import httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7
This commit is contained in:
CentOS Sources
parent
8a376421a5
commit
a608dd563a
3
.gitignore
vendored
3
.gitignore
vendored
@ -1,4 +1 @@
|
|||||||
SOURCES/htcacheclean.service.xml
|
|
||||||
SOURCES/httpd-2.4.37.tar.bz2
|
SOURCES/httpd-2.4.37.tar.bz2
|
||||||
SOURCES/httpd.conf.xml
|
|
||||||
SOURCES/httpd.service.xml
|
|
||||||
|
|||||||
@ -1,4 +1 @@
|
|||||||
a34c31169efbe6140496c37801489610461bdf9b SOURCES/htcacheclean.service.xml
|
|
||||||
4a38471de821288b0300148016f2b03dfee8adf2 SOURCES/httpd-2.4.37.tar.bz2
|
4a38471de821288b0300148016f2b03dfee8adf2 SOURCES/httpd-2.4.37.tar.bz2
|
||||||
fa18caadd0afbddc2c7a7fc404bf4f2b41867148 SOURCES/httpd.conf.xml
|
|
||||||
888df830bdc465de3bced6f075c33380018e544f SOURCES/httpd.service.xml
|
|
||||||
|
|||||||
123
SOURCES/htcacheclean.service.xml
Normal file
123
SOURCES/htcacheclean.service.xml
Normal file
@ -0,0 +1,123 @@
|
|||||||
|
<?xml version='1.0' encoding='utf-8'?>
|
||||||
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
|
||||||
|
|
||||||
|
]>
|
||||||
|
<!--
|
||||||
|
Copyright 2018 Red Hat, Inc.
|
||||||
|
|
||||||
|
Licensed to the Apache Software Foundation (ASF) under one or more
|
||||||
|
contributor license agreements. See the NOTICE file distributed with
|
||||||
|
this work for additional information regarding copyright ownership.
|
||||||
|
The ASF licenses this file to You under the Apache License, Version 2.0
|
||||||
|
(the "License"); you may not use this file except in compliance with
|
||||||
|
the License. You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language overning permissions and
|
||||||
|
limitations under the License.
|
||||||
|
-->
|
||||||
|
<refentry>
|
||||||
|
<refentryinfo>
|
||||||
|
<title>htcacheclean systemd unit</title>
|
||||||
|
<productname>httpd</productname>
|
||||||
|
<author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
|
||||||
|
</refentryinfo>
|
||||||
|
|
||||||
|
<refmeta>
|
||||||
|
<refentrytitle>htcacheclean.service</refentrytitle>
|
||||||
|
<manvolnum>8</manvolnum>
|
||||||
|
</refmeta>
|
||||||
|
|
||||||
|
<refnamediv>
|
||||||
|
<refname>htcacheclean.service</refname>
|
||||||
|
<refpurpose>htcacheclean unit file for systemd</refpurpose>
|
||||||
|
</refnamediv>
|
||||||
|
|
||||||
|
<refsynopsisdiv>
|
||||||
|
<para>
|
||||||
|
<filename>/usr/lib/systemd/system/htcacheclean.service</filename>
|
||||||
|
</para>
|
||||||
|
</refsynopsisdiv>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>Description</title>
|
||||||
|
|
||||||
|
<para>This manual page describes the <command>systemd</command>
|
||||||
|
unit file for the <command>htcacheclean</command> daemon. This
|
||||||
|
unit file provides a service which runs
|
||||||
|
<command>htcacheclean</command> in daemon mode,
|
||||||
|
periodically cleaning the disk cache root to ensure disk space
|
||||||
|
usage is within configured limits.</para>
|
||||||
|
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>Options</title>
|
||||||
|
|
||||||
|
<para>The service is configured by configuration file
|
||||||
|
<filename>/etc/sysconfig/htcacheclean</filename>. The following
|
||||||
|
variables are used, following standard <command>systemd</command>
|
||||||
|
<varname>EnvironmentFile=</varname> syntax:</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term><varname>INTERVAL=</varname></term>
|
||||||
|
|
||||||
|
<listitem><para>Sets the interval between cache clean runs, in
|
||||||
|
minutes. By default this is configured as
|
||||||
|
<emphasis>15</emphasis>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><varname>CACHE_ROOT=</varname></term>
|
||||||
|
|
||||||
|
<listitem><para>Sets the directory name used for the cache
|
||||||
|
root. By default this is configured as
|
||||||
|
<filename>/var/cache/httpd/proxy</filename>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><varname>LIMIT=</varname></term>
|
||||||
|
|
||||||
|
<listitem><para>Sets the total disk cache space limit, in
|
||||||
|
bytes. Use a <emphasis>K</emphasis> or <emphasis>M</emphasis>
|
||||||
|
suffix to signify kilobytes or megabytes. By default this is
|
||||||
|
set to <emphasis>100M</emphasis>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><varname>OPTIONS=</varname></term>
|
||||||
|
|
||||||
|
<listitem><para>Any other options to pass to
|
||||||
|
<command>htcacheclean</command>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>Files</title>
|
||||||
|
|
||||||
|
<para><filename>/usr/lib/systemd/system/htcacheclean.service</filename>,
|
||||||
|
<filename>/etc/sysconfig/htcacheclean</filename></para>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>See also</title>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
<citerefentry><refentrytitle>htcacheclean</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||||||
|
</para>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
</refentry>
|
||||||
|
|
||||||
|
<!-- LocalWords: systemd httpd htcacheclean
|
||||||
|
-->
|
||||||
192
SOURCES/httpd-2.4.37-CVE-2019-10092.patch
Normal file
192
SOURCES/httpd-2.4.37-CVE-2019-10092.patch
Normal file
@ -0,0 +1,192 @@
|
|||||||
|
diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
|
||||||
|
index e419eb6..dcafa9c 100644
|
||||||
|
--- a/modules/http/http_protocol.c
|
||||||
|
+++ b/modules/http/http_protocol.c
|
||||||
|
@@ -1132,13 +1132,10 @@ static const char *get_canned_error_string(int status,
|
||||||
|
"\">here</a>.</p>\n",
|
||||||
|
NULL));
|
||||||
|
case HTTP_USE_PROXY:
|
||||||
|
- return(apr_pstrcat(p,
|
||||||
|
- "<p>This resource is only accessible "
|
||||||
|
- "through the proxy\n",
|
||||||
|
- ap_escape_html(r->pool, location),
|
||||||
|
- "<br />\nYou will need to configure "
|
||||||
|
- "your client to use that proxy.</p>\n",
|
||||||
|
- NULL));
|
||||||
|
+ return("<p>This resource is only accessible "
|
||||||
|
+ "through the proxy\n"
|
||||||
|
+ "<br />\nYou will need to configure "
|
||||||
|
+ "your client to use that proxy.</p>\n");
|
||||||
|
case HTTP_PROXY_AUTHENTICATION_REQUIRED:
|
||||||
|
case HTTP_UNAUTHORIZED:
|
||||||
|
return("<p>This server could not verify that you\n"
|
||||||
|
@@ -1154,34 +1151,20 @@ static const char *get_canned_error_string(int status,
|
||||||
|
"error-notes",
|
||||||
|
"</p>\n"));
|
||||||
|
case HTTP_FORBIDDEN:
|
||||||
|
- s1 = apr_pstrcat(p,
|
||||||
|
- "<p>You don't have permission to access ",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- "\non this server.<br />\n",
|
||||||
|
- NULL);
|
||||||
|
- return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
|
||||||
|
+ return(add_optional_notes(r, "<p>You don't have permission to access this resource.", "error-notes", "</p>\n"));
|
||||||
|
case HTTP_NOT_FOUND:
|
||||||
|
- return(apr_pstrcat(p,
|
||||||
|
- "<p>The requested URL ",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- " was not found on this server.</p>\n",
|
||||||
|
- NULL));
|
||||||
|
+ return("<p>The requested URL was not found on this server.</p>\n");
|
||||||
|
case HTTP_METHOD_NOT_ALLOWED:
|
||||||
|
return(apr_pstrcat(p,
|
||||||
|
"<p>The requested method ",
|
||||||
|
ap_escape_html(r->pool, r->method),
|
||||||
|
- " is not allowed for the URL ",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- ".</p>\n",
|
||||||
|
+ " is not allowed for this URL.</p>\n",
|
||||||
|
NULL));
|
||||||
|
case HTTP_NOT_ACCEPTABLE:
|
||||||
|
- s1 = apr_pstrcat(p,
|
||||||
|
- "<p>An appropriate representation of the "
|
||||||
|
- "requested resource ",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- " could not be found on this server.</p>\n",
|
||||||
|
- NULL);
|
||||||
|
- return(add_optional_notes(r, s1, "variant-list", ""));
|
||||||
|
+ return(add_optional_notes(r,
|
||||||
|
+ "<p>An appropriate representation of the requested resource "
|
||||||
|
+ "could not be found on this server.</p>\n",
|
||||||
|
+ "variant-list", ""));
|
||||||
|
case HTTP_MULTIPLE_CHOICES:
|
||||||
|
return(add_optional_notes(r, "", "variant-list", ""));
|
||||||
|
case HTTP_LENGTH_REQUIRED:
|
||||||
|
@@ -1192,18 +1175,13 @@ static const char *get_canned_error_string(int status,
|
||||||
|
NULL);
|
||||||
|
return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
|
||||||
|
case HTTP_PRECONDITION_FAILED:
|
||||||
|
- return(apr_pstrcat(p,
|
||||||
|
- "<p>The precondition on the request "
|
||||||
|
- "for the URL ",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- " evaluated to false.</p>\n",
|
||||||
|
- NULL));
|
||||||
|
+ return("<p>The precondition on the request "
|
||||||
|
+ "for this URL evaluated to false.</p>\n");
|
||||||
|
case HTTP_NOT_IMPLEMENTED:
|
||||||
|
s1 = apr_pstrcat(p,
|
||||||
|
"<p>",
|
||||||
|
- ap_escape_html(r->pool, r->method), " to ",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- " not supported.<br />\n",
|
||||||
|
+ ap_escape_html(r->pool, r->method), " ",
|
||||||
|
+ " not supported for current URL.<br />\n",
|
||||||
|
NULL);
|
||||||
|
return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
|
||||||
|
case HTTP_BAD_GATEWAY:
|
||||||
|
@@ -1211,29 +1189,19 @@ static const char *get_canned_error_string(int status,
|
||||||
|
"response from an upstream server.<br />" CRLF;
|
||||||
|
return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
|
||||||
|
case HTTP_VARIANT_ALSO_VARIES:
|
||||||
|
- return(apr_pstrcat(p,
|
||||||
|
- "<p>A variant for the requested "
|
||||||
|
- "resource\n<pre>\n",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- "\n</pre>\nis itself a negotiable resource. "
