[httpd] update to 2.4.6
jorton
jorton at fedoraproject.org
Mon Jul 22 16:39:35 UTC 2013
commit e90db98c1ffd616811a980ee698904d83dc3237f
Author: Joe Orton <jorton at redhat.com>
Date: Mon Jul 22 17:39:21 2013 +0100
update to 2.4.6
- mod_ssl: use revised NPN API (r1487772)
.gitignore | 1 +
httpd-2.4.6-r1332643+.patch | 313 ++++++++++++++++++++
...iproxy.patch => httpd-2.4.6-sslmultiproxy.patch | 27 +-
httpd.spec | 10 +-
sources | 2 +-
5 files changed, 335 insertions(+), 18 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index c3f5396..4e0c552 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@ x86_64
/httpd-2.4.2.tar.bz2
/httpd-2.4.3.tar.bz2
/httpd-2.4.4.tar.bz2
+/httpd-2.4.6.tar.bz2
diff --git a/httpd-2.4.6-r1332643+.patch b/httpd-2.4.6-r1332643+.patch
new file mode 100644
index 0000000..d2e5565
--- /dev/null
+++ b/httpd-2.4.6-r1332643+.patch
@@ -0,0 +1,313 @@
+# ./pullrev.sh 1332643 1345599 1487772
+
+https://bugzilla.redhat.com//show_bug.cgi?id=809599
+
+http://svn.apache.org/viewvc?view=revision&revision=1332643
+http://svn.apache.org/viewvc?view=revision&revision=1345599
+http://svn.apache.org/viewvc?view=revision&revision=1487772
+
+--- httpd-2.4.6/modules/ssl/mod_ssl.c.r1332643+
++++ httpd-2.4.6/modules/ssl/mod_ssl.c
+@@ -413,6 +413,37 @@ int ssl_engine_disable(conn_rec *c)
+ return 1;
+ }
+
++static int modssl_register_npn(conn_rec *c,
++ ssl_npn_advertise_protos advertisefn,
++ ssl_npn_proto_negotiated negotiatedfn)
++{
++#ifdef HAVE_TLS_NPN
++ SSLConnRec *sslconn = myConnConfig(c);
++
++ if (!sslconn) {
++ return DECLINED;
++ }
++
++ if (!sslconn->npn_advertfns) {
++ sslconn->npn_advertfns =
++ apr_array_make(c->pool, 5, sizeof(ssl_npn_advertise_protos));
++ sslconn->npn_negofns =
++ apr_array_make(c->pool, 5, sizeof(ssl_npn_proto_negotiated));
++ }
++
++ if (advertisefn)
++ APR_ARRAY_PUSH(sslconn->npn_advertfns, ssl_npn_advertise_protos) =
++ advertisefn;
++ if (negotiatedfn)
++ APR_ARRAY_PUSH(sslconn->npn_negofns, ssl_npn_proto_negotiated) =
++ negotiatedfn;
++
++ return OK;
++#else
++ return DECLINED;
++#endif
++}
++
+ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
+ {
+ SSLSrvConfigRec *sc;
+@@ -584,6 +615,7 @@ static void ssl_register_hooks(apr_pool_
+
+ APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+ APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
++ APR_REGISTER_OPTIONAL_FN(modssl_register_npn);
+
+ ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl",
+ AUTHZ_PROVIDER_VERSION,
+--- httpd-2.4.6/modules/ssl/mod_ssl.h.r1332643+
++++ httpd-2.4.6/modules/ssl/mod_ssl.h
+@@ -63,5 +63,40 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_e
+
+ APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
+
++/** The npn_advertise_protos callback allows another modules to add
++ * entries to the list of protocol names advertised by the server
++ * during the Next Protocol Negotiation (NPN) portion of the SSL
++ * handshake. The callback is given the connection and an APR array;
++ * it should push one or more char*'s pointing to NUL-terminated
