1 |
commit: 8e7082d1d4d2d7c427d600a816934b89cdc6f7f8 |
2 |
Author: Benedikt Boehm <hollow <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Jul 29 08:08:30 2009 +0000 |
4 |
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Jul 29 08:08:30 2009 +0000 |
6 |
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/apache.git;a=commit;h=8e7082d1 |
7 |
|
8 |
remove patches that have been backported to 2.2.12 |
9 |
|
10 |
--- |
11 |
.gitignore | 1 + |
12 |
2.2/patches/04_all_mod_ssl_tls_sni.patch | 380 --------------------- |
13 |
.../05_all_fix_graceful_multiple_listeners.patch | 42 --- |
14 |
2.2/patches/06_all_CVE-2009-1191.patch | 37 -- |
15 |
2.2/patches/07_all_CVE-2009-1195.patch | 136 -------- |
16 |
2.2/patches/08_all_CVE-2009-1890.patch | 38 --- |
17 |
2.2/patches/09_all_CVE-2009-1891.patch | 29 -- |
18 |
2.2/patches/10_all_r779472.patch | 67 ---- |
19 |
2.2/patches/11_all_r790738.patch | 18 - |
20 |
9 files changed, 1 insertion(+), 747 deletions(-) |
21 |
|
22 |
diff --git a/.gitignore b/.gitignore |
23 |
new file mode 100644 |
24 |
index 0000000..bb6dce2 |
25 |
--- /dev/null |
26 |
+++ b/.gitignore |
27 |
@@ -0,0 +1 @@ |
28 |
+gentoo-apache-*.tar.bz2 |
29 |
|
30 |
diff --git a/2.2/patches/04_all_mod_ssl_tls_sni.patch b/2.2/patches/04_all_mod_ssl_tls_sni.patch |
31 |
deleted file mode 100644 |
32 |
index 73392ae..0000000 |
33 |
--- a/2.2/patches/04_all_mod_ssl_tls_sni.patch |
34 |
+++ /dev/null |
35 |
@@ -1,380 +0,0 @@ |
36 |
-# httpd-2.2.x-sni.patch - server name indication support for Apache 2.2 |
37 |
-# (see RFC 4366, "Transport Layer Security (TLS) Extensions") |
38 |
- |
39 |
-# based on a patch from the EdelKey project |
40 |
-# (http://www.edelweb.fr/EdelKey/files/apache-2.2.0+0.9.9+servername.patch) |
41 |
- |
42 |
-# Needs openssl-SNAP-20060330 / OpenSSL 0.9.8f or later |
43 |
-# to work properly (ftp://ftp.openssl.org/snapshot/). The 0.9.8 versions |
44 |
-# must be configured explicitly for TLS extension support at compile time |
45 |
-# ("./config enable-tlsext"). |
46 |
- |
47 |
-Index: httpd-2.2.x/modules/ssl/ssl_private.h |
48 |
-=================================================================== |
49 |
---- httpd-2.2.x/modules/ssl/ssl_private.h (revision 663014) |
50 |
-+++ httpd-2.2.x/modules/ssl/ssl_private.h (working copy) |
51 |
-@@ -35,6 +35,7 @@ |
52 |
- #include "http_connection.h" |
53 |
- #include "http_request.h" |
54 |
- #include "http_protocol.h" |
55 |
-+#include "http_vhost.h" |
56 |
- #include "util_script.h" |
57 |
- #include "util_filter.h" |
58 |
- #include "util_ebcdic.h" |
59 |
-@@ -555,6 +556,9 @@ int ssl_callback_NewSessionCach |
60 |
- SSL_SESSION *ssl_callback_GetSessionCacheEntry(SSL *, unsigned char *, int, int *); |
61 |
- void ssl_callback_DelSessionCacheEntry(SSL_CTX *, SSL_SESSION *); |
62 |
- void ssl_callback_LogTracingState(MODSSL_INFO_CB_ARG_TYPE, int, int); |
63 |
-+#ifndef OPENSSL_NO_TLSEXT |
64 |
-+int ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *); |
65 |
-+#endif |
66 |
- |
67 |
- /** Session Cache Support */ |
68 |
- void ssl_scache_init(server_rec *, apr_pool_t *); |
69 |
-Index: httpd-2.2.x/modules/ssl/ssl_engine_init.c |
70 |
-=================================================================== |
71 |
---- httpd-2.2.x/modules/ssl/ssl_engine_init.c (revision 663014) |
72 |
-+++ httpd-2.2.x/modules/ssl/ssl_engine_init.c (working copy) |
73 |
-@@ -355,6 +355,33 @@ static void ssl_init_server_check(server |
74 |
- } |
75 |
- } |
76 |
- |
77 |
-+#ifndef OPENSSL_NO_TLSEXT |
78 |
-+static void ssl_init_ctx_tls_extensions(server_rec *s, |
79 |
-+ apr_pool_t *p, |
80 |
-+ apr_pool_t *ptemp, |
81 |
-+ modssl_ctx_t *mctx) |
82 |
-+{ |
83 |
-+ /* |
84 |
-+ * Configure TLS extensions support |
85 |
-+ */ |
86 |
-+ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, |
87 |
-+ "Configuring TLS extension handling"); |
88 |
-+ |
89 |
-+ /* |
90 |
-+ * Server name indication (SNI) |
91 |
-+ */ |
92 |
-+ if (!SSL_CTX_set_tlsext_servername_callback(mctx->ssl_ctx, |
93 |
-+ ssl_callback_ServerNameIndication) || |
94 |
-+ !SSL_CTX_set_tlsext_servername_arg(mctx->ssl_ctx, mctx)) { |
95 |
-+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, |
96 |
-+ "Unable to initialize TLS servername extension " |
97 |