|
||||||
|
- "This indicates a configuration error.</p>\n",
|
||||||
|
- NULL));
|
||||||
|
+ return("<p>A variant for the requested "
|
||||||
|
+ "resource\n<pre>\n"
|
||||||
|
+ "\n</pre>\nis itself a negotiable resource. "
|
||||||
|
+ "This indicates a configuration error.</p>\n");
|
||||||
|
case HTTP_REQUEST_TIME_OUT:
|
||||||
|
return("<p>Server timeout waiting for the HTTP request from the client.</p>\n");
|
||||||
|
case HTTP_GONE:
|
||||||
|
- return(apr_pstrcat(p,
|
||||||
|
- "<p>The requested resource<br />",
|
||||||
|
- ap_escape_html(r->pool, r->uri),
|
||||||
|
- "<br />\nis no longer available on this server "
|
||||||
|
- "and there is no forwarding address.\n"
|
||||||
|
- "Please remove all references to this "
|
||||||
|
- "resource.</p>\n",
|
||||||
|
- NULL));
|
||||||
|
+ return("<p>The requested resource is no longer available on this server"
|
||||||
|
+ " and there is no forwarding address.\n"
|
||||||
|
+ "Please remove all references to this resource.</p>\n");
|
||||||
|
case HTTP_REQUEST_ENTITY_TOO_LARGE:
|
||||||
|
return(apr_pstrcat(p,
|
||||||
|
- "The requested resource<br />",
|
||||||
|
- ap_escape_html(r->pool, r->uri), "<br />\n",
|
||||||
|
- "does not allow request data with ",
|
||||||
|
+ "The requested resource does not allow request data with ",
|
||||||
|
ap_escape_html(r->pool, r->method),
|
||||||
|
" requests, or the amount of data provided in\n"
|
||||||
|
"the request exceeds the capacity limit.\n",
|
||||||
|
@@ -1317,11 +1285,9 @@ static const char *get_canned_error_string(int status,
|
||||||
|
"the Server Name Indication (SNI) in use for this\n"
|
||||||
|
"connection.</p>\n");
|
||||||
|
case HTTP_UNAVAILABLE_FOR_LEGAL_REASONS:
|
||||||
|
- s1 = apr_pstrcat(p,
|
||||||
|
- "<p>Access to ", ap_escape_html(r->pool, r->uri),
|
||||||
|
- "\nhas been denied for legal reasons.<br />\n",
|
||||||
|
- NULL);
|
||||||
|
- return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
|
||||||
|
+ return(add_optional_notes(r,
|
||||||
|
+ "<p>Access to this URL has been denied for legal reasons.<br />\n",
|
||||||
|
+ "error-notes", "</p>\n"));
|
||||||
|
default: /* HTTP_INTERNAL_SERVER_ERROR */
|
||||||
|
/*
|
||||||
|
* This comparison to expose error-notes could be modified to
|
||||||
|
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
|
||||||
|
index 800ede1..de48735 100644
|
||||||
|
--- a/modules/proxy/mod_proxy.c
|
||||||
|
+++ b/modules/proxy/mod_proxy.c
|
||||||
|
@@ -1055,9 +1055,10 @@ static int proxy_handler(request_rec *r)
|
||||||
|
char *end;
|
||||||
|
maxfwd = apr_strtoi64(str, &end, 10);
|
||||||
|
if (maxfwd < 0 || maxfwd == APR_INT64_MAX || *end) {
|
||||||
|
- return ap_proxyerror(r, HTTP_BAD_REQUEST,
|
||||||
|
- apr_psprintf(r->pool,
|
||||||
|
- "Max-Forwards value '%s' could not be parsed", str));
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO()
|
||||||
|
+ "Max-Forwards value '%s' could not be parsed", str);
|
||||||
|
+ return ap_proxyerror(r, HTTP_BAD_REQUEST,
|
||||||
|
+ "Max-Forwards request header could not be parsed");
|
||||||
|
}
|
||||||
|
else if (maxfwd == 0) {
|
||||||
|
switch (r->method_number) {
|
||||||
|
diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c
|
||||||
|
index 4a10987..8f6f853 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_ftp.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_ftp.c
|
||||||
|
@@ -1024,8 +1024,9 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker,
|
||||||
|
/* We break the URL into host, port, path-search */
|
||||||
|
if (r->parsed_uri.hostname == NULL) {
|
||||||
|
if (APR_SUCCESS != apr_uri_parse(p, url, &uri)) {
|
||||||
|
- return ap_proxyerror(r, HTTP_BAD_REQUEST,
|
||||||
|
- apr_psprintf(p, "URI cannot be parsed: %s", url));
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO()
|
||||||
|
+ "URI cannot be parsed: %s", url);
|
||||||
|
+ return ap_proxyerror(r, HTTP_BAD_REQUEST, "URI cannot be parsed");
|
||||||
|
}
|
||||||
|
connectname = uri.hostname;
|
||||||
|
connectport = uri.port;
|
||||||
|
diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
|
||||||
|
index 6501c68..0bbfa59 100644
|
||||||
|
--- a/modules/proxy/proxy_util.c
|
||||||
|
+++ b/modules/proxy/proxy_util.c
|
||||||
|
@@ -368,12 +368,9 @@ PROXY_DECLARE(char *)
|
||||||
|
|
||||||
|
PROXY_DECLARE(int) ap_proxyerror(request_rec *r, int statuscode, const char *message)
|
||||||
|
{
|
||||||
|
- const char *uri = ap_escape_html(r->pool, r->uri);
|
||||||
|
apr_table_setn(r->notes, "error-notes",
|
||||||
|
apr_pstrcat(r->pool,
|
||||||
|
- "The proxy server could not handle the request <em><a href=\"",
|
||||||
|
- uri, "\">", ap_escape_html(r->pool, r->method), " ", uri,
|
||||||
|
- "</a></em>.<p>\n"
|
||||||
|
+ "The proxy server could not handle the request<p>"
|
||||||
|
"Reason: <strong>", ap_escape_html(r->pool, message),
|
||||||
|
"</strong></p>",
|
||||||
|
NULL));
|
||||||
66
SOURCES/httpd-2.4.37-CVE-2019-10097.patch
Normal file
66
SOURCES/httpd-2.4.37-CVE-2019-10097.patch
Normal file
@ -0,0 +1,66 @@
|
|||||||
|
diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c
|
||||||
|
index 4572ce1..a0cbc0f 100644
|
||||||
|
--- a/modules/metadata/mod_remoteip.c
|
||||||
|
+++ b/modules/metadata/mod_remoteip.c
|
||||||
|
@@ -987,15 +987,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c,
|
||||||
|
return HDR_ERROR;
|
||||||
|
#endif
|
||||||
|
default:
|
||||||
|
- /* unsupported protocol, keep local connection address */
|
||||||
|
- return HDR_DONE;
|
||||||
|
+ /* unsupported protocol */
|
||||||
|
+ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(10183)
|
||||||
|
+ "RemoteIPProxyProtocol: unsupported protocol %.2hx",
|
||||||
|
+ (unsigned short)hdr->v2.fam);
|
||||||
|
+ return HDR_ERROR;
|
||||||
|
}
|
||||||
|
break; /* we got a sockaddr now */
|
||||||
|
-
|
||||||
|
- case 0x00: /* LOCAL command */
|
||||||
|
- /* keep local connection address for LOCAL */
|
||||||
|
- return HDR_DONE;
|
||||||
|
-
|
||||||
|
default:
|
||||||
|
/* not a supported command */
|
||||||
|
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(03507)
|
||||||
|
@@ -1087,11 +1085,24 @@ static apr_status_t remoteip_input_filter(ap_filter_t *f,
|
||||||
|
/* try to read a header's worth of data */
|
||||||
|
while (!ctx->done) {
|
||||||
|
if (APR_BRIGADE_EMPTY(ctx->bb)) {
|
||||||
|
- ret = ap_get_brigade(f->next, ctx->bb, ctx->mode, block,
|
||||||
|
- ctx->need - ctx->rcvd);
|
||||||
|
+ apr_off_t got, want = ctx->need - ctx->rcvd;
|
||||||
|
+
|
||||||
|
+ ret = ap_get_brigade(f->next, ctx->bb, ctx->mode, block, want);
|
||||||
|
if (ret != APR_SUCCESS) {
|
||||||
|
+ ap_log_cerror(APLOG_MARK, APLOG_ERR, ret, f->c, APLOGNO(10184)
|
||||||
|
+ "failed reading input");
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ ret = apr_brigade_length(ctx->bb, 1, &got);
|
||||||
|
+ if (ret || got > want) {
|
||||||
|
+ ap_log_cerror(APLOG_MARK, APLOG_ERR, ret, f->c, APLOGNO(10185)
|
||||||
|
+ "RemoteIPProxyProtocol header too long, "
|
||||||
|
+ "got %" APR_OFF_T_FMT " expected %" APR_OFF_T_FMT,
|
||||||
|
+ got, want);
|
||||||
|
+ f->c->aborted = 1;
|
||||||
|
+ return APR_ECONNABORTED;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
if (APR_BRIGADE_EMPTY(ctx->bb)) {
|
||||||
|
return block == APR_NONBLOCK_READ ? APR_SUCCESS : APR_EOF;
|
||||||
|
@@ -1139,6 +1150,13 @@ static apr_status_t remoteip_input_filter(ap_filter_t *f,
|
||||||
|
if (ctx->rcvd >= MIN_V2_HDR_LEN) {
|
||||||
|
ctx->need = MIN_V2_HDR_LEN +
|
||||||
|
remoteip_get_v2_len((proxy_header *) ctx->header);
|
||||||
|
+ if (ctx->need > sizeof(proxy_v2)) {
|
||||||
|
+ ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, f->c, APLOGNO(10186)
|
||||||
|
+ "RemoteIPProxyProtocol protocol header length too long");
|
||||||
|
+ f->c->aborted = 1;
|
||||||
|
+ apr_brigade_destroy(ctx->bb);
|
||||||
|
+ return APR_ECONNABORTED;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
if (ctx->rcvd >= ctx->need) {
|
||||||
|
psts = remoteip_process_v2_header(f->c, conn_conf,
|
||||||
91
SOURCES/httpd-2.4.37-CVE-2019-10098.patch
Normal file
91
SOURCES/httpd-2.4.37-CVE-2019-10098.patch
Normal file
@ -0,0 +1,91 @@
|
|||||||
|
diff --git a/include/ap_regex.h b/include/ap_regex.h
|
||||||
|
index 7d8df79..7af2f99 100644
|
||||||
|
--- a/include/ap_regex.h
|
||||||
|
+++ b/include/ap_regex.h
|
||||||
|
@@ -84,7 +84,11 @@ extern "C" {
|
||||||
|
|
||||||
|
#define AP_REG_DOLLAR_ENDONLY 0x200 /* '$' matches at end of subject string only */
|
||||||
|
|
||||||
|
-#define AP_REG_MATCH "MATCH_" /** suggested prefix for ap_regname */
|
||||||
|
+#define AP_REG_NO_DEFAULT 0x400 /**< Don't implicitely add AP_REG_DEFAULT options */
|
||||||
|
+
|
||||||
|
+#define AP_REG_MATCH "MATCH_" /**< suggested prefix for ap_regname */
|
||||||
|
+
|
||||||
|
+#define AP_REG_DEFAULT (AP_REG_DOTALL|AP_REG_DOLLAR_ENDONLY)
|
||||||
|
|
||||||
|
/* Error values: */
|
||||||
|
enum {
|
||||||
|
diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
|
||||||
|
index b7d5296..e976c51 100644
|
||||||
|
--- a/modules/filters/mod_substitute.c
|
||||||
|
+++ b/modules/filters/mod_substitute.c
|
||||||
|
@@ -667,8 +667,10 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
|
||||||
|
|
||||||
|
/* first see if we can compile the regex */
|
||||||
|
if (!is_pattern) {
|
||||||
|
- r = ap_pregcomp(cmd->pool, from, AP_REG_EXTENDED |
|
||||||
|
- (ignore_case ? AP_REG_ICASE : 0));
|
||||||
|
+ int flags = AP_REG_NO_DEFAULT
|
||||||
|
