patch @@ -1,3 +1,6 @@ + +Upstream-Status: everything but last hunk merged for 2.4.59 + From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 7 Jul 2020 09:48:01 +0100 diff --git a/httpd-2.4.58-r1912477+.patch b/httpd-2.4.58-r1912477+.patch index 6458df8..eb3deff 100644 --- a/httpd-2.4.58-r1912477+.patch +++ b/httpd-2.4.58-r1912477+.patch @@ -5,6 +5,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1912718 http://svn.apache.org/viewvc?view=revision&revision=1913654 http://svn.apache.org/viewvc?view=revision&revision=1914438 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.58/modules/dav/fs/config6.m4.r1912477+ +++ httpd-2.4.58/modules/dav/fs/config6.m4 @@ -20,4 +20,10 @@ diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch index c8ea8fa..f8fd4a4 100644 --- a/httpd-2.4.58-r1913912+.patch +++ b/httpd-2.4.58-r1913912+.patch @@ -3,6 +3,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1913912 http://svn.apache.org/viewvc?view=revision&revision=1915067 +Upstream-Status: merged for 2.4.59 + --- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 +++ httpd-2.4.58/modules/ssl/mod_ssl.c @@ -25,8 +25,7 @@ diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch index f9e0786..02dcac3 100644 --- a/httpd-2.4.58-r1914013.patch +++ b/httpd-2.4.58-r1914013.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1914013 http://svn.apache.org/viewvc?view=revision&revision=1914013 +Upstream-Status: merged for 2.4.59 + --- httpd-2.4.58/modules/filters/mod_xml2enc.c +++ httpd-2.4.58/modules/filters/mod_xml2enc.c @@ -209,7 +209,7 @@ diff --git a/httpd-2.4.58-r1914365.patch b/httpd-2.4.58-r1914365.patch index e7390eb..8512de3 100644 --- a/httpd-2.4.58-r1914365.patch +++ b/httpd-2.4.58-r1914365.patch @@ -1,6 +1,8 @@ # ./pullrev.sh 1914365 http://svn.apache.org/viewvc?view=revision&revision=1914365 +Upstream-Status: in trunk, not proposed for 2.4.x + --- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1914365 +++ httpd-2.4.58/modules/ssl/ssl_engine_init.c @@ -1421,8 +1421,10 @@ From dee54cd734ac9fb909a122b141005210c218dbfd Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 13:04:06 +0000 Subject: [PATCH 13/55] - Updated Systemd security settings (closes #3) (Rahul Sundaram) - updated httpd.service(5) man page (Joe Orton) --- httpd.service | 19 ++++++++++++++++++- httpd.service.xml | 24 +++++++++++++++++------- httpd.spec | 6 +++++- httpd@.service | 19 ++++++++++++++++++- 4 files changed, 58 insertions(+), 10 deletions(-) diff --git a/httpd.service b/httpd.service index c5b5e08..b75e28c 100644 --- a/httpd.service +++ b/httpd.service @@ -26,8 +26,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed -PrivateTmp=true +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target diff --git a/httpd.service.xml b/httpd.service.xml index 7dfdb97..3ddbc9e 100644 --- a/httpd.service.xml +++ b/httpd.service.xml @@ -231,7 +231,16 @@ Wants=network-online.target Process policies and restrictions - The httpd service uses the following options: + The httpd.service unit enables a + variety of sandboxing options. Many of these prevent the service + from changing the system configuration - such as + ProtectClock and + ProtectKernelModules. See + systemd.exec5 + and + systemd.service5 + for more information on these options. Particular notice should + be taken of the following: PrivateTmp is enabled by @@ -247,13 +256,14 @@ Wants=network-online.target the policy to continue, httpd will continue to run (and recover) if a single child is terminated because of excess memory consumption. - - See - systemd.exec5 - and - systemd.service5 - for more information. + ProtectHome is set to + read-only by default. CGI scripts run via + UserDir will not be able modify any + content in /home by + default. + + diff --git a/httpd.spec b/httpd.spec index 3b40eed..b2ea95b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 6%{?dist} +Release: 7%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,6 +829,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jan 15 2024 Rahul Sundaram - 2.4.58-7 +- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening +- updated httpd.service(5) (Joe Orton) + * Wed Jan 24 2024 Fedora Release Engineering - 2.4.58-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/httpd@.service b/httpd@.service index 84424fb..8b20b90 100644 --- a/httpd@.service +++ b/httpd@.service @@ -19,8 +19,25 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf # Send SIGWINCH for graceful stop KillSignal=SIGWINCH KillMode=mixed -PrivateTmp=true +DevicePolicy=closed +KeyringMode=private +LockPersonality=yes +MemoryDenyWriteExecute=yes OOMPolicy=continue +PrivateDevices=yes +PrivateTmp=true +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=read-only +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectSystem=yes +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native [Install] WantedBy=multi-user.target From 264f63b024fd9a66004460be7ea80195c27cc33f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 7 Mar 2024 17:02:24 +0000 Subject: [PATCH 14/55] - ignore source file changes in rpminspect's "upstream" module --- rpminspect.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 1b4f2fe..17e48d1 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,3 +4,18 @@ badfuncs: # and APR interfaces for IPv6 addresses. ignore: - /usr/lib*/httpd/modules/mod_proxy.so +upstream: + ignore: + - *.xml + - *.service + - *.socket + - *.conf + - *.sysconf + - *.tmpfiles + - README.* + - *.sysusers + - *.png + - httpd-ssl-* + - config.layout + - action*.sh + - apachectl.* From 5096106709c71826233d39ae724535d5795c6485 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 12:42:59 +0000 Subject: [PATCH 15/55] Add gating configuration. --- gating.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gating.yaml b/gating.yaml index e4c04e7..fb11fa9 100644 --- a/gating.yaml +++ b/gating.yaml @@ -14,3 +14,14 @@ decision_contexts: [bodhi_update_push_stable] subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} From 27131dea8da568264571886f93bc0f30ff455eb3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:23:51 +0000 Subject: [PATCH 16/55] Update tracking. --- httpd-2.4.51-r1894152.patch | 2 +- httpd-2.4.54-selinux.patch | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch index 10c4b3f..20e6784 100644 --- a/httpd-2.4.51-r1894152.patch +++ b/httpd-2.4.51-r1894152.patch @@ -1,7 +1,7 @@ # ./pullrev.sh 1894152 http://svn.apache.org/viewvc?view=revision&revision=1894152 -Upstream-Status: in trunk, not proposed for 2.4.x +Upstream-Status: merged for 2.4.59 --- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 +++ httpd-2.4.51/modules/filters/mod_deflate.c diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch index 4d66bd8..661b983 100644 --- a/httpd-2.4.54-selinux.patch +++ b/httpd-2.4.54-selinux.patch @@ -1,3 +1,6 @@ + +Upstream-Status: in trunk not in 2.4.x + diff --git a/configure.in b/configure.in index 74015ca..8c0ee10 100644 --- httpd-2.4.54/modules/arch/unix/config5.m4.selinux From 2ce898b07d9c7824441c032793f3dc1ed473088d Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:23:56 +0000 Subject: [PATCH 17/55] rebuild to fix changelog ordering --- httpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/httpd.spec b/httpd.spec index b2ea95b..1bd5e95 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.58 -Release: 7%{?dist} +Release: 8%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -829,7 +829,10 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Mon Jan 15 2024 Rahul Sundaram - 2.4.58-7 +* Thu Mar 28 2024 Joe Orton - 2.4.58-8 +- rebuild to fix changelog ordering + +* Mon Feb 15 2024 Rahul Sundaram - 2.4.58-7 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening - updated httpd.service(5) (Joe Orton) From 1c126ced89f57ab99219139a2ccdd2f6d657927b Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 28 Mar 2024 14:25:42 +0000 Subject: [PATCH 18/55] really fix changelog ordering. --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 1bd5e95..048057d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -832,7 +832,7 @@ exit $rv * Thu Mar 28 2024 Joe Orton - 2.4.58-8 - rebuild to fix changelog ordering -* Mon Feb 15 2024 Rahul Sundaram - 2.4.58-7 +* Thu Mar 7 2024 Rahul Sundaram - 2.4.58-7 - Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening - updated httpd.service(5) (Joe Orton) From 9ee4b1c3240908f7f663a0534198e600a4bc6cbc Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 5 Apr 2024 09:22:35 +0100 Subject: [PATCH 19/55] update to 2.4.59 --- .gitignore | 1 + httpd-2.4.43-r1861793+.patch | 272 ------ httpd-2.4.46-htcacheclean-dont-break.patch | 16 - httpd-2.4.51-r1894152.patch | 38 - httpd-2.4.54-gettid.patch | 94 -- httpd-2.4.58-r1913912+.patch | 849 ------------------ httpd-2.4.58-r1914013.patch | 16 - httpd-2.4.59-gettid.patch | 14 + ...172+.patch => httpd-2.4.59-unifycgid.patch | 292 +++--- httpd.spec | 16 +- sources | 4 +- 11 files changed, 168 insertions(+), 1444 deletions(-) delete mode 100644 httpd-2.4.43-r1861793+.patch delete mode 100644 httpd-2.4.46-htcacheclean-dont-break.patch delete mode 100644 httpd-2.4.51-r1894152.patch delete mode 100644 httpd-2.4.54-gettid.patch delete mode 100644 httpd-2.4.58-r1913912+.patch delete mode 100644 httpd-2.4.58-r1914013.patch create mode 100644 httpd-2.4.59-gettid.patch rename httpd-2.4.48-r1828172+.patch => httpd-2.4.59-unifycgid.patch (91%) diff --git a/.gitignore b/.gitignore index cc7babc..bdad39b 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ x86_64 /httpd-2.4.56.tar.bz2.asc /httpd-2.4.57.tar.bz2.asc /httpd-2.4.58.tar.bz2.asc +/httpd-2.4.59.tar.bz2.asc diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch deleted file mode 100644 index 89d0328..0000000 --- a/httpd-2.4.43-r1861793+.patch +++ /dev/null @@ -1,272 +0,0 @@ - -Upstream-Status: proposed for 2.4.59 - ---- httpd-2.4.43/configure.in.r1861793+ -+++ httpd-2.4.43/configure.in -@@ -465,6 +465,28 @@ - AC_SEARCH_LIBS(crypt, crypt) - CRYPT_LIBS="$LIBS" - APACHE_SUBST(CRYPT_LIBS) -+ -+if test "$ac_cv_search_crypt" != "no"; then -+ # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt -+ AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [ -+ AC_RUN_IFELSE([AC_LANG_PROGRAM([[ -+#include -+#include -+#include -+ -+#define PASSWD_0 "Hello world!" -+#define SALT_0 "\$6\$saltstring" -+#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \ -+ "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" -+]], [char *result = crypt(PASSWD_0, SALT_0); -+ if (!result) return 1; -+ if (strcmp(result, EXPECT_0)) return 2; -+])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])]) -+ if test "$ap_cv_crypt_sha2" = yes; then -+ AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes]) -+ fi -+fi -+ - LIBS="$saved_LIBS" - - dnl See Comment #Spoon ---- httpd-2.4.43/docs/man/htpasswd.1.r1861793+ -+++ httpd-2.4.43/docs/man/htpasswd.1 -@@ -27,16 +27,16 @@ - .SH "SYNOPSIS" - - .PP --\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR -+\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR -+\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR -+\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR - - .PP --\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR -+\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR - - - .SH "SUMMARY" -@@ -48,7 +48,7 @@ - Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&. - - .PP --\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&. -+\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&. - - .PP - This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&. -@@ -73,17 +73,26 @@ - \fB-m\fR - Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&. - .TP -+\fB-2\fR -+Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&. -+.TP -+\fB-5\fR -+Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&. -+.TP - \fB-B\fR - Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&. - .TP - \fB-C\fR - This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&. - .TP -+\fB-r\fR -+This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&. -+.TP - \fB-d\fR - Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&. - .TP - \fB-s\fR --Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&. -+Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&. - .TP - \fB-p\fR - Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&. -@@ -152,10 +161,13 @@ - When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&. - - .PP --The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&. -+The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&. -+ -+.PP -+The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&. - - .PP --The SHA and \fBcrypt()\fR formats are insecure by today's standards\&. -+The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&. - - .SH "RESTRICTIONS" - ---- httpd-2.4.43/support/htpasswd.c.r1861793+ -+++ httpd-2.4.43/support/htpasswd.c -@@ -109,17 +109,21 @@ - "for it." NL - " -i Read password from stdin without verification (for script usage)." NL - " -m Force MD5 encryption of the password (default)." NL -- " -B Force bcrypt encryption of the password (very secure)." NL -+ " -2 Force SHA-256 crypt() hash of the password (very secure)." NL -+ " -5 Force SHA-512 crypt() hash of the password (very secure)." NL -+ " -B Force bcrypt encryption of the password (very secure)." NL - " -C Set the computing time used for the bcrypt algorithm" NL - " (higher is more secure but slower, default: %d, valid: 4 to 17)." NL -+ " -r Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL -+ " (higher is more secure but slower, default: 5000)." NL - " -d Force CRYPT encryption of the password (8 chars max, insecure)." NL -- " -s Force SHA encryption of the password (insecure)." NL -+ " -s Force SHA-1 encryption of the password (insecure)." NL - " -p Do not encrypt the password (plaintext, insecure)." NL - " -D Delete the specified user." NL - " -v Verify password for the specified user." NL - "On other systems than Windows and NetWare the '-p' flag will " - "probably not work." NL -- "The SHA algorithm does not use a salt and is less secure than the " -+ "The SHA-1 algorithm does not use a salt and is less secure than the " - "MD5 algorithm." NL, - BCRYPT_DEFAULT_COST - ); -@@ -178,7 +182,7 @@ - if (rv != APR_SUCCESS) - exit(ERR_SYNTAX); - -- while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) { -+ while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) { - switch (opt) { - case 'c': - *mask |= APHTP_NEWFILE; ---- httpd-2.4.43/support/passwd_common.c.r1861793+ -+++ httpd-2.4.43/support/passwd_common.c -@@ -179,16 +179,21 @@ - int mkhash(struct passwd_ctx *ctx) - { - char *pw; -- char salt[16]; -+ char salt[17]; - apr_status_t rv; - int ret = 0; - #if CRYPT_ALGO_SUPPORTED - char *cbuf; - #endif -+#ifdef HAVE_CRYPT_SHA2 -+ const char *setting; -+ char method; -+#endif - -- if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) { -+ if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT -+ && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) { - apr_file_printf(errfile, -- "Warning: Ignoring -C argument for this algorithm." NL); -+ "Warning: Ignoring -C/-r argument for this algorithm." NL); - } - - if (ctx->passwd == NULL) { -@@ -246,6 +251,34 @@ - break; - #endif /* CRYPT_ALGO_SUPPORTED */ - -+#ifdef HAVE_CRYPT_SHA2 -+ case ALG_CRYPT_SHA256: -+ case ALG_CRYPT_SHA512: -+ ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool); -+ if (ret != 0) -+ break; -+ -+ method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6'; -+ -+ if (ctx->cost) -+ setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s", -+ method, ctx->cost, salt); -+ else -+ setting = apr_psprintf(ctx->pool, "$%c$%s", -+ method, salt); -+ -+ cbuf = crypt(pw, setting); -+ if (cbuf == NULL) { -+ rv = APR_FROM_OS_ERROR(errno); -+ ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv); -+ ret = ERR_PWMISMATCH; -+ break; -+ } -+ -+ apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1); -+ break; -+#endif /* HAVE_CRYPT_SHA2 */ -+ - #if BCRYPT_ALGO_SUPPORTED - case ALG_BCRYPT: - rv = apr_generate_random_bytes((unsigned char*)salt, 16); -@@ -294,6 +327,19 @@ - case 's': - ctx->alg = ALG_APSHA; - break; -+#ifdef HAVE_CRYPT_SHA2 -+ case '2': -+ ctx->alg = ALG_CRYPT_SHA256; -+ break; -+ case '5': -+ ctx->alg = ALG_CRYPT_SHA512; -+ break; -+#else -+ case '2': -+ case '5': -+ ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform."; -+ return ERR_ALG_NOT_SUPP; -+#endif - case 'p': - ctx->alg = ALG_PLAIN; - #if !PLAIN_ALGO_SUPPORTED -@@ -324,11 +370,12 @@ - return ERR_ALG_NOT_SUPP; - #endif - break; -- case 'C': { -+ case 'C': -+ case 'r': { - char *endptr; - long num = strtol(opt_arg, &endptr, 10); - if (*endptr != '\0' || num <= 0) { -- ctx->errstr = "argument to -C must be a positive integer"; -+ ctx->errstr = "argument to -C/-r must be a positive integer"; - return ERR_SYNTAX; - } - ctx->cost = num; ---- httpd-2.4.43/support/passwd_common.h.r1861793+ -+++ httpd-2.4.43/support/passwd_common.h -@@ -28,6 +28,8 @@ - #include "apu_version.h" - #endif - -+#include "ap_config_auto.h" -+ - #define MAX_STRING_LEN 256 - - #define ALG_PLAIN 0 -@@ -35,6 +37,8 @@ - #define ALG_APMD5 2 - #define ALG_APSHA 3 - #define ALG_BCRYPT 4 -+#define ALG_CRYPT_SHA256 5 -+#define ALG_CRYPT_SHA512 6 - - #define BCRYPT_DEFAULT_COST 5 - -@@ -84,7 +88,7 @@ - apr_size_t out_len; - char *passwd; - int alg; -- int cost; -+ int cost; /* cost for bcrypt, rounds for SHA-2 */ - enum { - PW_PROMPT = 0, - PW_ARG, diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch deleted file mode 100644 index 919e9e3..0000000 --- a/httpd-2.4.46-htcacheclean-dont-break.patch +++ /dev/null @@ -1,16 +0,0 @@ - -Upstream-Status: r1915508, proposed for 2.4.59 - -diff --git a/support/htcacheclean.c b/support/htcacheclean.c -index 958ba6d..0a7fe3c 100644 ---- a/support/htcacheclean.c -+++ b/support/htcacheclean.c -@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round) - } - } - } -- -- break; - } - } - } diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch deleted file mode 100644 index 20e6784..0000000 --- a/httpd-2.4.51-r1894152.patch +++ /dev/null @@ -1,38 +0,0 @@ -# ./pullrev.sh 1894152 -http://svn.apache.org/viewvc?view=revision&revision=1894152 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152 -+++ httpd-2.4.51/modules/filters/mod_deflate.c -@@ -835,6 +835,7 @@ - while (!APR_BRIGADE_EMPTY(bb)) - { - apr_bucket *b; -+ apr_status_t rv; - - /* - * Optimization: If we are a HEAD request and bytes_sent is not zero -@@ -914,8 +915,6 @@ - } - - if (APR_BUCKET_IS_FLUSH(e)) { -- apr_status_t rv; -- - /* flush the remaining data from the zlib buffers */ - zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate, - Z_SYNC_FLUSH, NO_UPDATE_CRC); -@@ -947,7 +946,12 @@ - } - - /* read */ -- apr_bucket_read(e, &data, &len, APR_BLOCK_READ); -+ rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ); -+ if (rv) { -+ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298) -+ "failed reading from %s bucket", e->type->name); -+ return rv; -+ } - if (!len) { - apr_bucket_delete(e); - continue; diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch deleted file mode 100644 index 88c956d..0000000 --- a/httpd-2.4.54-gettid.patch +++ /dev/null @@ -1,94 +0,0 @@ - -Upstream-Status: everything but last hunk merged for 2.4.59 - -From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001 -From: Joe Orton -Date: Tue, 7 Jul 2020 09:48:01 +0100 -Subject: [PATCH] Check and use gettid() directly with glibc 2.30+. - -* configure.in: Check for gettid() and define HAVE_SYS_GETTID if - gettid() is only usable via syscall(). - -* server/log.c (log_tid): Use gettid() directly if available. ---- - configure.in | 14 +++++++++----- - server/log.c | 8 ++++++-- - 2 files changed, 15 insertions(+), 7 deletions(-) - -diff --git a/configure.in b/configure.in -index 423d58d4b9a..60cbf7b7f81 100644 ---- httpd-2.4.54/configure.in.gettid -+++ httpd-2.4.54/configure.in -@@ -502,22 +502,26 @@ - timegm \ - getpgid \ - fopen64 \ --getloadavg -+getloadavg \ -+gettid - ) - - dnl confirm that a void pointer is large enough to store a long integer - APACHE_CHECK_VOID_PTR_LEN - --AC_CACHE_CHECK([for gettid()], ac_cv_gettid, -+if test $ac_cv_func_gettid = no; then -+ # On Linux before glibc 2.30, gettid() is only usable via syscall() -+ AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid, - [AC_TRY_RUN(#define _GNU_SOURCE - #include - #include - #include - int main(int argc, char **argv) { - pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; }, --[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])]) --if test "$ac_cv_gettid" = "yes"; then -- AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()]) -+ [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])]) -+ if test "$ap_cv_gettid" = "yes"; then -+ AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()]) -+ fi - fi - - dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs ---- httpd-2.4.54/server/log.c.gettid -+++ httpd-2.4.54/server/log.c -@@ -55,7 +55,7 @@ - #include "ap_mpm.h" - #include "ap_listen.h" - --#if HAVE_GETTID -+#if HAVE_SYS_GETTID - #include - #include - #endif -@@ -627,14 +627,18 @@ - #if APR_HAS_THREADS - int result; - #endif --#if HAVE_GETTID -+#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID) - if (arg && *arg == 'g') { -+#ifdef HAVE_GETTID -+ pid_t tid = gettid(); -+#else - pid_t tid = syscall(SYS_gettid); -+#endif - if (tid == -1) - return 0; - return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid); - } --#endif -+#endif /* HAVE_GETTID || HAVE_SYS_GETTID */ - #if APR_HAS_THREADS - if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS - && result != AP_MPMQ_NOT_SUPPORTED) -@@ -968,7 +972,7 @@ - #if APR_HAS_THREADS - field_start = len; - len += cpystrn(buf + len, ":tid ", buflen - len); -- item_len = log_tid(info, NULL, buf + len, buflen - len); -+ item_len = log_tid(info, "g", buf + len, buflen - len); - if (!item_len) - len = field_start; - else diff --git a/httpd-2.4.58-r1913912+.patch b/httpd-2.4.58-r1913912+.patch deleted file mode 100644 index f8fd4a4..0000000 --- a/httpd-2.4.58-r1913912+.patch +++ /dev/null @@ -1,849 +0,0 @@ -# ./pullrev.sh 1913912 1915067 - -http://svn.apache.org/viewvc?view=revision&revision=1913912 -http://svn.apache.org/viewvc?view=revision&revision=1915067 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.58/modules/ssl/mod_ssl.c.r1913912 -+++ httpd-2.4.58/modules/ssl/mod_ssl.c -@@ -25,8 +25,7 @@ - */ - - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "util_md5.h" - #include "util_mutex.h" - #include "ap_provider.h" -@@ -75,11 +74,9 @@ - SSL_CMD_SRV(SessionCache, TAKE1, - "SSL Session Cache storage " - "('none', 'nonenotnull', 'dbm:/path/to/file')") --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - SSL_CMD_SRV(CryptoDevice, TAKE1, - "SSL external Crypto Device usage " - "('builtin', '...')") --#endif - SSL_CMD_SRV(RandomSeed, TAKE23, - "SSL Pseudo Random Number Generator (PRNG) seeding source " - "('startup|connect builtin|file:/path|exec:/path [bytes]')") ---- httpd-2.4.58/modules/ssl/mod_ssl_openssl.h.r1913912 -+++ httpd-2.4.58/modules/ssl/mod_ssl_openssl.h -@@ -30,14 +30,17 @@ - - /* OpenSSL headers */ - --#ifndef SSL_PRIVATE_H - #include --#if (OPENSSL_VERSION_NUMBER >= 0x10001000) -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include /* for OPENSSL_API_LEVEL */ -+#endif -+#if OPENSSL_VERSION_NUMBER >= 0x10001000 - /* must be defined before including ssl.h */ - #define OPENSSL_NO_SSL_INTERN - #endif - #include --#endif -+#include -+#include - - /** - * init_server hook -- allow SSL_CTX-specific initialization to be performed by ---- httpd-2.4.58/modules/ssl/ssl_engine_config.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_config.c -@@ -27,6 +27,7 @@ - damned if you don't.'' - -- Unknown */ - #include "ssl_private.h" -+ - #include "util_mutex.h" - #include "ap_provider.h" - -@@ -593,14 +594,15 @@ - return NULL; - } - --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd, - void *dcfg, - const char *arg) - { - SSLModConfigRec *mc = myModConfig(cmd->server); - const char *err; -+#if MODSSL_HAVE_ENGINE_API - ENGINE *e; -+#endif - - if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { - return err; -@@ -609,13 +611,16 @@ - if (strcEQ(arg, "builtin")) { - mc->szCryptoDevice = NULL; - } -+#if MODSSL_HAVE_ENGINE_API - else if ((e = ENGINE_by_id(arg))) { - mc->szCryptoDevice = arg; - ENGINE_free(e); - } -+#endif - else { - err = "SSLCryptoDevice: Invalid argument; must be one of: " - "'builtin' (none)"; -+#if MODSSL_HAVE_ENGINE_API - e = ENGINE_get_first(); - while (e) { - err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e), -@@ -624,12 +629,12 @@ - * on the 'old' e, per the docs in engine.h. */ - e = ENGINE_get_next(e); - } -+#endif - return err; - } - - return NULL; - } --#endif - - const char *ssl_cmd_SSLRandomSeed(cmd_parms *cmd, - void *dcfg, ---- httpd-2.4.58/modules/ssl/ssl_engine_init.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_init.c -@@ -27,8 +27,7 @@ - see Recursive.'' - -- Unknown */ - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "mpm_common.h" - #include "mod_md.h" - -@@ -218,6 +217,16 @@ - } - #endif - -+static APR_INLINE unsigned long modssl_runtime_lib_version(void) -+{ -+#if MODSSL_USE_OPENSSL_PRE_1_1_API -+ return SSLeay(); -+#else -+ return OpenSSL_version_num(); -+#endif -+} -+ -+ - /* - * Per-module initialization - */ -@@ -225,18 +234,22 @@ - apr_pool_t *ptemp, - server_rec *base_server) - { -+ unsigned long runtime_lib_version = modssl_runtime_lib_version(); - SSLModConfigRec *mc = myModConfig(base_server); - SSLSrvConfigRec *sc; - server_rec *s; - apr_status_t rv; - apr_array_header_t *pphrases; - -- if (SSLeay() < MODSSL_LIBRARY_VERSION) { -+ AP_DEBUG_ASSERT(mc); -+ -+ if (runtime_lib_version < MODSSL_LIBRARY_VERSION) { - ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01882) - "Init: this version of mod_ssl was compiled against " -- "a newer library (%s, version currently loaded is %s)" -+ "a newer library (%s (%s), version currently loaded is 0x%lX)" - " - may result in undefined or erroneous behavior", -- MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT); -+ MODSSL_LIBRARY_TEXT, MODSSL_LIBRARY_DYNTEXT, -+ runtime_lib_version); - } - - /* We initialize mc->pid per-process in the child init, -@@ -313,11 +326,9 @@ - /* - * SSL external crypto device ("engine") support - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - if ((rv = ssl_init_Engine(base_server, p)) != APR_SUCCESS) { - return rv; - } --#endif - - ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server, APLOGNO(01883) - "Init: Initialized %s library", MODSSL_LIBRARY_NAME); -@@ -473,9 +484,9 @@ - * Support for external a Crypto Device ("engine"), usually - * a hardware accelerator card for crypto operations. - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) - apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p) - { -+#if MODSSL_HAVE_ENGINE_API - SSLModConfigRec *mc = myModConfig(s); - ENGINE *e; - -@@ -507,10 +518,9 @@ - - ENGINE_free(e); - } -- -+#endif - return APR_SUCCESS; - } --#endif - - #ifdef HAVE_TLSEXT - static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s, -@@ -1320,15 +1330,6 @@ - return 0; - } - --static APR_INLINE int modssl_DH_bits(DH *dh) --{ --#if OPENSSL_VERSION_NUMBER < 0x30000000L -- return DH_bits(dh); --#else -- return BN_num_bits(DH_get0_p(dh)); --#endif --} -- - /* SSL_CTX_use_PrivateKey_file() can fail either because the private - * key was encrypted, or due to a mismatch between an already-loaded - * cert and the key - a common misconfiguration - from calling -@@ -1354,15 +1355,10 @@ - SSLModConfigRec *mc = myModConfig(s); - const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; - int i; -- X509 *cert; -- DH *dh; -+ EVP_PKEY *pkey; - #ifdef HAVE_ECC -- EC_GROUP *ecparams = NULL; -- int nid; -- EC_KEY *eckey = NULL; --#endif --#ifndef HAVE_SSL_CONF_CMD -- SSL *ssl; -+ EC_GROUP *ecgroup = NULL; -+ int curve_nid = 0; - #endif - - /* no OpenSSL default prompts for any of the SSL_CTX_use_* calls, please */ -@@ -1373,7 +1369,7 @@ - (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, - const char *)); - i++) { -- EVP_PKEY *pkey; -+ X509 *cert = NULL; - const char *engine_certfile = NULL; - - key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i); -@@ -1416,8 +1412,6 @@ - if (modssl_is_engine_id(keyfile)) { - apr_status_t rv; - -- cert = NULL; -- - if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id, - engine_certfile, keyfile, - &cert, &pkey))) { -@@ -1488,22 +1482,21 @@ - * assume that if SSL_CONF is available, it's OpenSSL 1.0.2 or later, - * and SSL_CTX_get0_certificate is implemented.) - */ -- if (!