-+ "callback (incompatible OpenSSL version?)"); |
98 |
-+ ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s); |
99 |
-+ ssl_die(); |
100 |
-+ } |
101 |
-+} |
102 |
-+#endif |
103 |
-+ |
104 |
- static void ssl_init_ctx_protocol(server_rec *s, |
105 |
- apr_pool_t *p, |
106 |
- apr_pool_t *ptemp, |
107 |
-@@ -687,6 +714,9 @@ static void ssl_init_ctx(server_rec *s, |
108 |
- if (mctx->pks) { |
109 |
- /* XXX: proxy support? */ |
110 |
- ssl_init_ctx_cert_chain(s, p, ptemp, mctx); |
111 |
-+#ifndef OPENSSL_NO_TLSEXT |
112 |
-+ ssl_init_ctx_tls_extensions(s, p, ptemp, mctx); |
113 |
-+#endif |
114 |
- } |
115 |
- } |
116 |
- |
117 |
-@@ -1036,9 +1066,19 @@ void ssl_init_CheckServers(server_rec *b |
118 |
- klen = strlen(key); |
119 |
- |
120 |
- if ((ps = (server_rec *)apr_hash_get(table, key, klen))) { |
121 |
-- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, |
122 |
-+ ap_log_error(APLOG_MARK, |
123 |
-+#ifdef OPENSSL_NO_TLSEXT |
124 |
-+ APLOG_WARNING, |
125 |
-+#else |
126 |
-+ APLOG_DEBUG, |
127 |
-+#endif |
128 |
-+ 0, |
129 |
- base_server, |
130 |
-+#ifdef OPENSSL_NO_TLSEXT |
131 |
- "Init: SSL server IP/port conflict: " |
132 |
-+#else |
133 |
-+ "Init: SSL server IP/port overlap: " |
134 |
-+#endif |
135 |
- "%s (%s:%d) vs. %s (%s:%d)", |
136 |
- ssl_util_vhostid(p, s), |
137 |
- (s->defn_name ? s->defn_name : "unknown"), |
138 |
-@@ -1055,8 +1095,14 @@ void ssl_init_CheckServers(server_rec *b |
139 |
- |
140 |
- if (conflict) { |
141 |
- ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, |
142 |
-+#ifdef OPENSSL_NO_TLSEXT |
143 |
- "Init: You should not use name-based " |
144 |
- "virtual hosts in conjunction with SSL!!"); |
145 |
-+#else |
146 |
-+ "Init: Name-based SSL virtual hosts only " |
147 |
-+ "work for clients with TLS server name indication " |
148 |
-+ "support (RFC 4366)"); |
149 |
-+#endif |
150 |
- } |
151 |
- } |
152 |
- |
153 |
-Index: httpd-2.2.x/modules/ssl/ssl_engine_vars.c |
154 |
-=================================================================== |
155 |
---- httpd-2.2.x/modules/ssl/ssl_engine_vars.c (revision 663014) |
156 |
-+++ httpd-2.2.x/modules/ssl/ssl_engine_vars.c (working copy) |
157 |
-@@ -320,6 +320,12 @@ static char *ssl_var_lookup_ssl(apr_pool |
158 |
- else if (ssl != NULL && strcEQ(var, "COMPRESS_METHOD")) { |
159 |
- result = ssl_var_lookup_ssl_compress_meth(ssl); |
160 |
- } |
161 |
-+#ifndef OPENSSL_NO_TLSEXT |
162 |
-+ else if (ssl != NULL && strcEQ(var, "TLS_SNI")) { |
163 |
-+ result = apr_pstrdup(p, SSL_get_servername(ssl, |
164 |
-+ TLSEXT_NAMETYPE_host_name)); |
165 |
-+ } |
166 |
-+#endif |
167 |
- return result; |
168 |
- } |
169 |
- |
170 |
-Index: httpd-2.2.x/modules/ssl/ssl_engine_kernel.c |
171 |
-=================================================================== |
172 |
---- httpd-2.2.x/modules/ssl/ssl_engine_kernel.c (revision 663014) |
173 |
-+++ httpd-2.2.x/modules/ssl/ssl_engine_kernel.c (working copy) |
174 |
-@@ -31,6 +31,9 @@ |
175 |
- #include "ssl_private.h" |
176 |
- |
177 |
- static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn); |
178 |
-+#ifndef OPENSSL_NO_TLSEXT |
179 |
-+static int ssl_find_vhost(void *servername, conn_rec *c, server_rec *s); |
180 |
-+#endif |
181 |
- |
182 |
- /* |
183 |
- * Post Read Request Handler |
184 |
-@@ -39,6 +42,9 @@ int ssl_hook_ReadReq(request_rec *r) |
185 |
- { |
186 |
- SSLConnRec *sslconn = myConnConfig(r->connection); |
187 |
- SSL *ssl; |
188 |
-+#ifndef OPENSSL_NO_TLSEXT |
189 |
-+ const char *servername; |
190 |
-+#endif |
191 |
- |
192 |
- if (!sslconn) { |
193 |
- return DECLINED; |
194 |
-@@ -87,6 +93,14 @@ int ssl_hook_ReadReq(request_rec *r) |
195 |
- if (!ssl) { |
196 |
- return DECLINED; |
197 |
- } |
198 |
-+#ifndef OPENSSL_NO_TLSEXT |
199 |
-+ if (!r->hostname && |
200 |
-+ (servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) { |
201 |
-+ /* Use the SNI extension as the hostname if no Host: header was sent */ |
202 |
-+ r->hostname = apr_pstrdup(r->pool, servername); |
203 |
-+ ap_update_vhost_from_headers(r); |
204 |
-+ } |
205 |
-+#endif |
206 |
- SSL_set_app_data2(ssl, r); |
207 |
- |
208 |
- /* |
209 |
-@@ -353,6 +367,11 @@ int ssl_hook_Access(request_rec *r) |
210 |
- * currently active/remembered verify depth (because this means more |
