mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146 )

Merge from f31
2019-11-22 17:18:56 +00:00 · 2019-11-22 17:18:49 +00:00 · 2019-11-22 17:17:59 +00:00 · 2019-11-22 17:16:27 +00:00 · 2019-10-03 09:33:26 +01:00 · 2019-10-03 09:33:26 +01:00
6 changed files with 652 additions and 403 deletions
--- a/httpd-2.4.4-r1337344+.patch
+++ b/httpd-2.4.4-r1337344+.patch
@ -1,250 +0,0 @@
-# ./pullrev.sh 1337344 1341905 1342065 1341930
-
-suexec enhancements:
-
-1) use syslog for logging
-2) use capabilities not setuid/setgid root binary
-
-http://svn.apache.org/viewvc?view=revision&revision=1337344
-http://svn.apache.org/viewvc?view=revision&revision=1341905
-http://svn.apache.org/viewvc?view=revision&revision=1342065
-http://svn.apache.org/viewvc?view=revision&revision=1341930
-
--- httpd-2.4.4/configure.in.r1337344+
-+++ httpd-2.4.4/configure.in
-@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
- 
- AC_ARG_WITH(suexec-logfile,
- APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
-  AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
-+  if test "x$withval" = "xyes"; then
-+    AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
-+  fi
-+])
-+
-+AC_ARG_WITH(suexec-syslog,
-+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
-+  if test $withval = "yes"; then
-+    if test "x${with_suexec_logfile}" != "xno"; then
-+      AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
-+      AC_MSG_ERROR([suexec does not support both logging to file and syslog])
-+    fi
-+    AC_CHECK_FUNCS([vsyslog], [], [
-+       AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
-+    AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
-+  fi    
-+])
-+
- 
- AC_ARG_WITH(suexec-safepath,
- APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
-@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask,
- APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[
-   AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] )
- 
-+INSTALL_SUEXEC=setuid
-+AC_ARG_ENABLE([suexec-capabilities], 
-+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [
-+INSTALL_SUEXEC=caps
-+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, 
-+          [Enable if suexec is installed with Linux capabilities, not setuid])
-+])
-+APACHE_SUBST(INSTALL_SUEXEC)
-+
- dnl APR should go after the other libs, so the right symbols can be picked up
- if test x${apu_found} != xobsolete; then
-   AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
--- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+
-+++ httpd-2.4.4/docs/manual/suexec.html.en
-@@ -372,6 +372,21 @@
-       together with the <code>--enable-suexec</code> option to let
-       APACI accept your request for using the suEXEC feature.</dd>
- 
-+      <dt><code>--enable-suexec-capabilities</code></dt>
-+
-+      <dd><strong>Linux specific:</strong> Normally,
-+      the <code>suexec</code> binary is installed "setuid/setgid
-+      root", which allows it to run with the full privileges of the
-+      root user.  If this option is used, the <code>suexec</code>
-+      binary will instead be installed with only the setuid/setgid
-+      "capability" bits set, which is the subset of full root
-+      priviliges required for suexec operation.  Note that
-+      the <code>suexec</code> binary may not be able to write to a log
-+      file in this mode; it is recommended that the
-+      <code>--with-suexec-syslog --without-suexec-logfile</code>
-+      options are used in conjunction with this mode, so that syslog
-+      logging is used instead.</dd>
-+
-       <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
- 
-       <dd>The path to the <code>suexec</code> binary must be hard-coded
-@@ -433,6 +448,12 @@
-       "<code>suexec_log</code>" and located in your standard logfile
-       directory (<code>--logfiledir</code>).</dd>
- 
-+      <dt><code>--with-suexec-syslog</code></dt>
-+
-+      <dd>If defined, suexec will log notices and errors to syslog
-+      instead of a logfile.  This option must be combined
-+      with <code>--without-suexec-logfile</code>.</dd>
-+
-       <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
- 
-       <dd>Define a safe PATH environment to pass to CGI
-@@ -550,9 +571,12 @@ Group webgroup
- 
-     <p>The suEXEC wrapper will write log information
-     to the file defined with the <code>--with-suexec-logfile</code>
-    option as indicated above. If you feel you have configured and
-    installed the wrapper properly, have a look at this log and the
-    error_log for the server to see where you may have gone astray.</p>
-+    option as indicated above, or to syslog if <code>--with-suexec-syslog</code>
-+    is used. If you feel you have configured and
-+    installed the wrapper properly, have a look at the log and the
-+    error_log for the server to see where you may have gone astray. 
-+    The output of <code>"suexec -V"</code> will show the options