(cert = SSL_CTX_get0_certificate(mctx->ssl_ctx))) { -+ cert = SSL_CTX_get0_certificate(mctx->ssl_ctx); - #else -- ssl = SSL_new(mctx->ssl_ctx); -+ { -+ SSL *ssl = SSL_new(mctx->ssl_ctx); - if (ssl) { - /* Workaround bug in SSL_get_certificate in OpenSSL 0.9.8y */ - SSL_set_connect_state(ssl); - cert = SSL_get_certificate(ssl); -+ SSL_free(ssl); -+ } - } -- if (!ssl || !cert) { - #endif -+ if (!cert) { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02566) - "Unable to retrieve certificate %s", key_id); --#ifndef HAVE_SSL_CONF_CMD -- if (ssl) -- SSL_free(ssl); --#endif - return APR_EGENERAL; - } - -@@ -1525,10 +1518,6 @@ - } - #endif - --#ifndef HAVE_SSL_CONF_CMD -- SSL_free(ssl); --#endif -- - ap_log_error(APLOG_MARK, APLOG_INFO, 0, s, APLOGNO(02568) - "Certificate and private key %s configured from %s and %s", - key_id, certfile, keyfile); -@@ -1538,15 +1527,33 @@ - * Try to read DH parameters from the (first) SSLCertificateFile - */ - certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); -- if (certfile && !modssl_is_engine_id(certfile) -- && (dh = ssl_dh_GetParamFromFile(certfile))) { -- /* ### This should be replaced with SSL_CTX_set0_tmp_dh_pkey() -- * for OpenSSL 3.0+. */ -+ if (certfile && !modssl_is_engine_id(certfile)) { -+ int done = 0, num_bits = 0; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ DH *dh = modssl_dh_from_file(certfile); -+ if (dh) { -+ num_bits = DH_bits(dh); - SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); -+ DH_free(dh); -+ done = 1; -+ } -+#else -+ pkey = modssl_dh_pkey_from_file(certfile); -+ if (pkey) { -+ num_bits = EVP_PKEY_get_bits(pkey); -+ if (!SSL_CTX_set0_tmp_dh_pkey(mctx->ssl_ctx, pkey)) { -+ EVP_PKEY_free(pkey); -+ } -+ else { -+ done = 1; -+ } -+ } -+#endif -+ if (done) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) - "Custom DH parameters (%d bits) for %s loaded from %s", -- modssl_DH_bits(dh), vhost_id, certfile); -- DH_free(dh); -+ num_bits, vhost_id, certfile); -+ } - } - #if !MODSSL_USE_OPENSSL_PRE_1_1_API - else { -@@ -1561,13 +1568,27 @@ - * Similarly, try to read the ECDH curve name from SSLCertificateFile... - */ - if (certfile && !modssl_is_engine_id(certfile) -- && (ecparams = ssl_ec_GetParamFromFile(certfile)) -- && (nid = EC_GROUP_get_curve_name(ecparams)) -- && (eckey = EC_KEY_new_by_curve_name(nid))) { -+ && (ecgroup = modssl_ec_group_from_file(certfile)) -+ && (curve_nid = EC_GROUP_get_curve_name(ecgroup))) { -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+ EC_KEY *eckey = EC_KEY_new_by_curve_name(curve_nid); -+ if (eckey) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); -+ EC_KEY_free(eckey); -+ } -+ else { -+ curve_nid = 0; -+ } -+#else -+ if (!SSL_CTX_set1_curves(mctx->ssl_ctx, &curve_nid, 1)) { -+ curve_nid = 0; -+ } -+#endif -+ if (curve_nid) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) - "ECDH curve %s for %s specified in %s", -- OBJ_nid2sn(nid), vhost_id, certfile); -+ OBJ_nid2sn(curve_nid), vhost_id, certfile); -+ } - } - /* - * ...otherwise, enable auto curve selection (OpenSSL 1.0.2) -@@ -1575,18 +1596,20 @@ - * ECDH is always enabled in 1.1.0 unless excluded from SSLCipherList - */ - #if MODSSL_USE_OPENSSL_PRE_1_1_API -- else { -+ if (!curve_nid) { - #if defined(SSL_CTX_set_ecdh_auto) - SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1); - #else -- eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ EC_KEY *eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); -+ if (eckey) { - SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); -+ EC_KEY_free(eckey); -+ } - #endif - } - #endif - /* OpenSSL assures us that _free() is NULL-safe */ -- EC_KEY_free(eckey); -- EC_GROUP_free(ecparams); -+ EC_GROUP_free(ecgroup); - #endif - - return APR_SUCCESS; ---- httpd-2.4.58/modules/ssl/ssl_engine_io.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_io.c -@@ -28,8 +28,7 @@ - core keeps dumping.'' - -- Unknown */ - #include "ssl_private.h" --#include "mod_ssl.h" --#include "mod_ssl_openssl.h" -+ - #include "apr_date.h" - - APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, proxy_post_handshake, -@@ -2283,14 +2282,7 @@ - ssl_io_filter_cleanup, apr_pool_cleanup_null); - - if (APLOG_CS_IS_LEVEL(c, mySrvFromConn(c), APLOG_TRACE4)) { -- BIO *rbio = SSL_get_rbio(ssl), -- *wbio = SSL_get_wbio(ssl); -- BIO_set_callback(rbio, ssl_io_data_cb); -- BIO_set_callback_arg(rbio, (void *)ssl); -- if (wbio && wbio != rbio) { -- BIO_set_callback(wbio, ssl_io_data_cb); -- BIO_set_callback_arg(wbio, (void *)ssl); -- } -+ modssl_set_io_callbacks(ssl); - } - - return; -@@ -2374,13 +2366,22 @@ - "+-------------------------------------------------------------------------+"); - } - --long ssl_io_data_cb(BIO *bio, int cmd, -- const char *argp, -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+static long modssl_io_cb(BIO *bio, int cmd, const char *argp, -+ size_t len, int argi, long argl, int rc, -+ size_t *processed) -+#else -+static long modssl_io_cb(BIO *bio, int cmd, const char *argp, - int argi, long argl, long rc) -+#endif - { - SSL *ssl; - conn_rec *c; - server_rec *s; -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ (void)len; -+ (void)processed; -+#endif - - if ((ssl = (SSL *)BIO_get_callback_arg(bio)) == NULL) - return rc; -@@ -2402,7 +2403,7 @@ - "%s: %s %ld/%d bytes %s BIO#%pp [mem: %pp] %s", - MODSSL_LIBRARY_NAME, - (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "write" : "read"), -- rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), -+ (long)rc, argi, (cmd == (BIO_CB_WRITE|BIO_CB_RETURN) ? "to" : "from"), - bio, argp, dump); - if (*dump != '\0' && argp != NULL) - ssl_io_data_dump(c, s, argp, rc); -@@ -2417,3 +2418,25 @@ - } - return rc; - } -+ -+static APR_INLINE void set_bio_callback(BIO *bio, void *arg) -+{ -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ BIO_set_callback_ex(bio, modssl_io_cb); -+#else -+ BIO_set_callback(bio, modssl_io_cb); -+#endif -+ BIO_set_callback_arg(bio, arg); -+} -+ -+void modssl_set_io_callbacks(SSL *ssl) -+{ -+ BIO *rbio = SSL_get_rbio(ssl), -+ *wbio = SSL_get_wbio(ssl); -+ if (rbio) { -+ set_bio_callback(rbio, ssl); -+ } -+ if (wbio && wbio != rbio) { -+ set_bio_callback(wbio, ssl); -+ } -+} ---- httpd-2.4.58/modules/ssl/ssl_engine_kernel.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_kernel.c -@@ -2581,6 +2581,7 @@ - sc->server->pks->service_unavailable : 0; - - ap_update_child_status_from_server(c->sbh, SERVER_BUSY_READ, c, s); -+ - /* - * There is one special filter callback, which is set - * very early depending on the base_server's log level. -@@ -2589,14 +2590,7 @@ - * we need to set that callback here. - */ - if (APLOGtrace4(s)) { -- BIO *rbio = SSL_get_rbio(ssl), -- *wbio = SSL_get_wbio(ssl); -- BIO_set_callback(rbio, ssl_io_data_cb); -- BIO_set_callback_arg(rbio, (void *)ssl); -- if (wbio && wbio != rbio) { -- BIO_set_callback(wbio, ssl_io_data_cb); -- BIO_set_callback_arg(wbio, (void *)ssl); -- } -+ modssl_set_io_callbacks(ssl); - } - - return 1; ---- httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_engine_pphrase.c -@@ -30,6 +30,8 @@ - -- Clifford Stoll */ - #include "ssl_private.h" - -+#include -+ - typedef struct { - server_rec *s; - apr_pool_t *p; -@@ -606,8 +608,7 @@ - return (len); - } - -- --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - - /* OpenSSL UI implementation for passphrase entry; largely duplicated - * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be -@@ -831,7 +832,7 @@ - const char *certid, const char *keyid, - X509 **pubkey, EVP_PKEY **privkey) - { --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - const char *c, *scheme; - ENGINE *e; - UI_METHOD *ui_method = get_passphrase_ui(p); ---- httpd-2.4.58/modules/ssl/ssl_private.h.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_private.h -@@ -83,16 +83,13 @@ - - #include "ap_expr.h" - --/* OpenSSL headers */ --#include --#if (OPENSSL_VERSION_NUMBER >= 0x10001000) --/* must be defined before including ssl.h */ --#define OPENSSL_NO_SSL_INTERN --#endif --#if OPENSSL_VERSION_NUMBER >= 0x30000000 --#include -+/* keep first for compat API */ -+#ifndef OPENSSL_API_COMPAT -+#define OPENSSL_API_COMPAT 0x10101000 /* for ENGINE_ API */ - #endif --#include -+#include "mod_ssl_openssl.h" -+ -+/* OpenSSL headers */ - #include - #include - #include -@@ -102,12 +99,23 @@ - #include - #include - #include -+#include -+#if OPENSSL_VERSION_NUMBER >= 0x30000000 -+#include -+#endif - - /* Avoid tripping over an engine build installed globally and detected - * when the user points at an explicit non-engine flavor of OpenSSL - */ --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) \ -+ && (OPENSSL_VERSION_NUMBER < 0x30000000 \ -+ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ -+ && !defined(OPENSSL_NO_ENGINE) - #include -+#define MODSSL_HAVE_ENGINE_API 1 -+#endif -+#ifndef MODSSL_HAVE_ENGINE_API -+#define MODSSL_HAVE_ENGINE_API 0 - #endif - - #if (OPENSSL_VERSION_NUMBER < 0x0090801f) -@@ -142,10 +150,18 @@ - * include most changes from OpenSSL >= 1.1 (new functions, macros, - * deprecations, ...), so we have to work around this... - */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f) -+#if LIBRESSL_VERSION_NUMBER < 0x2070000f -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 -+#else -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 -+#endif - #else /* defined(LIBRESSL_VERSION_NUMBER) */ --#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) -+#if