211 |
- * restriction on the certificate chain). |
212 |
- */ |
213 |
-+ if ((sc->server->auth.verify_depth != UNSET) && |
214 |
-+ (dc->nVerifyDepth == UNSET)) { |
215 |
-+ /* apply per-vhost setting, if per-directory config is not set */ |
216 |
-+ dc->nVerifyDepth = sc->server->auth.verify_depth; |
217 |
-+ } |
218 |
- if (dc->nVerifyDepth != UNSET) { |
219 |
- /* XXX: doesnt look like sslconn->verify_depth is actually used */ |
220 |
- if (!(n = sslconn->verify_depth)) { |
221 |
-@@ -382,6 +401,11 @@ int ssl_hook_Access(request_rec *r) |
222 |
- * verification but at least skip the I/O-intensive renegotation |
223 |
- * handshake. |
224 |
- */ |
225 |
-+ if ((sc->server->auth.verify_mode != SSL_CVERIFY_UNSET) && |
226 |
-+ (dc->nVerifyClient == SSL_CVERIFY_UNSET)) { |
227 |
-+ /* apply per-vhost setting, if per-directory config is not set */ |
228 |
-+ dc->nVerifyClient = sc->server->auth.verify_mode; |
229 |
-+ } |
230 |
- if (dc->nVerifyClient != SSL_CVERIFY_UNSET) { |
231 |
- /* remember old state */ |
232 |
- verify_old = SSL_get_verify_mode(ssl); |
233 |
-@@ -997,6 +1021,9 @@ int ssl_hook_Fixup(request_rec *r) |
234 |
- SSLDirConfigRec *dc = myDirConfig(r); |
235 |
- apr_table_t *env = r->subprocess_env; |
236 |
- char *var, *val = ""; |
237 |
-+#ifndef OPENSSL_NO_TLSEXT |
238 |
-+ const char *servername; |
239 |
-+#endif |
240 |
- STACK_OF(X509) *peer_certs; |
241 |
- SSL *ssl; |
242 |
- int i; |
243 |
-@@ -1018,6 +1045,13 @@ int ssl_hook_Fixup(request_rec *r) |
244 |
- /* the always present HTTPS (=HTTP over SSL) flag! */ |
245 |
- apr_table_setn(env, "HTTPS", "on"); |
246 |
- |
247 |
-+#ifndef OPENSSL_NO_TLSEXT |
248 |
-+ /* add content of SNI TLS extension (if supplied with ClientHello) */ |
249 |
-+ if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) { |
250 |
-+ apr_table_set(env, "SSL_TLS_SNI", servername); |
251 |
-+ } |
252 |
-+#endif |
253 |
-+ |
254 |
- /* standard SSL environment variables */ |
255 |
- if (dc->nOptions & SSL_OPT_STDENVVARS) { |
256 |
- for (i = 0; ssl_hook_Fixup_vars[i]; i++) { |
257 |
-@@ -1810,3 +1844,141 @@ void ssl_callback_LogTracingState(MODSSL |
258 |
- } |
259 |
- } |
260 |
- |
261 |
-+#ifndef OPENSSL_NO_TLSEXT |
262 |
-+/* |
263 |
-+ * This callback function is executed when OpenSSL encounters an extended |
264 |
-+ * client hello with a server name indication extension ("SNI", cf. RFC 4366). |
265 |
-+ */ |
266 |
-+int ssl_callback_ServerNameIndication(SSL *ssl, int *al, modssl_ctx_t *mctx) |
267 |
-+{ |
268 |
-+ const char *servername = |
269 |
-+ SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); |
270 |
-+ |
271 |
-+ if (servername) { |
272 |
-+ conn_rec *c = (conn_rec *)SSL_get_app_data(ssl); |
273 |
-+ if (c) { |
274 |
-+ if (ap_vhost_iterate_given_conn(c, ssl_find_vhost, |
275 |
-+ (void *)servername)) { |
276 |
-+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, |
277 |
-+ "SSL virtual host for servername %s found", |
278 |
-+ servername); |
279 |
-+ return SSL_TLSEXT_ERR_OK; |
280 |
-+ } |
281 |
-+ else { |
282 |
-+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, |
283 |
-+ "No matching SSL virtual host for servername " |
284 |
-+ "%s found (using default/first virtual host)", |
285 |
-+ servername); |
286 |
-+ return SSL_TLSEXT_ERR_ALERT_WARNING; |
287 |
-+ } |
288 |
-+ } |
289 |
-+ } |
290 |
-+ |
291 |
-+ return SSL_TLSEXT_ERR_NOACK; |
292 |
-+} |
293 |
-+ |
294 |
-+/* |
295 |
-+ * Find a (name-based) SSL virtual host where either the ServerName |
296 |
-+ * or one of the ServerAliases matches the supplied name (to be used |
297 |
-+ * with ap_vhost_iterate_given_conn()) |
298 |
-+ */ |
299 |
-+static int ssl_find_vhost(void *servername, conn_rec *c, server_rec *s) |
300 |
-+{ |
301 |
-+ SSLSrvConfigRec *sc; |
302 |
-+ SSL *ssl; |
303 |
-+ BOOL found = FALSE; |
304 |
-+ apr_array_header_t *names; |
305 |
-+ int i; |
306 |
-+ |
307 |
-+ /* check ServerName */ |
308 |
-+ if (!strcasecmp(servername, s->server_hostname)) { |
309 |
-+ found = TRUE; |
310 |
-+ } |
311 |
-+ |
312 |
-+ /* |
313 |
-+ * if not matched yet, check ServerAlias entries |
314 |
-+ * (adapted from vhost.c:matches_aliases()) |
315 |
-+ */ |
316 |
-+ if (!found) { |
317 |
-+ names = s->names; |
318 |
-+ if (names) { |
319 |