-+    used to compile suexec, if using a binary distribution.</p>
- 
- </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
- <div class="section">
-@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined')
-     prettyPrint();
- }
- //--><!]]></script>
-</body></html>
-\ No newline at end of file
-+</body></html>
--- httpd-2.4.4/Makefile.in.r1337344+
-+++ httpd-2.4.4/Makefile.in
-@@ -238,11 +238,22 @@ install-man:
- 	  cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \
- 	fi
- 
-install-suexec:
-+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC)
-+
-+install-suexec-binary:
- 	@if test -f $(builddir)/support/suexec; then \
-             test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \
-             $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \
-            chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
-+	fi
-+
-+install-suexec-setuid:
-+	@if test -f $(builddir)/support/suexec; then \
-+	    chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
-+	fi
-+
-+install-suexec-caps:
-+	@if test -f $(builddir)/support/suexec; then \
-+            setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \
- 	fi
- 
- suexec:
--- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+
-+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c
-@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d
-     return NULL;
- }
- 
-+#ifdef AP_SUEXEC_CAPABILITIES
-+/* If suexec is using capabilities, don't test for the setuid bit. */
-+#define SETUID_TEST(finfo) (1)
-+#else
-+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID)
-+#endif
-+
- static int
- unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-                  apr_pool_t *ptemp)
-@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_
-     ap_unixd_config.suexec_enabled = 0;
-     if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp))
-          == APR_SUCCESS) {
-        if ((wrapper.protection & APR_USETID) && wrapper.user == 0
-+        if (SETUID_TEST(wrapper) && wrapper.user == 0
-             && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) {
-             ap_unixd_config.suexec_enabled = 1;
-             ap_unixd_config.suexec_disabled_reason = "";
--- httpd-2.4.4/support/suexec.c.r1337344+
-+++ httpd-2.4.4/support/suexec.c
-@@ -58,6 +58,10 @@
- #include <grp.h>
- #endif
- 
-+#ifdef AP_LOG_SYSLOG
-+#include <syslog.h>
-+#endif
-+
- #if defined(PATH_MAX)
- #define AP_MAXPATH PATH_MAX
- #elif defined(MAXPATHLEN)
-@@ -69,7 +73,20 @@
- #define AP_ENVBUF 256
- 
- extern char **environ;
-+
-+#ifdef AP_LOG_SYSLOG
-+/* Syslog support. */
-+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV)
-+#define AP_LOG_FACILITY LOG_AUTHPRIV
-+#elif !defined(AP_LOG_FACILITY)
-+#define AP_LOG_FACILITY LOG_AUTH
-+#endif
-+
-+static int log_open;
-+#else
-+/* Non-syslog support. */
- static FILE *log = NULL;
-+#endif
- 
- static const char *const safe_env_lst[] =
- {
-@@ -137,7 +154,14 @@ static void err_output(int is_error, con
- 
- static void err_output(int is_error, const char *fmt, va_list ap)
- {
-#ifdef AP_LOG_EXEC
-+#if defined(AP_LOG_SYSLOG)
-+    if (!log_open) {
-+        openlog("suexec", LOG_PID, AP_LOG_FACILITY);
-+        log_open = 1;
-+    }
-+
-+    vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap);
-+#elif defined(AP_LOG_EXEC)
-     time_t timevar;
-     struct tm *lt;
- 
-@@ -295,7 +319,9 @@ int main(int argc, char *argv[])
- #ifdef AP_HTTPD_USER
-         fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
- #endif
-#ifdef AP_LOG_EXEC
-+#if defined(AP_LOG_SYSLOG)
-+        fprintf(stderr, " -D AP_LOG_SYSLOG\n");
-+#elif defined(AP_LOG_EXEC)
-         fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
- #endif
- #ifdef AP_SAFE_PATH
-@@ -591,6 +617,12 @@ int main(int argc, char *argv[])
- #endif /* AP_SUEXEC_UMASK */
- 
-     /* Be sure to close the log file so the CGI can't mess with it. */
-+#ifdef AP_LOG_SYSLOG
-+    if (log_open) {
-+        closelog();
-+        log_open = 0;
-+    }
-+#else
-     if (log != NULL) {
- #if APR_HAVE_FCNTL_H
-         /*
-@@ -612,6 +644,7 @@ int main(int argc, char *argv[])
-         log = NULL;
- #endif
-     }
-+#endif
- 
-     /*
-      * Execute the command, replacing our image with its own.
--- a/httpd-2.4.41-r1828172+.patch
+++ b/httpd-2.4.41-r1828172+.patch
@ -1,10 +1,15 @@
-# ./pullrev.sh 1828172 1862968 1863191
+# ./pullrev.sh 1828172 1862968 1863191 1867878 1867882 1867968 1867970 1867971
 http://svn.apache.org/viewvc?view=revision&revision=1828172
 http://svn.apache.org/viewvc?view=revision&revision=1862968
 http://svn.apache.org/viewvc?view=revision&revision=1863191
+http://svn.apache.org/viewvc?view=revision&revision=1867878
+http://svn.apache.org/viewvc?view=revision&revision=1867882
+http://svn.apache.org/viewvc?view=revision&revision=1867968
+http://svn.apache.org/viewvc?view=revision&revision=1867970
+http://svn.apache.org/viewvc?view=revision&revision=1867971