++ * strings (such as "http/1.1" or "spdy/2") onto the array and return
++ * OK. To prevent further processing of (other modules') callbacks,
++ * return DONE. */
++typedef int (*ssl_npn_advertise_protos)(conn_rec *connection,
++ apr_array_header_t *protos);
++
++/** The npn_proto_negotiated callback allows other modules to discover
++ * the name of the protocol that was chosen during the Next Protocol
++ * Negotiation (NPN) portion of the SSL handshake. Note that this may
++ * be the empty string (in which case modules should probably assume
++ * HTTP), or it may be a protocol that was never even advertised by
++ * the server. The callback is given the connection, a
++ * non-NUL-terminated string containing the protocol name, and the
++ * length of the string; it should do something appropriate
++ * (i.e. insert or remove filters) and return OK. To prevent further
++ * processing of (other modules') callbacks, return DONE. */
++typedef int (*ssl_npn_proto_negotiated)(conn_rec *connection,
++ const char *proto_name,
++ apr_size_t proto_name_len);
++
++/* An optional function which can be used to register a pair of
++ * callbacks for NPN handling. This optional function should be
++ * invoked from a pre_connection hook which runs *after* mod_ssl.c's
++ * pre_connection hook. The function returns OK if the callbacks are
++ * register, or DECLINED otherwise (for example if mod_ssl does not
++l * support NPN). */
++APR_DECLARE_OPTIONAL_FN(int, modssl_register_npn, (conn_rec *conn,
++ ssl_npn_advertise_protos advertisefn,
++ ssl_npn_proto_negotiated negotiatedfn));
++
+ #endif /* __MOD_SSL_H__ */
+ /** @} */
+--- httpd-2.4.6/modules/ssl/ssl_engine_init.c.r1332643+
++++ httpd-2.4.6/modules/ssl/ssl_engine_init.c
+@@ -725,6 +725,11 @@ static void ssl_init_ctx_callbacks(serve
+ #endif
+
+ SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
++
++#ifdef HAVE_TLS_NPN
++ SSL_CTX_set_next_protos_advertised_cb(
++ ctx, ssl_callback_AdvertiseNextProtos, NULL);
++#endif
+ }
+
+ static void ssl_init_ctx_verify(server_rec *s,
+--- httpd-2.4.6/modules/ssl/ssl_engine_io.c.r1332643+
++++ httpd-2.4.6/modules/ssl/ssl_engine_io.c
+@@ -297,6 +297,7 @@ typedef struct {
+ apr_pool_t *pool;
+ char buffer[AP_IOBUFSIZE];
+ ssl_filter_ctx_t *filter_ctx;
++ int npn_finished; /* 1 if NPN has finished, 0 otherwise */
+ } bio_filter_in_ctx_t;
+
+ /*
+@@ -1400,6 +1401,37 @@ static apr_status_t ssl_io_filter_input(
+ APR_BRIGADE_INSERT_TAIL(bb, bucket);
+ }
+
++#ifdef HAVE_TLS_NPN
++ /* By this point, Next Protocol Negotiation (NPN) should be completed (if
++ * our version of OpenSSL supports it). If we haven't already, find out
++ * which protocol was decided upon and inform other modules by calling
++ * npn_proto_negotiated_hook. */
++ if (!inctx->npn_finished) {
++ SSLConnRec *sslconn = myConnConfig(f->c);
++ const unsigned char *next_proto = NULL;
++ unsigned next_proto_len = 0;
++ int n;
++
++ if (sslconn->npn_negofns) {
++ SSL_get0_next_proto_negotiated(
++ inctx->ssl, &next_proto, &next_proto_len);
++ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
++ APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
++ next_proto_len, (const char*)next_proto);
++
++ for (n = 0; n < sslconn->npn_negofns->nelts; n++) {
++ ssl_npn_proto_negotiated fn =
++ APR_ARRAY_IDX(sslconn->npn_negofns, n, ssl_npn_proto_negotiated);
++
++ if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE)
++ break;
++ }
++ }
++
++ inctx->npn_finished = 1;
++ }
++#endif
++
+ return APR_SUCCESS;
+ }
+
+@@ -1881,6 +1913,7 @@ static void ssl_io_input_add_filter(ssl_
+ inctx->block = APR_BLOCK_READ;
+ inctx->pool = c->pool;
+ inctx->filter_ctx = filter_ctx;
++ inctx->npn_finished = 0;
+ }
+
+ /* The request_rec pointer is passed in here only to ensure that the
+--- httpd-2.4.6/modules/ssl/ssl_engine_kernel.c.r1332643+
++++ httpd-2.4.6/modules/ssl/ssl_engine_kernel.c
+@@ -2161,6 +2161,97 @@ int ssl_callback_SessionTicket(SSL *ssl,
+ }
+ #endif /* HAVE_TLS_SESSION_TICKETS */
+
++#ifdef HAVE_TLS_NPN
++/*
++ * This callback function is executed when SSL needs to decide what protocols
++ * to advertise during Next Protocol Negotiation (NPN). It must produce a
++ * string in wire format -- a sequence of length-prefixed strings -- indicating
++ * the advertised protocols. Refer to SSL_CTX_set_next_protos_advertised_cb
++ * in OpenSSL for reference.
++ */
++int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
++ unsigned int *size_out, void *arg)
++{
++ conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
++ SSLConnRec *sslconn = myConnConfig(c);
++ apr_array_header_t *protos;
++ int num_protos;
++ unsigned int size;
++ int i;
++ unsigned char *data;
++ unsigned char *start;
++
++ *data_out = NULL;
++ *size_out = 0;
++
++ /* If the connection object is not available, or there are no NPN
++ * hooks registered, then there's nothing for us to do. */
++ if (c == NULL || sslconn->npn_advertfns == NULL) {
++ return SSL_TLSEXT_ERR_OK;
++ }
++
++ /* Invoke our npn_advertise_protos hook, giving other modules a chance to
++ * add alternate protocol names to advertise. */
++ protos = apr_array_make(c->pool, 0, sizeof(char *));
++ for (i = 0; i < sslconn->npn_advertfns->nelts; i++) {
++ ssl_npn_advertise_protos fn =
++ APR_ARRAY_IDX(sslconn->npn_advertfns, i, ssl_npn_advertise_protos);
++
++ if (fn(c, protos) == DONE)
++ break;
++ }
++ num_protos = protos->nelts;
++
++ /* We now have a list of null-terminated strings; we need to concatenate
++ * them together into a single string, where each protocol name is prefixed
++ * by its length. First, calculate how long that string will be. */
++ size = 0;
++ for (i = 0; i < num_protos; ++i) {
++ const char *string = APR_ARRAY_IDX(protos, i, const char*);
++ unsigned int length = strlen(string);
++ /* If the protocol name is too long (the length must fit in one byte),
++ * then log an error and skip it. */
++ if (length > 255) {
++ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02307)
++ "SSL NPN protocol name too long (length=%u): %s",
++ length, string);
++ continue;
++ }
++ /* Leave room for the length prefix (one byte) plus the protocol name