+ | (ap_regcomp_get_default_cflags() & AP_REG_DOLLAR_ENDONLY)
|
||||||
|
+ | (ignore_case ? AP_REG_ICASE : 0);
|
||||||
|
+ r = ap_pregcomp(cmd->pool, from, flags);
|
||||||
|
if (!r)
|
||||||
|
return "Substitute could not compile regex";
|
||||||
|
}
|
||||||
|
diff --git a/server/core.c b/server/core.c
|
||||||
|
index 76432ce..6d00777 100644
|
||||||
|
--- a/server/core.c
|
||||||
|
+++ b/server/core.c
|
||||||
|
@@ -4973,7 +4973,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
|
||||||
|
init_config_defines(pconf);
|
||||||
|
apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null);
|
||||||
|
|
||||||
|
- ap_regcomp_set_default_cflags(AP_REG_DOLLAR_ENDONLY);
|
||||||
|
+ ap_regcomp_set_default_cflags(AP_REG_DEFAULT);
|
||||||
|
|
||||||
|
mpm_common_pre_config(pconf);
|
||||||
|
|
||||||
|
diff --git a/server/util_pcre.c b/server/util_pcre.c
|
||||||
|
index f2cb1bb..2a665c8 100644
|
||||||
|
--- a/server/util_pcre.c
|
||||||
|
+++ b/server/util_pcre.c
|
||||||
|
@@ -120,7 +120,7 @@ AP_DECLARE(void) ap_regfree(ap_regex_t *preg)
|
||||||
|
* Compile a regular expression *
|
||||||
|
*************************************************/
|
||||||
|
|
||||||
|
-static int default_cflags = AP_REG_DOLLAR_ENDONLY;
|
||||||
|
+static int default_cflags = AP_REG_DEFAULT;
|
||||||
|
|
||||||
|
AP_DECLARE(int) ap_regcomp_get_default_cflags(void)
|
||||||
|
{
|
||||||
|
@@ -168,7 +168,8 @@ AP_DECLARE(int) ap_regcomp(ap_regex_t * preg, const char *pattern, int cflags)
|
||||||
|
int errcode = 0;
|
||||||
|
int options = PCRE_DUPNAMES;
|
||||||
|
|
||||||
|
- cflags |= default_cflags;
|
||||||
|
+ if ((cflags & AP_REG_NO_DEFAULT) == 0)
|
||||||
|
+ cflags |= default_cflags;
|
||||||
|
if ((cflags & AP_REG_ICASE) != 0)
|
||||||
|
options |= PCRE_CASELESS;
|
||||||
|
if ((cflags & AP_REG_NEWLINE) != 0)
|
||||||
|
diff --git a/server/util_regex.c b/server/util_regex.c
|
||||||
|
index 2a30d68..5405f8d 100644
|
||||||
|
--- a/server/util_regex.c
|
||||||
|
+++ b/server/util_regex.c
|
||||||
|
@@ -94,6 +94,7 @@ AP_DECLARE(ap_rxplus_t*) ap_rxplus_compile(apr_pool_t *pool,
|
||||||
|
}
|
||||||
|
|
||||||
|
/* anything after the current delimiter is flags */
|
||||||
|
+ ret->flags = ap_regcomp_get_default_cflags() & AP_REG_DOLLAR_ENDONLY;
|
||||||
|
while (*++endp) {
|
||||||
|
switch (*endp) {
|
||||||
|
case 'i': ret->flags |= AP_REG_ICASE; break;
|
||||||
|
@@ -106,7 +107,7 @@ AP_DECLARE(ap_rxplus_t*) ap_rxplus_compile(apr_pool_t *pool,
|
||||||
|
default: break; /* we should probably be stricter here */
|
||||||
|
}
|
||||||
|
}
|
||||||
|
- if (ap_regcomp(&ret->rx, rxstr, ret->flags) == 0) {
|
||||||
|
+ if (ap_regcomp(&ret->rx, rxstr, AP_REG_NO_DEFAULT | ret->flags) == 0) {
|
||||||
|
apr_pool_cleanup_register(pool, &ret->rx, rxplus_cleanup,
|
||||||
|
apr_pool_cleanup_null);
|
||||||
|
}
|
||||||
68
SOURCES/httpd-2.4.37-CVE-2020-1934.patch
Normal file
68
SOURCES/httpd-2.4.37-CVE-2020-1934.patch
Normal file
@ -0,0 +1,68 @@
|
|||||||
|
--- a/modules/proxy/mod_proxy_ftp.c 2020/02/07 17:01:07 1873744
|
||||||
|
+++ b/modules/proxy/mod_proxy_ftp.c 2020/02/07 17:04:45 1873745
|
||||||
|
@@ -218,7 +218,7 @@
|
||||||
|
* (EBCDIC) machines either.
|
||||||
|
*/
|
||||||
|
static apr_status_t ftp_string_read(conn_rec *c, apr_bucket_brigade *bb,
|
||||||
|
- char *buff, apr_size_t bufflen, int *eos)
|
||||||
|
+ char *buff, apr_size_t bufflen, int *eos, apr_size_t *outlen)
|
||||||
|
{
|
||||||
|
apr_bucket *e;
|
||||||
|
apr_status_t rv;
|
||||||
|
@@ -230,6 +230,7 @@
|
||||||
|
/* start with an empty string */
|
||||||
|
buff[0] = 0;
|
||||||
|
*eos = 0;
|
||||||
|
+ *outlen = 0;
|
||||||
|
|
||||||
|
/* loop through each brigade */
|
||||||
|
while (!found) {
|
||||||
|
@@ -273,6 +274,7 @@
|
||||||
|
if (len > 0) {
|
||||||
|
memcpy(pos, response, len);
|
||||||
|
pos += len;
|
||||||
|
+ *outlen += len;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
apr_bucket_delete(e);
|
||||||
|
@@ -385,28 +387,36 @@
|
||||||
|
char buff[5];
|
||||||
|
char *mb = msgbuf, *me = &msgbuf[msglen];
|
||||||
|
apr_status_t rv;
|
||||||
|
+ apr_size_t nread;
|
||||||
|
+
|
||||||
|
int eos;
|
||||||
|
|
||||||
|
- if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos))) {
|
||||||
|
+ if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos, &nread))) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
/*
|
||||||
|
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL, APLOGNO(03233)
|
||||||
|
"<%s", response);
|
||||||
|
*/
|
||||||
|
+ if (nread < 4) {
|
||||||
|
+ ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, APLOGNO(10229) "Malformed FTP response '%s'", response);
|
||||||
|
+ *mb = '\0';
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (!apr_isdigit(response[0]) || !apr_isdigit(response[1]) ||
|
||||||
|
- !apr_isdigit(response[2]) || (response[3] != ' ' && response[3] != '-'))
|
||||||
|
+ !apr_isdigit(response[2]) || (response[3] != ' ' && response[3] != '-'))
|
||||||
|
status = 0;
|
||||||
|
else
|
||||||
|
status = 100 * response[0] + 10 * response[1] + response[2] - 111 * '0';
|
||||||
|
|
||||||
|
mb = apr_cpystrn(mb, response + 4, me - mb);
|
||||||
|
|
||||||
|
- if (response[3] == '-') {
|
||||||
|
+ if (response[3] == '-') { /* multi-line reply "123-foo\nbar\n123 baz" */
|
||||||
|
memcpy(buff, response, 3);
|
||||||
|
buff[3] = ' ';
|
||||||
|
do {
|
||||||
|
- if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos))) {
|
||||||
|
+ if (APR_SUCCESS != (rv = ftp_string_read(ftp_ctrl, bb, response, sizeof(response), &eos, &nread))) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
mb = apr_cpystrn(mb, response + (' ' == response[0] ? 1 : 4), me - mb);
|
||||||
225
SOURCES/httpd-2.4.37-balancer-failover.patch
Normal file
225
SOURCES/httpd-2.4.37-balancer-failover.patch
Normal file
@ -0,0 +1,225 @@
|
|||||||
|
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
|
||||||
|
index ec1e042..2c0500f 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_http.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_http.c
|
||||||
|
@@ -310,16 +310,18 @@ static int stream_reqbody_read(proxy_http_req_t *req, apr_bucket_brigade *bb,
|
||||||
|
return OK;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method)
|
||||||
|
+static int stream_reqbody(proxy_http_req_t *req)
|
||||||
|
{
|
||||||
|
request_rec *r = req->r;
|
||||||
|
int seen_eos = 0, rv = OK;
|
||||||
|
apr_size_t hdr_len;
|
||||||
|
char chunk_hdr[20]; /* must be here due to transient bucket. */
|
||||||
|
+ conn_rec *origin = req->origin;
|
||||||
|
proxy_conn_rec *p_conn = req->backend;
|
||||||
|
apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
|
||||||
|
apr_bucket_brigade *header_brigade = req->header_brigade;
|
||||||
|
apr_bucket_brigade *input_brigade = req->input_brigade;
|
||||||
|
+ rb_methods rb_method = req->rb_method;
|
||||||
|
apr_off_t bytes, bytes_streamed = 0;
|
||||||
|
apr_bucket *e;
|
||||||
|
|
||||||
|
@@ -333,7 +335,7 @@ static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method)
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!APR_BRIGADE_EMPTY(input_brigade)) {
|
||||||
|
- /* If this brigade contains EOS, either stop or remove it. */
|
||||||
|
+ /* If this brigade contains EOS, remove it and be done. */
|
||||||
|
if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
|
||||||
|
seen_eos = 1;
|
||||||
|
|
||||||
|
@@ -375,7 +377,8 @@ static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method)
|
||||||
|
APR_BRIGADE_INSERT_TAIL(input_brigade, e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
- else if (bytes_streamed > req->cl_val) {
|
||||||
|
+ else if (rb_method == RB_STREAM_CL
|
||||||
|
+ && bytes_streamed > req->cl_val) {
|
||||||
|
/* C-L < bytes streamed?!?
|
||||||
|
* We will error out after the body is completely
|
||||||
|
* consumed, but we can't stream more bytes at the
|
||||||
|
@@ -407,7 +410,7 @@ static int stream_reqbody(proxy_http_req_t *req, rb_methods rb_method)
|
||||||
|
APR_BRIGADE_PREPEND(input_brigade, header_brigade);
|
||||||
|
|
||||||
|
/* Flush here on EOS because we won't stream_reqbody_read() again */
|
||||||
|
- rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, req->origin,
|
||||||
|
+ rv = ap_proxy_pass_brigade(bucket_alloc, r, p_conn, origin,
|
||||||
|
input_brigade, seen_eos);
|
||||||
|
if (rv != OK) {
|
||||||
|
return rv;
|
||||||
|
@@ -454,10 +457,6 @@ static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
|
||||||
|
/* If this brigade contains EOS, either stop or remove it. */
|
||||||
|
if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))) {
|
||||||
|
seen_eos = 1;
|
||||||
|
-
|
||||||
|
- /* We can't pass this EOS to the output_filters. */
|
||||||
|
- e = APR_BRIGADE_LAST(input_brigade);
|
||||||
|
- apr_bucket_delete(e);
|
||||||
|
}
|
||||||
|
|
||||||
|
apr_brigade_length(input_brigade, 1, &bytes);
|
||||||
|
@@ -644,7 +643,18 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
|
||||||
|
*/
|
||||||
|
temp_brigade = apr_brigade_create(p, bucket_alloc);
|
||||||
|
block = req->prefetch_nonblocking ? APR_NONBLOCK_READ : APR_BLOCK_READ;
|
||||||
|
- do {
|
||||||
|
+
|
||||||
|
+ /* Account for saved input, if any. */
|
||||||
|
+ apr_brigade_length(input_brigade, 0, &bytes_read);
|
||||||
|
+
|
||||||
|
+ /* Ensure we don't hit a wall where we have a buffer too small
|
||||||
|
+ * for ap_get_brigade's filters to fetch us another bucket,
|
||||||
|
+ * surrender once we hit 80 bytes less than MAX_MEM_SPOOL
|
||||||
|
+ * (an arbitrary value).