--- httpd-2.4.37/modules/generators/mod_cgi.c
-+++ httpd-2.4.37/modules/generators/mod_cgi.c
+--- httpd-2.4.41/modules/generators/mod_cgi.c
+++ httpd-2.4.41/modules/generators/mod_cgi.c
@@ -92,6 +92,10 @@
     apr_size_t  bufbytes;
 } cgi_server_conf;
@ -87,9 +92,31 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
             }
         }
     }
-@@ -563,189 +590,7 @@
+@@ -541,212 +568,10 @@
+     return APR_SUCCESS;
 }
 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-    apr_status_t rv;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb);
+-         e = APR_BUCKET_NEXT(e))
+-    {
+-        if (APR_BUCKET_IS_EOS(e)) {
+-            break;
+-        }
+-        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
+-        if (rv != APR_SUCCESS) {
+-            break;
+-        }
+-    }
+-}
+-
 #if APR_FILES_AS_SOCKETS
 -
 -/* A CGI bucket type is needed to catch any output to stderr from the
@ -274,11 +301,13 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 -    apr_bucket_copy_notimpl
 -};
 -
-+#include "cgi_common.h"
+#define WANT_CGI_BUCKET
 #endif
+#include "cgi_common.h"
 
 static int cgi_handler(request_rec *r)
-@@ -766,6 +611,8 @@
+ {
+@@ -766,6 +591,8 @@
     apr_status_t rv;
     cgi_exec_info_t e_info;
     conn_rec *c;
@ -287,34 +316,132 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 
     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
         return DECLINED;
-@@ -928,7 +775,7 @@
-     apr_file_pipe_timeout_set(script_in, 0);
-     apr_file_pipe_timeout_set(script_err, 0);
+@@ -925,10 +752,7 @@
+     AP_DEBUG_ASSERT(script_in != NULL);
 
+ #if APR_FILES_AS_SOCKETS
+-    apr_file_pipe_timeout_set(script_in, 0);
+-    apr_file_pipe_timeout_set(script_err, 0);
+-
 -    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
 +    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
     if (b == NULL)
         return HTTP_INTERNAL_SERVER_ERROR;
 #else
-@@ -985,7 +832,7 @@
-              * stderr output, as normal. */
-             discard_script_output(bb);
-             apr_brigade_destroy(bb);
+@@ -938,111 +762,7 @@
+     b = apr_bucket_eos_create(c->bucket_alloc);
+     APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-    /* Handle script return... */
+-    if (!nph) {
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && r->status == 200) {
+-            /* For a redirect whether internal or not, discard any
+-             * remaining stdout from the script, and log any remaining
+-             * stderr output, as normal. */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
 -            apr_file_pipe_timeout_set(script_err, r->server->timeout);
-+            apr_file_pipe_timeout_set(script_err, timeout);
-             log_script_err(r, script_err);
-         }
- 
-@@ -1036,7 +883,7 @@
-      * connection drops or we stopped sending output for some other
-      * reason */
-     if (rv == APR_SUCCESS && !r->connection->aborted) {
+-            log_script_err(r, script_err);
+-        }
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one.  We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-    else /* nph */ {
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-
+-    /* don't soak up script output if errors occurred writing it
+-     * out...  otherwise, we prolong the life of the script when the
+-     * connection drops or we stopped sending output for some other
+-     * reason */
+-    if (rv == APR_SUCCESS && !r->connection->aborted) {
 -        apr_file_pipe_timeout_set(script_err, r->server->timeout);
-+        apr_file_pipe_timeout_set(script_err, timeout);
-         log_script_err(r, script_err);
-     }
+-        log_script_err(r, script_err);
+-    }
+-
+-    apr_file_close(script_err);
+-
+-    return OK;                      /* NOT r->status, even if it has changed. */
+    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
+ }
 
-@@ -1277,7 +1124,7 @@
+ /*============================================================================
+@@ -1277,7 +997,7 @@
 AP_DECLARE_MODULE(cgi) =
 {
     STANDARD20_MODULE_STUFF,
@ -323,8 +450,26 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     NULL,                        /* dir merger --- default is to override */
     create_cgi_config,           /* server config */
     merge_cgi_config,            /* merge server config */
--- httpd-2.4.37/modules/generators/mod_cgid.c
-+++ httpd-2.4.37/modules/generators/mod_cgid.c
+--- httpd-2.4.41/modules/generators/config5.m4
+++ httpd-2.4.41/modules/generators/config5.m4
+@@ -78,4 +78,15 @@
+ 
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
+AC_ARG_ENABLE(cgid-fdpassing,
+  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
+  [if test "$enableval" = "yes"; then
+     AC_CHECK_DECL(CMSG_DATA,
+       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
+       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
+#include <sys/types.h>
+#include <sys/socket.h>])
+  fi
+])
+
+ APACHE_MODPATH_FINISH
+--- httpd-2.4.41/modules/generators/mod_cgid.c
+++ httpd-2.4.41/modules/generators/mod_cgid.c
@@ -342,15 +342,19 @@
     return close(fd);
 }
@ -350,7 +495,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     do {
         do {
             rc = read(fd, buf + bytes_read, buf_size - bytes_read);
-@@ -365,9 +369,52 @@
+@@ -365,9 +369,60 @@
         }
     } while (bytes_read < buf_size);
 
