From 17ff17c2292c3b36ea902d2144e9778b32b63054 Mon Sep 17 00:00:00 2001 From: qhw01063182 Date: Mon, 22 Dec 2025 11:46:54 +0800 Subject: [PATCH 1/5] [CVE]update to httpd-2.4.37-65.6 Signed-off-by: qhw01063182 --- 1000-httpd-anolis-rebrand.patch | 370 ------------- 1001-httpd-anolis-support-loongarch64.patch | 32 -- httpd-2.4.37-sslvhostsnipolicy.patch | 553 ++++++++++++++++++++ httpd-2.4.37-sw.patch | 66 --- httpd.spec | 426 ++++++++------- snipolicy.conf | 15 + 6 files changed, 780 insertions(+), 682 deletions(-) delete mode 100644 1000-httpd-anolis-rebrand.patch delete mode 100644 1001-httpd-anolis-support-loongarch64.patch create mode 100644 httpd-2.4.37-sslvhostsnipolicy.patch delete mode 100644 httpd-2.4.37-sw.patch create mode 100644 snipolicy.conf diff --git a/1000-httpd-anolis-rebrand.patch b/1000-httpd-anolis-rebrand.patch deleted file mode 100644 index 94aa798..0000000 --- a/1000-httpd-anolis-rebrand.patch +++ /dev/null @@ -1,370 +0,0 @@ -From de0dd0e04d3045426c4b0fd1d681c3a80575376b Mon Sep 17 00:00:00 2001 -From: zhangbinchen -Date: Tue, 16 Mar 2021 18:17:35 +0800 -Subject: [PATCH] rebrand-for-anolis - -Signed-off-by: zhangbinchen ---- - docs/manual/developer/thread_safety.html.en | 2 +- - docs/manual/index.html.de | 4 ++-- - docs/manual/index.html.en | 4 ++-- - docs/manual/index.html.es | 4 ++-- - docs/manual/index.html.fr.utf8 | 4 ++-- - docs/manual/index.html.ja.utf8 | 4 ++-- - docs/manual/index.html.tr.utf8 | 4 ++-- - docs/manual/index.html.zh-cn.utf8 | 4 ++-- - docs/manual/install.html.fr.utf8 | 4 ++-- - docs/manual/install.html.tr.utf8 | 4 ++-- - docs/manual/platform/index.html.en | 4 ++-- - docs/manual/platform/index.html.fr.utf8 | 4 ++-- - docs/manual/platform/rpm.html.en | 6 +++--- - docs/manual/platform/rpm.html.fr.utf8 | 6 +++--- - docs/manual/ssl/ssl_compat.html.en | 10 ++-------- - docs/manual/ssl/ssl_compat.html.fr.utf8 | 11 ++--------- - 16 files changed, 33 insertions(+), 46 deletions(-) - -diff --git a/docs/manual/developer/thread_safety.html.en b/docs/manual/developer/thread_safety.html.en -index e9e2130..e3fb303 100644 ---- a/docs/manual/developer/thread_safety.html.en -+++ b/docs/manual/developer/thread_safety.html.en -@@ -304,4 +304,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.de b/docs/manual/index.html.de -index 84032a9..d039a72 100644 ---- a/docs/manual/index.html.de -+++ b/docs/manual/index.html.de -@@ -93,7 +93,7 @@ - -

Plattform-spezifische Anmerkungen

- -@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.en b/docs/manual/index.html.en -index 493be56..294258c 100644 ---- a/docs/manual/index.html.en -+++ b/docs/manual/index.html.en -@@ -91,7 +91,7 @@ Documentation - -

Platform Specific Notes

- -@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.es b/docs/manual/index.html.es -index 0256bec..68aa346 100644 ---- a/docs/manual/index.html.es -+++ b/docs/manual/index.html.es -@@ -94,7 +94,7 @@ Documentaci - -

Notas Sobre Plataformas Específicas

- -

Otros Temas

-@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.fr.utf8 b/docs/manual/index.html.fr.utf8 -index e729674..4eb6d0a 100644 ---- a/docs/manual/index.html.fr.utf8 -+++ b/docs/manual/index.html.fr.utf8 -@@ -93,7 +93,7 @@ - -

Notes spécifiques aux différentes plateformes

- -@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.ja.utf8 b/docs/manual/index.html.ja.utf8 -index 37b85d3..1a62301 100644 ---- a/docs/manual/index.html.ja.utf8 -+++ b/docs/manual/index.html.ja.utf8 -@@ -93,7 +93,7 @@ - -

プラットフォーム固有ã®æƒ…å ±

- -@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.tr.utf8 b/docs/manual/index.html.tr.utf8 -index 70a7f31..1036391 100644 ---- a/docs/manual/index.html.tr.utf8 -+++ b/docs/manual/index.html.tr.utf8 -@@ -91,7 +91,7 @@ Belgeleri - -