|
||||||
|
+ */
|
||||||
|
+ while (bytes_read < MAX_MEM_SPOOL - 80
|
||||||
|
+ && (APR_BRIGADE_EMPTY(input_brigade)
|
||||||
|
+ || !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade)))) {
|
||||||
|
status = ap_get_brigade(r->input_filters, temp_brigade,
|
||||||
|
AP_MODE_READBYTES, block,
|
||||||
|
MAX_MEM_SPOOL - bytes_read);
|
||||||
|
@@ -686,15 +696,7 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
|
||||||
|
c->client_ip, c->remote_host ? c->remote_host: "");
|
||||||
|
return HTTP_INTERNAL_SERVER_ERROR;
|
||||||
|
}
|
||||||
|
-
|
||||||
|
- /* Ensure we don't hit a wall where we have a buffer too small
|
||||||
|
- * for ap_get_brigade's filters to fetch us another bucket,
|
||||||
|
- * surrender once we hit 80 bytes less than MAX_MEM_SPOOL
|
||||||
|
- * (an arbitrary value.)
|
||||||
|
- */
|
||||||
|
- } while ((bytes_read < MAX_MEM_SPOOL - 80)
|
||||||
|
- && !APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(input_brigade))
|
||||||
|
- && !req->prefetch_nonblocking);
|
||||||
|
+ }
|
||||||
|
|
||||||
|
/* Use chunked request body encoding or send a content-length body?
|
||||||
|
*
|
||||||
|
@@ -838,35 +840,21 @@ static int ap_proxy_http_request(proxy_http_req_t *req)
|
||||||
|
{
|
||||||
|
int rv;
|
||||||
|
request_rec *r = req->r;
|
||||||
|
- apr_bucket_alloc_t *bucket_alloc = req->bucket_alloc;
|
||||||
|
- apr_bucket_brigade *header_brigade = req->header_brigade;
|
||||||
|
- apr_bucket_brigade *input_brigade = req->input_brigade;
|
||||||
|
|
||||||
|
/* send the request header/body, if any. */
|
||||||
|
switch (req->rb_method) {
|
||||||
|
+ case RB_SPOOL_CL:
|
||||||
|
case RB_STREAM_CL:
|
||||||
|
case RB_STREAM_CHUNKED:
|
||||||
|
if (req->do_100_continue) {
|
||||||
|
- rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend,
|
||||||
|
- req->origin, header_brigade, 1);
|
||||||
|
+ rv = ap_proxy_pass_brigade(req->bucket_alloc, r, req->backend,
|
||||||
|
+ req->origin, req->header_brigade, 1);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
- rv = stream_reqbody(req, req->rb_method);
|
||||||
|
+ rv = stream_reqbody(req);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
|
||||||
|
- case RB_SPOOL_CL:
|
||||||
|
- /* Prefetch has built the header and spooled the whole body;
|
||||||
|
- * if we don't expect 100-continue we can flush both all at once,
|
||||||
|
- * otherwise flush the header only.
|
||||||
|
- */
|
||||||
|
- if (!req->do_100_continue) {
|
||||||
|
- APR_BRIGADE_CONCAT(header_brigade, input_brigade);
|
||||||
|
- }
|
||||||
|
- rv = ap_proxy_pass_brigade(bucket_alloc, r, req->backend,
|
||||||
|
- req->origin, header_brigade, 1);
|
||||||
|
- break;
|
||||||
|
-
|
||||||
|
default:
|
||||||
|
/* shouldn't be possible */
|
||||||
|
rv = HTTP_INTERNAL_SERVER_ERROR;
|
||||||
|
@@ -1577,15 +1565,10 @@ int ap_proxy_http_process_response(proxy_http_req_t *req)
|
||||||
|
|
||||||
|
/* Send the request body (fully). */
|
||||||
|
switch(req->rb_method) {
|
||||||
|
+ case RB_SPOOL_CL:
|
||||||
|
case RB_STREAM_CL:
|
||||||
|
case RB_STREAM_CHUNKED:
|
||||||
|
- status = stream_reqbody(req, req->rb_method);
|
||||||
|
- break;
|
||||||
|
- case RB_SPOOL_CL:
|
||||||
|
- /* Prefetch has spooled the whole body, flush it. */
|
||||||
|
- status = ap_proxy_pass_brigade(req->bucket_alloc, r,
|
||||||
|
- backend, origin,
|
||||||
|
- req->input_brigade, 1);
|
||||||
|
+ status = stream_reqbody(req);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
/* Shouldn't happen */
|
||||||
|
@@ -1940,6 +1923,7 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
|
||||||
|
const char *u;
|
||||||
|
proxy_http_req_t *req = NULL;
|
||||||
|
proxy_conn_rec *backend = NULL;
|
||||||
|
+ apr_bucket_brigade *input_brigade = NULL;
|
||||||
|
int is_ssl = 0;
|
||||||
|
conn_rec *c = r->connection;
|
||||||
|
proxy_dir_conf *dconf;
|
||||||
|
@@ -2005,8 +1989,20 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
|
||||||
|
|
||||||
|
dconf = ap_get_module_config(r->per_dir_config, &proxy_module);
|
||||||
|
|
||||||
|
+ /* We possibly reuse input data prefetched in previous call(s), e.g. for a
|
||||||
|
+ * balancer fallback scenario, and in this case the 100 continue settings
|
||||||
|
+ * should be consistent between balancer members. If not, we need to ignore
|
||||||
|
+ * Proxy100Continue on=>off once we tried to prefetch already, otherwise
|
||||||
|
+ * the HTTP_IN filter won't send 100 Continue for us anymore, and we might
|
||||||
|
+ * deadlock with the client waiting for each other. Note that off=>on is
|
||||||
|
+ * not an issue because in this case r->expecting_100 is false (the 100
|
||||||
|
+ * Continue is out already), but we make sure that prefetch will be
|
||||||
|
+ * nonblocking to avoid passing more time there.
|
||||||
|
+ */
|
||||||
|
+ apr_pool_userdata_get((void **)&input_brigade, "proxy-req-input", p);
|
||||||
|
+
|
||||||
|
/* Should we handle end-to-end or ping 100-continue? */
|
||||||
|
- if ((r->expecting_100 && dconf->forward_100_continue)
|
||||||
|
+ if ((r->expecting_100 && (dconf->forward_100_continue || input_brigade))
|
||||||
|
|| PROXY_DO_100_CONTINUE(worker, r)) {
|
||||||
|
/* We need to reset r->expecting_100 or prefetching will cause
|
||||||
|
* ap_http_filter() to send "100 Continue" response by itself. So
|
||||||
|
@@ -2023,7 +2019,8 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
|
||||||
|
/* Should we block while prefetching the body or try nonblocking and flush
|
||||||
|
* data to the backend ASAP?
|
||||||
|
*/
|
||||||
|
- else if (apr_table_get(r->subprocess_env, "proxy-prefetch-nonblocking")) {
|
||||||
|
+ else if (input_brigade || apr_table_get(r->subprocess_env,
|
||||||
|
+ "proxy-prefetch-nonblocking")) {
|
||||||
|
req->prefetch_nonblocking = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -2048,6 +2045,17 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
|
||||||
|
sizeof(req->server_portstr))))
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
+ /* The header is always (re-)built since it depends on worker settings,
|
||||||
|
+ * but the body can be fetched only once (even partially), so it's saved
|
||||||
|
+ * in between proxy_http_handler() calls should we come back here.
|
||||||
|
+ */
|
||||||
|
+ req->header_brigade = apr_brigade_create(p, req->bucket_alloc);
|
||||||
|
+ if (input_brigade == NULL) {
|
||||||
|
+ input_brigade = apr_brigade_create(p, req->bucket_alloc);
|
||||||
|
+ apr_pool_userdata_setn(input_brigade, "proxy-req-input", NULL, p);
|
||||||
|
+ }
|
||||||
|
+ req->input_brigade = input_brigade;
|
||||||
|
+
|
||||||
|
/* Prefetch (nonlocking) the request body so to increase the chance to get
|
||||||
|
* the whole (or enough) body and determine Content-Length vs chunked or
|
||||||
|
* spooled. By doing this before connecting or reusing the backend, we want
|
||||||
|
@@ -2058,8 +2066,6 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
|
||||||
|
* to reduce to the minimum the unavoidable local is_socket_connected() vs
|
||||||
|
* remote keepalive race condition.
|
||||||
|
*/
|
||||||
|
- req->input_brigade = apr_brigade_create(p, req->bucket_alloc);
|
||||||
|
- req->header_brigade = apr_brigade_create(p, req->bucket_alloc);
|
||||||
|
if ((status = ap_proxy_http_prefetch(req, uri, locurl)) != OK)
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
87
SOURCES/httpd-2.4.37-logjournal.patch
Normal file
87
SOURCES/httpd-2.4.37-logjournal.patch
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
|
||||||
|
index 762e773e94..0848d2e377 100644
|
||||||
|
--- a/modules/loggers/config.m4
|
||||||
|
+++ b/modules/loggers/config.m4
|
||||||
|
@@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
|
||||||
|
APACHE_MODPATH_INIT(loggers)
|
||||||
|
|
||||||
|
APACHE_MODULE(log_config, logging configuration. You won't be able to log requests to the server without this module., , , yes)
|
||||||
|
+APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
|
||||||
|
+
|
||||||
|
APACHE_MODULE(log_debug, configurable debug logging, , , most)
|
||||||
|
APACHE_MODULE(log_forensic, forensic logging)
|
||||||
|
|
||||||
|
diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
|
||||||
|
index 996c09cf49..50a056a2f8 100644
|
||||||
|
--- a/modules/loggers/mod_log_config.c
|
||||||
|
+++ b/modules/loggers/mod_log_config.c
|
||||||
|
@@ -172,6 +172,10 @@
|
||||||
|
#include <limits.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#ifdef HAVE_SYSTEMD
|
||||||
|
+#include <systemd/sd-journal.h>
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
#define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
|
||||||
|
|
||||||
|
module AP_MODULE_DECLARE_DATA log_config_module;
|
||||||
|
@@ -1638,6 +1642,25 @@ static apr_status_t ap_default_log_writer( request_rec *r,
|
||||||
|
|
||||||
|
return rv;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
|
||||||
|
+ int priority)
|
||||||
|
+{
|
||||||
|
+#ifdef HAVE_SYSTEMD
|
||||||
|
+ int fd;
|
||||||
|
+
|
||||||
|
+ fd = sd_journal_stream_fd("httpd", priority, 0);
|
||||||
|
+ if (fd < 0) return fd;
|
||||||
|
+
|
||||||
|
+ /* This is an AF_UNIX socket fd so is more pipe-like than
|
||||||
|
+ * file-like (the fd is neither seekable or readable), and use of
|
||||||
|
+ * apr_os_pipe_put_ex() allows cleanup registration. */
|
||||||
|
+ return apr_os_pipe_put_ex(outfd, &fd, 1, p);
|
||||||
|
+#else
|
||||||
|
+ return APR_ENOTIMPL;
|
||||||
|
+#endif
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
|
||||||
|
const char* name)
|
||||||
|
{
|
||||||
|
@@ -1650,6 +1673,32 @@ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
|
||||||
|
}
|
||||||
|
return ap_piped_log_write_fd(pl);
|
||||||
|
}
|
||||||
|
+ else if (strncasecmp(name, "journald:", 9) == 0) {
|
||||||
|
+ int priority;
|
||||||
|
+ const char *err = ap_parse_log_level(name + 9, &priority);
|
||||||
|
+ apr_status_t rv;
|
||||||
|
+ apr_file_t *fd;
|
||||||
|
+
|
||||||
|
+ if (err == NULL && priority > LOG_DEBUG) {
|
||||||
|
+ err = "TRACE level debugging not supported with journald";
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (err) {
|
||||||
|
+ ap_log_error(APLOG_MARK, APLOG_ERR, APR_EBADPATH, s,
|
||||||
|
+ "invalid journald log priority name %s: %s",
|
||||||
|
+ name, err);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ rv = wrap_journal_stream(p, &fd, priority);
|
||||||
|
+ if (rv) {
|
||||||
|
+ ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
|
||||||
|
+ "could not open journald log stream");
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return fd;
|
||||||
|
+ }
|
||||||
|
else {
|
||||||
|
const char *fname = ap_server_root_relative(p, name);
|
||||||
|
apr_file_t *fd;
|
||||||
1713
SOURCES/httpd-2.4.37-proxy-continue.patch
Normal file
1713
SOURCES/httpd-2.4.37-proxy-continue.patch
Normal file
File diff suppressed because it is too large
Load Diff
194
SOURCES/httpd-2.4.37-session-expiry-updt-int.patch
Normal file
194