@ -366,11 +511,12 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    
 +    msg.msg_iov = &vec;
 +    msg.msg_iovlen = 1;
-+    
-+    msg.msg_control = u.buf;
-+    msg.msg_controllen = sizeof(u.buf);
 +
-+    if (errfd) *errfd = 0;
+    if (errfd) {
+        msg.msg_control = u.buf;
+        msg.msg_controllen = sizeof(u.buf);
+        *errfd = 0;
+    }
 +    
 +    /* use MSG_WAITALL to skip loop on truncated reads */
 +    do {
@ -380,10 +526,17 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    if (rc == 0) {
 +        return ECONNRESET;
 +    }
-+    
-+    cmsg = CMSG_FIRSTHDR(&msg);
+    else if (rc < 0) {
+        return errno;
+    }
+    else if (rc != buf_size) {
+        /* MSG_WAITALL should ensure the recvmsg blocks until the
+         * entire length is read, but let's be paranoid. */
+        return APR_INCOMPLETE;
+    }
+
 +    if (errfd
-+        && cmsg
+        && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL
 +        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
 +        && cmsg->cmsg_level == SOL_SOCKET
 +        && cmsg->cmsg_type == SCM_RIGHTS) {
@ -403,7 +556,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 /* deal with signals
  */
 static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
-@@ -384,7 +431,7 @@
+@@ -384,7 +439,7 @@
     return APR_SUCCESS;
 }
 
@ -412,7 +565,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 {
     va_list ap;
     int rc;
-@@ -399,9 +446,39 @@
+@@ -399,9 +454,39 @@
     }
     va_end(ap);
 
@ -452,7 +605,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     if (rc < 0) {
         return errno;
     }
-@@ -410,7 +487,7 @@
+@@ -410,7 +495,7 @@
 }
 
 static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
@ -461,7 +614,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 {
     int i;
     char **environ;
-@@ -421,7 +498,7 @@
+@@ -421,7 +506,7 @@
     r->server = apr_pcalloc(r->pool, sizeof(server_rec));
 
     /* read the request header */
@ -470,7 +623,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     if (stat != APR_SUCCESS) {
         return stat;
     }
-@@ -479,14 +556,15 @@
+@@ -479,14 +564,15 @@
     return APR_SUCCESS;
 }
 
@ -488,7 +641,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 
 
     if (ugid == NULL) {
-@@ -507,16 +585,21 @@
+@@ -507,16 +593,21 @@
     req.args_len = r->args ? strlen(r->args) : 0;
     req.loglevel = r->server->log.level;
 
@ -512,7 +665,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
                            &req, sizeof(req),
                            r->filename, req.filename_len,
                            argv0, req.argv0_len,
-@@ -531,7 +614,7 @@
+@@ -531,7 +622,7 @@
     for (i = 0; i < req.env_count; i++) {
         apr_size_t curlen = strlen(env[i]);
 
@ -521,7 +674,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
                                 env[i], curlen)) != APR_SUCCESS) {
             return stat;
         }
-@@ -582,20 +665,34 @@
+@@ -582,20 +673,34 @@
     }
 }
 
@ -564,7 +717,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 }
 
 static int cgid_server(void *data)
-@@ -669,7 +766,7 @@
+@@ -669,7 +774,7 @@
     }
 
     while (!daemon_should_exit) {
@ -573,7 +726,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
         char *argv0 = NULL;
         char **env = NULL;
         const char * const *argv;
-@@ -709,7 +806,7 @@
+@@ -709,7 +814,7 @@
         r = apr_pcalloc(ptrans, sizeof(request_rec));
         procnew = apr_pcalloc(ptrans, sizeof(*procnew));
         r->pool = ptrans;
@ -582,7 +735,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
         if (stat != APR_SUCCESS) {
             ap_log_error(APLOG_MARK, APLOG_ERR, stat,
                          main_server, APLOGNO(01248)
-@@ -741,6 +838,16 @@
+@@ -741,6 +846,16 @@
             continue;
         }
 
@ -599,7 +752,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
         apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
         apr_os_file_put(&inout, &sd2, 0, r->pool);
 
-@@ -800,7 +907,10 @@
+@@ -800,7 +915,10 @@
             close(sd2);
         }
         else {
@ -611,7 +764,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 
             argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
 
-@@ -1099,6 +1209,33 @@
+@@ -1099,6 +1217,33 @@
     return ret;
 }
 
@ -645,19 +798,49 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
                       apr_file_t *script_err)
-@@ -1204,6 +1341,11 @@
+@@ -1204,6 +1349,13 @@
     return ret;
 }
 
-+#ifdef HAVE_CGID_FDPASSING
 +/* Pull in CGI bucket implementation. */
-+#include "cgi_common.h"
+#define cgi_server_conf cgid_server_conf
+#ifdef HAVE_CGID_FDPASSING
+#define WANT_CGI_BUCKET
 +#endif
+#include "cgi_common.h"
 +
 static int connect_to_daemon(int *sdptr, request_rec *r,
                              cgid_server_conf *conf)
 {
-@@ -1395,6 +1537,7 @@
+@@ -1270,27 +1422,6 @@
+     return OK;
+ }
+ 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-    apr_status_t rv;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb);
+-         e = APR_BUCKET_NEXT(e))
+-    {
+-        if (APR_BUCKET_IS_EOS(e)) {
+-            break;
+-        }
+-        rv = apr_bucket_read(e, &buf, &len, APR_BLOCK_READ);
+-        if (rv != APR_SUCCESS) {
+-            break;
+-        }
+-    }
+-}
+-
+ /****************************************************************
+  *
+  * Actual cgid handling...
+@@ -1395,6 +1526,7 @@
 
