From 86ccab7b48357a3a842a80f1cb85c5fb435511bd Mon Sep 17 00:00:00 2001 From: Renbo Date: Tue, 13 Aug 2024 10:42:56 +0800 Subject: [PATCH 1/5] update to httpd-2.4.37-65.2.src.rpm Signed-off-by: Renbo --- 1000-httpd-anolis-rebrand.patch | 370 -------------------- 1001-httpd-anolis-support-loongarch64.patch | 32 -- httpd-2.4.37-CVE-2024-38476.patch | 301 ++++++++++++++++ httpd-2.4.37-CVE-2024-39884+.patch | 266 ++++++++++++++ httpd-2.4.37-r1919325.patch | 217 ++++++++++++ httpd-2.4.37-sw.patch | 66 ---- httpd.spec | 41 +-- 7 files changed, 803 insertions(+), 490 deletions(-) delete mode 100644 1000-httpd-anolis-rebrand.patch delete mode 100644 1001-httpd-anolis-support-loongarch64.patch create mode 100644 httpd-2.4.37-CVE-2024-38476.patch create mode 100644 httpd-2.4.37-CVE-2024-39884+.patch create mode 100644 httpd-2.4.37-r1919325.patch delete mode 100644 httpd-2.4.37-sw.patch diff --git a/1000-httpd-anolis-rebrand.patch b/1000-httpd-anolis-rebrand.patch deleted file mode 100644 index 94aa798..0000000 --- a/1000-httpd-anolis-rebrand.patch +++ /dev/null @@ -1,370 +0,0 @@ -From de0dd0e04d3045426c4b0fd1d681c3a80575376b Mon Sep 17 00:00:00 2001 -From: zhangbinchen -Date: Tue, 16 Mar 2021 18:17:35 +0800 -Subject: [PATCH] rebrand-for-anolis - -Signed-off-by: zhangbinchen ---- - docs/manual/developer/thread_safety.html.en | 2 +- - docs/manual/index.html.de | 4 ++-- - docs/manual/index.html.en | 4 ++-- - docs/manual/index.html.es | 4 ++-- - docs/manual/index.html.fr.utf8 | 4 ++-- - docs/manual/index.html.ja.utf8 | 4 ++-- - docs/manual/index.html.tr.utf8 | 4 ++-- - docs/manual/index.html.zh-cn.utf8 | 4 ++-- - docs/manual/install.html.fr.utf8 | 4 ++-- - docs/manual/install.html.tr.utf8 | 4 ++-- - docs/manual/platform/index.html.en | 4 ++-- - docs/manual/platform/index.html.fr.utf8 | 4 ++-- - docs/manual/platform/rpm.html.en | 6 +++--- - docs/manual/platform/rpm.html.fr.utf8 | 6 +++--- - docs/manual/ssl/ssl_compat.html.en | 10 ++-------- - docs/manual/ssl/ssl_compat.html.fr.utf8 | 11 ++--------- - 16 files changed, 33 insertions(+), 46 deletions(-) - -diff --git a/docs/manual/developer/thread_safety.html.en b/docs/manual/developer/thread_safety.html.en -index e9e2130..e3fb303 100644 ---- a/docs/manual/developer/thread_safety.html.en -+++ b/docs/manual/developer/thread_safety.html.en -@@ -304,4 +304,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.de b/docs/manual/index.html.de -index 84032a9..d039a72 100644 ---- a/docs/manual/index.html.de -+++ b/docs/manual/index.html.de -@@ -93,7 +93,7 @@ - -

Plattform-spezifische Anmerkungen

- -@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.en b/docs/manual/index.html.en -index 493be56..294258c 100644 ---- a/docs/manual/index.html.en -+++ b/docs/manual/index.html.en -@@ -91,7 +91,7 @@ Documentation - -

Platform Specific Notes

- -@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.es b/docs/manual/index.html.es -index 0256bec..68aa346 100644 ---- a/docs/manual/index.html.es -+++ b/docs/manual/index.html.es -@@ -94,7 +94,7 @@ Documentaci - -

Notas Sobre Plataformas Específicas

- -

Otros Temas

-@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.fr.utf8 b/docs/manual/index.html.fr.utf8 -index e729674..4eb6d0a 100644 ---- a/docs/manual/index.html.fr.utf8 -+++ b/docs/manual/index.html.fr.utf8 -@@ -93,7 +93,7 @@ - -

Notes spécifiques aux différentes plateformes

- -@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.ja.utf8 b/docs/manual/index.html.ja.utf8 -index 37b85d3..1a62301 100644 ---- a/docs/manual/index.html.ja.utf8 -+++ b/docs/manual/index.html.ja.utf8 -@@ -93,7 +93,7 @@ - -

プラットフォーム固有ã®æƒ…å ±

- -@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.tr.utf8 b/docs/manual/index.html.tr.utf8 -index 70a7f31..1036391 100644 ---- a/docs/manual/index.html.tr.utf8 -+++ b/docs/manual/index.html.tr.utf8 -@@ -91,7 +91,7 @@ Belgeleri - -

Platformlara Özgü Bilgiler

- -@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.zh-cn.utf8 b/docs/manual/index.html.zh-cn.utf8 -index 1f7f63f..76b88d8 100644 ---- a/docs/manual/index.html.zh-cn.utf8 -+++ b/docs/manual/index.html.zh-cn.utf8 -@@ -88,7 +88,7 @@ - -

å¹³å°ç›¸å…³è¯´æ˜Ž

- -@@ -119,4 +119,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/install.html.fr.utf8 b/docs/manual/install.html.fr.utf8 -index ccf39a2..5a0fd01 100644 ---- a/docs/manual/install.html.fr.utf8 -+++ b/docs/manual/install.html.fr.utf8 -@@ -69,7 +69,7 @@ -

Aperçu pour les plus pressés

- -
--
Installation sous Fedora/CentOS/Red Hat Enterprise Linux
-+
Installation sous AnolisOS/Fedora/CentOS/Red Hat Enterprise Linux
-
- 
sudo yum install httpd
- sudo service httpd start
-@@ -525,4 +525,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/install.html.tr.utf8 b/docs/manual/install.html.tr.utf8 -index fdb89ea..fd6d691 100644 ---- a/docs/manual/install.html.tr.utf8 -+++ b/docs/manual/install.html.tr.utf8 -@@ -66,7 +66,7 @@ -
-

Tez canlılar için genel bir bakış

-
--
Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum
-+
AnolisoS/Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum
-
- 
sudo yum install httpd
- sudo systemctl enable httpd
-@@ -494,4 +494,4 @@ if (typeof(prettyPrint) !== 'undefined') {
-     prettyPrint();
- }
- //-->
--
-\ No newline at end of file
-+
-diff --git a/docs/manual/platform/index.html.en b/docs/manual/platform/index.html.en
-index 07af003..8949d4d 100644
---- a/docs/manual/platform/index.html.en
-+++ b/docs/manual/platform/index.html.en
-@@ -66,7 +66,7 @@
-     
- 
-     

--      
RPM Based Systems (Redhat / CentOS / Fedora)

-+	    
RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)

-       

-         
This document explains how to build, install, and run Apache 2.4
-         on systems supporting the RPM packaging format.

-@@ -121,4 +121,4 @@ if (typeof(prettyPrint) !== 'undefined') {
-     prettyPrint();
- }
- //-->
--
-\ No newline at end of file
-+
-diff --git a/docs/manual/platform/index.html.fr.utf8 b/docs/manual/platform/index.html.fr.utf8
-index 03404a5..bc0a8a8 100644
---- a/docs/manual/platform/index.html.fr.utf8
-+++ b/docs/manual/platform/index.html.fr.utf8
-@@ -67,7 +67,7 @@
-     
- 
-     

--      
Systèmes à base de paquets RPM (Redhat / CentOS / Fedora)

-+	    
Systèmes à base de paquets RPM (AnolisOS / Redhat / CentOS / Fedora)

-       

-         
Ce document explique comment installer, configurer et
- 	exécuter Apache 2.4 sur des systèmes qui supportent le format de
-@@ -127,4 +127,4 @@ if (typeof(prettyPrint) !== 'undefined') {
-     prettyPrint();
- }
- //-->
--
-\ No newline at end of file
-+
-diff --git a/docs/manual/platform/rpm.html.en b/docs/manual/platform/rpm.html.en
-index 992fe9e..bc1c696 100644
---- a/docs/manual/platform/rpm.html.en
-+++ b/docs/manual/platform/rpm.html.en
-@@ -7,7 +7,7 @@
-               This file is generated from xml source: DO NOT EDIT
-         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-       -->
--Using Apache With RPM Based Systems (Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4
-+Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4
- 
- 
- 
-@@ -21,7 +21,7 @@
-
-
<-
-