SOURCES/httpd-2.4.37-session-expiry-updt-int.patch
Normal file
@ -0,0 +1,194 @@
|
|||||||
|
diff --git a/docs/manual/mod/mod_session.html.en b/docs/manual/mod/mod_session.html.en
|
||||||
|
index 6834f8e..9f8301f 100644
|
||||||
|
--- a/docs/manual/mod/mod_session.html.en
|
||||||
|
+++ b/docs/manual/mod/mod_session.html.en
|
||||||
|
@@ -82,6 +82,7 @@
|
||||||
|
<li><img alt="" src="../images/down.gif" /> <a href="#sessionheader">SessionHeader</a></li>
|
||||||
|
<li><img alt="" src="../images/down.gif" /> <a href="#sessioninclude">SessionInclude</a></li>
|
||||||
|
<li><img alt="" src="../images/down.gif" /> <a href="#sessionmaxage">SessionMaxAge</a></li>
|
||||||
|
+<li><img alt="" src="../images/down.gif" /> <a href="#sessionexpiryupdateinterval">SessionExpiryUpdateInterval</a></li>
|
||||||
|
</ul>
|
||||||
|
<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&list_id=144532&product=Apache%20httpd-2&query_format=specific&order=changeddate%20DESC%2Cpriority%2Cbug_severity&component=mod_session">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&component=mod_session">Report a bug</a></li></ul><h3>See also</h3>
|
||||||
|
<ul class="seealso">
|
||||||
|
@@ -482,6 +483,37 @@ AuthName realm
|
||||||
|
|
||||||
|
<p>Setting the maxage to zero disables session expiry.</p>
|
||||||
|
|
||||||
|
+</div>
|
||||||
|
+<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||||||
|
+<div class="directive-section"><h2><a name="SessionExpiryUpdateInterval" id="sessionexpiryupdateinterval">SessionExpiryUpdateInterval</a> <a name="sessionexpiryupdateinterval" id="sessionexpiryupdateinterval">Directive</a></h2>
|
||||||
|
+<table class="directive">
|
||||||
|
+<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Define the number of seconds a session's expiry may change without the session being updated</td></tr>
|
||||||
|
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SessionExpiryUpdateInterval <var>interval</var></code></td></tr>
|
||||||
|
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SessionExpiryUpdateInterval 0 (always update)</code></td></tr>
|
||||||
|
+<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory, .htaccess</td></tr>
|
||||||
|
+<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_session</td></tr>
|
||||||
|
+</table>
|
||||||
|
+ <p>The <code class="directive">SessionExpiryUpdateInterval</code> directive allows
|
||||||
|
+ sessions to avoid the cost associated with writing the session each request
|
||||||
|
+ when only the expiry time has changed. This can be used to make a website
|
||||||
|
+ more efficient or reduce load on a database when using
|
||||||
|
+ <module>mod_session_dbd</module>. The session is always written if the data
|
||||||
|
+ stored in the session has changed or the expiry has changed by more than the
|
||||||
|
+ configured interval.</p>
|
||||||
|
+
|
||||||
|
+ <p>Setting the interval to zero disables this directive, and the session
|
||||||
|
+ expiry is refreshed for each request.</p>
|
||||||
|
+
|
||||||
|
+ <p>This directive only has an effect when combined with <code class="directive"><a href="../mod/mod_session.html#sessionmaxage">SessionMaxAge</a></code> to enable session
|
||||||
|
+ expiry. Sessions without an expiry are only written when the data stored in
|
||||||
|
+ the session has changed.</p>
|
||||||
|
+
|
||||||
|
+ <div class="warning"><h3>Warning</h3>
|
||||||
|
+ <p>Because the session expiry may not be refreshed with each request, it's
|
||||||
|
+ possible for sessions to expire up to <var>interval</var> seconds early.
|
||||||
|
+ Using a small interval usually provides sufficient savings while having a
|
||||||
|
+ minimal effect on expiry resolution.</p></div>
|
||||||
|
+
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="bottomlang">
|
||||||
|
diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c
|
||||||
|
index d517020..10e6396 100644
|
||||||
|
--- a/modules/session/mod_session.c
|
||||||
|
+++ b/modules/session/mod_session.c
|
||||||
|
@@ -177,6 +177,7 @@ static apr_status_t ap_session_save(request_rec * r, session_rec * z)
|
||||||
|
{
|
||||||
|
if (z) {
|
||||||
|
apr_time_t now = apr_time_now();
|
||||||
|
+ apr_time_t initialExpiry = z->expiry;
|
||||||
|
int rv = 0;
|
||||||
|
|
||||||
|
session_dir_conf *dconf = ap_get_module_config(r->per_dir_config,
|
||||||
|
@@ -207,6 +208,17 @@ static apr_status_t ap_session_save(request_rec * r, session_rec * z)
|
||||||
|
z->expiry = now + z->maxage * APR_USEC_PER_SEC;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* don't save if the only change is the expiry by a small amount */
|
||||||
|
+ if (!z->dirty && dconf->expiry_update_time
|
||||||
|
+ && (z->expiry - initialExpiry < dconf->expiry_update_time)) {
|
||||||
|
+ return APR_SUCCESS;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* also don't save sessions that didn't change at all */
|
||||||
|
+ if (!z->dirty && !z->maxage) {
|
||||||
|
+ return APR_SUCCESS;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* encode the session */
|
||||||
|
rv = ap_run_session_encode(r, z);
|
||||||
|
if (OK != rv) {
|
||||||
|
@@ -553,6 +565,10 @@ static void *merge_session_dir_config(apr_pool_t * p, void *basev, void *addv)
|
||||||
|
new->env_set = add->env_set || base->env_set;
|
||||||
|
new->includes = apr_array_append(p, base->includes, add->includes);
|
||||||
|
new->excludes = apr_array_append(p, base->excludes, add->excludes);
|
||||||
|
+ new->expiry_update_time = (add->expiry_update_set == 0)
|
||||||
|
+ ? base->expiry_update_time
|
||||||
|
+ : add->expiry_update_time;
|
||||||
|
+ new->expiry_update_set = add->expiry_update_set || base->expiry_update_set;
|
||||||
|
|
||||||
|
return new;
|
||||||
|
}
|
||||||
|
@@ -622,6 +638,21 @@ static const char *add_session_exclude(cmd_parms * cmd, void *dconf, const char
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static const char *
|
||||||
|
+ set_session_expiry_update(cmd_parms * parms, void *dconf, const char *arg)
|
||||||
|
+{
|
||||||
|
+ session_dir_conf *conf = dconf;
|
||||||
|
+
|
||||||
|
+ conf->expiry_update_time = atoi(arg);
|
||||||
|
+ if (conf->expiry_update_time < 0) {
|
||||||
|
+ return "SessionExpiryUpdateInterval must be positive or nul";
|
||||||
|
+ }
|
||||||
|
+ conf->expiry_update_time = apr_time_from_sec(conf->expiry_update_time);
|
||||||
|
+ conf->expiry_update_set = 1;
|
||||||
|
+
|
||||||
|
+ return NULL;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
|
||||||
|
static const command_rec session_cmds[] =
|
||||||
|
{
|
||||||
|
@@ -637,6 +668,9 @@ static const command_rec session_cmds[] =
|
||||||
|
"URL prefixes to include in the session. Defaults to all URLs"),
|
||||||
|
AP_INIT_TAKE1("SessionExclude", add_session_exclude, NULL, RSRC_CONF|OR_AUTHCFG,
|
||||||
|
"URL prefixes to exclude from the session. Defaults to no URLs"),
|
||||||
|
+ AP_INIT_TAKE1("SessionExpiryUpdateInterval", set_session_expiry_update, NULL, RSRC_CONF|OR_AUTHCFG,
|
||||||
|
+ "time interval for which a session's expiry time may change "
|
||||||
|
+ "without having to be rewritten. Zero to disable"),
|
||||||
|
{NULL}
|
||||||
|
};
|
||||||
|
|
||||||
|
diff --git a/modules/session/mod_session.h b/modules/session/mod_session.h
|
||||||
|
index a6dd5e9..bdeb532 100644
|
||||||
|
--- a/modules/session/mod_session.h
|
||||||
|
+++ b/modules/session/mod_session.h
|
||||||
|
@@ -115,6 +115,9 @@ typedef struct {
|
||||||
|
* URLs included if empty */
|
||||||
|
apr_array_header_t *excludes; /* URL prefixes to be excluded. No
|
||||||
|
* URLs excluded if empty */
|
||||||
|
+ apr_time_t expiry_update_time; /* seconds the session expiry may change and
|
||||||
|
+ * not have to be rewritten */
|
||||||
|
+ int expiry_update_set;
|
||||||
|
} session_dir_conf;
|
||||||
|
|
||||||
|
/**
|
||||||
|
diff --git a/modules/session/mod_session_cookie.c b/modules/session/mod_session_cookie.c
|
||||||
|
index 6a02322..4aa75e4 100644
|
||||||
|
--- a/modules/session/mod_session_cookie.c
|
||||||
|
+++ b/modules/session/mod_session_cookie.c
|
||||||
|
@@ -60,9 +60,6 @@ static apr_status_t session_cookie_save(request_rec * r, session_rec * z)
|
||||||
|
session_cookie_dir_conf *conf = ap_get_module_config(r->per_dir_config,
|
||||||
|
&session_cookie_module);
|
||||||
|
|
||||||
|
- /* don't cache auth protected pages */
|
||||||
|
- apr_table_addn(r->headers_out, "Cache-Control", "no-cache");
|
||||||
|
-
|
||||||
|
/* create RFC2109 compliant cookie */
|
||||||
|
if (conf->name_set) {
|
||||||
|
if (z->encoded && z->encoded[0]) {
|
||||||
|
@@ -162,6 +159,9 @@ static apr_status_t session_cookie_load(request_rec * r, session_rec ** z)
|
||||||
|
/* put the session in the notes so we don't have to parse it again */
|
||||||
|
apr_table_setn(m->notes, note, (char *)zz);
|
||||||
|
|
||||||
|
+ /* don't cache auth protected pages */
|
||||||
|
+ apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private");
|
||||||
|
+
|
||||||
|
return OK;
|
||||||
|
|
||||||
|
}
|
||||||
|
diff --git a/modules/session/mod_session_dbd.c b/modules/session/mod_session_dbd.c
|
||||||
|
index 0be7306..f683da2 100644
|
||||||
|
--- a/modules/session/mod_session_dbd.c
|
||||||
|
+++ b/modules/session/mod_session_dbd.c
|
||||||
|
@@ -245,6 +245,9 @@ static apr_status_t session_dbd_load(request_rec * r, session_rec ** z)
|
||||||
|
/* put the session in the notes so we don't have to parse it again */
|
||||||
|
apr_table_setn(m->notes, note, (char *)zz);
|
||||||
|
|
||||||
|
+ /* don't cache pages with a session */
|
||||||
|
+ apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private");
|
||||||
|
+
|
||||||
|
return OK;
|
||||||
|
|
||||||
|
}
|
||||||
|
@@ -409,9 +412,6 @@ static apr_status_t session_dbd_save(request_rec * r, session_rec * z)
|
||||||
|
if (conf->name_set || conf->name2_set) {
|
||||||
|
char *oldkey = NULL, *newkey = NULL;
|
||||||
|
|
||||||
|
- /* don't cache pages with a session */
|
||||||
|
- apr_table_addn(r->headers_out, "Cache-Control", "no-cache");
|
||||||
|
-
|
||||||
|
/* if the session is new or changed, make a new session ID */
|
||||||
|
if (z->uuid) {
|
||||||
|
oldkey = apr_pcalloc(r->pool, APR_UUID_FORMATTED_LENGTH + 1);
|
||||||
|
@@ -458,7 +458,7 @@ static apr_status_t session_dbd_save(request_rec * r, session_rec * z)
|
||||||
|
else if (conf->peruser) {
|
||||||
|
|
||||||
|
/* don't cache pages with a session */
|
||||||
|
- apr_table_addn(r->headers_out, "Cache-Control", "no-cache");
|
||||||
|
+ apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private");
|
||||||
|
|
||||||
|
if (r->user) {
|
||||||
|
ret = dbd_save(r, r->user, r->user, z->encoded, z->expiry);
|
||||||
259
SOURCES/httpd.conf.xml
Normal file
259
SOURCES/httpd.conf.xml
Normal file
@ -0,0 +1,259 @@
|
|||||||
|
<?xml version='1.0' encoding='utf-8'?>
|
||||||
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
|
||||||
|
|
||||||
|
]>
|
||||||
|
<!--
|
||||||
|
Copyright 2018 Red Hat, Inc.