-+ char **name = (char **)names->elts; |
320 |
-+ for (i = 0; i < names->nelts; ++i) { |
321 |
-+ if (!name[i]) |
322 |
-+ continue; |
323 |
-+ if (!strcasecmp(servername, name[i])) { |
324 |
-+ found = TRUE; |
325 |
-+ break; |
326 |
-+ } |
327 |
-+ } |
328 |
-+ } |
329 |
-+ } |
330 |
-+ |
331 |
-+ /* if still no match, check ServerAlias entries with wildcards */ |
332 |
-+ if (!found) { |
333 |
-+ names = s->wild_names; |
334 |
-+ if (names) { |
335 |
-+ char **name = (char **)names->elts; |
336 |
-+ for (i = 0; i < names->nelts; ++i) { |
337 |
-+ if (!name[i]) |
338 |
-+ continue; |
339 |
-+ if (!ap_strcasecmp_match(servername, name[i])) { |
340 |
-+ found = TRUE; |
341 |
-+ break; |
342 |
-+ } |
343 |
-+ } |
344 |
-+ } |
345 |
-+ } |
346 |
-+ |
347 |
-+ /* set SSL_CTX (if matched) */ |
348 |
-+ if (found && (ssl = ((SSLConnRec *)myConnConfig(c))->ssl) && |
349 |
-+ (sc = mySrvConfig(s))) { |
350 |
-+ SSL_set_SSL_CTX(ssl, sc->server->ssl_ctx); |
351 |
-+ /* |
352 |
-+ * SSL_set_SSL_CTX() only deals with the server cert, |
353 |
-+ * so we need to duplicate a few additional settings |
354 |
-+ * from the ctx by hand |
355 |
-+ */ |
356 |
-+ SSL_set_options(ssl, SSL_CTX_get_options(ssl->ctx)); |
357 |
-+ if ((SSL_get_verify_mode(ssl) == SSL_VERIFY_NONE) || |
358 |
-+ (SSL_num_renegotiations(ssl) == 0)) { |
359 |
-+ /* |
360 |
-+ * Only initialize the verification settings from the ctx |
361 |
-+ * if they are not yet set, or if we're called when a new |
362 |
-+ * SSL connection is set up (num_renegotiations == 0). |
363 |
-+ * Otherwise, we would possibly reset a per-directory |
364 |
-+ * configuration which was put into effect by ssl_hook_Access. |
365 |
-+ */ |
366 |
-+ SSL_set_verify(ssl, SSL_CTX_get_verify_mode(ssl->ctx), |
367 |
-+ SSL_CTX_get_verify_callback(ssl->ctx)); |
368 |
-+ } |
369 |
-+ |
370 |
-+ /* |
371 |
-+ * We also need to make sure that the correct mctx |
372 |
-+ * (accessed through the c->base_server->module_config vector) |
373 |
-+ * is assigned to the connection - the CRL callback e.g. |
374 |
-+ * makes use of it for retrieving its store (mctx->crl). |
375 |
-+ * Since logging in callbacks uses c->base_server in many |
376 |
-+ * cases, it also ensures that these messages are routed |
377 |
-+ * to the proper log. |
378 |
-+ */ |
379 |
-+ c->base_server = s; |
380 |
-+ |
381 |
-+ /* |
382 |
-+ * There is one special filter callback, which is set |
383 |
-+ * very early depending on the base_server's log level. |
384 |
-+ * If this is not the first vhost we're now selecting |
385 |
-+ * (and the first vhost doesn't use APLOG_DEBUG), then |
386 |
-+ * we need to set that callback here. |
387 |
-+ */ |
388 |
-+ if (c->base_server->loglevel >= APLOG_DEBUG) { |
389 |
-+ BIO_set_callback(SSL_get_rbio(ssl), ssl_io_data_cb); |
390 |
-+ BIO_set_callback_arg(SSL_get_rbio(ssl), (void *)ssl); |
391 |
-+ } |
392 |
-+ |
393 |
-+ return 1; |
394 |
-+ } |
395 |
-+ |
396 |
-+ return 0; |
397 |
-+} |
398 |
-+#endif |
399 |
-Index: httpd-2.2.x/modules/ssl/ssl_toolkit_compat.h |
400 |
-=================================================================== |
401 |
---- httpd-2.2.x/modules/ssl/ssl_toolkit_compat.h (revision 663014) |
402 |
-+++ httpd-2.2.x/modules/ssl/ssl_toolkit_compat.h (working copy) |
403 |
-@@ -264,6 +264,12 @@ typedef void (*modssl_popfree_fn)(char * |
404 |
- #define SSL_SESS_CACHE_NO_INTERNAL SSL_SESS_CACHE_NO_INTERNAL_LOOKUP |
405 |
- #endif |
406 |
- |
407 |
-+#ifndef OPENSSL_NO_TLSEXT |
408 |
-+#ifndef SSL_CTRL_SET_TLSEXT_HOSTNAME |
409 |
-+#define OPENSSL_NO_TLSEXT |
410 |
-+#endif |
411 |
-+#endif |
412 |
-+ |
413 |
- #endif /* SSL_TOOLKIT_COMPAT_H */ |
414 |
- |
415 |
- /** @} */ |
416 |
|
417 |
diff --git a/2.2/patches/05_all_fix_graceful_multiple_listeners.patch b/2.2/patches/05_all_fix_graceful_multiple_listeners.patch |
418 |
deleted file mode 100644 |
419 |
index 6ed9de1..0000000 |
420 |
--- a/2.2/patches/05_all_fix_graceful_multiple_listeners.patch |
421 |
+++ /dev/null |
422 |
@@ -1,42 +0,0 @@ |
423 |
---- httpd/httpd/branches/2.2.x/server/mpm/prefork/prefork.c 2009/01/31 20:53:11 739607 |
424 |
-+++ httpd/httpd/branches/2.2.x/server/mpm/prefork/prefork.c 2009/01/31 20:54:55 739608 |
425 |
-@@ -577,19 +577,27 @@ |
426 |
- apr_int32_t numdesc; |
427 |
