Resolves: RHEL-14691 - mod_http2 rebase to 2.0.25
This commit is contained in:
Luboš Uhliarik
parent
d326eaaec5
commit
f2ca621a76
1
.gitignore
vendored
1
.gitignore
vendored
@ -1,3 +1,4 @@
|
||||
/mod_http2-1.*.tar.gz
|
||||
/mod_http2-1.[0-9]*.[0-9]*/
|
||||
/clog
|
||||
/mod_http2-2.0.25.tar.gz
|
||||
|
||||
@ -1,14 +0,0 @@
|
||||
diff -uap mod_http2-1.14.0/mod_http2/h2_from_h1.c.buildfix mod_http2-1.14.0/mod_http2/h2_from_h1.c
|
||||
--- mod_http2-1.14.0/mod_http2/h2_from_h1.c.buildfix 2019-02-12 13:30:56.000000000 +0000
|
||||
+++ mod_http2-1.14.0/mod_http2/h2_from_h1.c 2019-03-14 10:35:46.365678537 +0000
|
||||
@@ -35,6 +35,10 @@
|
||||
#include "h2_task.h"
|
||||
#include "h2_util.h"
|
||||
|
||||
+#ifndef AP_STATUS_IS_HEADER_ONLY
|
||||
+#define AP_STATUS_IS_HEADER_ONLY(x) ((x) == HTTP_NO_CONTENT || \
|
||||
+ (x) == HTTP_NOT_MODIFIED)
|
||||
+#endif
|
||||
|
||||
/* This routine is called by apr_table_do and merges all instances of
|
||||
* the passed field values into a single array that will be further
|
||||
@ -1,65 +0,0 @@
|
||||
commit 124c2ca0886b05d0871ee09466de555d757b72fc
|
||||
Author: Joe Orton <jorton@redhat.com>
|
||||
Date: Fri May 7 10:58:18 2021 +0100
|
||||
|
||||
Switch to using OpenSSL EVP_* API to avoid deprecation warnings
|
||||
with OpenSSL 3.0.
|
||||
|
||||
diff --git a/mod_http2/h2_push.c b/mod_http2/h2_push.c
|
||||
index 8ae0b49..0a90a5d 100644
|
||||
--- a/mod_http2/h2_push.c
|
||||
+++ b/mod_http2/h2_push.c
|
||||
@@ -23,7 +23,7 @@
|
||||
#include <apr_time.h>
|
||||
|
||||
#ifdef H2_OPENSSL
|
||||
-#include <openssl/sha.h>
|
||||
+#include <openssl/evp.h>
|
||||
#endif
|
||||
|
||||
#include <httpd.h>
|
||||
@@ -472,27 +472,32 @@ typedef struct h2_push_diary_entry {
|
||||
|
||||
|
||||
#ifdef H2_OPENSSL
|
||||
-static void sha256_update(SHA256_CTX *ctx, const char *s)
|
||||
+static void sha256_update(EVP_MD_CTX *ctx, const char *s)
|
||||
{
|
||||
- SHA256_Update(ctx, s, strlen(s));
|
||||
+ EVP_DigestUpdate(ctx, s, strlen(s));
|
||||
}
|
||||
|
||||
static void calc_sha256_hash(h2_push_diary *diary, apr_uint64_t *phash, h2_push *push)
|
||||
{
|
||||
- SHA256_CTX sha256;
|
||||
+ EVP_MD_CTX *md;
|
||||
apr_uint64_t val;
|
||||
- unsigned char hash[SHA256_DIGEST_LENGTH];
|
||||
+ unsigned char hash[EVP_MAX_MD_SIZE];
|
||||
+ unsigned len;
|
||||
int i;
|
||||
-
|
||||
- SHA256_Init(&sha256);
|
||||
- sha256_update(&sha256, push->req->scheme);
|
||||
- sha256_update(&sha256, "://");
|
||||
- sha256_update(&sha256, push->req->authority);
|
||||
- sha256_update(&sha256, push->req->path);
|
||||
- SHA256_Final(hash, &sha256);
|
||||
+
|
||||
+ md = EVP_MD_CTX_create();
|
||||
+ ap_assert(md != NULL);
|
||||
+
|
||||
+ i = EVP_DigestInit_ex(md, EVP_sha256(), NULL);
|
||||
+ ap_assert(i == 1);
|
||||
+ sha256_update(md, push->req->scheme);
|
||||
+ sha256_update(md, "://");
|
||||
+ sha256_update(md, push->req->authority);
|
||||
+ sha256_update(md, push->req->path);
|
||||
+ EVP_DigestFinal(md, hash, &len);
|
||||
|
||||
val = 0;
|
||||
- for (i = 0; i != sizeof(val); ++i)
|
||||
+ for (i = 0; i != len; ++i)
|
||||
val = val * 256 + hash[i];
|
||||
*phash = val >> (64 - diary->mask_bits);
|
||||
}
|
||||
@ -1,13 +0,0 @@
|
||||
diff --git a/mod_http2/h2_request.c b/mod_http2/h2_request.c
|
||||
index 45df9b1..70241d4 100644
|
||||
--- a/mod_http2/h2_request.c
|
||||
+++ b/mod_http2/h2_request.c
|
||||
@@ -371,7 +371,7 @@ request_rec *h2_request_create_rec(const h2_request *req, conn_rec *c)
|
||||
ap_add_input_filter_handle(ap_http_input_filter_handle,
|
||||
NULL, r, r->connection);
|
||||
|
||||
- if ((access_status = ap_run_post_read_request(r))) {
|
||||
+ if ((access_status = ap_post_read_request(r))) {
|
||||
/* Request check post hooks failed. An example of this would be a
|
||||
* request for a vhost where h2 is disabled --> 421.