 static int cgid_handler(request_rec *r)
 {
@ -665,7 +848,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     int retval, nph, dbpos;
     char *argv0, *dbuf;
     apr_bucket_brigade *bb;
-@@ -1404,10 +1547,11 @@
+@@ -1404,10 +1536,11 @@
     int seen_eos, child_stopped_reading;
     int sd;
     char **env;
@ -678,7 +861,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 
     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
         return DECLINED;
-@@ -1416,7 +1560,7 @@
+@@ -1416,7 +1549,7 @@
     conf = ap_get_module_config(r->server->module_config, &cgid_module);
     dc = ap_get_module_config(r->per_dir_config, &cgid_module);
 
@ -687,7 +870,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     is_included = !strcmp(r->protocol, "INCLUDED");
 
     if ((argv0 = strrchr(r->filename, '/')) != NULL) {
-@@ -1469,6 +1613,17 @@
+@@ -1469,6 +1602,17 @@
     }
     */
 
@ -705,7 +888,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     /*
      * httpd core function used to add common environment variables like
      * DOCUMENT_ROOT. 
-@@ -1481,12 +1636,16 @@
+@@ -1481,12 +1625,16 @@
         return retval;
     }
 
@ -723,7 +906,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
     info->conf = conf;
     info->r = r;
-@@ -1508,12 +1667,7 @@
+@@ -1508,12 +1656,7 @@
      */
 
     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
@ -737,10 +920,116 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
 
     /* Transfer any put/post args, CERN style...
-@@ -1605,23 +1759,28 @@
+@@ -1605,114 +1748,19 @@
      */
     shutdown(sd, 1);
 
+-    /* Handle script return... */
+-    if (!nph) {
+-        conn_rec *c = r->connection;
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-
+-            /* Soak up all the script output */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one. We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-        if (rv != APR_SUCCESS) { 
+-            ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
+-                          "Failed to flush CGI output to client");
+-        }
+-    }
+-
+-    if (nph) {
+-        conn_rec *c = r->connection;
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        ap_pass_brigade(r->output_filters, bb);
+-    }
 +    bb = apr_brigade_create(r->pool, c->bucket_alloc);
 +#ifdef HAVE_CGID_FDPASSING
 +    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
@ -752,76 +1041,13 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    APR_BRIGADE_INSERT_TAIL(bb, b);
 +    b = apr_bucket_eos_create(c->bucket_alloc);
 +    APR_BRIGADE_INSERT_TAIL(bb, b);
-+
-     /* Handle script return... */
-     if (!nph) {
-        conn_rec *c = r->connection;
-         const char *location;
-         char sbuf[MAX_STRING_LEN];
-         int ret;
 
-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
-        APR_BRIGADE_INSERT_TAIL(bb, b);
-        b = apr_bucket_eos_create(c->bucket_alloc);
-        APR_BRIGADE_INSERT_TAIL(bb, b);
-
-         if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
-                                                         APLOG_MODULE_INDEX)))
-         {
-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
-+            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
- 
-             /*
-              * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
-@@ -1658,6 +1817,11 @@
-             /* Soak up all the script output */
-             discard_script_output(bb);
-             apr_brigade_destroy(bb);
-+            if (script_err) {
-+                apr_file_pipe_timeout_set(script_err, timeout);
-+                log_script_err(r, script_err);
-+            }
-+            
-             /* This redirect needs to be a GET no matter what the original
-              * method was.
-              */
-@@ -1690,7 +1854,6 @@
-     }
- 
-     if (nph) {
-        conn_rec *c = r->connection;
-         struct ap_filter_t *cur;
- 
-         /* get rid of all filters up through protocol...  since we
-@@ -1704,14 +1867,20 @@
-         }
-         r->output_filters = r->proto_output_filters = cur;
- 
-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
-        APR_BRIGADE_INSERT_TAIL(bb, b);
-        b = apr_bucket_eos_create(c->bucket_alloc);
-        APR_BRIGADE_INSERT_TAIL(bb, b);
-        ap_pass_brigade(r->output_filters, bb);
-+        rv = ap_pass_brigade(r->output_filters, bb);
-     }
- 
-+    /* don't soak up script output if errors occurred writing it
-+     * out...  otherwise, we prolong the life of the script when the
-+     * connection drops or we stopped sending output for some other
-+     * reason */
-+    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
-+        apr_file_pipe_timeout_set(script_err, timeout);
-+        log_script_err(r, script_err);
-+    }
-+
-+    if (script_err) apr_file_close(script_err);
-+
-     return OK; /* NOT r->status, even if it has changed. */
+-    return OK; /* NOT r->status, even if it has changed. */
+    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
 }
 