- const apr_pollfd_t *pdesc; |
428 |
- |
429 |
-- /* timeout == -1 == wait forever */ |
430 |
-- status = apr_pollset_poll(pollset, -1, &numdesc, &pdesc); |
431 |
-+ /* check for termination first so we don't sleep for a while in |
432 |
-+ * poll if already signalled |
433 |
-+ */ |
434 |
-+ if (one_process && shutdown_pending) { |
435 |
-+ SAFE_ACCEPT(accept_mutex_off()); |
436 |
-+ return; |
437 |
-+ } |
438 |
-+ else if (die_now) { |
439 |
-+ /* In graceful stop/restart; drop the mutex |
440 |
-+ * and terminate the child. */ |
441 |
-+ SAFE_ACCEPT(accept_mutex_off()); |
442 |
-+ clean_child_exit(0); |
443 |
-+ } |
444 |
-+ /* timeout == 10 seconds to avoid a hang at graceful restart/stop |
445 |
-+ * caused by the closing of sockets by the signal handler |
446 |
-+ */ |
447 |
-+ status = apr_pollset_poll(pollset, apr_time_from_sec(10), |
448 |
-+ &numdesc, &pdesc); |
449 |
- if (status != APR_SUCCESS) { |
450 |
-- if (APR_STATUS_IS_EINTR(status)) { |
451 |
-- if (one_process && shutdown_pending) { |
452 |
-- return; |
453 |
-- } |
454 |
-- else if (die_now) { |
455 |
-- /* In graceful stop/restart; drop the mutex |
456 |
-- * and terminate the child. */ |
457 |
-- SAFE_ACCEPT(accept_mutex_off()); |
458 |
-- clean_child_exit(0); |
459 |
-- } |
460 |
-+ if (APR_STATUS_IS_TIMEUP(status) || |
461 |
-+ APR_STATUS_IS_EINTR(status)) { |
462 |
- continue; |
463 |
- } |
464 |
- /* Single Unix documents select as returning errnos |
465 |
|
466 |
diff --git a/2.2/patches/06_all_CVE-2009-1191.patch b/2.2/patches/06_all_CVE-2009-1191.patch |
467 |
deleted file mode 100644 |
468 |
index cbb790a..0000000 |
469 |
--- a/2.2/patches/06_all_CVE-2009-1191.patch |
470 |
+++ /dev/null |
471 |
@@ -1,37 +0,0 @@ |
472 |
-Index: modules/proxy/mod_proxy_ajp.c |
473 |
-=================================================================== |
474 |
---- modules/proxy/mod_proxy_ajp.c (Revision 763379) |
475 |
-+++ modules/proxy/mod_proxy_ajp.c (Arbeitskopie) |
476 |
-@@ -307,21 +307,17 @@ |
477 |
- "proxy: read zero bytes, expecting" |
478 |
- " %" APR_OFF_T_FMT " bytes", |
479 |
- content_length); |
480 |
-- status = ajp_send_data_msg(conn->sock, msg, 0); |
481 |
-- if (status != APR_SUCCESS) { |
482 |
-- /* We had a failure: Close connection to backend */ |
483 |
-- conn->close++; |
484 |
-- ap_log_error(APLOG_MARK, APLOG_ERR, status, r->server, |
485 |
-- "proxy: send failed to %pI (%s)", |
486 |
-- conn->worker->cp->addr, |
487 |
-- conn->worker->hostname); |
488 |
-- return HTTP_INTERNAL_SERVER_ERROR; |
489 |
-- } |
490 |
-- else { |
491 |
-- /* Client send zero bytes with C-L > 0 |
492 |
-- */ |
493 |
-- return HTTP_BAD_REQUEST; |
494 |
-- } |
495 |
-+ /* |
496 |
-+ * We can only get here if the client closed the connection |
497 |
-+ * to us without sending the body. |
498 |
-+ * Now the connection is in the wrong state on the backend. |
499 |
-+ * Sending an empty data msg doesn't help either as it does |
500 |
-+ * not move this connection to the correct state on the backend |
501 |
-+ * for later resusage by the next request again. |
502 |
-+ * Close it to clean things up. |
503 |
-+ */ |
504 |
-+ conn->close++; |
505 |
-+ return HTTP_BAD_REQUEST; |
506 |
- } |
507 |
- } |
508 |
- |
509 |
|
510 |
diff --git a/2.2/patches/07_all_CVE-2009-1195.patch b/2.2/patches/07_all_CVE-2009-1195.patch |
511 |
deleted file mode 100644 |
512 |
index 14a6dba..0000000 |
513 |
--- a/2.2/patches/07_all_CVE-2009-1195.patch |
514 |
+++ /dev/null |
515 |
@@ -1,136 +0,0 @@ |
516 |
-Index: server/config.c |
517 |
-=================================================================== |
518 |
---- server/config.c (revision 773036) |
519 |
-+++ server/config.c (working copy) |
520 |
-@@ -1510,7 +1510,7 @@ |
521 |
- parms.temp_pool = ptemp; |
522 |
- parms.server = s; |
523 |
- parms.override = (RSRC_CONF | OR_ALL) & ~(OR_AUTHCFG | OR_LIMIT); |
524 |
-- parms.override_opts = OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER | OPT_MULTI; |
525 |
-+ parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI; |
526 |
- |
527 |
- parms.config_file = ap_pcfg_open_custom(p, "-c/-C directives", |
528 |
- &arr_parms, NULL, |
529 |
-@@ -1617,7 +1617,7 @@ |
530 |
- parms.temp_pool = ptemp; |
531 |
- parms.server = s; |
532 |