|
||||
*/
|
||||
@ -1,30 +0,0 @@
|
||||
diff --git a/mod_http2/mod_proxy_http2.c b/mod_http2/mod_proxy_http2.c
|
||||
index 893aa8f..d52d5d9 100644
|
||||
--- a/mod_http2/mod_proxy_http2.c
|
||||
+++ b/mod_http2/mod_proxy_http2.c
|
||||
@@ -154,11 +154,25 @@ static int proxy_http2_canon(request_rec *r, char *url)
|
||||
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
||||
path = url; /* this is the raw path */
|
||||
}
|
||||
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
||||
+ path = url; /* this is the encoded path already */
|
||||
+ search = r->args;
|
||||
+ }
|
||||
else {
|
||||
path = ap_proxy_canonenc(r->pool, url, (int)strlen(url),
|
||||
enc_path, 0, r->proxyreq);
|
||||
search = r->args;
|
||||
}
|
||||
+ if (search && *ap_scan_vchar_obstext(search)) {
|
||||
+ /*
|
||||
+ * We have a raw control character or a ' ' in r->args.
|
||||
+ * Correct encoding was missed.
|
||||
+ */
|
||||
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412)
|
||||
+ "To be forwarded query string contains control "
|
||||
+ "characters or spaces");
|
||||
+ return HTTP_FORBIDDEN;
|
||||
+ }
|
||||
break;
|
||||
case PROXYREQ_PROXY:
|
||||
path = url;
|
||||
@ -2,20 +2,17 @@
|
||||
%{!?_httpd_mmn: %global _httpd_mmn %(cat %{_includedir}/httpd/.mmn 2>/dev/null || echo 0-0)}
|
||||
|
||||
Name: mod_http2
|
||||
Version: 1.15.19
|
||||
Release: 5%{?dist}
|
||||
Version: 2.0.25
|
||||
Release: 1%{?dist}
|
||||
Summary: module implementing HTTP/2 for Apache 2
|
||||
License: ASL 2.0
|
||||
URL: https://icing.github.io/mod_h2/
|
||||
Source0: https://github.com/icing/mod_h2/releases/download/v%{version}/mod_http2-%{version}.tar.gz
|
||||
Patch1: mod_http2-1.14.1-buildfix.patch
|
||||
Patch2: mod_http2-1.15.14-openssl30.patch
|
||||
# Patch1: ...
|
||||
|
||||
# Security patches:
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2034672
|
||||
Patch100: mod_http2-1.15.19-CVE-2021-44224.patch
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2176209
|
||||
Patch101: mod_http2-1.15.19-CVE-2023-25690.patch
|
||||
#
|
||||
# Patch100: ...
|
||||
|
||||
BuildRequires: make
|
||||
BuildRequires: gcc
|
||||
@ -31,11 +28,6 @@ top of libnghttp2 for httpd 2.4 servers.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch1 -p1 -b .buildfix
|
||||
%patch2 -p1 -b .openssl30
|
||||
|
||||
%patch100 -p1 -b .CVE-2021-44224
|
||||
%patch101 -p1 -b .CVE-2023-25690
|
||||
|
||||
%build
|
||||
autoreconf -i
|
||||
@ -60,6 +52,9 @@ echo "LoadModule proxy_http2_module modules/mod_proxy_http2.so" > %{buildroot}%{
|
||||
%{_httpd_moddir}/mod_proxy_http2.so
|
||||
|
||||
%changelog
|
||||
* Mon Jan 08 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.0.25-1
|
||||
- Resolves: RHEL-14691 - mod_http2 rebase to 2.0.25
|
||||
|
||||
* Wed Aug 16 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.15.19-5
|
||||
- Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
|
||||
mod_rewrite and mod_proxy
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (mod_http2-1.15.19.tar.gz) = 6b03dd027cbf6560cf58066ff1a1348462eb3daef6edc48e680a18007e4e987d348f5ddef90378c13453c642c80c88f7af388336b08d06d110795ba08548c093
|
||||
SHA512 (mod_http2-2.0.25.tar.gz) = 1d9ccb26032f55e563cf3da6c129d0652ca897f0fb445998c7cb09629bb7dcdc7235b05e2f762a4b16047279e6c158e8d681756e4136315381286fc09d633e83
|
||||
|
||||
Loading…
Reference in New Issue
Block a user