++ * itself. */
++ size += 1 + length;
++ }
++
++ /* If there is nothing to advertise (either because no modules added
++ * anything to the protos array, or because all strings added to the array
++ * were skipped), then we're done. */
++ if (size == 0) {
++ return SSL_TLSEXT_ERR_OK;
++ }
++
++ /* Now we can build the string. Copy each protocol name string into the
++ * larger string, prefixed by its length. */
++ data = apr_palloc(c->pool, size * sizeof(unsigned char));
++ start = data;
++ for (i = 0; i < num_protos; ++i) {
++ const char *string = APR_ARRAY_IDX(protos, i, const char*);
++ apr_size_t length = strlen(string);
++ if (length > 255)
++ continue;
++ *start = (unsigned char)length;
++ ++start;
++ memcpy(start, string, length * sizeof(unsigned char));
++ start += length;
++ }
++
++ /* Success. */
++ *data_out = data;
++ *size_out = size;
++ return SSL_TLSEXT_ERR_OK;
++}
++
++#endif /* HAVE_TLS_NPN */
++
+ #ifndef OPENSSL_NO_SRP
+
+ int ssl_callback_SRPServerParams(SSL *ssl, int *ad, void *arg)
+--- httpd-2.4.6/modules/ssl/ssl_private.h.r1332643+
++++ httpd-2.4.6/modules/ssl/ssl_private.h
+@@ -98,6 +98,8 @@
+ #include <openssl/x509_vfy.h>
+ #include <openssl/ocsp.h>
+
++#include "mod_ssl.h"
++
+ /* Avoid tripping over an engine build installed globally and detected
+ * when the user points at an explicit non-engine flavor of OpenSSL
+ */
+@@ -139,6 +141,11 @@
+ #define HAVE_FIPS
+ #endif
+
++#if OPENSSL_VERSION_NUMBER >= 0x10001000L && !defined(OPENSSL_NO_NEXTPROTONEG) \
++ && !defined(OPENSSL_NO_TLSEXT)
++#define HAVE_TLS_NPN
++#endif
++
+ #if (OPENSSL_VERSION_NUMBER >= 0x10000000)
+ #define MODSSL_SSL_CIPHER_CONST const
+ #define MODSSL_SSL_METHOD_CONST const
+@@ -487,6 +494,12 @@ typedef struct {
+ * connection */
+ } reneg_state;
+
++#ifdef HAVE_TLS_NPN
++ /* Poor man's inter-module optional hooks for NPN. */
++ apr_array_header_t *npn_advertfns; /* list of ssl_npn_advertise_protos callbacks */
++ apr_array_header_t *npn_negofns; /* list of ssl_npn_proto_negotiated callbacks. */
++#endif
++
+ server_rec *server;
+ } SSLConnRec;
+
+@@ -842,6 +855,7 @@ int ssl_callback_ServerNameIndi
+ int ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
+ EVP_CIPHER_CTX *, HMAC_CTX *, int);
+ #endif
++int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data, unsigned int *len, void *arg);
+
+ /** Session Cache Support */
+ void ssl_scache_init(server_rec *, apr_pool_t *);
diff --git a/httpd-2.4.4-sslmultiproxy.patch b/httpd-2.4.6-sslmultiproxy.patch
similarity index 78%
rename from httpd-2.4.4-sslmultiproxy.patch
rename to httpd-2.4.6-sslmultiproxy.patch
index 7b912a0..f8a3b4b 100644
--- a/httpd-2.4.4-sslmultiproxy.patch
+++ b/httpd-2.4.6-sslmultiproxy.patch
@@ -1,8 +1,9 @@
-diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
-index 6ea367c..3cbd08f 100644
---- a/modules/ssl/mod_ssl.c
-+++ b/modules/ssl/mod_ssl.c
-@@ -378,6 +378,9 @@ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c)
+
+Ugly hack to enable mod_ssl and mod_nss to "share" hooks.