- parms.override = (RSRC_CONF | OR_ALL) & ~(OR_AUTHCFG | OR_LIMIT); |
533 |
-- parms.override_opts = OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER | OPT_MULTI; |
534 |
-+ parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI; |
535 |
- |
536 |
- rv = ap_pcfg_openfile(&cfp, p, fname); |
537 |
- if (rv != APR_SUCCESS) { |
538 |
-@@ -1755,7 +1755,7 @@ |
539 |
- parms.temp_pool = ptemp; |
540 |
- parms.server = s; |
541 |
- parms.override = (RSRC_CONF | OR_ALL) & ~(OR_AUTHCFG | OR_LIMIT); |
542 |
-- parms.override_opts = OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER | OPT_MULTI; |
543 |
-+ parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI; |
544 |
- parms.limited = -1; |
545 |
- |
546 |
- errmsg = ap_walk_config(conftree, &parms, s->lookup_defaults); |
547 |
-Index: server/core.c |
548 |
-=================================================================== |
549 |
---- server/core.c (revision 773036) |
550 |
-+++ server/core.c (working copy) |
551 |
-@@ -108,8 +108,7 @@ |
552 |
- conf->opts = dir ? OPT_UNSET : OPT_UNSET|OPT_ALL; |
553 |
- conf->opts_add = conf->opts_remove = OPT_NONE; |
554 |
- conf->override = dir ? OR_UNSET : OR_UNSET|OR_ALL; |
555 |
-- conf->override_opts = OPT_UNSET | OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER |
556 |
-- | OPT_MULTI; |
557 |
-+ conf->override_opts = OPT_UNSET | OPT_ALL | OPT_SYM_OWNER | OPT_MULTI; |
558 |
- |
559 |
- conf->content_md5 = 2; |
560 |
- conf->accept_path_info = 3; |
561 |
-@@ -242,8 +241,15 @@ |
562 |
- conf->opts_remove = (conf->opts_remove & ~new->opts_add) |
563 |
- | new->opts_remove; |
564 |
- conf->opts = (conf->opts & ~conf->opts_remove) | conf->opts_add; |
565 |
-- if ((base->opts & OPT_INCNOEXEC) && (new->opts & OPT_INCLUDES)) { |
566 |
-- conf->opts = (conf->opts & ~OPT_INCNOEXEC) | OPT_INCLUDES; |
567 |
-+ |
568 |
-+ /* If Includes was enabled with exec in the base config, but |
569 |
-+ * was enabled without exec in the new config, then disable |
570 |
-+ * exec in the merged set. */ |
571 |
-+ if (((base->opts & (OPT_INCLUDES|OPT_INC_WITH_EXEC)) |
572 |
-+ == (OPT_INCLUDES|OPT_INC_WITH_EXEC)) |
573 |
-+ && ((new->opts & (OPT_INCLUDES|OPT_INC_WITH_EXEC)) |
574 |
-+ == OPT_INCLUDES)) { |
575 |
-+ conf->opts &= ~OPT_INC_WITH_EXEC; |
576 |
- } |
577 |
- } |
578 |
- else { |
579 |
-@@ -1304,10 +1310,12 @@ |
580 |
- opt = OPT_INDEXES; |
581 |
- } |
582 |
- else if (!strcasecmp(w, "Includes")) { |
583 |
-- opt = OPT_INCLUDES; |
584 |
-+ /* If Includes is permitted, both Includes and |
585 |
-+ * IncludesNOEXEC may be changed. */ |
586 |
-+ opt = (OPT_INCLUDES | OPT_INC_WITH_EXEC); |
587 |
- } |
588 |
- else if (!strcasecmp(w, "IncludesNOEXEC")) { |
589 |
-- opt = (OPT_INCLUDES | OPT_INCNOEXEC); |
590 |
-+ opt = OPT_INCLUDES; |
591 |
- } |
592 |
- else if (!strcasecmp(w, "FollowSymLinks")) { |
593 |
- opt = OPT_SYM_LINKS; |
594 |
-@@ -1428,10 +1436,10 @@ |
595 |
- opt = OPT_INDEXES; |
596 |
- } |
597 |
- else if (!strcasecmp(w, "Includes")) { |
598 |
-- opt = OPT_INCLUDES; |
599 |
-+ opt = (OPT_INCLUDES | OPT_INC_WITH_EXEC); |
600 |
- } |
601 |
- else if (!strcasecmp(w, "IncludesNOEXEC")) { |
602 |
-- opt = (OPT_INCLUDES | OPT_INCNOEXEC); |
603 |
-+ opt = OPT_INCLUDES; |
604 |
- } |
605 |
- else if (!strcasecmp(w, "FollowSymLinks")) { |
606 |
- opt = OPT_SYM_LINKS; |
607 |
-Index: modules/filters/mod_include.c |
608 |
-=================================================================== |
609 |
---- modules/filters/mod_include.c (revision 773036) |
610 |
-+++ modules/filters/mod_include.c (working copy) |
611 |
-@@ -3574,7 +3574,7 @@ |
612 |
- intern->seen_eos = 0; |
613 |
- intern->state = PARSE_PRE_HEAD; |
614 |
- ctx->flags = (SSI_FLAG_PRINTING | SSI_FLAG_COND_TRUE); |
615 |
-- if (ap_allow_options(r) & OPT_INCNOEXEC) { |
616 |
-+ if ((ap_allow_options(r) & OPT_INC_WITH_EXEC) == 0) { |
617 |
- ctx->flags |= SSI_FLAG_NO_EXEC; |
618 |
- } |
619 |
- intern->accessenable = conf->accessenable; |
620 |
-Index: include/http_core.h |
621 |
-=================================================================== |
622 |
---- include/http_core.h (revision 773036) |
623 |
-+++ include/http_core.h (working copy) |
624 |
-@@ -65,7 +65,7 @@ |
625 |
- #define OPT_NONE 0 |
626 |
- /** Indexes directive */ |