OPENSSL_VERSION_NUMBER < 0x10100000L -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 1 -+#else -+#define MODSSL_USE_OPENSSL_PRE_1_1_API 0 - #endif -+#endif /* defined(LIBRESSL_VERSION_NUMBER) */ - - #if defined(OPENSSL_FIPS) || OPENSSL_VERSION_NUMBER >= 0x30000000L - #define HAVE_FIPS -@@ -211,7 +227,10 @@ - #endif - - /* Secure Remote Password */ --#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) -+#if !defined(OPENSSL_NO_SRP) \ -+ && (OPENSSL_VERSION_NUMBER < 0x30000000L \ -+ || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)) \ -+ && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB) - #define HAVE_SRP - #include - #endif -@@ -254,6 +273,14 @@ - #endif - #endif - -+/* those may be deprecated */ -+#ifndef X509_get_notBefore -+#define X509_get_notBefore X509_getm_notBefore -+#endif -+#ifndef X509_get_notAfter -+#define X509_get_notAfter X509_getm_notAfter -+#endif -+ - #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) - #define HAVE_OPENSSL_KEYLOG - #endif -@@ -1019,7 +1046,7 @@ - /** I/O */ - void ssl_io_filter_init(conn_rec *, request_rec *r, SSL *); - void ssl_io_filter_register(apr_pool_t *); --long ssl_io_data_cb(BIO *, int, const char *, int, long, long); -+void modssl_set_io_callbacks(SSL *ssl); - - /* ssl_io_buffer_fill fills the setaside buffering of the HTTP request - * to allow an SSL renegotiation to take place. */ -@@ -1057,9 +1084,13 @@ - X509 **pubkey, EVP_PKEY **privkey); - - /** Diffie-Hellman Parameter Support */ --DH *ssl_dh_GetParamFromFile(const char *); -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+DH *modssl_dh_from_file(const char *); -+#else -+EVP_PKEY *modssl_dh_pkey_from_file(const char *); -+#endif - #ifdef HAVE_ECC --EC_GROUP *ssl_ec_GetParamFromFile(const char *); -+EC_GROUP *modssl_ec_group_from_file(const char *); - #endif - - /* Store the EVP_PKEY key (serialized into DER) in the hash table with ---- httpd-2.4.58/modules/ssl/ssl_util.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util.c -@@ -476,7 +476,7 @@ - - int modssl_is_engine_id(const char *name) - { --#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT) -+#if MODSSL_HAVE_ENGINE_API - /* ### Can handle any other special ENGINE key names here? */ - return strncmp(name, "pkcs11:", 7) == 0; - #else ---- httpd-2.4.58/modules/ssl/ssl_util_ssl.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util_ssl.c -@@ -464,29 +464,52 @@ - ** _________________________________________________________________ - */ - --DH *ssl_dh_GetParamFromFile(const char *file) -+#if OPENSSL_VERSION_NUMBER < 0x30000000L -+DH *modssl_dh_from_file(const char *file) - { -- DH *dh = NULL; -+ DH *dh; - BIO *bio; - - if ((bio = BIO_new_file(file, "r")) == NULL) - return NULL; - dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); - BIO_free(bio); -- return (dh); -+ -+ return dh; -+} -+#else -+EVP_PKEY *modssl_dh_pkey_from_file(const char *file) -+{ -+ EVP_PKEY *pkey; -+ BIO *bio; -+ -+ if ((bio = BIO_new_file(file, "r")) == NULL) -+ return NULL; -+ pkey = PEM_read_bio_Parameters(bio, NULL); -+ BIO_free(bio); -+ -+ return pkey; - } -+#endif - - #ifdef HAVE_ECC --EC_GROUP *ssl_ec_GetParamFromFile(const char *file) -+EC_GROUP *modssl_ec_group_from_file(const char *file) - { -- EC_GROUP *group = NULL; -+ EC_GROUP *group; - BIO *bio; - - if ((bio = BIO_new_file(file, "r")) == NULL) - return NULL; -+#if OPENSSL_VERSION_NUMBER < 0x30000000L - group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); -+#else -+ group = PEM_ASN1_read_bio((void *)d2i_ECPKParameters, -+ PEM_STRING_ECPARAMETERS, bio, -+ NULL, NULL, NULL); -+#endif - BIO_free(bio); -- return (group); -+ -+ return group; - } - #endif - ---- httpd-2.4.58/modules/ssl/ssl_util_stapling.c.r1913912 -+++ httpd-2.4.58/modules/ssl/ssl_util_stapling.c -@@ -29,9 +29,9 @@ - -- Alexei Sayle */ - - #include "ssl_private.h" -+ - #include "ap_mpm.h" - #include "apr_thread_mutex.h" --#include "mod_ssl_openssl.h" - - APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_stapling_status, - (server_rec *s, apr_pool_t *p, ---- httpd-2.4.58/support/ab.c.r1913912 -+++ httpd-2.4.58/support/ab.c -@@ -166,13 +166,18 @@ - - #if defined(HAVE_OPENSSL) - --#include -+#include - #include - #include - #include - #include - #include - #include -+#include -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#include -+#endif -+ - #define USE_SSL - - #define SK_NUM(x) sk_X509_num(x) -@@ -555,22 +560,33 @@ - * - */ - #ifdef USE_SSL --static long ssl_print_cb(BIO *bio,int cmd,const char *argp,int argi,long argl,long ret) -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+static long ssl_print_cb(BIO *bio, int cmd, const char *argp, -+ size_t len, int argi, long argl, int ret, -+ size_t *processed) -+#else -+static long ssl_print_cb(BIO *bio, int cmd, const char *argp, -+ int argi, long argl, long ret) -+#endif - { - BIO *out; -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ (void)len; -+ (void)processed; -+#endif - - out=(BIO *)BIO_get_callback_arg(bio); - if (out == NULL) return(ret); - - if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) { - BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n", -- bio, argp, argi, ret, ret); -+ bio, argp, argi, (long)ret, (long)ret); - BIO_dump(out,(char *)argp,(int)ret); - return(ret); - } - else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) { - BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n", -- bio, argp, argi, ret, ret); -+ bio, argp, argi, (long)ret, (long)ret); - BIO_dump(out,(char *)argp,(int)ret); - } - return ret; -@@ -765,17 +781,29 @@ - break; - #ifndef OPENSSL_NO_EC - case EVP_PKEY_EC: { -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ size_t len; -+ char cname[80]; -+ if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME, -+ cname, sizeof(cname), &len)) { -+ cname[0] = '?'; -+ len = 1; -+ } -+ cname[len] = '\0'; -+#else - const char *cname = NULL; - EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); - int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); - EC_KEY_free(ec); - cname = EC_curve_nid2nist(nid); -- if (!cname) -+ if (!cname) { - cname = OBJ_nid2sn(nid); -- -+ if (!cname) -+ cname = "?"; -+ } -+#endif - apr_snprintf(ssl_tmp_key, 128, "ECDH %s %d bits", -- cname, -- EVP_PKEY_bits(key)); -+ cname, EVP_PKEY_bits(key)); - break; - } - #endif -@@ -1428,7 +1456,11 @@ - SSL_set_bio(c->ssl, bio, bio); - SSL_set_connect_state(c->ssl); - if (verbosity >= 4) { -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ BIO_set_callback_ex(bio, ssl_print_cb); -+#else - BIO_set_callback(bio, ssl_print_cb); -+#endif - BIO_set_callback_arg(bio, (void *)bio_err); - } - #ifdef HAVE_TLSEXT diff --git a/httpd-2.4.58-r1914013.patch b/httpd-2.4.58-r1914013.patch deleted file mode 100644 index 02dcac3..0000000 --- a/httpd-2.4.58-r1914013.patch +++ /dev/null @@ -1,16 +0,0 @@ -# ./pullrev.sh 1914013 -http://svn.apache.org/viewvc?view=revision&revision=1914013 - -Upstream-Status: merged for 2.4.59 - ---- httpd-2.4.58/modules/filters/mod_xml2enc.c -+++ httpd-2.4.58/modules/filters/mod_xml2enc.c -@@ -209,7 +209,7 @@ - - /* to sniff, first we look for BOM */ - if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) { -- ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf, -+ ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf, - ctx->bytes); - if (HAVE_ENCODING(ctx->xml2enc)) { - ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432) diff --git a/httpd-2.4.59-gettid.patch b/httpd-2.4.59-gettid.patch new file mode 100644 index 0000000..4857e37 --- /dev/null +++ b/httpd-2.4.59-gettid.patch @@ -0,0 +1,14 @@ + +Upstream-Status: not pushed upstream + +--- httpd-2.4.54/server/log.c.gettid ++++ httpd-2.4.54/server/log.c +@@ -968,7 +972,7 @@ + #if APR_HAS_THREADS + field_start = len; + len += cpystrn(buf + len, ":tid ", buflen - len); +- item_len = log_tid(info, NULL, buf + len, buflen - len); ++ item_len = log_tid(info, "g", buf + len, buflen - len); + if (!item_len) + len = field_start; + else diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.59-unifycgid.patch similarity index 91% rename from httpd-2.4.48-r1828172+.patch rename to httpd-2.4.59-unifycgid.patch index 5f3be4c..54216e0 100644 --- a/httpd-2.4.48-r1828172+.patch +++ b/httpd-2.4.59-unifycgid.patch @@ -1,14 +1,41 @@ https://github.com/apache/httpd/pull/209 -Upstream-Status: in trunk, not proposed for 2.4.x - +diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml +index ddacd4af19..6d4379d165 100644 +--- a/.github/workflows/linux.yml ++++ b/.github/workflows/linux.yml +@@ -48,11 +48,11 @@ jobs: + - name: Shared MPMs, all-modules + config: --enable-mods-shared=reallyall --enable-mpms-shared=all + # ------------------------------------------------------------------------- +- - name: Event MPM, all-modules, mod_cgid only +- config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi ++ - name: Event MPM, all-modules, mod_cgid fdpassing ++ config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi --enable-cgid-fdpassing + # ------------------------------------------------------------------------- +- - name: Event MPM, all-modules, no CMSG_DATA +- config: --enable-mods-shared=reallyall --with-mpm=event ac_cv_have_decl_CMSG_DATA=no ++ - name: Event MPM, all-modules, mod_cgid w/o fdpassing ++ config: --enable-mods-shared=reallyall --with-mpm=event --disable-cgi + # ------------------------------------------------------------------------- + - name: Default, all-modules + install + config: --enable-mods-shared=reallyall +diff --git