Using Apache With RPM Based Systems (Redhat / CentOS / Fedora)

-+ Apache > HTTP Server > Documentation > Version 2.4 > Platform Specific Notes

Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)

-
-

Available Languages:  en  | -  fr 

-@@ -245,4 +245,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/platform/rpm.html.fr.utf8 b/docs/manual/platform/rpm.html.fr.utf8 -index 3ae9ee3..78e6f77 100644 ---- a/docs/manual/platform/rpm.html.fr.utf8 -+++ b/docs/manual/platform/rpm.html.fr.utf8 -@@ -7,7 +7,7 @@ - This file is generated from xml source: DO NOT EDIT - XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX - --> --Utiliser Apache sur les systèmes à base de paquets RPM (Redhat -+<title>Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat - / CentOS / Fedora) - Serveur HTTP Apache Version 2.4 - - -@@ -23,7 +23,7 @@ -
<-
-

Utiliser Apache sur les systèmes à base de paquets RPM (Redhat -+ plateformes

Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat - / CentOS / Fedora)

-
-

Langues Disponibles:  en  | -@@ -261,4 +261,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/ssl/ssl_compat.html.en b/docs/manual/ssl/ssl_compat.html.en -index fb7b888..122f52d 100644 ---- a/docs/manual/ssl/ssl_compat.html.en -+++ b/docs/manual/ssl/ssl_compat.html.en -@@ -31,13 +31,7 @@ - This page covers backwards compatibility between mod_ssl and other - SSL solutions. mod_ssl is not the only SSL solution for Apache; four - additional products are (or were) also available: Ben Laurie's freely --available Apache-SSL (from --where mod_ssl were originally derived in 1998), Red Hat's commercial --Secure Web Server (which was based on mod_ssl), Covalent's commercial --Raven SSL Module (also based on --mod_ssl) and finally C2Net's (now Red Hat's) commercial product Stronghold (based --on a different evolution branch, named Sioux up to Stronghold 2.x, and --based on mod_ssl since Stronghold 3.x).

-+available Apache-SSL

- -

- mod_ssl mostly provides a superset of the functionality of all the other -@@ -245,4 +239,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/ssl/ssl_compat.html.fr.utf8 b/docs/manual/ssl/ssl_compat.html.fr.utf8 -index 1c9a0c6..a4adb34 100644 ---- a/docs/manual/ssl/ssl_compat.html.fr.utf8 -+++ b/docs/manual/ssl/ssl_compat.html.fr.utf8 -@@ -31,14 +31,7 @@ -

Ce document couvre la compatibilité ascendante entre mod_ssl et - d'autres solutions SSL. mod_ssl n'est pas la seule solution SSL pour Apache ; - quatre autres produits sont (ou ont été) également disponibles : --Apache-SSL, le produit libre de --Ben Laurie (d'où mod_ssl est issu à l'origine en 1998), Secure --Web Server, un produit commercial de Red Hat (basé sur mod_ssl), --Raven SSL Module, un produit commercial --de Covalent (basé lui aussi sur mod_ssl), et enfin Stronghold, produit --commercial de C2Net et maintenant de Red Hat, (basé sur une branche --d'évolution différente appelée Sioux jusqu'à Stronghold 2.x et basé sur --mod_ssl depuis Stronghold 3.x).