627 |
- #define OPT_INDEXES 1 |
628 |
--/** Includes directive */ |
629 |
-+/** SSI is enabled without exec= permission */ |
630 |
- #define OPT_INCLUDES 2 |
631 |
- /** FollowSymLinks directive */ |
632 |
- #define OPT_SYM_LINKS 4 |
633 |
-@@ -73,14 +73,14 @@ |
634 |
- #define OPT_EXECCGI 8 |
635 |
- /** directive unset */ |
636 |
- #define OPT_UNSET 16 |
637 |
--/** IncludesNOEXEC directive */ |
638 |
--#define OPT_INCNOEXEC 32 |
639 |
-+/** SSI exec= permission is permitted, iff OPT_INCLUDES is also set */ |
640 |
-+#define OPT_INC_WITH_EXEC 32 |
641 |
- /** SymLinksIfOwnerMatch directive */ |
642 |
- #define OPT_SYM_OWNER 64 |
643 |
- /** MultiViews directive */ |
644 |
- #define OPT_MULTI 128 |
645 |
- /** All directives */ |
646 |
--#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_SYM_LINKS|OPT_EXECCGI) |
647 |
-+#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_INC_WITH_EXEC|OPT_SYM_LINKS|OPT_EXECCGI) |
648 |
- /** @} */ |
649 |
- |
650 |
- /** |
651 |
- |
652 |
|
653 |
diff --git a/2.2/patches/08_all_CVE-2009-1890.patch b/2.2/patches/08_all_CVE-2009-1890.patch |
654 |
deleted file mode 100644 |
655 |
index 672c82b..0000000 |
656 |
--- a/2.2/patches/08_all_CVE-2009-1890.patch |
657 |
+++ /dev/null |
658 |
@@ -1,38 +0,0 @@ |
659 |
---- httpd/httpd/trunk/modules/proxy/mod_proxy_http.c 2009/07/02 13:37:39 790586 |
660 |
-+++ httpd/httpd/trunk/modules/proxy/mod_proxy_http.c 2009/07/02 13:41:18 790587 |
661 |
-@@ -427,10 +427,16 @@ |
662 |
- apr_off_t bytes_streamed = 0; |
663 |
- |
664 |
- if (old_cl_val) { |
665 |
-+ char *endstr; |
666 |
-+ |
667 |
- add_cl(p, bucket_alloc, header_brigade, old_cl_val); |
668 |
-- if (APR_SUCCESS != (status = apr_strtoff(&cl_val, old_cl_val, NULL, |
669 |
-- 0))) { |
670 |
-- return HTTP_INTERNAL_SERVER_ERROR; |
671 |
-+ status = apr_strtoff(&cl_val, old_cl_val, &endstr, 10); |
672 |
-+ |
673 |
-+ if (status || *endstr || endstr == old_cl_val || cl_val < 0) { |
674 |
-+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, |
675 |
-+ "proxy: could not parse request Content-Length (%s)", |
676 |
-+ old_cl_val); |
677 |
-+ return HTTP_BAD_REQUEST; |
678 |
- } |
679 |
- } |
680 |
- terminate_headers(bucket_alloc, header_brigade); |
681 |
-@@ -463,8 +469,13 @@ |
682 |
- * |
683 |
- * Prevents HTTP Response Splitting. |
684 |
- */ |
685 |
-- if (bytes_streamed > cl_val) |
686 |
-- continue; |
687 |
-+ if (bytes_streamed > cl_val) { |
688 |
-+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
689 |
-+ "proxy: read more bytes of request body than expected " |
690 |
-+ "(got %" APR_OFF_T_FMT ", expected %" APR_OFF_T_FMT ")", |
691 |
-+ bytes_streamed, cl_val); |
692 |
-+ return HTTP_INTERNAL_SERVER_ERROR; |
693 |
-+ } |
694 |
- |
695 |
- if (header_brigade) { |
696 |
- /* we never sent the header brigade, so go ahead and |
697 |
|
698 |
diff --git a/2.2/patches/09_all_CVE-2009-1891.patch b/2.2/patches/09_all_CVE-2009-1891.patch |
699 |
deleted file mode 100644 |
700 |
index 4d778f8..0000000 |
701 |
--- a/2.2/patches/09_all_CVE-2009-1891.patch |
702 |
+++ /dev/null |
703 |
@@ -1,29 +0,0 @@ |
704 |
---- httpd/httpd/branches/2.2.x/server/core_filters.c 2009/07/06 12:01:05 791453 |
705 |
-+++ httpd/httpd/branches/2.2.x/server/core_filters.c 2009/07/06 12:03:20 791454 |
706 |
-@@ -542,6 +542,12 @@ |
707 |
- apr_read_type_e eblock = APR_NONBLOCK_READ; |
708 |
- apr_pool_t *input_pool = b->p; |
709 |
- |
710 |
-+ /* Fail quickly if the connection has already been aborted. */ |
711 |
-+ if (c->aborted) { |
712 |
-+ apr_brigade_cleanup(b); |
713 |
-+ return APR_ECONNABORTED; |
714 |
-+ } |
715 |
-+ |
716 |
- if (ctx == NULL) { |
717 |
- ctx = apr_pcalloc(c->pool, sizeof(*ctx)); |
718 |
- net->out_ctx = ctx; |
719 |
-@@ -909,12 +915,9 @@ |
720 |
- /* No need to check for SUCCESS, we did that above. */ |
721 |
- if (!APR_STATUS_IS_EAGAIN(rv)) { |
722 |
- c->aborted = 1; |
723 |
-+ return APR_ECONNABORTED; |
724 |
- } |
725 |
- |
726 |
-- /* The client has aborted, but the request was successful. We |
727 |
-- * will report success, and leave it to the access and error |
728 |
-- * logs to note that the connection was aborted. |
729 |
-- */ |
730 |
- return APR_SUCCESS; |
731 |
- } |
732 |
- |
733 |
|
734 |