|
||||||
|
|
||||||
|
Licensed to the Apache Software Foundation (ASF) under one or more
|
||||||
|
contributor license agreements. See the NOTICE file distributed with
|
||||||
|
this work for additional information regarding copyright ownership.
|
||||||
|
The ASF licenses this file to You under the Apache License, Version 2.0
|
||||||
|
(the "License"); you may not use this file except in compliance with
|
||||||
|
the License. You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
-->
|
||||||
|
|
||||||
|
<refentry>
|
||||||
|
<refentryinfo>
|
||||||
|
<title>httpd.conf</title>
|
||||||
|
<productname>httpd</productname>
|
||||||
|
<author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
|
||||||
|
</refentryinfo>
|
||||||
|
|
||||||
|
<refmeta>
|
||||||
|
<refentrytitle>httpd.conf</refentrytitle>
|
||||||
|
<manvolnum>5</manvolnum>
|
||||||
|
</refmeta>
|
||||||
|
|
||||||
|
<refnamediv>
|
||||||
|
<refname>httpd.conf</refname>
|
||||||
|
<refpurpose>Configuration files for httpd</refpurpose>
|
||||||
|
</refnamediv>
|
||||||
|
|
||||||
|
<refsynopsisdiv>
|
||||||
|
<para>
|
||||||
|
<filename>/etc/httpd/conf/httpd.conf</filename>,
|
||||||
|
<filename>/etc/httpd/conf.modules.d</filename>,
|
||||||
|
<filename>/etc/httpd/conf.d</filename>
|
||||||
|
</para>
|
||||||
|
</refsynopsisdiv>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>Description</title>
|
||||||
|
|
||||||
|
<para>The main configuration file for the <command>httpd</command> daemon is
|
||||||
|
<filename>/etc/httpd/conf/httpd.conf</filename>. The syntax of
|
||||||
|
this file is described at <ulink
|
||||||
|
url="https://httpd.apache.org/docs/2.4/configuring.html"/>, and
|
||||||
|
the full set of available directives is listed at <ulink
|
||||||
|
url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Configuration structure</title>
|
||||||
|
|
||||||
|
<para>The main configuration file
|
||||||
|
(<filename>httpd.conf</filename>) sets up various defaults and
|
||||||
|
includes configuration files from two directories -
|
||||||
|
<filename>/etc/httpd/conf.modules.d</filename> and
|
||||||
|
<filename>/etc/httpd/conf.d</filename>. Packages containing
|
||||||
|
loadable modules (like <option>mod_ssl.so</option>) place files
|
||||||
|
in the <filename>conf.modules.d</filename> directory with the
|
||||||
|
appropriate <option>LoadModule</option> directive so that module
|
||||||
|
is loaded by default.</para>
|
||||||
|
|
||||||
|
<para>Some notable configured defaults are:.</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term><option>DocumentRoot @DOCROOT@/html</option></term>
|
||||||
|
<listitem><para>The default document root from which content
|
||||||
|
is served.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
<term><option>Listen 80</option></term>
|
||||||
|
<listitem><para>The daemon lists on TCP port 80.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
<term><option>ErrorLog "logs/error_log"</option></term>
|
||||||
|
<listitem><para>Error messages are logged to
|
||||||
|
<filename>@LOGDIR@/error_log</filename>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
<varlistentry>
|
||||||
|
<term><option>ScriptAlias /cgi-bin/ "@DOCROOT@/cgi-bin/"</option></term>
|
||||||
|
<listitem><para>CGI scripts are served via the URL-path <option>/cgi-bin/</option>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
</variablelist>
|
||||||
|
|
||||||
|
<para>To remove any of the default configuration provided in
|
||||||
|
separate files covered below, replace that file with an empty
|
||||||
|
file rather than removing it from the filesystem, otherwise it
|
||||||
|
may be restored to the original when the package which provides
|
||||||
|
it is upgraded.</para>
|
||||||
|
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>MPM configuration</title>
|
||||||
|
|
||||||
|
<para>The configuration file at
|
||||||
|
<filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename> is
|
||||||
|
used to select the multi-processing module (MPM), which governs
|
||||||
|
how <command>httpd</command> divides work between processes
|
||||||
|
and/or threads at run-time. Exactly one
|
||||||
|
<option>LoadModule</option> directive must be uncommented in
|
||||||
|
this file; by default the <option>@MPM@</option> MPM is enabled.
|
||||||
|
For more information on MPMs, see <ulink
|
||||||
|
url="https://httpd.apache.org/docs/2.4/mpm.html"/>.</para>
|
||||||
|
|
||||||
|
<para>If using the <emphasis>prefork</emphasis> MPM, the
|
||||||
|
"httpd_graceful_shutdown" SELinux boolean should also be
|
||||||
|
enabled, since with this MPM, httpd needs to establish TCP
|
||||||
|
connections to local ports to successfully complete a graceful
|
||||||
|
restart or shutdown. This boolean can be enabled by running the
|
||||||
|
command: <command>semanage boolean -m --on
|
||||||
|
httpd_graceful_shutdown</command></para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Module configuration files</title>
|
||||||
|
|
||||||
|
<para>Module configuration files are provided in the
|
||||||
|
<filename>/etc/httpd/conf.modules.d/</filename> directory. Filenames
|
||||||
|
in this directory are by convention prefixed with two digit numeric
|
||||||
|
prefix to ensure they are processed in the desired order. Core
|
||||||
|
modules provide with the <command>httpd</command> package are
|
||||||
|
loaded by files with a <option>0x-</option> prefix to ensure
|
||||||
|
these are loaded first. Only filenames with a
|
||||||
|
<option>.conf</option> suffix in this directory will be
|
||||||
|
processed.</para>
|
||||||
|
|
||||||
|
<para>Other provided configuration files are listed below.
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.modules.d/00-base.conf</filename></term>
|
||||||
|
<listitem><para>The set of core modules included with
|
||||||
|
<command>httpd</command> which are all loaded by
|
||||||
|
default.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.modules.d/00-optional.conf</filename></term>
|
||||||
|
<listitem><para>The set of non-core modules included with
|
||||||
|
<command>httpd</command> which are <emphasis>not</emphasis>
|
||||||
|
loaded by default.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.modules.d/00-systemd.conf</filename></term>
|
||||||
|
<listitem><para>This file loads <option>mod_systemd</option>
|
||||||
|
which is necessary for the correct operation of the
|
||||||
|
<command>httpd.service</command> service, and should not be
|
||||||
|
removed or disabled.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Other configuration files</title>
|
||||||
|
|
||||||
|
<para>Default module configuration files and site-specific
|
||||||
|
configuration files are loaded from the
|
||||||
|
<filename>/etc/httpd/conf.d/</filename> directory. Only files
|
||||||
|
with a <option>.conf</option> suffix will be loaded. The
|
||||||
|
following files are provided:
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.d/userdir.conf</filename></term>
|
||||||
|
<listitem><para>This file gives an example configuration for
|
||||||
|
<option>mod_userdir</option> to map URLs such as
|
||||||
|
<option>http://localhost/~jim/</option> to
|
||||||
|
<filename>/home/jim/public_html/</filename>. Userdir mapping
|
||||||
|
is disabled by default.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.d/autoindex.conf</filename></term>
|
||||||
|
<listitem><para>This file provides the default configuration
|
||||||
|
for <option>mod_autoindex</option> which generates HTML
|
||||||
|
directory listings when enabled. It also makes file icon
|
||||||
|
image files available at the <option>/icons/</option>
|
||||||
|
URL-path.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.d/welcome.conf</filename></term>
|
||||||
|
<listitem><para>This file enables a "welcome page" at
|
||||||
|
<option>http://localhost/</option> if no content is present
|
||||||
|
in the default documentation root
|
||||||
|
<filename>/var/www/html</filename>.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><filename>/etc/httpd/conf.d/ssl.conf</filename> (present only if <option>mod_ssl</option> is installed)</term>
|
||||||
|
<listitem><para>This file configures a TLS
|
||||||
|
<option>VirtualHost</option> listening on port
|
||||||
|
<option>443</option>. If the default configuration is used,
|
||||||
|
the referenced test certificate and private key are
|
||||||
|
generated the first time <command>httpd.service</command> is
|
||||||
|
started; see
|
||||||
|
<citerefentry><refentrytitle>httpd-init.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||||||
|
for more information.</para></listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
</variablelist></para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Instantiated services</title>
|
||||||
|
|
||||||
|
<para>As an alternative to (or in addition to) the
|
||||||
|
<command>httpd.service</command> unit, the instantiated template
|
||||||
|
service <command>httpd@.service</command> unit file can be used,
|
||||||
|
which starts <command>httpd</command> using a different
|
||||||
|
configuration file to the default. For example,
|
||||||
|
<command>systemctl start httpd@foobar.service</command> will
|
||||||
|
start httpd using the configuration file
|
||||||
|
<filename>/etc/httpd/conf/foobar.conf</filename>. See <citerefentry><refentrytitle>httpd@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more information.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
</refsect1>
|
||||||
|
<refsect1>
|
||||||
|
<title>Files</title>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
<filename>/etc/httpd/conf/httpd.conf</filename>,
|
||||||
|
<filename>/etc/httpd/conf.d</filename>,
|
||||||
|
<filename>/etc/httpd/conf.modules.d</filename>
|
||||||
|
</para>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>See also</title>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
<citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<ulink url="https://httpd.apache.org/docs/2.4/configuring.html"/>,
|
||||||
|
<ulink url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>
|
||||||
|
</para>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
</refentry>
|
||||||
|
|
||||||
|
<!-- LocalWords: systemd PidFile
|
||||||
|
-->
|
||||||
332
SOURCES/httpd.service.xml
Normal file
332
SOURCES/httpd.service.xml
Normal file
@ -0,0 +1,332 @@
|
|||||||
|
<?xml version='1.0' encoding='utf-8'?>
|
||||||
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
|
||||||
|
|
||||||
|
]>
|
||||||
|
<!--
|
||||||
|
Copyright 2018 Red Hat, Inc.