-+Apache-SSL

- -

En plus de ses fonctionnalités propres, mod_ssl rassemble la plupart de - celles des autres solutions SSL, si bien qu'il est très simple de -@@ -254,4 +247,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ --- -2.18.4 - diff --git a/1001-httpd-anolis-support-loongarch64.patch b/1001-httpd-anolis-support-loongarch64.patch deleted file mode 100644 index 37efba2..0000000 --- a/1001-httpd-anolis-support-loongarch64.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -Nur httpd-2.4.37/build/config.guess httpd-2.4.37.new/build/config.guess ---- httpd-2.4.37/build/config.guess 2018-10-18 22:34:08.000000000 +0800 -+++ httpd-2.4.37.new/build/config.guess 2021-11-04 11:15:42.592000000 +0800 -@@ -897,6 +897,9 @@ - UNAME_MACHINE=aarch64_be - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; -+ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) -+ echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" -+ exit ;; - alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in - EV5) UNAME_MACHINE=alphaev5 ;; -diff -Nur httpd-2.4.37/build/config.sub httpd-2.4.37.new/build/config.sub ---- httpd-2.4.37/build/config.sub 2018-10-18 22:34:08.000000000 +0800 -+++ httpd-2.4.37.new/build/config.sub 2021-11-04 11:15:42.592000000 +0800 -@@ -265,6 +265,7 @@ - | k1om \ - | le32 | le64 \ - | lm32 \ -+ | loongarch32 | loongarch64 | loongarchx32 \ - | m32c | m32r | m32rle | m68000 | m68k | m88k \ - | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ - | mips | mipsbe | mipseb | mipsel | mipsle \ -@@ -390,6 +391,7 @@ - | k1om-* \ - | le32-* | le64-* \ - | lm32-* \ -+ | loongarch32-* | loongarch64-* | loongarchx32-* \ - | m32c-* | m32r-* | m32rle-* \ - | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ - | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ diff --git a/httpd-2.4.37-CVE-2024-38476.patch b/httpd-2.4.37-CVE-2024-38476.patch new file mode 100644 index 0000000..7f165e1 --- /dev/null +++ b/httpd-2.4.37-CVE-2024-38476.patch @@ -0,0 +1,301 @@ + +-- backported bnotes needed by this CVE fix from https://svn.apache.org/viewvc?view=revision&revision=1887384 +-- modified it a little bit so it actually doesn't store bnotes into req structure to not brake compatibility +-- but it stores AP_REQUEST_TRUSTED_CT info into r->notes + +diff --git a/include/http_protocol.h b/include/http_protocol.h +index 8ed77ac..81949ca 100644 +--- a/include/http_protocol.h ++++ b/include/http_protocol.h +@@ -402,6 +402,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l); + */ + AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct); + ++/** ++ * Set the content type for this request (r->content_type). ++ * @param r The current request ++ * @param ct The new content type ++ * @param trusted If non-zero, The content-type should come from a ++ * trusted source such as server configuration rather ++ * than application output. ++ * for the AddOutputFilterByType directive to work correctly. ++ */ ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted); ++ + /** + * Set the Accept-Ranges header for this response + * @param r The current request +diff --git a/include/httpd.h b/include/httpd.h +index 99f7f04..d8746c1 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -645,6 +645,7 @@ struct ap_method_list_t { + /** the array used for extension methods */ + apr_array_header_t *method_list; + }; ++/** @} */ + + /** + * @defgroup module_magic Module Magic mime types +@@ -715,6 +716,31 @@ struct ap_method_list_t { + + /** @} // values_request_rec_used_path_info */ + ++#define AP_REQUEST_TRUSTED_CT "rh-bnotes-trusted-ct" ++ ++/** ++ * This is a convenience macro to ease with getting specific request ++ * binary notes. ++ */ ++#define AP_REQUEST_GET_BNOTE(r, mask) (apr_table_get(r->notes, mask) ? 1 : 0) ++ ++/** ++ * This is a convenience macro to ease with setting specific request ++ * binary notes. ++ */ ++#define AP_REQUEST_SET_BNOTE(r, mask, val) do { \ ++ if (val) \ ++ apr_table_setn(r->notes, mask, "1"); \ ++ else \ ++ apr_table_unset(r->notes, mask); \ ++} while (0) ++ ++/** ++ * Returns true if the content-type field is from a trusted source ++ */ ++#define AP_REQUEST_IS_TRUSTED_CT(r) \ ++ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT)) ++/** @} */ + + /* + * Things which may vary per file-lookup WITHIN a request --- +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index df862e0..d003aea 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1077,8 +1077,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct) + } + else if (!r->content_type || strcmp(r->content_type, ct)) { + r->content_type = ct; ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0); + } + } ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted) ++{ ++ ap_set_content_type(r, ct); ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0); ++} + + AP_DECLARE(void) ap_set_accept_ranges(request_rec *r) + { +diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c +index 28c53be..4cd1c48 100644 +--- a/modules/http/mod_mime.c ++++ b/modules/http/mod_mime.c +@@ -759,7 +759,7 @@ static int find_ct(request_rec *r) + int found_metadata = 0; + + if (r->finfo.filetype == APR_DIR) { +- ap_set_content_type(r, DIR_MAGIC_TYPE); ++ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1); + return OK; + } + +@@ -837,7 +837,7 @@ static int find_ct(request_rec *r) + if (exinfo == NULL || !exinfo->forced_type) { + if ((type = apr_hash_get(mime_type_extensions, ext, + APR_HASH_KEY_STRING)) != NULL) { +- ap_set_content_type(r, (char*) type); ++ ap_set_content_type_ex(r, (char*) type, 1); + found = 1; + } + } +@@ -846,7 +846,7 @@ static int find_ct(request_rec *r) + + /* empty string is treated as special case for RemoveType */ + if (exinfo->forced_type && *exinfo->forced_type) { +- ap_set_content_type(r, exinfo->forced_type); ++ ap_set_content_type_ex(r, exinfo->forced_type, 1); + found = 1; + } + +@@ -951,33 +951,33 @@ static int find_ct(request_rec *r) + memcpy(tmp, ctp->subtype, ctp->subtype_len); + tmp += ctp->subtype_len; + *tmp = 0; +- ap_set_content_type(r, base_content_type); ++ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + while (pp != NULL) { + if (charset && !strcmp(pp->attr, "charset")) { + if (!override) { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; charset=", + charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + override = 1; + } + } + else { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; ", pp->attr, + "=", pp->val, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + pp = pp->next; + } + if (charset && !override) { +- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type, + "; charset=", charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + } + } +diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c +index ac9c3b7..5e398b5 100644 +--- a/modules/mappers/mod_actions.c ++++ b/modules/mappers/mod_actions.c +@@ -182,8 +182,10 @@ static int action_handler(request_rec *r) + return DECLINED; + + /* Second, check for actions (which override the method scripts) */ +- action = r->handler ? r->handler : +- ap_field_noparam(r->pool, r->content_type); ++ action = r->handler; ++ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) { ++ action = ap_field_noparam(r->pool, r->content_type); ++ } + + if (action && (t = apr_table_get(conf->action_types, action))) { + int virtual = (*t++ == '0' ? 0 : 1); +diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c +index da68353..e91ba5f 100644 +--- a/modules/mappers/mod_negotiation.c ++++ b/modules/mappers/mod_negotiation.c +@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg) + * might be doing. + */ + if (sub_req->handler && !sub_req->content_type) { +- ap_set_content_type(sub_req, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1); + } + + /* +@@ -3008,14 +3008,14 @@ static int handle_map_file(request_rec *r) + /* set MIME type and charset as negotiated */ + if (best->mime_type && *best->mime_type) { + if (best->content_charset && *best->content_charset) { +- ap_set_content_type(r, apr_pstrcat(r->pool, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, + best->mime_type, + "; charset=", + best->content_charset, +- NULL)); ++ NULL), 1); + } + else { +- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1); + } + } + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index a25c7ae..2b70d66 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -5477,7 +5477,7 @@ static int hook_mimetype(request_rec *r) + rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'", + r->filename, t)); + +- ap_set_content_type(r, t); ++ ap_set_content_type_ex(r, t, 1); + } + + /* handler */ +diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c +index 1ea970d..55ab281 100644 +--- a/modules/metadata/mod_headers.c ++++ b/modules/metadata/mod_headers.c +@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + break; + case hdr_set: + if (!strcasecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + break; + case hdr_setifempty: + if (NULL == apr_table_get(headers, hdr->header)) { + if (!strcasecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + } +@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + const char *repl = process_regexp(hdr, r->content_type, r); + if (repl == NULL) + return 0; +- ap_set_content_type(r, repl); ++ ap_set_content_type_ex(r, repl, 1); + } + if (apr_table_get(headers, hdr->header)) { + edit_do ed; +diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c +index c12529a..fe30f27 100644 +--- a/modules/metadata/mod_mime_magic.c ++++ b/modules/metadata/mod_mime_magic.c +@@ -789,7 +789,7 @@ static int magic_rsl_to_request(request_rec *r) + /* XXX: this could be done at config time I'm sure... but I'm + * confused by all this magic_rsl stuff. -djg */ + ap_content_type_tolower(tmp); +- ap_set_content_type(r, tmp); ++ ap_set_content_type_ex(r, tmp, 1); + + if (state == rsl_encoding) { + tmp = rsl_strdup(r, encoding_frag, +@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r) + + /* extract content type/encoding/language from sub-request */ + if (sub->content_type) { +- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1); + #if MIME_MAGIC_DEBUG + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557) + MODNAME ": subrequest %s got %s", +diff --git a/server/config.c b/server/config.c +index f815b22..fc4d76b 100644 +--- a/server/config.c ++++ b/server/config.c +@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r) + } + + if (!r->handler) { +- if (r->content_type) { ++ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) { + handler = r->content_type; + if ((p=ap_strchr_c(handler, ';')) != NULL) { + char *new_handler = (char *)apr_pmemdup(r->pool, handler, +diff --git a/server/core.c b/server/core.c +index 8575aae..82706cf 100644 +--- a/server/core.c ++++ b/server/core.c +@@ -4722,7 +4722,7 @@ static int core_override_type(request_rec *r) + /* Check for overrides with ForceType / SetHandler + */ + if (conf->mime_type && strcmp(conf->mime_type, "none")) +- ap_set_content_type(r, (char*) conf->mime_type); ++ ap_set_content_type_ex(r, (char*) conf->mime_type, 1); + + if (conf->expr_handler) { + const char *err; diff --git a/httpd-2.4.37-CVE-2024-39884+.patch b/httpd-2.4.37-CVE-2024-39884+.patch new file mode 100644 index 0000000..03aae94 --- /dev/null +++ b/httpd-2.4.37-CVE-2024-39884+.patch @@ -0,0 +1,266 @@ +diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c +index 965fef5..6df3bf4 100644 +--- a/modules/cluster/mod_heartmonitor.c ++++ b/modules/cluster/mod_heartmonitor.c +@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r) + hmserver.seen = apr_time_now(); + hm_update_stat(ctx, &hmserver, r->pool); + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + ap_set_content_length(r, 2); + ap_rputs("OK", r); + ap_rflush(r); +diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c +index 792b514..28479b9 100644 +--- a/modules/dav/main/mod_dav.c ++++ b/modules/dav/main/mod_dav.c +@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body) + r->status = status; + r->status_line = ap_get_status_line(status); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* begin the response now... */ + ap_rvputs(r, +@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r, + { + r->status = err->status; + +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR + "status = status; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* Send the headers and actual multistatus response now... */ + ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR +@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r) + + /* send the options response */ + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* send the headers and response body */ + ap_rputs(DAV_XML_HEADER DEBUG_CR +@@ -3191,7 +3191,7 @@ static int dav_method_lock(request_rec *r) + (*locks_hooks->close_lockdb)(lockdb); + + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r); + if (lock == NULL) +diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c +index d818dc1..4d79b86 100644 +--- a/modules/examples/mod_example_hooks.c ++++ b/modules/examples/mod_example_hooks.c +@@ -993,7 +993,7 @@ static int x_handler(request_rec *r) + * Set the Content-type header. Note that we do not actually have to send + * the headers: this is done by the http core. + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + /* + * If we're only supposed to send header information (HEAD request), we're + * already there. +diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c +index d083d32..489e76c 100644 +--- a/modules/filters/mod_data.c ++++ b/modules/filters/mod_data.c +@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) + } + } + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + + } + +diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c +index a46a944..05f994c 100644 +--- a/modules/filters/mod_include.c ++++ b/modules/filters/mod_include.c +@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r) + if (r->handler && (strcmp(r->handler, "server-parsed") == 0)) + { + if (!r->content_type || !*r->content_type) { +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + r->handler = "default-handler"; + } +diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c +index ea6bf03..8b619e8 100644 +--- a/modules/filters/mod_proxy_html.c ++++ b/modules/filters/mod_proxy_html.c +@@ -933,7 +933,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422) + "No i18n support found. Install mod_xml2enc if required"); + enc = XML_CHAR_ENCODING_NONE; +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + else { + /* if we wanted a non-default charset_out, insert the +@@ -949,7 +949,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + cenc, NULL)); + } + else /* Normal case, everything worked, utf-8 output */ +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + + ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype); +diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c +index 66cd31c..4650d18 100644 +--- a/modules/generators/mod_cgi.c ++++ b/modules/generators/mod_cgi.c +@@ -795,7 +795,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c +index 102d2b3..57e119f 100644 +--- a/modules/generators/mod_cgid.c ++++ b/modules/generators/mod_cgid.c +@@ -1801,7 +1801,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c +index e5e63de..67df675 100644 +--- a/modules/generators/mod_info.c ++++ b/modules/generators/mod_info.c +@@ -777,7 +777,7 @@ static int display_info(request_rec * r) + return DECLINED; + } + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rputs(DOCTYPE_XHTML_1_0T + "\n" +diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c +index 5bada07..2cb38c7 100644 +--- a/modules/generators/mod_status.c ++++ b/modules/generators/mod_status.c +@@ -273,7 +273,7 @@ static int status_handler(request_rec *r) + if (r->method_number != M_GET) + return DECLINED; + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* + * Simple table-driven form data set parser that lets you alter the header +@@ -301,7 +301,7 @@ static int status_handler(request_rec *r) + no_table_report = 1; + break; + case STAT_OPT_AUTO: +- ap_set_content_type(r, "text/plain; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1); + short_report = 1; + break; + } +diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c +index 16cb23c..27c44b2 100644 +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -1245,7 +1245,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r) + } + } + +- ap_set_content_type(r, "message/http"); ++ ap_set_content_type_ex(r, "message/http", 1); + + /* Now we recreate the request, and echo it back */ + +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index 417fee6..d003aea 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1423,10 +1423,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error) + request_conf->suppress_charset = 1; /* avoid adding default + * charset later + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + else { +- ap_set_content_type(r, "text/html; charset=iso-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1); + } + + if ((status == HTTP_METHOD_NOT_ALLOWED) +diff --git a/modules/http/http_request.c b/modules/http/http_request.c +index e873aab..3521cfb 100644 +--- a/modules/http/http_request.c ++++ b/modules/http/http_request.c +@@ -709,7 +709,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r) + r->args = rr->args; + r->finfo = rr->finfo; + r->handler = rr->handler; +- ap_set_content_type(r, rr->content_type); ++ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(rr)); + r->content_encoding = rr->content_encoding; + r->content_languages = rr->content_languages; + r->per_dir_config = rr->per_dir_config; +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index eecb3f7..b71dc98 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r) + st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config, + &ldap_module); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + if (r->header_only) + return OK; +diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c +index 187a500..3e14933 100644 +--- a/modules/mappers/mod_imagemap.c ++++ b/modules/mappers/mod_imagemap.c +@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect) + + static void menu_header(request_rec *r, char *menu) + { +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", + ap_escape_html(r->pool, r->uri), +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index c599e1a..d5c20af 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -1480,7 +1480,7 @@ static int balancer_handler(request_rec *r) + + if (apr_table_get(params, "xml")) { + char date[APR_RFC822_DATE_LEN]; +- ap_set_content_type(r, "text/xml"); ++ ap_set_content_type_ex(r, "text/xml", 1); + ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r); + ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r); + ap_rputs(" <httpd:balancers>\n", r); diff --git a/httpd-2.4.37-r1919325.patch b/httpd-2.4.37-r1919325.patch new file mode 100644 index 0000000..7ec9972 --- /dev/null +++ b/httpd-2.4.37-r1919325.patch @@ -0,0 +1,217 @@ +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 114b126..a25c7ae 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -2343,9 +2343,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c) + * of an earlier expansion to include expansion specifiers that + * are interpreted by a later expansion, producing results that + * were not intended by the administrator. ++ * ++ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark ++ * is found respectively in a literal or in a lookup/expansion (whether ++ * it's the first or last qmark depends on [QSL]). Should be initialized ++ * to -1 and remains so if no qmark is found. + */ +-static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) ++static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry, ++ int *unsafe_qmark) + { ++#define EXPAND_SPECIALS "\\$%" + result_list *result, *current; + result_list sresult[SMALL_EXPANSION]; + unsigned spc = 0; +@@ -2353,8 +2360,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) + char *p, *c; + apr_pool_t *pool = ctx->r->pool; + +- span = strcspn(input, "\\$%"); + inputlen = strlen(input); ++ if (!unsafe_qmark) { ++ span = strcspn(input, EXPAND_SPECIALS); ++ } ++ else { ++ span = strcspn(input, EXPAND_SPECIALS "?"); ++ if (input[span] == '?') { ++ /* this qmark is not from an expansion thus safe */ ++ *unsafe_qmark = 0; ++ ++ /* keep tracking only if interested in the last qmark */ ++ if (entry && (entry->flags & RULEFLAG_QSLAST)) { ++ do { ++ span++; ++ span += strcspn(input + span, EXPAND_SPECIALS "?"); ++ } while (input[span] == '?'); ++ } ++ else { ++ unsafe_qmark = NULL; ++ span += strcspn(input + span, EXPAND_SPECIALS); ++ } ++ } ++ } + + /* fast exit */ + if (inputlen == span) { +@@ -2372,6 +2400,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) + + /* loop for specials */ + do { ++ int expanded = 0; ++ + /* prepare next entry */ + if (current->len) { + current->next = (spc < SMALL_EXPANSION) +@@ -2417,6 +2447,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) + current->len = span; + current->string = p; + outlen += span; ++ ++ expanded = 1; + p = endp + 1; + } + +@@ -2456,19 +2488,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) + } + + /* reuse of key variable as result */ +- key = lookup_map(ctx->r, map, do_expand(key, ctx, entry)); +- ++ key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL)); + if (!key && dflt && *dflt) { +- key = do_expand(dflt, ctx, entry); ++ key = do_expand(dflt, ctx, entry, NULL); + } +- +- if (key) { ++ if (key && *key) { + span = strlen(key); + current->len = span; + current->string = key; + outlen += span; + } + ++ expanded = 1; + p = endp + 1; + } + } +@@ -2498,8 +2529,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) + current->len = span; + current->string = bri->source + bri->regmatch[n].rm_so; + } +- + outlen += span; ++ ++ expanded = 1; + } + + p += 2; +@@ -2512,8 +2544,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry) + ++outlen; + } + ++ if (unsafe_qmark && expanded && current->len ++ && memchr(current->string, '?', current->len)) { ++ /* this qmark is from an expansion thus unsafe */ ++ *unsafe_qmark = 1; ++ ++ /* keep tracking only if interested in the last qmark */ ++ if (!entry || !(entry->flags & RULEFLAG_QSLAST)) { ++ unsafe_qmark = NULL; ++ } ++ } ++ + /* check the remainder */ +- if (*p && (span = strcspn(p, "\\$%")) > 0) { ++ if (!unsafe_qmark) { ++ span = strcspn(p, EXPAND_SPECIALS); ++ } ++ else { ++ span = strcspn(p, EXPAND_SPECIALS "?"); ++ if (p[span] == '?') { ++ /* this qmark is not from an expansion thus safe */ ++ *unsafe_qmark = 0; ++ ++ /* keep tracking only if interested in the last qmark */ ++ if (entry && (entry->flags & RULEFLAG_QSLAST)) { ++ do { ++ span++; ++ span += strcspn(p + span, EXPAND_SPECIALS "?"); ++ } while (p[span] == '?'); ++ } ++ else { ++ unsafe_qmark = NULL; ++ span += strcspn(p + span, EXPAND_SPECIALS); ++ } ++ } ++ } ++ if (span > 0) { + if (current->len) { + current->next = (spc < SMALL_EXPANSION) + ? &(sresult[spc++]) +@@ -2558,7 +2623,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx) + char *name, *val; + + while (env) { +- name = do_expand(env->data, ctx, NULL); ++ name = do_expand(env->data, ctx, NULL, NULL); + if (*name == '!') { + name++; + apr_table_unset(ctx->r->subprocess_env, name); +@@ -2685,7 +2750,7 @@ static void add_cookie(request_rec *r, char *s) + static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx) + { + while (cookie) { +- add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL)); ++ add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL)); + cookie = cookie->next; + } + +@@ -3964,7 +4029,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx) + int basis; + + if (p->ptype != CONDPAT_AP_EXPR) +- input = do_expand(p->input, ctx, NULL); ++ input = do_expand(p->input, ctx, NULL, NULL); + + switch (p->ptype) { + case CONDPAT_FILE_EXISTS: +@@ -4128,7 +4193,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, + char *expanded; + + if (p->forced_mimetype) { +- expanded = do_expand(p->forced_mimetype, ctx, p); ++ expanded = do_expand(p->forced_mimetype, ctx, p, NULL); + + if (*expanded) { + ap_str_tolower(expanded); +@@ -4142,7 +4207,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, + } + + if (p->forced_handler) { +- expanded = do_expand(p->forced_handler, ctx, p); ++ expanded = do_expand(p->forced_handler, ctx, p, NULL); + + if (*expanded) { + ap_str_tolower(expanded); +@@ -4279,12 +4344,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p, + + /* expand the result */ + if (!(p->flags & RULEFLAG_NOSUB)) { +- newuri = do_expand(p->output, ctx, p); ++ int unsafe_qmark = -1; ++ ++ if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) { ++ newuri = do_expand(p->output, ctx, p, NULL); ++ } ++ else { ++ newuri = do_expand(p->output, ctx, p, &unsafe_qmark); ++ } + rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, + newuri)); +- if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && +- ap_strcasestr(r->unparsed_uri, "%3f") && +- ap_strchr_c(newuri, '?')) { ++ ++ if (unsafe_qmark > 0) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() + "Unsafe URL with %%3f URL rewritten without " + "UnsafeAllow3F"); diff --git a/httpd-2.4.37-sw.patch b/httpd-2.4.37-sw.patch deleted file mode 100644 index 0951329..0000000 --- a/httpd-2.4.37-sw.patch +++ /dev/null @@ -1,66 +0,0 @@ -diff -Naur httpd-2.4.37.org/configure httpd-2.4.37.sw/configure ---- httpd-2.4.37.org/configure 2018-10-18 22:34:09.000000000 +0800 -+++ httpd-2.4.37.sw/configure 2023-07-21 14:55:43.876595734 +0800 -@@ -29566,6 +29566,10 @@ - # ulimit only accepts English "unlimited" on input - APACHECTL_ULIMIT="ulimit -S -n unlimited" - ;; -+ *sw_64*-dec-osf*) -+ # Tru64: -H is for setting, not retrieving -+ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" -+ ;; - *alpha*-dec-osf*) - # Tru64: -H is for setting, not retrieving - APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" -diff -Naur httpd-2.4.37.org/support/config.m4 httpd-2.4.37.sw/support/config.m4 ---- httpd-2.4.37.org/support/config.m4 2011-04-08 03:32:49.000000000 +0800 -+++ httpd-2.4.37.sw/support/config.m4 2023-07-21 14:56:03.520289713 +0800 -@@ -136,6 +136,10 @@ - # ulimit only accepts English "unlimited" on input - APACHECTL_ULIMIT="ulimit -S -n unlimited" - ;; -+ *sw_64*-dec-osf*) -+ # Tru64: -H is for setting, not retrieving -+ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" -+ ;; - *alpha*-dec-osf*) - # Tru64: -H is for setting, not retrieving - APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" - -diff -Nuar httpd-2.4.37.org/build/config.guess httpd-2.4.37.sw/build/config.guess ---- httpd-2.4.37.org/build/config.guess 2023-08-09 16:22:45.045389206 +0800 -+++ httpd-2.4.37.sw/build/config.guess 2023-08-09 16:24:04.103173784 +0800 -@@ -900,6 +900,14 @@ - loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) - echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" - exit ;; -+ sw_64:Linux:*:*) -+ case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in -+ sw) UNAME_MACHINE=sw_64 ;; -+ esac -+ objdump --private-headers /bin/sh | grep -q ld.so.1 -+ if test "$?" = 0 ; then LIBC=gnulibc1 ; fi -+ echo ${UNAME_MACHINE}-sunway-linux-${LIBC} -+ exit ;; - alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in - EV5) UNAME_MACHINE=alphaev5 ;; -diff -Nuar httpd-2.4.37.org/build/config.sub httpd-2.4.37.sw/build/config.sub ---- httpd-2.4.37.org/build/config.sub 2023-08-09 16:22:45.045389206 +0800 -+++ httpd-2.4.37.sw/build/config.sub 2023-08-09 16:23:26.159837338 +0800 -@@ -245,6 +245,7 @@ - 1750a | 580 \ - | a29k \ - | aarch64 | aarch64_be \ -+ | sw_64 \ - | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ - | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ - | am33_2.0 \ -@@ -370,6 +371,7 @@ - 580-* \ - | a29k-* \ - | aarch64-* | aarch64_be-* \ -+ | sw_64-* \ - | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ - | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ - | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ diff --git a/httpd.spec b/httpd.spec index ac8a603..e241bd8 100644 --- a/httpd.spec +++ b/httpd.spec @@ -1,11 +1,10 @@ -%define anolis_release .0.1 %define contentdir %{_datadir}/httpd %define docroot /var/www %define suexec_caller apache %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} %define vstring %(source /etc/os-release; echo ${NAME}) -%if 0%{?fedora} > 26 || 0%{?rhel} > 7 || 0%{?anolis} +%if 0%{?fedora} > 26 || 0%{?rhel} > 7 %global mpm event %else %global mpm prefork @@ -14,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.37 -Release: 65%{anolis_release}%{?dist}.1 +Release: 65%{?dist}.2 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source2: httpd.logrotate @@ -172,6 +171,8 @@ Patch92: httpd-2.4.37-mod_status-duplicate-key.patch Patch93: httpd-2.4.37-r1885607.patch # https://issues.redhat.com/browse/RHEL-14321 Patch94: httpd-2.4.57-r1884505+.patch +# https://bz.apache.org/bugzilla/show_bug.cgi?id=69197 +Patch95: httpd-2.4.37-r1919325.patch # Security fixes Patch200: httpd-2.4.37-r1851471.patch @@ -271,12 +272,11 @@ Patch243: httpd-2.4.37-CVE-2024-38473.patch Patch244: httpd-2.4.37-CVE-2024-38477.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295022 Patch245: httpd-2.4.37-CVE-2024-39573.patch - -# Add by Anolis -Patch1000: 1000-httpd-anolis-rebrand.patch -Patch1001: 1001-httpd-anolis-support-loongarch64.patch -Patch2000: httpd-2.4.37-sw.patch -# End +# https://bugzilla.redhat.com/show_bug.cgi?id=2295015 +Patch246: httpd-2.4.37-CVE-2024-38476.