-@@ -1829,7 +1998,7 @@
+ 
+@@ -1829,7 +1877,7 @@
         return retval;
     }
 
@ -830,27 +1056,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 
     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
     info->conf = conf;
--- httpd-2.4.37/modules/generators/config5.m4
-+++ httpd-2.4.37/modules/generators/config5.m4
-@@ -78,4 +78,15 @@
- 
- APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
- 
-+AC_ARG_ENABLE(cgid-fdpassing,
-+  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
-+  [if test "$enableval" = "yes"; then
-+     AC_CHECK_DECL(CMSG_DATA,
-+       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
-+       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
-+#include <sys/types.h>
-+#include <sys/socket.h>])
-+  fi
-+])
-+
- APACHE_MODPATH_FINISH
--- httpd-2.4.37/modules/generators/cgi_common.h
-+++ httpd-2.4.37/modules/generators/cgi_common.h
-@@ -0,0 +1,216 @@
+--- httpd-2.4.41/modules/generators/cgi_common.h
+++ httpd-2.4.41/modules/generators/cgi_common.h
+@@ -0,0 +1,359 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
@ -880,6 +1088,24 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +#include "httpd.h"
 +#include "util_filter.h"
 +
+static void discard_script_output(apr_bucket_brigade *bb)
+{
+    apr_bucket *e;
+    const char *buf;
+    apr_size_t len;
+
+    for (e = APR_BRIGADE_FIRST(bb);
+         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+         e = APR_BRIGADE_FIRST(bb))
+    {
+        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
+            break;
+        }
+        apr_bucket_delete(e);
+    }
+}
+
+#ifdef WANT_CGI_BUCKET
 +/* A CGI bucket type is needed to catch any output to stderr from the
 + * script; see PR 22030. */
 +static const apr_bucket_type_t bucket_type_cgi;
@ -902,6 +1128,10 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    apr_pollfd_t fd;
 +    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
 +
+    /* Disable APR timeout handling since we'll use poll() entirely. */
+    apr_file_pipe_timeout_set(out, 0);
+    apr_file_pipe_timeout_set(err, 0);
+    
 +    APR_BUCKET_INIT(b);
 +    b->free = apr_bucket_free;
 +    b->list = list;
@ -1067,3 +1297,124 @@ http://svn.apache.org/viewvc?view=revision&revision=1863191
 +    apr_bucket_copy_notimpl
 +};
 +
+#endif /* WANT_CGI_BUCKET */
+
+/* Handle the CGI response output, having set up the brigade with the
+ * CGI or PIPE bucket as appropriate. */
+static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb,
+                               apr_interval_time_t timeout, cgi_server_conf *conf,
+                               char *logdata, apr_file_t *script_err)
+{
+    apr_status_t rv;
+    
+    /* Handle script return... */
+    if (!nph) {
+        const char *location;
+        char sbuf[MAX_STRING_LEN];
+        int ret;
+
+        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+                                                        APLOG_MODULE_INDEX)))
+        {
+            ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err);
+
+            /*
+             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+             * does not set an explicit status and ap_meets_conditions, which
+             * is called by ap_scan_script_header_err_brigade, detects that
+             * the conditions of the requests are met and the response is
+             * not modified.
+             * In this case set r->status and return OK in order to prevent
+             * running through the error processing stack as this would
+             * break with mod_cache, if the conditions had been set by
+             * mod_cache itself to validate a stale entity.
+             * BTW: We circumvent the error processing stack anyway if the
+             * CGI script set an explicit status code (whatever it is) and
+             * the only possible values for ret here are:
+             *
+             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+             * processing of the response of the CGI script, e.g broken headers
+             * or a crashed CGI process).
+             */
+            if (ret == HTTP_NOT_MODIFIED) {
+                r->status = ret;
+                return OK;
+            }
+
+            return ret;
+        }
+
+        location = apr_table_get(r->headers_out, "Location");
+
+        if (location && r->status == 200) {
+            /* For a redirect whether internal or not, discard any
+             * remaining stdout from the script, and log any remaining
+             * stderr output, as normal. */
+            discard_script_output(bb);
+            apr_brigade_destroy(bb);
+
+            if (script_err) {
+                apr_file_pipe_timeout_set(script_err, timeout);
+                log_script_err(r, script_err);
+            }
+        }
+
+        if (location && location[0] == '/' && r->status == 200) {
+            /* This redirect needs to be a GET no matter what the original
+             * method was.
+             */
+            r->method = "GET";
+            r->method_number = M_GET;
+
+            /* We already read the message body (if any), so don't allow
+             * the redirected request to think it has one.  We can ignore
+             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+             */
+            apr_table_unset(r->headers_in, "Content-Length");
+
+            ap_internal_redirect_handler(location, r);
+            return OK;
+        }
+        else if (location && r->status == 200) {
+            /* XXX: Note that if a script wants to produce its own Redirect
+             * body, it now has to explicitly *say* "Status: 302"
+             */
+            discard_script_output(bb);
+            apr_brigade_destroy(bb);
+            return HTTP_MOVED_TEMPORARILY;
+        }
+
+        rv = ap_pass_brigade(r->output_filters, bb);
+    }
+    else /* nph */ {
+        struct ap_filter_t *cur;
+
+        /* get rid of all filters up through protocol...  since we
+         * haven't parsed off the headers, there is no way they can
+         * work
+         */
+
+        cur = r->proto_output_filters;
+        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+            cur = cur->next;
+        }