+
+--- httpd-2.4.6/modules/ssl/mod_ssl.c.sslmultiproxy
++++ httpd-2.4.6/modules/ssl/mod_ssl.c
+@@ -369,6 +369,9 @@ static SSLConnRec *ssl_init_connection_c
return sslconn;
}
@@ -12,7 +13,7 @@ index 6ea367c..3cbd08f 100644
int ssl_proxy_enable(conn_rec *c)
{
SSLSrvConfigRec *sc;
-@@ -386,6 +389,12 @@ int ssl_proxy_enable(conn_rec *c)
+@@ -377,6 +380,12 @@ int ssl_proxy_enable(conn_rec *c)
sc = mySrvConfig(sslconn->server);
if (!sc->proxy_enabled) {
@@ -25,7 +26,7 @@ index 6ea367c..3cbd08f 100644
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01961)
"SSL Proxy requested for %s but not enabled "
"[Hint: SSLProxyEngine]", sc->vhost_id);
-@@ -405,6 +414,10 @@ int ssl_engine_disable(conn_rec *c)
+@@ -396,6 +405,10 @@ int ssl_engine_disable(conn_rec *c)
SSLConnRec *sslconn = myConnConfig(c);
@@ -36,7 +37,7 @@ index 6ea367c..3cbd08f 100644
if (sslconn) {
sc = mySrvConfig(sslconn->server);
}
-@@ -590,6 +603,9 @@ static void ssl_register_hooks(apr_pool_t *p)
+@@ -612,6 +625,9 @@ static void ssl_register_hooks(apr_pool_
ap_hook_post_read_request(ssl_hook_ReadReq, pre_prr,NULL, APR_HOOK_MIDDLE);
ssl_var_register(p);
@@ -46,11 +47,9 @@ index 6ea367c..3cbd08f 100644
APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
-diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c
-index 536e6b1..c508fff 100644
---- a/modules/ssl/ssl_engine_vars.c
-+++ b/modules/ssl/ssl_engine_vars.c
-@@ -53,10 +53,15 @@ static void ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algk
+--- httpd-2.4.6/modules/ssl/ssl_engine_vars.c.sslmultiproxy
++++ httpd-2.4.6/modules/ssl/ssl_engine_vars.c
+@@ -53,10 +53,15 @@ static void ssl_var_lookup_ssl_cipher_b
static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
@@ -77,7 +76,7 @@ index 536e6b1..c508fff 100644
APR_REGISTER_OPTIONAL_FN(ssl_is_https);
APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
-@@ -241,6 +249,15 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r,
+@@ -241,6 +249,15 @@ char *ssl_var_lookup(apr_pool_t *p, serv
*/
if (result == NULL && c != NULL) {
SSLConnRec *sslconn = myConnConfig(c);
diff --git a/httpd.spec b/httpd.spec
index 9976c09..06fbaa2 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -57,10 +57,10 @@ Patch24: httpd-2.4.1-corelimit.patch
Patch25: httpd-2.4.1-selinux.patch
Patch26: httpd-2.4.4-r1337344+.patch
Patch27: httpd-2.4.2-icons.patch
-Patch28: httpd-2.4.4-r1332643+.patch
+Patch28: httpd-2.4.6-r1332643+.patch
Patch29: httpd-2.4.3-mod_systemd.patch
Patch30: httpd-2.4.4-cachehardmax.patch
-Patch31: httpd-2.4.4-sslmultiproxy.patch
+Patch31: httpd-2.4.6-sslmultiproxy.patch
# Bug fixes
Patch51: httpd-2.4.3-sslsninotreq.patch
Patch54: httpd-2.4.4-dump-vhost-twice.patch
@@ -186,7 +186,7 @@ interface for storing and accessing per-user session data.
%patch28 -p1 -b .r1332643+
%patch29 -p1 -b .systemd
%patch30 -p1 -b .cachehardmax
-%patch31 -p1 -b .sslmulti
+%patch31 -p1 -b .sslmultiproxy
%patch51 -p1 -b .sninotreq
%patch54 -p1 -b .vhosttwice
@@ -615,6 +615,10 @@ rm -rf $RPM_BUILD_ROOT
%{_sysconfdir}/rpm/macros.httpd
%changelog
+* Mon Jul 22 2013 Joe Orton <jorton at redhat.com> - 2.4.6-1
+- update to 2.4.6
+- mod_ssl: use revised NPN API (r1487772)
+
* Thu Jul 11 2013 Jan Kaluza <jkaluza at redhat.com> - 2.4.4-12
- mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
- apxs: mention -p option in manpage
diff --git a/sources b/sources
index a228990..35e4d06 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-0e712ee2119cd798c8ae39d5f11a9206 httpd-2.4.4.tar.bz2
+ea5e361ca37b8d7853404419dd502efe httpd-2.4.6.tar.bz2
More information about the scm-commits
mailing list