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2297362 +# https://bugzilla.redhat.com/show_bug.cgi?id=2295761 +Patch247: httpd-2.4.37-CVE-2024-39884+.patch License: ASL 2.0 Group: System Environment/Daemons @@ -287,7 +287,7 @@ BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: systemd-devel # web server testpage added to redhat-logos in 82.0 (rhbz1896319) # new logo requires new footer copyring which was added in rhbz1934800 -Requires: /etc/mime.types, system-logos-httpd +Requires: /etc/mime.types, system-logos(httpd-logo-ng) Obsoletes: httpd-suexec Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} @@ -509,11 +509,10 @@ interface for storing and accessing per-user session data. %patch244 -p1 -b .CVE-2024-38477 %patch245 -p1 -b .CVE-2024-39573 -# Add by Anolis -%patch1000 -p1 -%patch1001 -p1 -%patch2000 -p1 -# End +# CVE-2024-38474 regression fix +%patch95 -p1 -b .r1919325 +%patch246 -p1 -b .CVE-2024-38476 +%patch247 -p1 -b .CVE-2024-39884+ # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -1019,13 +1018,10 @@ rm -rf $RPM_BUILD_ROOT %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Wed Jul 24 2024 zhangbinchen <zhangbinchen@openanolis.org> - 2.4.37-65.0.1.1 -- Rebrand for Anolis OS -- Requires system-logos-httpd -- Support loongarch64 platform(Liwei Ge) -- add patch for CVE-2023-27522(guo.chuang@zte.com.cn) - cherry-pick `add sw patch #400077d851a81ce23aa39db271e26c3df254ae53`. (nijie@wxiat.com) - cherry-pick `change sw patch #bdacf2efe00d8445328f798df8c5520728801e8c`. (nijie@wxiat.com) +* Tue Aug 06 2024 LuboÅ¡ Uhliarik <luhliari@redhat.com> - 2.4.37-65.2 +- Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend + applications whose response headers are malicious or exploitable (CVE-2024-38476) +- Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix * Thu Jul 11 2024 LuboÅ¡ Uhliarik <luhliari@redhat.com> - 2.4.37-65.1 - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue @@ -1131,6 +1127,7 @@ rm -rf $RPM_BUILD_ROOT * Fri Jun 10 2022 LuboÅ¡ Uhliarik <luhliari@redhat.com> - 2.4.37-49 - Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer + dereference * Mon Mar 21 2022 LuboÅ¡ Uhliarik <luhliari@redhat.com> - 2.4.37-48 - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling -- Gitee From 1f2663764aa88c33c928278e9592a3c0386657cc Mon Sep 17 00:00:00 2001 From: Zhao Hang <wb-zh951434@alibaba-inc.com> Date: Fri, 17 Dec 2021 06:31:15 +0000 Subject: [PATCH 2/5] rebrand for anolis and requires system-logos-httpd --- 10000-htppd-anolis-rebrand.patch | 370 +++++++++++++++++++++++++++++++ httpd.spec | 17 +- 2 files changed, 384 insertions(+), 3 deletions(-) create mode 100644 10000-htppd-anolis-rebrand.patch diff --git a/10000-htppd-anolis-rebrand.patch b/10000-htppd-anolis-rebrand.patch new file mode 100644 index 0000000..94aa798 --- /dev/null +++ b/10000-htppd-anolis-rebrand.patch @@ -0,0 +1,370 @@ +From de0dd0e04d3045426c4b0fd1d681c3a80575376b Mon Sep 17 00:00:00 2001 +From: zhangbinchen <zhangbinchen@uniontech.com> +Date: Tue, 16 Mar 2021 18:17:35 +0800 +Subject: [PATCH] rebrand-for-anolis + +Signed-off-by: zhangbinchen <zhangbinchen@uniontech.com> +--- + docs/manual/developer/thread_safety.html.en | 2 +- + docs/manual/index.html.de | 4 ++-- + docs/manual/index.html.en | 4 ++-- + docs/manual/index.html.es | 4 ++-- + docs/manual/index.html.fr.utf8 | 4 ++-- + docs/manual/index.html.ja.utf8 | 4 ++-- + docs/manual/index.html.tr.utf8 | 4 ++-- + docs/manual/index.html.zh-cn.utf8 | 4 ++-- + docs/manual/install.html.fr.utf8 | 4 ++-- + docs/manual/install.html.tr.utf8 | 4 ++-- + docs/manual/platform/index.html.en | 4 ++-- + docs/manual/platform/index.html.fr.utf8 | 4 ++-- + docs/manual/platform/rpm.html.en | 6 +++--- + docs/manual/platform/rpm.html.fr.utf8 | 6 +++--- + docs/manual/ssl/ssl_compat.html.en | 10 ++-------- + docs/manual/ssl/ssl_compat.html.fr.utf8 | 11 ++--------- + 16 files changed, 33 insertions(+), 46 deletions(-) + +diff --git a/docs/manual/developer/thread_safety.html.en b/docs/manual/developer/thread_safety.html.en +index e9e2130..e3fb303 100644 +--- a/docs/manual/developer/thread_safety.html.en ++++ b/docs/manual/developer/thread_safety.html.en +@@ -304,4 +304,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.de b/docs/manual/index.html.de +index 84032a9..d039a72 100644 +--- a/docs/manual/index.html.de ++++ b/docs/manual/index.html.de +@@ -93,7 +93,7 @@ + </ul> + </div><div class="category"><h2><a name="platform" id="platform">Plattform-spezifische Anmerkungen</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">RPM-basierte Systeme (Redhat / CentOS / Fedora)</a></li> ++ <li><a href="platform/rpm.html">RPM-basierte Systeme (AnolisoS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + <li><a href="platform/ebcdic.html">EBCDIC-Portierung</a></li> + </ul> +@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.en b/docs/manual/index.html.en +index 493be56..294258c 100644 +--- a/docs/manual/index.html.en ++++ b/docs/manual/index.html.en +@@ -91,7 +91,7 @@ Documentation</h1> + </ul> + </div><div class="category"><h2><a name="platform" id="platform">Platform Specific Notes</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">RPM-based Systems (Redhat / CentOS / Fedora)</a></li> ++ <li><a href="platform/rpm.html">RPM-based Systems (AnolisOS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + <li><a href="platform/ebcdic.html">EBCDIC Port</a></li> + </ul> +@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.es b/docs/manual/index.html.es +index 0256bec..68aa346 100644 +--- a/docs/manual/index.html.es ++++ b/docs/manual/index.html.es +@@ -94,7 +94,7 @@ Documentaci + </ul> + </div><div class="category"><h2><a name="platform" id="platform">Notas Sobre Plataformas Específicas</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">Sistemas Basados en RPM (Redhat / CentOS / Fedora)</a></li> ++<li><a href="platform/rpm.html">Sistemas Basados en RPM (AnolisOS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + </ul> + </div><div class="category"><h2><a name="other" id="other">Otros Temas</a></h2> +@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.fr.utf8 b/docs/manual/index.html.fr.utf8 +index e729674..4eb6d0a 100644 +--- a/docs/manual/index.html.fr.utf8 ++++ b/docs/manual/index.html.fr.utf8 +@@ -93,7 +93,7 @@ + </ul> + </div><div class="category"><h2><a name="platform" id="platform">Notes spécifiques aux différentes plateformes</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">Systèmes basés sur les paquet RPM (Redhat / CentOS / Fedora)</a></li> ++ <li><a href="platform/rpm.html">Systèmes basés sur les paquet RPM (AnolisOS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + <li><a href="platform/ebcdic.html">Portage EBCDIC</a></li> + </ul> +@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.ja.utf8 b/docs/manual/index.html.ja.utf8 +index 37b85d3..1a62301 100644 +--- a/docs/manual/index.html.ja.utf8 ++++ b/docs/manual/index.html.ja.utf8 +@@ -93,7 +93,7 @@ + </ul> + </div><div class="category"><h2><a name="platform" id="platform">プラットフォーム固有ã®æƒ…å ±</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">RPMベースã®ã‚·ã‚¹ãƒ†ãƒ  (Redhat / CentOS / Fedora)</a></li> ++ <li><a href="platform/rpm.html">RPMベースã®ã‚·ã‚¹ãƒ†ãƒ  (AnolisOS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + <li><a href="platform/ebcdic.html">EBCDIC 版</a></li> + </ul> +@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.tr.utf8 b/docs/manual/index.html.tr.utf8 +index 70a7f31..1036391 100644 +--- a/docs/manual/index.html.tr.utf8 ++++ b/docs/manual/index.html.tr.utf8 +@@ -91,7 +91,7 @@ Belgeleri</h1> + </ul> + </div><div class="category"><h2><a name="platform" id="platform">Platformlara Özgü Bilgiler</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">RPM tabanlı Sistemler (Redhat / CentOS / Fedora)</a></li> ++ <li><a href="platform/rpm.html">RPM tabanlı Sistemler (AnolisOS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + <li><a href="platform/ebcdic.html">EBCDIC Port</a></li> + </ul> +@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/index.html.zh-cn.utf8 b/docs/manual/index.html.zh-cn.utf8 +index 1f7f63f..76b88d8 100644 +--- a/docs/manual/index.html.zh-cn.utf8 ++++ b/docs/manual/index.html.zh-cn.utf8 +@@ -88,7 +88,7 @@ + </ul> + </div><div class="category"><h2><a name="platform" id="platform">å¹³å°ç›¸å…³è¯´æ˜Ž</a></h2> + <ul><li><a href="platform/windows.html">Microsoft Windows</a></li> +-<li><a href="platform/rpm.html">基于RPM安装包的系统 (Redhat / CentOS / Fedora)</a></li> ++ <li><a href="platform/rpm.html">基于RPM安装包的系统 (AnolisOS / Redhat / CentOS / Fedora)</a></li> + <li><a href="platform/netware.html">Novell NetWare</a></li> + <li><a href="platform/ebcdic.html">EBCDIC 系统</a></li> + </ul> +@@ -119,4 +119,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/install.html.fr.utf8 b/docs/manual/install.html.fr.utf8 +index ccf39a2..5a0fd01 100644 +--- a/docs/manual/install.html.fr.utf8 ++++ b/docs/manual/install.html.fr.utf8 +@@ -69,7 +69,7 @@ + <h2><a name="overview" id="overview">Aperçu pour les plus pressés</a></h2> + + <dl> +- <dt>Installation sous Fedora/CentOS/Red Hat Enterprise Linux</dt> ++ <dt>Installation sous AnolisOS/Fedora/CentOS/Red Hat Enterprise Linux</dt> + <dd> + <pre class="prettyprint lang-">sudo yum install httpd + sudo service httpd start</pre> +@@ -525,4 +525,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/install.html.tr.utf8 b/docs/manual/install.html.tr.utf8 +index fdb89ea..fd6d691 100644 +--- a/docs/manual/install.html.tr.utf8 ++++ b/docs/manual/install.html.tr.utf8 +@@ -66,7 +66,7 @@ + <div class="section"> + <h2><a name="overview" id="overview">Tez canlılar için genel bir bakış</a></h2> + <dl> +- <dt>Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum</dt> ++ <dt>AnolisoS/Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum</dt> + <dd> + <pre class="prettyprint lang-">sudo yum install httpd + sudo systemctl enable httpd +@@ -494,4 +494,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/platform/index.html.en b/docs/manual/platform/index.html.en +index 07af003..8949d4d 100644 +--- a/docs/manual/platform/index.html.en ++++ b/docs/manual/platform/index.html.en +@@ -66,7 +66,7 @@ + + + <dl> +- <dt>RPM Based Systems (Redhat / CentOS / Fedora)</dt> ++ <dt>RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)</dt> + <dd> + <p>This document explains how to build, install, and run Apache 2.4 + on systems supporting the RPM packaging format.</p> +@@ -121,4 +121,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/platform/index.html.fr.utf8 b/docs/manual/platform/index.html.fr.utf8 +index 03404a5..bc0a8a8 100644 +--- a/docs/manual/platform/index.html.fr.utf8 ++++ b/docs/manual/platform/index.html.fr.utf8 +@@ -67,7 +67,7 @@ + + + <dl> +- <dt>Systèmes à base de paquets RPM (Redhat / CentOS / Fedora)</dt> ++ <dt>Systèmes à base de paquets RPM (AnolisOS / Redhat / CentOS / Fedora)</dt> + <dd> + <p>Ce document explique comment installer, configurer et + exécuter Apache 2.4 sur des systèmes qui supportent le format de +@@ -127,4 +127,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--><!]]></script> +-</body></html> +\ No newline at end of file ++</body></html> +diff --git a/docs/manual/platform/rpm.html.en b/docs/manual/platform/rpm.html.en +index 992fe9e..bc1c696 100644 +--- a/docs/manual/platform/rpm.html.en ++++ b/docs/manual/platform/rpm.html.en +@@ -7,7 +7,7 @@ + This file is generated from xml source: DO NOT EDIT + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX + --> +-<title>Using Apache With RPM Based Systems (Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4 ++Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4 + + + +@@ -21,7 +21,7 @@ +