+        r->output_filters = r->proto_output_filters = cur;
+
+        rv = ap_pass_brigade(r->output_filters, bb);
+    }
+
+    /* don't soak up script output if errors occurred writing it
+     * out...  otherwise, we prolong the life of the script when the
+     * connection drops or we stopped sending output for some other
+     * reason */
+    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
+        apr_file_pipe_timeout_set(script_err, timeout);
+        log_script_err(r, script_err);
+    }
+
+    if (script_err) apr_file_close(script_err);
+
+    return OK;                      /* NOT r->status, even if it has changed. */
+}
--- a/httpd-2.4.41-r1865749.patch
+++ b/httpd-2.4.41-r1865749.patch
@ -0,0 +1,14 @@
+# ./pullrev.sh 1865749
+http://svn.apache.org/viewvc?view=revision&revision=1865749
+
+--- httpd-2.4.41/modules/proxy/mod_proxy_balancer.c.r1865749
+++ httpd-2.4.41/modules/proxy/mod_proxy_balancer.c
+@@ -1104,7 +1104,7 @@
+     if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname)
+         return 0;
+ 
+-    return strcmp(uri.hostname, ap_get_server_name(r)) == 0;
+    return strcasecmp(uri.hostname, ap_get_server_name(r)) == 0;
+ }
+ 
+ /* Manages the loadfactors and member status
--- a/httpd-2.4.41-r1870095+.patch
+++ b/httpd-2.4.41-r1870095+.patch
@ -0,0 +1,117 @@
+# ./pullrev.sh 1870095 1870097
+http://svn.apache.org/viewvc?view=revision&revision=1870095
+http://svn.apache.org/viewvc?view=revision&revision=1870097
+
+--- httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
+++ httpd-2.4.41/modules/ssl/ssl_engine_kernel.c
+@@ -114,6 +114,45 @@
+     return result;
+ }
+ 
+/* If a renegotiation is required for the location, and the request
+ * includes a message body (and the client has not requested a "100
+ * Continue" response), then the client will be streaming the request
+ * body over the wire already.  In that case, it is not possible to
+ * stop and perform a new SSL handshake immediately; once the SSL
+ * library moves to the "accept" state, it will reject the SSL packets
+ * which the client is sending for the request body.
+ *
+ * To allow authentication to complete in the hook, the solution used
+ * here is to fill a (bounded) buffer with the request body, and then
+ * to reinject that request body later.
+ *
+ * This function is called to fill the renegotiation buffer for the
+ * location as required, or fail.  Returns zero on success or HTTP_
+ * error code on failure.
+ */
+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)
+{
+    int rv;
+    apr_size_t rsize;
+
+    /* ### this is HTTP/1.1 specific, special case for protocol? */
+    if (r->expecting_100 || !ap_request_has_body(r)) {
+        return 0;
+    }
+
+    rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize;
+    if (rsize > 0) {
+        /* Fill the I/O buffer with the request body if possible. */
+        rv = ssl_io_buffer_fill(r, rsize);
+    }
+    else {
+        /* If the reneg buffer size is set to zero, just fail. */
+        rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
+    }
+
+    return rv;
+}
+
+ #ifdef HAVE_TLSEXT
+ static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)
+ {
+@@ -814,41 +853,14 @@
+         }
+     }
+ 
+-    /* If a renegotiation is now required for this location, and the
+-     * request includes a message body (and the client has not
+-     * requested a "100 Continue" response), then the client will be
+-     * streaming the request body over the wire already.  In that
+-     * case, it is not possible to stop and perform a new SSL
+-     * handshake immediately; once the SSL library moves to the
+-     * "accept" state, it will reject the SSL packets which the client
+-     * is sending for the request body.
+-     *
+-     * To allow authentication to complete in this auth hook, the
+-     * solution used here is to fill a (bounded) buffer with the
+-     * request body, and then to reinject that request body later.
+-     */
+-    if (renegotiate && !renegotiate_quick
+-        && !r->expecting_100
+-        && ap_request_has_body(r)) {
+-        int rv;
+-        apr_size_t rsize;
+-
+-        rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE :
+-                                                dc->nRenegBufferSize;
+-        if (rsize > 0) {
+-            /* Fill the I/O buffer with the request body if possible. */
+-            rv = ssl_io_buffer_fill(r, rsize);
+-        }
+-        else {
+-            /* If the reneg buffer size is set to zero, just fail. */
+-            rv = HTTP_REQUEST_ENTITY_TOO_LARGE;
+-        }
+-
+-        if (rv) {
+    /* Fill reneg buffer if required. */
+    if (renegotiate && !renegotiate_quick) {
+        rc = fill_reneg_buffer(r, dc);
+        if (rc) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257)
+                           "could not buffer message body to allow "
+                           "SSL renegotiation to proceed");
+-            return rv;
+            return rc;
+         }
+     }
+ 
+@@ -1132,6 +1144,17 @@
+             }
+         }
+ 
+        /* Fill reneg buffer if required. */
+        if (change_vmode) {
+            rc = fill_reneg_buffer(r, dc);
+            if (rc) {
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228)
+                              "could not buffer message body to allow "
+                              "TLS Post-Handshake Authentication to proceed");
+                return rc;
+            }
+        }
+
+         if (change_vmode) {
+             char peekbuf[1];
+ 
--- a/httpd.spec
+++ b/httpd.spec
@ -13,7 +13,7 @@
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.41
-Release: 1%{?dist}
+Release: 6.1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
@ -66,7 +66,6 @@ Patch21: httpd-2.4.39-r1842929+.patch
 Patch23: httpd-2.4.39-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
 Patch25: httpd-2.4.25-selinux.patch
-Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
 Patch29: httpd-2.4.33-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
@ -77,12 +76,14 @@ Patch38: httpd-2.4.34-sslciphdefault.patch
 Patch39: httpd-2.4.37-sslprotdefault.patch
 Patch40: httpd-2.4.39-r1861269.patch
 Patch41: httpd-2.4.37-r1861793+.patch
-Patch42: httpd-2.4.37-r1828172+.patch
+Patch42: httpd-2.4.41-r1828172+.patch