|
||||||
|
|
||||||
|
Licensed to the Apache Software Foundation (ASF) under one or more
|
||||||
|
contributor license agreements. See the NOTICE file distributed with
|
||||||
|
this work for additional information regarding copyright ownership.
|
||||||
|
The ASF licenses this file to You under the Apache License, Version 2.0
|
||||||
|
(the "License"); you may not use this file except in compliance with
|
||||||
|
the License. You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
-->
|
||||||
|
|
||||||
|
<refentry>
|
||||||
|
<refentryinfo>
|
||||||
|
<title>httpd systemd units</title>
|
||||||
|
<productname>httpd</productname>
|
||||||
|
<author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
|
||||||
|
</refentryinfo>
|
||||||
|
|
||||||
|
<refmeta>
|
||||||
|
<refentrytitle>httpd.service</refentrytitle>
|
||||||
|
<manvolnum>8</manvolnum>
|
||||||
|
</refmeta>
|
||||||
|
|
||||||
|
<refnamediv>
|
||||||
|
<refname>httpd.service</refname>
|
||||||
|
<refname>httpd@.service</refname>
|
||||||
|
<refname>httpd.socket</refname>
|
||||||
|
<refname>httpd-init.service</refname>
|
||||||
|
<refpurpose>httpd unit files for systemd</refpurpose>
|
||||||
|
</refnamediv>
|
||||||
|
|
||||||
|
<refsynopsisdiv>
|
||||||
|
<para>
|
||||||
|
<filename>/usr/lib/systemd/system/httpd.service</filename>,
|
||||||
|
<filename>/usr/lib/systemd/system/httpd@.service</filename>,
|
||||||
|
<filename>/usr/lib/systemd/system/httpd-init.service</filename>,
|
||||||
|
<filename>/usr/lib/systemd/system/httpd.socket</filename>
|
||||||
|
</para>
|
||||||
|
</refsynopsisdiv>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>Description</title>
|
||||||
|
|
||||||
|
<para>This manual page describes the <command>systemd</command>
|
||||||
|
unit files used to integrate the <command>httpd</command> daemon
|
||||||
|
with <command>systemd</command>. Two main unit files are
|
||||||
|
available: <command>httpd.service</command> allows the
|
||||||
|
<command>httpd</command> daemon to be run as a system service, and
|
||||||
|
<command>httpd.socket</command> allows httpd to be started via
|
||||||
|
socket-based activation. Most systems will use
|
||||||
|
<command>httpd.service</command>.</para>
|
||||||
|
|
||||||
|
<para>The <command>apachectl</command> command has been modified
|
||||||
|
to invoke <command>systemctl</command> for most uses, so for
|
||||||
|
example, running <command>apachectl start</command> is equivalent
|
||||||
|
to running <command>systemctl start httpd.service</command>. This
|
||||||
|
ensures that the running httpd daemon is tracked and managed by
|
||||||
|
<command>systemd</command>. In contrast, running
|
||||||
|
<command>httpd</command> directly from a root shell will start the
|
||||||
|
service outside of <command>systemd</command>; in this case,
|
||||||
|
default security restrictions described below (including, but not
|
||||||
|
limited to, SELinux) will not be enforced.</para>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Changing default behaviour</title>
|
||||||
|
|
||||||
|
<para>To change the default behaviour of the httpd service, an
|
||||||
|
<emphasis>over-ride</emphasis> file should be created, rather
|
||||||
|
than changing
|
||||||
|
<filename>/usr/lib/systemd/system/httpd.service</filename>
|
||||||
|
directly, since such changes would be lost over package
|
||||||
|
upgrades. Running <command>systemctl edit
|
||||||
|
httpd.service</command> or <command>systemctl edit
|
||||||
|
httpd.socket</command> as root will create a drop-in file (in
|
||||||
|
the former case, in
|
||||||
|
<filename>/etc/systemd/system/httpd.service.d</filename>) which
|
||||||
|
over-rides the system defaults.</para>
|
||||||
|
|
||||||
|
<para>For example, to set the <option>LD_LIBRARY_PATH</option>
|
||||||
|
environment variable for the daemon, run <command>systemctl edit
|
||||||
|
httpd.service</command> and enter:
|
||||||
|
|
||||||
|
<programlisting>[Service]
|
||||||
|
Environment=LD_LIBRARY_PATH=/opt/vendor/lib</programlisting></para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Starting the service at boot time</title>
|
||||||
|
|
||||||
|
<para>The httpd.service and httpd.socket units are
|
||||||
|
<emphasis>disabled</emphasis> by default. To start the httpd
|
||||||
|
service at boot time, run: <command>systemctl enable
|
||||||
|
httpd.service</command>. In the default configuration, the
|
||||||
|
httpd daemon will accept connections on port 80 (and, if mod_ssl
|
||||||
|
is installed, TLS connections on port 443) for any configured
|
||||||
|
IPv4 or IPv6 address.</para>
|
||||||
|
|
||||||
|
<para>If httpd is configured to depend on any specific IP
|
||||||
|
address (for example, with a "Listen" directive) which may only
|
||||||
|
become available during start-up, or if httpd depends on other
|
||||||
|
services (such as a database daemon), the service
|
||||||
|
<emphasis>must</emphasis> be configured to ensure correct
|
||||||
|
start-up ordering.</para>
|
||||||
|
|
||||||
|
<para>For example, to ensure httpd is only running after all
|
||||||
|
configured network interfaces are configured, create a drop-in
|
||||||
|
file (as described above) with the following section:
|
||||||
|
|
||||||
|
<programlisting>[Unit]
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target</programlisting>
|
||||||
|
|
||||||
|
See <ulink
|
||||||
|
url="https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/"/>
|
||||||
|
for more information on start-up ordering with systemd.</para>
|
||||||
|
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>SSL/TLS certificate generation</title>
|
||||||
|
|
||||||
|
<para>The <command>httpd-init.service</command> unit is provided
|
||||||
|
with the mod_ssl package. This oneshot unit automatically
|
||||||
|
creates a TLS server certificate and key (using a generated
|
||||||
|
self-signed CA certificate and key) for testing purposes before
|
||||||
|
httpd is started. To inhibit certificate generation, use
|
||||||
|
<command>systemctl mask httpd-init.service</command> after
|
||||||
|
installing mod_ssl, and adjust the mod_ssl configuration to use
|
||||||
|
an appropriate certificate and key.</para>
|
||||||
|
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Reloading and stopping the service</title>
|
||||||
|
|
||||||
|
<para>When running <command>systemctl reload
|
||||||
|
httpd.service</command>, a <emphasis>graceful</emphasis>
|
||||||
|
restart is used, which sends a signal to the httpd parent
|
||||||
|
process to reload the configuration and re-open log files. Any
|
||||||
|
children with open connections at the time of reload will
|
||||||
|
terminate only once they have completed serving requests. This
|
||||||
|
prevents users of the server seeing errors (or potentially
|
||||||
|
losing data) due to the reload, but means some there is some
|
||||||
|
delay before any configuration changes take effect for all
|
||||||
|
users.</para>
|
||||||
|
|
||||||
|
<para>Similarly, a <emphasis>graceful stop</emphasis> is used
|
||||||
|
when <command>systemctl stop httpd.service</command> is run,
|
||||||
|
which terminates the server only once active connections have
|
||||||
|
been processed.</para>
|
||||||
|
|
||||||
|
<para>To "ungracefully" stop the server without waiting for
|
||||||
|
requests to complete, use <command>systemctl kill
|
||||||
|
--kill-who=main httpd</command>; similarly to "ungracefully"
|
||||||
|
reload the configuration, use <command>systemctl kill
|
||||||
|
--kill-who=main --signal=HUP httpd</command>.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Automated service restarts</title>
|
||||||
|
|
||||||
|
<para>System packages (including the httpd package itself) may
|
||||||
|
restart the httpd service automatically after packages are
|
||||||
|
upgraded, installed, or removed. This is done using the
|
||||||
|
<command>systemctl reload httpd.service</command>, which
|
||||||
|
produces a <emphasis>graceful</emphasis> restart by default as
|
||||||
|
described above.</para>
|
||||||
|
|
||||||
|
<para>To suppress automatic reloads entirely, create the file
|
||||||
|
<filename>/etc/sysconfig/httpd-disable-posttrans</filename>.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Changing the default MPM (Multi-Processing Module)</title>
|
||||||
|
|
||||||
|
<para>httpd offers a choice of multi-processing modules (MPMs),
|
||||||
|
which can be configured in
|
||||||
|
<filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.
|
||||||
|
See
|
||||||
|
<citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||||
|
for more information on changing the MPM.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>systemd integration and mod_systemd</title>
|
||||||
|
|
||||||
|
<para>The httpd service uses the <option>notify</option> systemd
|
||||||
|
service type. The <literal>mod_systemd</literal> module must be
|
||||||
|
loaded (as in the default configuration) for this to work
|
||||||
|
correctly - the service will fail if this module is not
|
||||||
|
loaded. <literal>mod_systemd</literal> also makes worker and
|
||||||
|
request statistics available when running <command>systemctl status
|
||||||
|
httpd</command>. See
|
||||||
|
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||||
|
for more information on systemd service types.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Security and SELinux</title>
|
||||||
|
|
||||||
|
<para>The default SELinux policy restricts the httpd service in
|
||||||
|
various ways. For example, the default policy limits the ports
|
||||||
|
to which httpd can bind (using the <literal>Listen</literal>
|
||||||
|
directive), which parts of the filesystem can be accessed, and
|
||||||
|
whether outgoing TCP connections are possible. Many of these
|
||||||
|
restrictions can be relaxed or adjusted by using
|
||||||
|
<command>semanage</command> to change booleans or other
|
||||||
|
types. See
|
||||||
|
<citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||||||
|
for more information.</para>
|
||||||
|
|
||||||
|
<para>The httpd service enables <emphasis>PrivateTmp</emphasis>
|
||||||
|
by default. The <filename>/tmp</filename> and
|
||||||
|
<filename>/var/tmp</filename> directories available within the
|
||||||
|
httpd process (and CGI scripts, etc) are not shared by other
|
||||||
|
processes. See
|
||||||
|
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||||
|
for more information.</para>
|
||||||
|
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Socket activation</title>
|
||||||
|
|
||||||
|
<para>Socket activation (see
|
||||||
|
<citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||||
|
for more information) can be used with <command>httpd</command>
|
||||||
|
by enabling the <command>httpd.socket</command> unit. The
|
||||||
|
<command>httpd</command> listener configuration must exactly
|
||||||
|
match the <literal>ListenStream</literal> options configured for
|
||||||
|
the <command>httpd.socket</command> unit. The default
|
||||||
|
<command>httpd.socket</command> has a
|
||||||
|
<literal>ListenStream=80</literal> and, if mod_ssl is installed,
|
||||||
|
<literal>ListenStream=443</literal> by a drop-in file. If
|
||||||
|
additional <literal>Listen</literal> directives are added to the
|
||||||
|
httpd configuration, corresponding
|
||||||
|
<literal>ListenStream</literal> options should be added via
|
||||||
|
drop-in files, for example via <command>systemctl edit
|
||||||
|
httpd.socket</command>.</para>
|
||||||
|
|
||||||
|
<para>If using socket activation with httpd, only one listener
|
||||||
|
on any given TCP port is supported; a configuration with both
|
||||||
|
"<literal>Listen 127.0.0.1:80</literal>" and "<literal>Listen
|
||||||
|
192.168.1.2:80</literal>" will not work.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
<refsect2>
|
||||||
|
<title>Instantiated services</title>
|
||||||
|
|
||||||
|
<para>The <command>httpd@.service</command> unit is an
|
||||||
|
instantiated template service. An instance of this unit will be
|
||||||
|
started using the configuration file
|
||||||
|
<filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
|
||||||
|
<emphasis>INSTANCE</emphasis> is replaced with the instance
|
||||||
|
name. For example, <command>systemctl start
|
||||||
|
httpd@foobar.service</command> will start httpd using the
|
||||||
|
configuration file
|
||||||
|
<filename>/etc/httpd/conf/foobar.conf</filename>. The
|
||||||
|
<option>HTTPD_INSTANCE</option> environment variable is set to
|
||||||
|
the instance name by the unit and is available for use within
|
||||||
|
the configuration file.</para>
|
||||||
|
|
||||||
|
<para>To allow multiple instances of httpd to run
|
||||||
|
simultaneously, a number of configuration directives must be
|
||||||
|
changed, such as <command>PidFile</command> and
|
||||||
|
<command>DefaultRuntimeDir</command> to pick non-conflicting
|
||||||
|
paths, and <command>Listen</command> to choose different ports.