+
<-
+

Using Apache With RPM Based Systems (Redhat / CentOS / Fedora)

++ Apache > HTTP Server > Documentation > Version 2.4 > Platform Specific Notes

Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)

+
+

Available Languages:  en  | +  fr 

+@@ -245,4 +245,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/platform/rpm.html.fr.utf8 b/docs/manual/platform/rpm.html.fr.utf8 +index 3ae9ee3..78e6f77 100644 +--- a/docs/manual/platform/rpm.html.fr.utf8 ++++ b/docs/manual/platform/rpm.html.fr.utf8 +@@ -7,7 +7,7 @@ + This file is generated from xml source: DO NOT EDIT + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX + --> +-Utiliser Apache sur les systèmes à base de paquets RPM (Redhat ++<title>Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat + / CentOS / Fedora) - Serveur HTTP Apache Version 2.4 + + +@@ -23,7 +23,7 @@ +
<-
+

Utiliser Apache sur les systèmes à base de paquets RPM (Redhat ++ plateformes

Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat + / CentOS / Fedora)

+
+

Langues Disponibles:  en  | +@@ -261,4 +261,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/ssl/ssl_compat.html.en b/docs/manual/ssl/ssl_compat.html.en +index fb7b888..122f52d 100644 +--- a/docs/manual/ssl/ssl_compat.html.en ++++ b/docs/manual/ssl/ssl_compat.html.en +@@ -31,13 +31,7 @@ + This page covers backwards compatibility between mod_ssl and other + SSL solutions. mod_ssl is not the only SSL solution for Apache; four + additional products are (or were) also available: Ben Laurie's freely +-available Apache-SSL (from +-where mod_ssl were originally derived in 1998), Red Hat's commercial +-Secure Web Server (which was based on mod_ssl), Covalent's commercial +-Raven SSL Module (also based on +-mod_ssl) and finally C2Net's (now Red Hat's) commercial product Stronghold (based +-on a different evolution branch, named Sioux up to Stronghold 2.x, and +-based on mod_ssl since Stronghold 3.x).

++available Apache-SSL

+ +

+ mod_ssl mostly provides a superset of the functionality of all the other +@@ -245,4 +239,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/ssl/ssl_compat.html.fr.utf8 b/docs/manual/ssl/ssl_compat.html.fr.utf8 +index 1c9a0c6..a4adb34 100644 +--- a/docs/manual/ssl/ssl_compat.html.fr.utf8 ++++ b/docs/manual/ssl/ssl_compat.html.fr.utf8 +@@ -31,14 +31,7 @@ +

Ce document couvre la compatibilité ascendante entre mod_ssl et + d'autres solutions SSL. mod_ssl n'est pas la seule solution SSL pour Apache ; + quatre autres produits sont (ou ont été) également disponibles : +-Apache-SSL, le produit libre de +-Ben Laurie (d'où mod_ssl est issu à l'origine en 1998), Secure +-Web Server, un produit commercial de Red Hat (basé sur mod_ssl), +-Raven SSL Module, un produit commercial +-de Covalent (basé lui aussi sur mod_ssl), et enfin Stronghold, produit +-commercial de C2Net et maintenant de Red Hat, (basé sur une branche +-d'évolution différente appelée Sioux jusqu'à Stronghold 2.x et basé sur +-mod_ssl depuis Stronghold 3.x).