a/changes-entries/pr54221.txt b/changes-entries/pr54221.txt +new file mode 100644 +index 0000000000..62b75ea4dd +--- /dev/null ++++ b/changes-entries/pr54221.txt +@@ -0,0 +1,3 @@ ++ *) mod_cgid: Optional support for file descriptor passing, fixing ++ error log handling (configure --enable-cgid-fdpassing) on Unix ++ platforms. PR 54221. [Joe Orton] diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h new file mode 100644 -index 0000000000..69df73ce68 +index 0000000000..66f9418f21 --- /dev/null +++ b/modules/generators/cgi_common.h -@@ -0,0 +1,629 @@ +@@ -0,0 +1,639 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. @@ -37,6 +64,7 @@ index 0000000000..69df73ce68 + +#include "httpd.h" +#include "util_filter.h" ++#include "util_script.h" + +static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv; +static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps; @@ -439,9 +467,18 @@ index 0000000000..69df73ce68 + char sbuf[MAX_STRING_LEN]; + int ret; + -+ if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -+ APLOG_MODULE_INDEX))) -+ { ++ ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX); ++ ++ /* xCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ ++ if (ret != OK) { + /* In the case of a timeout reading script output, clear + * the brigade to avoid a second attempt to read the + * output. */ @@ -659,10 +696,18 @@ index bf295217e0..086355353b 100644 + APACHE_MODPATH_FINISH diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c -index 7e4b126c10..421124a0cb 100644 +index 1f7778617e..3799b06ce3 100644 --- a/modules/generators/mod_cgi.c +++ b/modules/generators/mod_cgi.c -@@ -61,9 +61,6 @@ +@@ -48,7 +48,6 @@ + #include "http_protocol.h" + #include "http_main.h" + #include "http_log.h" +-#include "util_script.h" + #include "ap_mpm.h" + #include "mod_core.h" + #include "mod_cgi.h" +@@ -61,9 +60,6 @@ module AP_MODULE_DECLARE_DATA cgi_module; @@ -672,14 +717,10 @@ index 7e4b126c10..421124a0cb 100644 static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command; /* Read and discard the data in the brigade produced by a CGI script */ -@@ -92,6 +89,15 @@ typedef struct { - apr_size_t bufbytes; - } cgi_server_conf; +@@ -96,6 +92,11 @@ typedef struct { + apr_interval_time_t timeout; + } cgi_dirconf; -+typedef struct { -+ apr_interval_time_t timeout; -+} cgi_dirconf; -+ +#if APR_FILES_AS_SOCKETS +#define WANT_CGI_BUCKET +#endif @@ -688,44 +729,7 @@ index 7e4b126c10..421124a0cb 100644 static void *create_cgi_config(apr_pool_t *p, server_rec *s) { cgi_server_conf *c = -@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv) - return overrides->logname ? overrides : base; - } - -+static void *create_cgi_dirconf(apr_pool_t *p, char *dummy) -+{ -+ cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf)); -+ return c; -+} -+ - static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg) - { - server_rec *s = cmd->server; -@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy, - return NULL; - } - -+static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg) -+{ -+ cgi_dirconf *dc = dummy; -+ -+ if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { -+ return "CGIScriptTimeout has wrong format"; -+ } -+ -+ return NULL; -+} -+ - static const command_rec cgi_cmds[] = - { - AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF, -@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF, - "the maximum length (in bytes) of the script debug log"), - AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF, - "the maximum size (in bytes) to record of a POST request"), -+AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF, -+ "The amount of time to wait between successful reads from " -+ "the CGI script, in seconds."), +@@ -185,64 +186,6 @@ AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_C {NULL} }; @@ -790,37 +794,7 @@ index 7e4b126c10..421124a0cb 100644 static int log_script(request_rec *r, cgi_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out, - apr_filepath_name_get(r->filename)); - } - else { -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; -+ - apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT); - - *script_in = procnew->out; - if (!*script_in) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_in, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_in, timeout); - - if (e_info->prog_type == RUN_AS_CGI) { - *script_out = procnew->in; - if (!*script_out) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_out, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_out, timeout); - - *script_err = procnew->err; - if (!*script_err) - return APR_EBADF; -- apr_file_pipe_timeout_set(*script_err, r->server->timeout); -+ apr_file_pipe_timeout_set(*script_err, timeout); - } - } - } -@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, +@@ -563,230 +506,23 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv, return APR_SUCCESS; } @@ -963,11 +937,14 @@ index 7e4b126c10..421124a0cb 100644 - apr_size_t *len, apr_read_type_e block) -{ - struct cgi_bucket_data *data = b->data; -- apr_interval_time_t timeout; +- apr_interval_time_t timeout = 0; - apr_status_t rv; - int gotdata = 0; +- cgi_dirconf *dc = ap_get_module_config(data->r->per_dir_config, &cgi_module); - -- timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout; +- if (block != APR_NONBLOCK_READ) { +- timeout = dc->timeout > 0 ? dc->timeout : data->r->server->timeout; +- } - - do { - const apr_pollfd_t *results; @@ -1048,10 +1025,10 @@ index 7e4b126c10..421124a0cb 100644 apr_status_t rv; cgi_exec_info_t e_info; - conn_rec *c; -+ cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); -+ apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; + cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module); + apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout; - if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { +@@ -794,8 +530,6 @@ static int cgi_handler(request_rec *r) return DECLINED; } @@ -1060,7 +1037,7 @@ index 7e4b126c10..421124a0cb 100644 is_included = !strcmp(r->protocol, "INCLUDED"); p = r->main ? r->main->pool : r->pool; -@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r) +@@ -864,83 +598,24 @@ static int cgi_handler(request_rec *r) return HTTP_INTERNAL_SERVER_ERROR; } @@ -1157,7 +1134,7 @@ index 7e4b126c10..421124a0cb 100644 /* Is this flush really needed? */ apr_file_flush(script_out); apr_file_close(script_out); -@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r) +@@ -948,10 +623,7 @@ static int cgi_handler(request_rec *r) AP_DEBUG_ASSERT(script_in != NULL); #if APR_FILES_AS_SOCKETS @@ -1169,7 +1146,7 @@ index 7e4b126c10..421124a0cb 100644 if (b == NULL) return HTTP_INTERNAL_SERVER_ERROR; #else -@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r) +@@ -961,120 +633,7 @@ static int cgi_handler(request_rec *r) b = apr_bucket_eos_create(c->bucket_alloc); APR_BRIGADE_INSERT_TAIL(bb, b); @@ -1179,9 +1156,18 @@ index 7e4b126c10..421124a0cb 100644 - char sbuf[MAX_STRING_LEN]; - int ret; - -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { +- ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX); +- +- /* xCGI has its own body framing mechanism which we don't +- * match against any provided Content-Length, so let the +- * core determine C-L vs T-E based on what's actually sent. +- */ +- if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) +- apr_table_unset(r->headers_out, "Content-Length"); +- apr_table_unset(r->headers_out, "Transfer-Encoding"); +- +- if (ret != OK) { - ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); - - /* @@ -1220,7 +1206,7 @@ index 7e4b126c10..421124a0cb 100644 - * stderr output, as normal. */ - discard_script_output(bb); - apr_brigade_destroy(bb); -- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - @@ -1271,7 +1257,7 @@ index 7e4b126c10..421124a0cb 100644 - * connection drops or we stopped sending output for some other - * reason */ - if (rv == APR_SUCCESS && !r->connection->aborted) { -- apr_file_pipe_timeout_set(script_err, r->server->timeout); +- apr_file_pipe_timeout_set(script_err, timeout); - log_script_err(r, script_err); - } - @@ -1282,7 +1268,7 @@ index 7e4b126c10..421124a0cb 100644 } /*============================================================================ -@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1188,107 +747,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f, return APR_SUCCESS; } @@ -1390,7 +1376,7 @@ index 7e4b126c10..421124a0cb 100644 /* This is the means by which unusual (non-unix) os's may find alternate * means to run a given command (e.g. shebang/registry parsing on Win32) */ -@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p) +@@ -1304,6 +765,7 @@ static void register_hooks(apr_pool_t *p) static const char * const aszPre[] = { "mod_include.c", NULL }; ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST); @@ -1398,18 +1384,19 @@ index 7e4b126c10..421124a0cb 100644 } AP_DECLARE_MODULE(cgi) = - { - STANDARD20_MODULE_STUFF, -- NULL, /* dir config creater */ -+ create_cgi_dirconf, /* dir config creater */ - NULL, /* dir merger --- default is to override */ - create_cgi_config, /* server config */ - merge_cgi_config, /* merge server config */ diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c -index 2258a683b7..dddfb25254 100644 +index 4bab59f932..1d55b8dc48 100644 --- a/modules/generators/mod_cgid.c +++ b/modules/generators/mod_cgid.c -@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; +@@ -57,7 +57,6 @@ + #include "http_protocol.h" + #include "http_main.h" + #include "http_log.h" +-#include "util_script.h" + #include "ap_mpm.h" + #include "mpm_common.h" + #include "mod_suexec.h" +@@ -80,11 +79,6 @@ module AP_MODULE_DECLARE_DATA cgid_module; static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew); static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server); @@ -1421,7 +1408,7 @@ index 2258a683b7..dddfb25254 100644 static apr_pool_t *pcgi = NULL; static pid_t daemon_pid; -@@ -220,6 +215,15 @@ typedef struct { +@@ -220,6 +214,15 @@ typedef struct { #endif } cgid_req_t; @@ -1437,7 +1424,7 @@ index 2258a683b7..dddfb25254 100644 /* This routine is called to create the argument list to be passed * to the CGI script. When suexec is enabled, the suexec path, user, and * group are the first three arguments to be passed; if not, all three -@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd) +@@ -342,15 +345,19 @@ static apr_status_t close_unix_socket(void *thefd) return close(fd); } @@ -1462,7 +1449,7 @@ index 2258a683b7..dddfb25254 100644 do { do { rc = read(fd, buf + bytes_read, buf_size - bytes_read); -@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) +@@ -365,9 +372,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size) } } while (bytes_read < buf_size); @@ -1523,7 +1510,7 @@ index 2258a683b7..dddfb25254 100644 /* deal with signals */ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) -@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) +@@ -384,7 +442,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size) return APR_SUCCESS; } @@ -1532,7 +1519,7 @@ index 2258a683b7..dddfb25254 100644 { va_list ap; int rc; -@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -399,9 +457,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } va_end(ap); @@ -1572,7 +1559,7 @@ index 2258a683b7..dddfb25254 100644 if (rc < 0) { return errno; } -@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) +@@ -410,7 +498,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...) } static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, @@ -1581,7 +1568,7 @@ index 2258a683b7..dddfb25254 100644 { int i; char **environ; -@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -421,7 +509,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, r->server = apr_pcalloc(r->pool, sizeof(server_rec)); /* read the request header */ @@ -1590,7 +1577,7 @@ index 2258a683b7..dddfb25254 100644 if (stat != APR_SUCCESS) { return stat; } -@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -431,6 +519,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } @@ -1605,7 +1592,7 @@ index 2258a683b7..dddfb25254 100644 /* handle module indexes and such */ rconf = (void **)ap_create_request_config(r->pool); -@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, +@@ -479,14 +575,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env, return APR_SUCCESS; } @@ -1623,7 +1610,7 @@ index 2258a683b7..dddfb25254 100644 if (ugid == NULL) { -@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -507,16 +604,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, req.args_len = r->args ? strlen(r->args) : 0; req.loglevel = r->server->log.level; @@ -1647,7 +1634,7 @@ index 2258a683b7..dddfb25254 100644 &req, sizeof(req), r->filename, req.filename_len, argv0, req.argv0_len, -@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, +@@ -531,7 +633,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env, for (i = 0; i < req.env_count; i++) { apr_size_t curlen = strlen(env[i]); @@ -1656,7 +1643,7 @@ index 2258a683b7..dddfb25254 100644 env[i], curlen)) != APR_SUCCESS) { return stat; } -@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig) +@@ -582,20 +684,34 @@ static void daemon_signal_handler(int sig) } } @@ -1699,7 +1686,7 @@ index 2258a683b7..dddfb25254 100644 } static int cgid_server(void *data) -@@ -670,7 +787,7 @@ static int cgid_server(void *data) +@@ -670,7 +786,7 @@ static int cgid_server(void *data) } while (!daemon_should_exit) { @@ -1708,7 +1695,7 @@ index 2258a683b7..dddfb25254 100644 char *argv0 = NULL; char **env = NULL; const char * const *argv; -@@ -710,7 +827,7 @@ static int cgid_server(void *data) +@@ -710,7 +826,7 @@ static int cgid_server(void *data) r = apr_pcalloc(ptrans, sizeof(request_rec)); procnew = apr_pcalloc(ptrans, sizeof(*procnew)); r->pool = ptrans; @@ -1717,7 +1704,7 @@ index 2258a683b7..dddfb25254 100644 if (stat != APR_SUCCESS) { ap_log_error(APLOG_MARK, APLOG_ERR, stat, main_server, APLOGNO(01248) -@@ -742,6 +859,16 @@ static int cgid_server(void *data) +@@ -742,6 +858,16 @@ static int cgid_server(void *data) continue; } @@ -1734,7 +1721,7 @@ index 2258a683b7..dddfb25254 100644 apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool); apr_os_file_put(&inout, &sd2, 0, r->pool); -@@ -801,7 +928,10 @@ static int cgid_server(void *data) +@@ -801,7 +927,10 @@ static int cgid_server(void *data) close(sd2); } else { @@ -1746,7 +1733,7 @@ index 2258a683b7..dddfb25254 100644 argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args); -@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, +@@ -946,16 +1075,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, if (ret != OK ) { return ret; } @@ -1763,7 +1750,7 @@ index 2258a683b7..dddfb25254 100644 } return ret; } -@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] = +@@ -1066,41 +1185,6 @@ static const command_rec cgid_cmds[] = {NULL} }; @@ -1805,7 +1792,7 @@ index 2258a683b7..dddfb25254 100644 static int log_script(request_rec *r, cgid_server_conf * conf, int ret, char *dbuf, const char *sbuf, apr_bucket_brigade *bb, apr_file_t *script_err) -@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1221,7 +1305,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, ++connect_tries; if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) { return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno, @@ -1814,7 +1801,7 @@ index 2258a683b7..dddfb25254 100644 } if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) { /* Save errno for later */ -@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1242,7 +1326,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r, } else { close(sd); @@ -1823,7 +1810,7 @@ index 2258a683b7..dddfb25254 100644 "unable to connect to cgi daemon after multiple tries"); } } -@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1258,13 +1342,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r, if (connect_errno == ENOENT && apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > DEFAULT_CONNECT_STARTUP_DELAY) { @@ -1842,7 +1829,7 @@ index 2258a683b7..dddfb25254 100644 "cgid daemon is gone; is Apache terminating?"); } } -@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, +@@ -1272,23 +1358,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r, return OK; } @@ -1866,7 +1853,7 @@ index 2258a683b7..dddfb25254 100644 /**************************************************************** * * Actual cgid handling... -@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * +@@ -1374,7 +1443,9 @@ static apr_status_t get_cgi_pid(request_rec *r, cgid_server_conf *conf, pid_t * return stat; } @@ -1877,7 +1864,7 @@ index 2258a683b7..dddfb25254 100644 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261) "daemon couldn't find CGI process for connection %lu", r->connection->id); -@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr) +@@ -1393,19 +1464,21 @@ static apr_status_t cleanup_script(void *vptr) static int cgid_handler(request_rec *r) { @@ -1903,7 +1890,7 @@ index 2258a683b7..dddfb25254 100644 if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) { return DECLINED; -@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r) +@@ -1414,7 +1487,7 @@ static int cgid_handler(request_rec *r) conf = ap_get_module_config(r->server->module_config, &cgid_module); dc = ap_get_module_config(r->per_dir_config, &cgid_module); @@ -1912,7 +1899,7 @@ index 2258a683b7..dddfb25254 100644 is_included = !strcmp(r->protocol, "INCLUDED"); if ((argv0 = strrchr(r->filename, '/')) != NULL) { -@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r) +@@ -1429,12 +1502,12 @@ static int cgid_handler(request_rec *r) argv0 = r->filename; if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) { @@ -1927,7 +1914,7 @@ index 2258a683b7..dddfb25254 100644 "attempt to include NPH CGI script"); } -@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r) +@@ -1443,12 +1516,12 @@ static int cgid_handler(request_rec *r) #error at mod_cgi.c for required code in this path. #else if (r->finfo.filetype == APR_NOFILE) { @@ -1942,7 +1929,7 @@ index 2258a683b7..dddfb25254 100644 "attempt to invoke directory as script"); } -@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r) +@@ -1456,7 +1529,7 @@ static int cgid_handler(request_rec *r) r->path_info && *r->path_info) { /* default to accept */ @@ -1951,7 +1938,7 @@ index 2258a683b7..dddfb25254 100644 "AcceptPathInfo off disallows user's path"); } /* -@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r) +@@ -1467,6 +1540,17 @@ static int cgid_handler(request_rec *r) } */ @@ -1969,7 +1956,7 @@ index 2258a683b7..dddfb25254 100644 /* * httpd core function used to add common environment variables like * DOCUMENT_ROOT. -@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r) +@@ -1479,24 +1563,28 @@ static int cgid_handler(request_rec *r) return retval; } @@ -2005,7 +1992,7 @@ index 2258a683b7..dddfb25254 100644 } /* We are putting the socket discriptor into an apr_file_t so that we can -@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r) +@@ -1506,95 +1594,25 @@ static int cgid_handler(request_rec *r) */ apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool); @@ -2114,7 +2101,7 @@ index 2258a683b7..dddfb25254 100644 } /* we're done writing, or maybe we didn't write at all; -@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r) +@@ -1603,134 +1621,22 @@ static int cgid_handler(request_rec *r) */ shutdown(sd, 1); @@ -2131,9 +2118,18 @@ index 2258a683b7..dddfb25254 100644 - b = apr_bucket_eos_create(c->bucket_alloc); - APR_BRIGADE_INSERT_TAIL(bb, b); - -- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, -- APLOG_MODULE_INDEX))) -- { +- ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX); +- +- /* xCGI has its own body framing mechanism which we don't +- * match against any provided Content-Length, so let the +- * core determine C-L vs T-E based on what's actually sent. +- */ +- if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) +- apr_table_unset(r->headers_out, "Content-Length"); +- apr_table_unset(r->headers_out, "Transfer-Encoding"); +- +- if (ret != OK) { - ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); - - /* @@ -2253,7 +2249,7 @@ index 2258a683b7..dddfb25254 100644 static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb, char *s) { -@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r) +@@ -1815,7 +1721,7 @@ static void add_ssi_vars(request_rec *r) } static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, @@ -2262,7 +2258,7 @@ index 2258a683b7..dddfb25254 100644 { char **env; int sd; -@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1836,7 +1742,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return retval; } @@ -2271,7 +2267,7 @@ index 2258a683b7..dddfb25254 100644 info = apr_palloc(r->pool, sizeof(struct cleanup_script_info)); info->conf = conf; -@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, +@@ -1881,91 +1787,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f, return APR_SUCCESS; } @@ -2363,7 +2359,7 @@ index 2258a683b7..dddfb25254 100644 static void register_hook(apr_pool_t *p) { static const char * const aszPre[] = { "mod_include.c", NULL }; -@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p) +@@ -1973,6 +1794,7 @@ static void register_hook(apr_pool_t *p) ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE); ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE); diff --git a/httpd.spec b/httpd.spec index 048057d..7bb8b5a 100644 --- a/httpd.spec +++ b/httpd.spec @@ -23,8 +23,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.58 -Release: 8%{?dist} +Version: 2.4.59 +Release: 1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -85,27 +85,22 @@ Patch20: httpd-2.4.48-r1842929+.patch Patch21: httpd-2.4.43-mod_systemd.patch Patch22: httpd-2.4.53-export.patch Patch23: httpd-2.4.43-corelimit.patch -Patch24: httpd-2.4.54-gettid.patch +Patch24: httpd-2.4.59-gettid.patch Patch25: httpd-2.4.54-icons.patch Patch26: httpd-2.4.43-cachehardmax.patch Patch27: httpd-2.4.43-socket-activation.patch Patch28: httpd-2.4.43-sslciphdefault.patch Patch29: httpd-2.4.43-sslprotdefault.patch -Patch30: httpd-2.4.43-r1861793+.patch -Patch31: httpd-2.4.48-r1828172+.patch +Patch31: httpd-2.4.59-unifycgid.patch Patch32: httpd-2.4.43-logjournal.patch Patch33: httpd-2.4.53-separate-systemd-fns.patch Patch34: httpd-2.4.58-r1912477+.patch -Patch35: httpd-2.4.58-r1913912+.patch Patch36: httpd-2.4.58-r1914365.patch Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch -Patch61: httpd-2.4.58-r1914013.patch -Patch62: httpd-2.4.46-htcacheclean-dont-break.patch -Patch63: httpd-2.4.51-r1894152.patch # Security fixes # Patch200: ... @@ -829,6 +824,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Apr 5 2024 Joe Orton - 2.4.59-1 +- update to 2.4.59 + * Thu Mar 28 2024 Joe Orton - 2.4.58-8 - rebuild to fix changelog ordering diff --git a/sources b/sources index 8ac3947..e8e92fb 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (httpd-2.4.58.tar.bz2) = d6e73bf413a507ec16b621ff635e178206207a9e9810ce3944b3dc98d39cde8f225307110167fc9da5822175796c8cb66f98be5b9f0d8b76dcd83a401d39b2c1 -SHA512 (httpd-2.4.58.tar.bz2.asc) = aa021b067fc84ae6a09d5ce321207622c6c08f22632ac7362318ca0505b84357d77d4ebc1f17fa2c3030ed9d9fd177e8fb989932caeef695e76936e010b63aa0 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192 +SHA512 (httpd-2.4.59.tar.bz2) = 209da0bbac5e2564d4590302515b35495be6402273ff4024aa93e85e44554c95e053201d606383936425a41e1b5b97e6b40055dcbb385eb691a5029a6f3158c2 +SHA512 (httpd-2.4.59.tar.bz2.asc) = 85237e204e57d930e2b7a85a21f8d593e81895f96350c3a345978538a536f3c0614ba89256905c0aa558880fc6fb10608b8dd7cbd026af326b1d83601c267f2d From 26cf4a8749501f156c4984ec9c4f6f17449ee09a Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 15 Apr 2024 09:03:50 +0100 Subject: [PATCH 20/55] mod_ssl: add DH param handling fix (r1916863) --- httpd-2.4.59-r1916863.patch | 54 +++++++++++++++++++++++++++++++++++++ httpd.spec | 6 ++++- pullrev.sh | 4 +-- 3 files changed, 61 insertions(+), 3 deletions(-) create mode 100644 httpd-2.4.59-r1916863.patch diff --git a/httpd-2.4.59-r1916863.patch b/httpd-2.4.59-r1916863.patch new file mode 100644 index 0000000..162662c --- /dev/null +++ b/httpd-2.4.59-r1916863.patch @@ -0,0 +1,54 @@ +# ./pullrev.sh 1916863 +http://svn.apache.org/viewvc?view=revision&revision=1916863 + +Upstream-Status: in trunk, not proposed for 2.4.x + +--- httpd-2.4.59/modules/ssl/ssl_engine_init.c ++++ httpd-2.4.59/modules/ssl/ssl_engine_init.c +@@ -1416,6 +1416,7 @@ + const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile; + int i; + EVP_PKEY *pkey; ++ int custom_dh_done = 0; + #ifdef HAVE_ECC + EC_GROUP *ecgroup = NULL; + int curve_nid = 0; +@@ -1591,14 +1592,14 @@ + */ + certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *); + if (certfile && !modssl_is_engine_id(certfile)) { +- int done = 0, num_bits = 0; ++ int num_bits = 0; + #if OPENSSL_VERSION_NUMBER < 0x30000000L + DH *dh = modssl_dh_from_file(certfile); + if (dh) { + num_bits = DH_bits(dh); + SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh); + DH_free(dh); +- done = 1; ++ custom_dh_done = 1; + } + #else + pkey = modssl_dh_pkey_from_file(certfile); +@@ -1608,18 +1609,18 @@ + EVP_PKEY_free(pkey); + } + else { +- done = 1; ++ custom_dh_done = 1; + } + } + #endif +- if (done) { ++ if (custom_dh_done) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) + "Custom DH parameters (%d bits) for %s loaded from %s", + num_bits, vhost_id, certfile); + } + } + #if !MODSSL_USE_OPENSSL_PRE_1_1_API +- else { ++ if (!custom_dh_done) { + /* If no parameter is manually configured, enable auto + * selection. */ + SSL_CTX_set_dh_auto(mctx->ssl_ctx, 1); diff --git a/httpd.spec b/httpd.spec index 7bb8b5a..864c8b7 100644 --- a/httpd.spec +++ b/httpd.spec @@ -24,7 +24,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.59 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -101,6 +101,7 @@ Patch37: httpd-2.4.54-selinux.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch60: httpd-2.4.43-enable-sslv3.patch +Patch61: httpd-2.4.59-r1916863.patch # Security fixes # Patch200: ... @@ -824,6 +825,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Apr 15 2024 Joe Orton - 2.4.59-2 +- mod_ssl: add DH param handling fix (r1916863) + * Fri Apr 5 2024 Joe Orton - 2.4.59-1 - update to 2.4.59 diff --git a/pullrev.sh b/pullrev.sh index 7ace161..f21a7fb 100755 --- a/pullrev.sh +++ b/pullrev.sh @@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then fi repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk" -repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" -ver=2.4.58 +#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x" +ver=2.4.59 prefix="httpd-${ver}" suffix="${SUFFIX:-r$1${2:++}}" fn="${prefix}-${suffix}.patch" From c83c1cdcee789c8f509204448b8b1f7c62295c49 Mon Sep 17 00:00:00 2001 From: Michal Srb Date: Wed, 17 Apr 2024 15:36:18 +0000 Subject: [PATCH 21/55] Fix rpminspect.yaml syntax Any entries in the upstream inspection block that contain wildcards for glob(7) specification need to be wrapped in single quotes. We are also changing the badfuncs block to allow the specific function in mod_proxy.so rather than ignoring the entire file. Thanks to David Cantrell who discovered this problem (in OSCI-6724) and proposed the fix. --- rpminspect.yaml | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 17e48d1..7696d42 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -2,20 +2,21 @@ badfuncs: # mod_proxy uses inet_ntoa (safely) for IPv4 address matching, # and APR interfaces for IPv6 addresses. - ignore: - - /usr/lib*/httpd/modules/mod_proxy.so + allowed: + /usr/lib*/httpd/modules/mod_proxy.so: + - inet_ntoa upstream: ignore: - - *.xml - - *.service - - *.socket - - *.conf - - *.sysconf - - *.tmpfiles - - README.* - - *.sysusers - - *.png - - httpd-ssl-* + - '*.xml' + - '*.service' + - '*.socket' + - '*.conf' + - '*.sysconf' + - '*.tmpfiles' + - 'README.*' + - '*.sysusers' + - '*.png' + - 'httpd-ssl-*' - config.layout - - action*.sh - - apachectl.* + - 'action*.sh' + - 'apachectl.*' From 53ecf37db77bbc8f033dfabe31590005d2c666f9 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 3 May 2024 08:59:53 +0100 Subject: [PATCH 22/55] apachectl(8): use BUG_REPORT_URL from /etc/os-release apachectl(8): fix grammar (#2278748) httpd.service.xml(8): mention ProtectSystem= setting --- apachectl.xml | 5 +++-- httpd.service.xml | 11 +++++++++-- httpd.spec | 13 +++++++++---- 3 files changed, 21 insertions(+), 8 deletions(-) diff --git a/apachectl.xml b/apachectl.xml index 34da42c..fb3a86d 100644 --- a/apachectl.xml +++ b/apachectl.xml @@ -5,6 +5,7 @@ ]>