From 186c046627bf17fc905c2f8afe7b670afe22e309 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 18 Dec 2025 11:54:58 +0000 Subject: [PATCH] import UBI httpd-2.4.62-7.el9_7.2 --- SOURCES/httpd-2.4.62-hcheck-stuck.patch | 68 +++ SOURCES/httpd-2.4.62-sslvhostsnipolicy.patch | 554 +++++++++++++++++++ SOURCES/snipolicy.conf | 15 + SPECS/httpd.spec | 29 +- 4 files changed, 663 insertions(+), 3 deletions(-) create mode 100644 SOURCES/httpd-2.4.62-hcheck-stuck.patch create mode 100644 SOURCES/httpd-2.4.62-sslvhostsnipolicy.patch create mode 100644 SOURCES/snipolicy.conf diff --git a/SOURCES/httpd-2.4.62-hcheck-stuck.patch b/SOURCES/httpd-2.4.62-hcheck-stuck.patch new file mode 100644 index 0000000..ca7c24a --- /dev/null +++ b/SOURCES/httpd-2.4.62-hcheck-stuck.patch @@ -0,0 +1,68 @@ +diff --git a/modules/proxy/mod_proxy_hcheck.c b/modules/proxy/mod_proxy_hcheck.c +index 70f1de8..70bfa26 100644 +--- a/modules/proxy/mod_proxy_hcheck.c ++++ b/modules/proxy/mod_proxy_hcheck.c +@@ -992,12 +992,30 @@ static apr_status_t hc_watchdog_callback(int state, void *data, + sctx_t *ctx = (sctx_t *)data; + server_rec *s = ctx->s; + proxy_server_conf *conf; ++ proxy_worker **workers; ++ proxy_worker *worker; ++ apr_time_t now; ++ int i, n; ++ ++ conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); ++ balancer = (proxy_balancer *)conf->balancers->elts; + + switch (state) { + case AP_WATCHDOG_STATE_STARTING: + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258) + "%s watchdog started.", + HCHECK_WATHCHDOG_NAME); ++ /* set last update time for all workers */ ++ now = apr_time_now(); ++ for (i = 0; i < conf->balancers->nelts; i++, balancer++) { ++ workers = (proxy_worker **)balancer->workers->elts; ++ for (n = 0; n < balancer->workers->nelts; n++, ++workers) { ++ worker = *workers; ++ if (worker->s->updated == 0) { ++ worker->s->updated = now; ++ } ++ } ++ } + #if HC_USE_THREADS + if (tpsize && hctp == NULL) { + rv = apr_thread_pool_create(&hctp, tpsize, +@@ -1023,21 +1041,13 @@ static apr_status_t hc_watchdog_callback(int state, void *data, + + case AP_WATCHDOG_STATE_RUNNING: + /* loop thru all workers */ +- if (s) { +- int i; +- conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module); +- balancer = (proxy_balancer *)conf->balancers->elts; +- ctx->s = s; ++ { ++ now = apr_time_now(); + for (i = 0; i < conf->balancers->nelts; i++, balancer++) { +- int n; +- apr_time_t now; +- proxy_worker **workers; +- proxy_worker *worker; + /* Have any new balancers or workers been added dynamically? */ + ap_proxy_sync_balancer(balancer, s, conf); + workers = (proxy_worker **)balancer->workers->elts; +- now = apr_time_now(); +- for (n = 0; n < balancer->workers->nelts; n++) { ++ for (n = 0; n < balancer->workers->nelts; n++, workers++) { + worker = *workers; + if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) && + (worker->s->method != NONE) && +@@ -1077,7 +1087,6 @@ static apr_status_t hc_watchdog_callback(int state, void *data, + hc_check(NULL, baton); + } + } +- workers++; + } + } + } diff --git a/SOURCES/httpd-2.4.62-sslvhostsnipolicy.patch b/SOURCES/httpd-2.4.62-sslvhostsnipolicy.patch new file mode 100644 index 0000000..f9c105c --- /dev/null +++ b/SOURCES/httpd-2.4.62-sslvhostsnipolicy.patch @@ -0,0 +1,554 @@ +From f063cc14f9aae9c19de45dfa3c48828a75249e05 Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Tue, 11 Nov 2025 10:23:22 +0100 +Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the + compatibility level required for VirtualHost matching. + +For "secure" and "authonly" modes, a hash of the policy-relevant vhost +configuration is created and stored in the post_config hooks, reducing +the runtime code complexity (and overhead). + +* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New + function, replacing ssl_server_compatible et al. + +* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New + function. + +* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash, + hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash): + New functions. + (ssl_init_Module): Invoke create_sni_policy_hash to store the hash + for every SSLSrvConfigRec. + +* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field. + (SSLSrvConfigRec): Add sni_policy_hash field. + +PR: 69743 +GitHub: closes #561 +--- + docs/manual/mod/mod_ssl.html.en | 77 ++++++++++++++++++ + modules/ssl/mod_ssl.c | 2 + + modules/ssl/ssl_engine_config.c | 41 ++++++++++ + modules/ssl/ssl_engine_init.c | 107 +++++++++++++++++++++++++ + modules/ssl/ssl_engine_kernel.c | 133 ++++++-------------------------- + modules/ssl/ssl_private.h | 17 ++++ + 6 files changed, 267 insertions(+), 110 deletions(-) + +diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en +index 3fc8a48..6a929ea 100644 +--- a/docs/manual/mod/mod_ssl.html.en ++++ b/docs/manual/mod/mod_ssl.html.en +@@ -125,6 +125,7 @@ to provide the cryptography engine.

+
  • SSLUseStapling
    • +
  • SSLVerifyClient
    • +
  • SSLVerifyDepth
    • ++
  • SSLVHostSNIPolicy
    • + +

    Bugfix checklist

    See also

    +