++Apache-SSL

+ +

En plus de ses fonctionnalités propres, mod_ssl rassemble la plupart de + celles des autres solutions SSL, si bien qu'il est très simple de +@@ -254,4 +247,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +-- +2.18.4 + diff --git a/httpd.spec b/httpd.spec index e241bd8..8ded191 100644 --- a/httpd.spec +++ b/httpd.spec @@ -1,10 +1,11 @@ +%define anolis_release .0.1 %define contentdir %{_datadir}/httpd %define docroot /var/www %define suexec_caller apache %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} %define vstring %(source /etc/os-release; echo ${NAME}) -%if 0%{?fedora} > 26 || 0%{?rhel} > 7 +%if 0%{?fedora} > 26 || 0%{?rhel} > 7 || 0%{?anolis} %global mpm event %else %global mpm prefork @@ -13,7 +14,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.37 -Release: 65%{?dist}.2 +Release: 65%{anolis_release}%{?dist}.2 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source2: httpd.logrotate @@ -278,6 +279,10 @@ Patch246: httpd-2.4.37-CVE-2024-38476.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295761 Patch247: httpd-2.4.37-CVE-2024-39884+.patch +# Add by Anolis +Patch1000: 10000-htppd-anolis-rebrand.patch +# End + License: ASL 2.0 Group: System Environment/Daemons BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -513,6 +518,9 @@ interface for storing and accessing per-user session data. %patch95 -p1 -b .r1919325 %patch246 -p1 -b .CVE-2024-38476 %patch247 -p1 -b .CVE-2024-39884+ +# Add by Anolis +%patch1000 -p1 +# End # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -1018,6 +1026,10 @@ rm -rf $RPM_BUILD_ROOT %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Aug 13 2024 zhangbinchen - 2.4.37-65.0.1.2 +- Rebrand for Anolis OS +- Requires system-logos-httpd + * Tue Aug 06 2024 Luboš Uhliarik - 2.4.37-65.2 - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend applications whose response headers are malicious or exploitable (CVE-2024-38476) @@ -1127,7 +1139,6 @@ rm -rf $RPM_BUILD_ROOT * Fri Jun 10 2022 Luboš Uhliarik - 2.4.37-49 - Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer - dereference * Mon Mar 21 2022 Luboš Uhliarik - 2.4.37-48 - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling -- Gitee From 6d158e2b593fb2f4a6970ceaf51c6b37acb63f06 Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Thu, 4 Nov 2021 11:28:04 +0800 Subject: [PATCH 3/5] build: support loongarch64 platform Signed-off-by: Liwei Ge --- ...d.patch => 1000-httpd-anolis-rebrand.patch | 0 1001-httpd-anolis-support-loongarch64.patch | 32 +++++++++++++++++++ httpd.spec | 5 ++- 3 files changed, 36 insertions(+), 1 deletion(-) rename 10000-htppd-anolis-rebrand.patch => 1000-httpd-anolis-rebrand.patch (100%) create mode 100644 1001-httpd-anolis-support-loongarch64.patch diff --git a/10000-htppd-anolis-rebrand.patch b/1000-httpd-anolis-rebrand.patch similarity index 100% rename from 10000-htppd-anolis-rebrand.patch rename to 1000-httpd-anolis-rebrand.patch diff --git a/1001-httpd-anolis-support-loongarch64.patch b/1001-httpd-anolis-support-loongarch64.patch new file mode 100644 index 0000000..37efba2 --- /dev/null +++ b/1001-httpd-anolis-support-loongarch64.patch @@ -0,0 +1,32 @@ +diff -Nur httpd-2.4.37/build/config.guess httpd-2.4.37.new/build/config.guess +--- httpd-2.4.37/build/config.guess 2018-10-18 22:34:08.000000000 +0800 ++++ httpd-2.4.37.new/build/config.guess 2021-11-04 11:15:42.592000000 +0800 +@@ -897,6 +897,9 @@ + UNAME_MACHINE=aarch64_be + echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + exit ;; ++ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) ++ echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" ++ exit ;; + alpha:Linux:*:*) + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in + EV5) UNAME_MACHINE=alphaev5 ;; +diff -Nur httpd-2.4.37/build/config.sub httpd-2.4.37.new/build/config.sub +--- httpd-2.4.37/build/config.sub 2018-10-18 22:34:08.000000000 +0800 ++++ httpd-2.4.37.new/build/config.sub 2021-11-04 11:15:42.592000000 +0800 +@@ -265,6 +265,7 @@ + | k1om \ + | le32 | le64 \ + | lm32 \ ++ | loongarch32 | loongarch64 | loongarchx32 \ + | m32c | m32r | m32rle | m68000 | m68k | m88k \ + | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ + | mips | mipsbe | mipseb | mipsel | mipsle \ +@@ -390,6 +391,7 @@ + | k1om-* \ + | le32-* | le64-* \ + | lm32-* \ ++ | loongarch32-* | loongarch64-* | loongarchx32-* \ + | m32c-* | m32r-* | m32rle-* \ + | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ + | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ diff --git a/httpd.spec b/httpd.spec index 8ded191..0cc5569 100644 --- a/httpd.spec +++ b/httpd.spec @@ -280,7 +280,8 @@ Patch246: httpd-2.4.37-CVE-2024-38476.patch Patch247: httpd-2.4.37-CVE-2024-39884+.patch # Add by Anolis -Patch1000: 10000-htppd-anolis-rebrand.patch +Patch1000: 1000-httpd-anolis-rebrand.patch +Patch1001: 1001-httpd-anolis-support-loongarch64.patch # End License: ASL 2.0 @@ -520,6 +521,7 @@ interface for storing and accessing per-user session data. %patch247 -p1 -b .CVE-2024-39884+ # Add by Anolis %patch1000 -p1 +%patch1001 -p1 # End # Patch in the vendor string @@ -1029,6 +1031,7 @@ rm -rf $RPM_BUILD_ROOT * Tue Aug 13 2024 zhangbinchen - 2.4.37-65.0.1.2 - Rebrand for Anolis OS - Requires system-logos-httpd +- Support loongarch64 platform(Liwei Ge) * Tue Aug 06 2024 Luboš Uhliarik - 2.4.37-65.2 - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend -- Gitee From ee291e576dfb2e13d7ec4379271622c84264bd3e Mon Sep 17 00:00:00 2001 From: Zhao Hang Date: Tue, 30 Jan 2024 10:08:33 +0800 Subject: [PATCH 4/5] Requires system-logos-httpd Signed-off-by: Zhao Hang --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 0cc5569..98d63b9 100644 --- a/httpd.spec +++ b/httpd.spec @@ -293,7 +293,7 @@ BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0 BuildRequires: systemd-devel # web server testpage added to redhat-logos in 82.0 (rhbz1896319) # new logo requires new footer copyring which was added in rhbz1934800 -Requires: /etc/mime.types, system-logos(httpd-logo-ng) +Requires: /etc/mime.types, system-logos-httpd Obsoletes: httpd-suexec Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} -- Gitee From 54a4231cc8466fe4e87119de74f47897c0fbab4c Mon Sep 17 00:00:00 2001 From: wxiat Date: Fri, 21 Jul 2023 15:23:24 +0800 Subject: [PATCH 5/5] - cherry-pick `add sw patch #400077d851a81ce23aa39db271e26c3df254ae53`. - cherry-pick `change sw patch #bdacf2efe00d8445328f798df8c5520728801e8c`. Signed-off-by: wxiat Signed-off-by: Weisson --- httpd-2.4.37-sw.patch | 66 +++++++++++++++++++++++++++++++++++++++++++ httpd.spec | 5 ++++ 2 files changed, 71 insertions(+) create mode 100644 httpd-2.4.37-sw.patch diff --git a/httpd-2.4.37-sw.patch b/httpd-2.4.37-sw.patch new file mode 100644 index 0000000..0951329 --- /dev/null +++ b/httpd-2.4.37-sw.patch @@ -0,0 +1,66 @@ +diff -Naur httpd-2.4.37.org/configure httpd-2.4.37.sw/configure +--- httpd-2.4.37.org/configure 2018-10-18 22:34:09.000000000 +0800 ++++ httpd-2.4.37.sw/configure 2023-07-21 14:55:43.876595734 +0800 +@@ -29566,6 +29566,10 @@ + # ulimit only accepts English "unlimited" on input + APACHECTL_ULIMIT="ulimit -S -n unlimited" + ;; ++ *sw_64*-dec-osf*) ++ # Tru64: -H is for setting, not retrieving ++ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" ++ ;; + *alpha*-dec-osf*) + # Tru64: -H is for setting, not retrieving + APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" +diff -Naur httpd-2.4.37.org/support/config.m4 httpd-2.4.37.sw/support/config.m4 +--- httpd-2.4.37.org/support/config.m4 2011-04-08 03:32:49.000000000 +0800 ++++ httpd-2.4.37.sw/support/config.m4 2023-07-21 14:56:03.520289713 +0800 +@@ -136,6 +136,10 @@ + # ulimit only accepts English "unlimited" on input + APACHECTL_ULIMIT="ulimit -S -n unlimited" + ;; ++ *sw_64*-dec-osf*) ++ # Tru64: -H is for setting, not retrieving ++ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" ++ ;; + *alpha*-dec-osf*) + # Tru64: -H is for setting, not retrieving + APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" + +diff -Nuar httpd-2.4.37.org/build/config.guess httpd-2.4.37.sw/build/config.guess +--- httpd-2.4.37.org/build/config.guess 2023-08-09 16:22:45.045389206 +0800 ++++ httpd-2.4.37.sw/build/config.guess 2023-08-09 16:24:04.103173784 +0800 +@@ -900,6 +900,14 @@ + loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) + echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" + exit ;; ++ sw_64:Linux:*:*) ++ case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in ++ sw) UNAME_MACHINE=sw_64 ;; ++ esac ++ objdump --private-headers /bin/sh | grep -q ld.so.1 ++ if test "$?" = 0 ; then LIBC=gnulibc1 ; fi ++ echo ${UNAME_MACHINE}-sunway-linux-${LIBC} ++ exit ;; + alpha:Linux:*:*) + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in + EV5) UNAME_MACHINE=alphaev5 ;; +diff -Nuar httpd-2.4.37.org/build/config.sub httpd-2.4.37.sw/build/config.sub +--- httpd-2.4.37.org/build/config.sub 2023-08-09 16:22:45.045389206 +0800 ++++ httpd-2.4.37.sw/build/config.sub 2023-08-09 16:23:26.159837338 +0800 +@@ -245,6 +245,7 @@ + 1750a | 580 \ + | a29k \ + | aarch64 | aarch64_be \ ++ | sw_64 \ + | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ + | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ + | am33_2.0 \ +@@ -370,6 +371,7 @@ + 580-* \ + | a29k-* \ + | aarch64-* | aarch64_be-* \ ++ | sw_64-* \ + | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ + | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ + | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ diff --git a/httpd.spec b/httpd.spec index 98d63b9..a91a5bc 100644 --- a/httpd.spec +++ b/httpd.spec @@ -282,6 +282,7 @@ Patch247: httpd-2.4.37-CVE-2024-39884+.patch # Add by Anolis Patch1000: 1000-httpd-anolis-rebrand.patch Patch1001: 1001-httpd-anolis-support-loongarch64.patch +Patch2000: httpd-2.4.37-sw.patch # End License: ASL 2.0 @@ -522,6 +523,7 @@ interface for storing and accessing per-user session data. # Add by Anolis %patch1000 -p1 %patch1001 -p1 +%patch2000 -p1 # End # Patch in the vendor string @@ -1032,6 +1034,9 @@ rm -rf $RPM_BUILD_ROOT - Rebrand for Anolis OS - Requires system-logos-httpd - Support loongarch64 platform(Liwei Ge) +- add patch for CVE-2023-27522(guo.chuang@zte.com.cn) + cherry-pick `add sw patch #400077d851a81ce23aa39db271e26c3df254ae53`. (nijie@wxiat.com) + cherry-pick `change sw patch #bdacf2efe00d8445328f798df8c5520728801e8c`. (nijie@wxiat.com) * Tue Aug 06 2024 Luboš Uhliarik - 2.4.37-65.2 - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend -- Gitee