 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch58: httpd-2.4.34-r1738878.patch
 Patch60: httpd-2.4.34-enable-sslv3.patch
+Patch61: httpd-2.4.41-r1865749.patch
+Patch62: httpd-2.4.41-r1870095+.patch

 # Security fixes

@ -158,7 +159,7 @@ Epoch: 1
 BuildRequires: openssl-devel
 Requires(pre): httpd-filesystem
 Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
-Requires: sscg >= 2.2.0
+Requires: sscg >= 2.2.0, /usr/bin/hostname
 # Require an OpenSSL which supports PROFILE=SYSTEM
 Conflicts: openssl-libs < 1:1.0.1h-4

@ -206,7 +207,6 @@ interface for storing and accessing per-user session data.
 %patch23 -p1 -b .export
 %patch24 -p1 -b .corelimit
 %patch25 -p1 -b .selinux
-#patch26 -p1 -b .r1337344+
 %patch27 -p1 -b .icons
 %patch29 -p1 -b .systemd
 %patch30 -p1 -b .cachehardmax
@ -221,6 +221,8 @@ interface for storing and accessing per-user session data.

 %patch58 -p1 -b .r1738878
 %patch60 -p1 -b .enable-sslv3
+%patch61 -p1 -b .r1865749
+%patch62 -p1 -b .r1870095

 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@ -741,6 +743,21 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd

 %changelog
+* Thu Nov 21 2019 Joe Orton <jorton@redhat.com> - 2.4.41-6.1
+- mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146)
+
+* Fri Oct  4 2019 Joe Orton <jorton@redhat.com> - 2.4.41-6
+- mod_cgid/mod_cgi: further upstream consolidation patches
+
+* Thu Oct  3 2019 Joe Orton <jorton@redhat.com> - 2.4.41-5
+- mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688)
+
+* Wed Oct  2 2019 Joe Orton <jorton@redhat.com> - 2.4.41-4
+- mod_cgid: possible stdout timeout handling fix (#1757683)
+
+* Wed Sep 25 2019 Joe Orton <jorton@redhat.com> - 2.4.41-3
+- mod_ssl: restore dependency on /usr/bin/hostname (#1135118)
+
 * Thu Aug 15 2019 Joe Orton <jorton@redhat.com> - 2.4.41-1
 - update to 2.4.41

--- a/pullrev.sh
+++ b/pullrev.sh
@ -7,7 +7,7 @@ fi

 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
 #repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=2.4.37
+ver=2.4.41
 prefix="httpd-${ver}"
 suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"
@ -36,7 +36,7 @@ for r in $*; do
    echo "+ fetching ${r}"
    this=`mktemp /tmp/pullrevXXXXXX`
    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \
-        --addprefix="${prefix}/" > ${this}
+        -x '*.xml' --addprefix="${prefix}/" > ${this}
    next=`mktemp /tmp/pullrevXXXXXX`
    combinediff --quiet ${prev} ${this} > ${next}
    rm -f "${this}"
Author	SHA1	Message	Date
Joe Orton	1f4a25cb66	mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146 )	2019-11-22 17:18:56 +00:00
Joe Orton	f425607336	Merge from f31	2019-11-22 17:18:49 +00:00
Joe Orton	0f1628abfa	mod_ssl: fix request body buffering w/TLSv1.3 PHA (#1775146 ) Resolves: rhbz#1775146	2019-11-22 17:17:59 +00:00
Joe Orton	0b5ef4808a	mod_cgid/mod_cgi: further upstream consolidation patches	2019-11-22 17:16:27 +00:00
Joe Orton	93ee9fee48	Remove suexec patch already merged upstream.	2019-10-03 09:33:26 +01:00
Joe Orton	75477cc3c3	mod_proxy_balancer: fix balancer-manager XSRF check (PR 63688)	2019-10-03 09:33:26 +01:00
Joe Orton	da11a13286	mod_cgid: possible stdout timeout handling fix (#1757683 ) Resolves: rhbz#1757683	2019-10-02 12:09:50 +01:00
Joe Orton	772e6b5324	mod_ssl: restore dependency on /usr/bin/hostname (#1135118 ) Resolves: rhbz#1135118	2019-10-02 12:09:39 +01:00