|
||||||
|
The example configuration file
|
||||||
|
<filename>/usr/share/doc/httpd/instance.conf</filename>
|
||||||
|
demonstrates how to make such changes using
|
||||||
|
<option>HTTPD_INSTANCE</option> variable.</para>
|
||||||
|
|
||||||
|
<para>It can be useful to configure instances of
|
||||||
|
<command>httpd@.service</command> to reload when
|
||||||
|
<command>httpd.service</command> is reloaded; for example,
|
||||||
|
<command>logrotate</command> will reload only
|
||||||
|
<command>httpd.service</command> when logs are rotated. If this
|
||||||
|
behaviour is required, create a drop-in file for the instance as
|
||||||
|
follows:
|
||||||
|
|
||||||
|
<programlisting>[Unit]
|
||||||
|
ReloadPropagatedFrom=httpd.service</programlisting>
|
||||||
|
|
||||||
|
As with normal units, drop-in files for instances can be created
|
||||||
|
using <command>systemctl edit</command>, e.g. <command>systemctl edit
|
||||||
|
httpd@foobar.service</command>.</para>
|
||||||
|
</refsect2>
|
||||||
|
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>Files</title>
|
||||||
|
|
||||||
|
<para><filename>/usr/lib/systemd/system/httpd.service</filename>,
|
||||||
|
<filename>/usr/lib/systemd/system/httpd.socket</filename>,
|
||||||
|
<filename>/usr/lib/systemd/system/httpd@.service</filename>,
|
||||||
|
<filename>/etc/systemd/systemd/httpd.service.d</filename></para>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
<refsect1>
|
||||||
|
<title>See also</title>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
<citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
|
||||||
|
<citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||||||
|
</para>
|
||||||
|
</refsect1>
|
||||||
|
|
||||||
|
</refentry>
|
||||||
|
|
||||||
|
<!-- LocalWords: systemd PidFile
|
||||||
|
-->
|
||||||
@ -13,7 +13,7 @@
|
|||||||
Summary: Apache HTTP Server
|
Summary: Apache HTTP Server
|
||||||
Name: httpd
|
Name: httpd
|
||||||
Version: 2.4.37
|
Version: 2.4.37
|
||||||
Release: 21%{?dist}
|
Release: 30%{?dist}
|
||||||
URL: https://httpd.apache.org/
|
URL: https://httpd.apache.org/
|
||||||
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
|
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
|
||||||
Source1: index.html
|
Source1: index.html
|
||||||
@ -90,9 +90,12 @@ Patch32: httpd-2.4.37-sslprotdefault.patch
|
|||||||
Patch33: httpd-2.4.37-mod-md-mod-ssl-hooks.patch
|
Patch33: httpd-2.4.37-mod-md-mod-ssl-hooks.patch
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1725031
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1725031
|
||||||
Patch34: httpd-2.4.37-r1861793+.patch
|
Patch34: httpd-2.4.37-r1861793+.patch
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1704317ě
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1704317
|
||||||
Patch35: httpd-2.4.37-sslkeylogfile-support.patch
|
Patch35: httpd-2.4.37-sslkeylogfile-support.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1794728
|
||||||
|
Patch36: httpd-2.4.37-session-expiry-updt-int.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1209162
|
||||||
|
Patch37: httpd-2.4.37-logjournal.patch
|
||||||
# Bug fixes
|
# Bug fixes
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1397243
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1397243
|
||||||
Patch61: httpd-2.4.35-r1738878.patch
|
Patch61: httpd-2.4.35-r1738878.patch
|
||||||
@ -122,6 +125,10 @@ Patch73: httpd-2.4.35-ocsp-wrong-ctx.patch
|
|||||||
Patch74: httpd-2.4.37-r1828172+.patch
|
Patch74: httpd-2.4.37-r1828172+.patch
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1775158
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1775158
|
||||||
Patch75: httpd-2.4.37-r1870095+.patch
|
Patch75: httpd-2.4.37-r1870095+.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1771847
|
||||||
|
Patch76: httpd-2.4.37-proxy-continue.patch
|
||||||
|
Patch77: httpd-2.4.37-balancer-failover.patch
|
||||||
|
|
||||||
|
|
||||||
# Security fixes
|
# Security fixes
|
||||||
Patch200: httpd-2.4.37-r1851471.patch
|
Patch200: httpd-2.4.37-r1851471.patch
|
||||||
@ -137,6 +144,16 @@ Patch204: httpd-2.4.37-CVE-2019-0220.patch
|
|||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1741864
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1741864
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1741868
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1741868
|
||||||
Patch205: httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch
|
Patch205: httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1823259
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1747284
|
||||||
|
# fixes both CVE-2020-1927 and CVE-2019-10098
|
||||||
|
Patch206: httpd-2.4.37-CVE-2019-10098.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1747281
|
||||||
|
Patch207: httpd-2.4.37-CVE-2019-10092.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1747291
|
||||||
|
Patch208: httpd-2.4.37-CVE-2019-10097.patch
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1820772
|
||||||
|
Patch209: httpd-2.4.37-CVE-2020-1934.patch
|
||||||
|
|
||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
Group: System Environment/Daemons
|
Group: System Environment/Daemons
|
||||||
@ -280,6 +297,8 @@ interface for storing and accessing per-user session data.
|
|||||||
%patch33 -p1 -b .mod-md-mod-ssl-hooks
|
%patch33 -p1 -b .mod-md-mod-ssl-hooks
|
||||||
%patch34 -p1 -b .r1861793+
|
%patch34 -p1 -b .r1861793+
|
||||||
%patch35 -p1 -b .sslkeylogfile-support
|
%patch35 -p1 -b .sslkeylogfile-support
|
||||||
|
%patch36 -p1 -b .session-expiry
|
||||||
|
%patch37 -p1 -b .logjournal
|
||||||
|
|
||||||
%patch61 -p1 -b .r1738878
|
%patch61 -p1 -b .r1738878
|
||||||
%patch62 -p1 -b .r1633085
|
%patch62 -p1 -b .r1633085
|
||||||
@ -294,6 +313,9 @@ interface for storing and accessing per-user session data.
|
|||||||
%patch73 -p1 -b .ocspwrongctx
|
%patch73 -p1 -b .ocspwrongctx
|
||||||
%patch74 -p1 -b .r1828172+
|
%patch74 -p1 -b .r1828172+
|
||||||
%patch75 -p1 -b .r1870095+
|
%patch75 -p1 -b .r1870095+
|
||||||
|
%patch76 -p1 -b .proxy-continue
|
||||||
|
%patch77 -p1 -b .balancer-failover
|
||||||
|
|
||||||
|
|
||||||
%patch200 -p1 -b .r1851471
|
%patch200 -p1 -b .r1851471
|
||||||
%patch201 -p1 -b .CVE-2019-0211
|
%patch201 -p1 -b .CVE-2019-0211
|
||||||
@ -301,6 +323,10 @@ interface for storing and accessing per-user session data.
|
|||||||
%patch203 -p1 -b .CVE-2019-0217
|
%patch203 -p1 -b .CVE-2019-0217
|
||||||
%patch204 -p1 -b .CVE-2019-0220
|
%patch204 -p1 -b .CVE-2019-0220
|
||||||
%patch205 -p1 -b .CVE-2019-9511-and-9516-and-9517
|
%patch205 -p1 -b .CVE-2019-9511-and-9516-and-9517
|
||||||
|
%patch206 -p1 -b .CVE-2019-10098
|
||||||
|
%patch207 -p1 -b .CVE-2019-10092
|
||||||
|
%patch208 -p1 -b .CVE-2019-10097
|
||||||
|
%patch209 -p1 -b .CVE-2020-1934
|
||||||
|
|
||||||
# Patch in the vendor string
|
# Patch in the vendor string
|
||||||
sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
|
sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
|
||||||
@ -613,7 +639,7 @@ exit 0
|
|||||||
%systemd_preun httpd.service htcacheclean.service httpd.socket
|
%systemd_preun httpd.service htcacheclean.service httpd.socket
|
||||||
|
|
||||||
%postun
|
%postun
|
||||||
%systemd_postun
|
%systemd_postun httpd.service htcacheclean.service httpd.socket
|
||||||
|
|
||||||
# Trigger for conversion from SysV, per guidelines at:
|
# Trigger for conversion from SysV, per guidelines at:
|
||||||
# https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd
|
# https://fedoraproject.org/wiki/Packaging:ScriptletSnippets#Systemd
|
||||||
@ -803,6 +829,30 @@ rm -rf $RPM_BUILD_ROOT
|
|||||||
%{_rpmconfigdir}/macros.d/macros.httpd
|
%{_rpmconfigdir}/macros.d/macros.httpd
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Jun 15 2020 Joe Orton <jorton@redhat.com> - 2.4.37-30
|
||||||
|
- Resolves: #1209162 - support logging to journald from CustomLog
|
||||||
|
|
||||||
|
* Mon Jun 08 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-29
|
||||||
|
- Resolves: #1823263 (CVE-2020-1934) - CVE-2020-1934 httpd: mod_proxy_ftp use of
|
||||||
|
uninitialized value
|
||||||
|
|
||||||
|
* Fri May 29 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-28
|
||||||
|
- Related: #1771847 - BalancerMember ping parameter for mod_proxy_http
|
||||||
|
doesn't work
|
||||||
|
|
||||||
|
* Tue Apr 14 2020 Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-27
|
||||||
|
- Resolves: #1823259 - CVE-2020-1927 httpd:2.4/httpd: mod_rewrite configurations
|
||||||
|
vulnerable to open redirect
|
||||||
|
- Resolves: #1747284 - CVE-2019-10098 httpd:2.4/httpd: mod_rewrite potential
|
||||||
|
open redirect
|
||||||
|
- Resolves: #1747281 - CVE-2019-10092 httpd:2.4/httpd: limited cross-site
|
||||||
|
scripting in mod_proxy error page
|
||||||
|
- Resolves: #1747291 - CVE-2019-10097 httpd:2.4/httpd: null-pointer dereference
|
||||||
|
in mod_remoteip
|
||||||
|
- Resolves: #1771847 - BalancerMember ping parameter for mod_proxy_http
|
||||||
|
doesn't work
|
||||||
|
- Resolves: #1794728 - Backport of SessionExpiryUpdateInterval directive
|
||||||
|
|
||||||
* Mon Dec 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-21
|
* Mon Dec 02 2019 Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-21
|
||||||
- Resolves: #1775158 - POST request with TLS 1.3 PHA client auth fails:
|
- Resolves: #1775158 - POST request with TLS 1.3 PHA client auth fails:
|
||||||
Re-negotiation handshake failed: Client certificate missing
|
Re-negotiation handshake failed: Client certificate missing
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user