diff --git a/2.2/patches/10_all_r779472.patch b/2.2/patches/10_all_r779472.patch |
735 |
deleted file mode 100644 |
736 |
index c4bb6cb..0000000 |
737 |
--- a/2.2/patches/10_all_r779472.patch |
738 |
+++ /dev/null |
739 |
@@ -1,67 +0,0 @@ |
740 |
-Index: server/core.c |
741 |
-=================================================================== |
742 |
---- server/core.c (revision 779471) |
743 |
-+++ server/core.c (revision 779472) |
744 |
-@@ -661,7 +661,11 @@ |
745 |
- core_dir_config *conf = |
746 |
- (core_dir_config *)ap_get_module_config(r->per_dir_config, &core_module); |
747 |
- |
748 |
-- return conf->opts; |
749 |
-+ /* Per comment in http_core.h - the OPT_INC_WITH_EXEC bit is |
750 |
-+ * inverted, such that the exposed semantics match that of |
751 |
-+ * OPT_INCNOEXEC; i.e., the bit is only enabled if exec= is *not* |
752 |
-+ * permitted. */ |
753 |
-+ return conf->opts ^ OPT_INC_WITH_EXEC; |
754 |
- } |
755 |
- |
756 |
- AP_DECLARE(int) ap_allow_overrides(request_rec *r) |
757 |
-Index: modules/filters/mod_include.c |
758 |
-=================================================================== |
759 |
---- modules/filters/mod_include.c (revision 779471) |
760 |
-+++ modules/filters/mod_include.c (revision 779472) |
761 |
-@@ -3565,7 +3565,7 @@ |
762 |
- intern->seen_eos = 0; |
763 |
- intern->state = PARSE_PRE_HEAD; |
764 |
- ctx->flags = (SSI_FLAG_PRINTING | SSI_FLAG_COND_TRUE); |
765 |
-- if ((ap_allow_options(r) & OPT_INC_WITH_EXEC) == 0) { |
766 |
-+ if (ap_allow_options(r) & OPT_INCNOEXEC) { |
767 |
- ctx->flags |= SSI_FLAG_NO_EXEC; |
768 |
- } |
769 |
- intern->accessenable = conf->accessenable; |
770 |
-Index: include/http_core.h |
771 |
-=================================================================== |
772 |
---- include/http_core.h (revision 779471) |
773 |
-+++ include/http_core.h (revision 779472) |
774 |
-@@ -73,16 +73,29 @@ |
775 |
- #define OPT_EXECCGI 8 |
776 |
- /** directive unset */ |
777 |
- #define OPT_UNSET 16 |
778 |
--/** SSI exec= permission is permitted, iff OPT_INCLUDES is also set */ |
779 |
--#define OPT_INC_WITH_EXEC 32 |
780 |
-+/** IncludesNOEXEC directive */ |
781 |
-+#define OPT_INCNOEXEC 32 |
782 |
- /** SymLinksIfOwnerMatch directive */ |
783 |
- #define OPT_SYM_OWNER 64 |
784 |
- /** MultiViews directive */ |
785 |
- #define OPT_MULTI 128 |
786 |
- /** All directives */ |
787 |
--#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_INC_WITH_EXEC|OPT_SYM_LINKS|OPT_EXECCGI) |
788 |
-+#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_INCNOEXEC|OPT_SYM_LINKS|OPT_EXECCGI) |
789 |
- /** @} */ |
790 |
- |
791 |
-+#ifdef CORE_PRIVATE |
792 |
-+/* For internal use only - since 2.2.12, the OPT_INCNOEXEC bit is |
793 |
-+ * internally replaced by OPT_INC_WITH_EXEC. The internal semantics |
794 |
-+ * of the two SSI-related bits are hence: |
795 |
-+ * |
796 |
-+ * OPT_INCLUDES => "enable SSI, without exec= permission" |
797 |
-+ * OPT_INC_WITH_EXEC => "iff OPT_INCLUDES is set, also enable exec=" |
798 |
-+ * |
799 |
-+ * The set of options exposed via ap_allow_options() retains the |
800 |
-+ * semantics of OPT_INCNOEXEC by flipping the bit. */ |
801 |
-+#define OPT_INC_WITH_EXEC OPT_INCNOEXEC |
802 |
-+#endif |
803 |
-+ |
804 |
- /** |
805 |
- * @defgroup get_remote_host Remote Host Resolution |
806 |
- * @ingroup APACHE_CORE_HTTPD |
807 |
|
808 |
diff --git a/2.2/patches/11_all_r790738.patch b/2.2/patches/11_all_r790738.patch |
809 |
deleted file mode 100644 |
810 |
index 3ddf33b..0000000 |
811 |
--- a/2.2/patches/11_all_r790738.patch |
812 |
+++ /dev/null |
813 |
@@ -1,18 +0,0 @@ |
814 |
-Index: server/core.c |
815 |
-=================================================================== |
816 |
---- server/core.c (revision 790737) |
817 |
-+++ server/core.c (revision 790738) |
818 |
-@@ -665,7 +665,12 @@ |
819 |
- * inverted, such that the exposed semantics match that of |
820 |
- * OPT_INCNOEXEC; i.e., the bit is only enabled if exec= is *not* |
821 |
- * permitted. */ |
822 |
-- return conf->opts ^ OPT_INC_WITH_EXEC; |
823 |
-+ if (conf->opts & OPT_INCLUDES) { |
824 |
-+ return conf->opts ^ OPT_INC_WITH_EXEC; |
825 |
-+ } |
826 |
-+ else { |
827 |
-+ return conf->opts; |
828 |
-+ } |
829 |
- } |
830 |
- |
831 |
- AP_DECLARE(int) ap_allow_overrides(request_rec *r) |