Platformlara Özgü Bilgiler

- -@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/index.html.zh-cn.utf8 b/docs/manual/index.html.zh-cn.utf8 -index 1f7f63f..76b88d8 100644 ---- a/docs/manual/index.html.zh-cn.utf8 -+++ b/docs/manual/index.html.zh-cn.utf8 -@@ -88,7 +88,7 @@ - -

å¹³å°ç›¸å…³è¯´æ˜Ž

- -@@ -119,4 +119,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/install.html.fr.utf8 b/docs/manual/install.html.fr.utf8 -index ccf39a2..5a0fd01 100644 ---- a/docs/manual/install.html.fr.utf8 -+++ b/docs/manual/install.html.fr.utf8 -@@ -69,7 +69,7 @@ -

Aperçu pour les plus pressés

- -
--
Installation sous Fedora/CentOS/Red Hat Enterprise Linux
-+
Installation sous AnolisOS/Fedora/CentOS/Red Hat Enterprise Linux
-
- 
sudo yum install httpd
- sudo service httpd start
-@@ -525,4 +525,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/install.html.tr.utf8 b/docs/manual/install.html.tr.utf8 -index fdb89ea..fd6d691 100644 ---- a/docs/manual/install.html.tr.utf8 -+++ b/docs/manual/install.html.tr.utf8 -@@ -66,7 +66,7 @@ -
-

Tez canlılar için genel bir bakış

-
--
Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum
-+
AnolisoS/Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum
-
- 
sudo yum install httpd
- sudo systemctl enable httpd
-@@ -494,4 +494,4 @@ if (typeof(prettyPrint) !== 'undefined') {
-     prettyPrint();
- }
- //-->
--
-\ No newline at end of file
-+
-diff --git a/docs/manual/platform/index.html.en b/docs/manual/platform/index.html.en
-index 07af003..8949d4d 100644
---- a/docs/manual/platform/index.html.en
-+++ b/docs/manual/platform/index.html.en
-@@ -66,7 +66,7 @@
-     
- 
-     

--      
RPM Based Systems (Redhat / CentOS / Fedora)

-+	    
RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)

-       

-         
This document explains how to build, install, and run Apache 2.4
-         on systems supporting the RPM packaging format.

-@@ -121,4 +121,4 @@ if (typeof(prettyPrint) !== 'undefined') {
-     prettyPrint();
- }
- //-->
--
-\ No newline at end of file
-+
-diff --git a/docs/manual/platform/index.html.fr.utf8 b/docs/manual/platform/index.html.fr.utf8
-index 03404a5..bc0a8a8 100644
---- a/docs/manual/platform/index.html.fr.utf8
-+++ b/docs/manual/platform/index.html.fr.utf8
-@@ -67,7 +67,7 @@
-     
- 
-     

--      
Systèmes à base de paquets RPM (Redhat / CentOS / Fedora)

-+	    
Systèmes à base de paquets RPM (AnolisOS / Redhat / CentOS / Fedora)

-       

-         
Ce document explique comment installer, configurer et
- 	exécuter Apache 2.4 sur des systèmes qui supportent le format de
-@@ -127,4 +127,4 @@ if (typeof(prettyPrint) !== 'undefined') {
-     prettyPrint();
- }
- //-->
--
-\ No newline at end of file
-+
-diff --git a/docs/manual/platform/rpm.html.en b/docs/manual/platform/rpm.html.en
-index 992fe9e..bc1c696 100644
---- a/docs/manual/platform/rpm.html.en
-+++ b/docs/manual/platform/rpm.html.en
-@@ -7,7 +7,7 @@
-               This file is generated from xml source: DO NOT EDIT
-         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-       -->
--Using Apache With RPM Based Systems (Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4
-+Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4
- 
- 
- 
-@@ -21,7 +21,7 @@
-
-
<-
-

Using Apache With RPM Based Systems (Redhat / CentOS / Fedora)

-+ Apache > HTTP Server > Documentation > Version 2.4 > Platform Specific Notes

Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)

-
-

Available Languages:  en  | -  fr 

-@@ -245,4 +245,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/platform/rpm.html.fr.utf8 b/docs/manual/platform/rpm.html.fr.utf8 -index 3ae9ee3..78e6f77 100644 ---- a/docs/manual/platform/rpm.html.fr.utf8 -+++ b/docs/manual/platform/rpm.html.fr.utf8 -@@ -7,7 +7,7 @@ - This file is generated from xml source: DO NOT EDIT - XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX - --> --Utiliser Apache sur les systèmes à base de paquets RPM (Redhat -+<title>Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat - / CentOS / Fedora) - Serveur HTTP Apache Version 2.4 - - -@@ -23,7 +23,7 @@ -
<-
-

Utiliser Apache sur les systèmes à base de paquets RPM (Redhat -+ plateformes

Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat - / CentOS / Fedora)

-
-

Langues Disponibles:  en  | -@@ -261,4 +261,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/ssl/ssl_compat.html.en b/docs/manual/ssl/ssl_compat.html.en -index fb7b888..122f52d 100644 ---- a/docs/manual/ssl/ssl_compat.html.en -+++ b/docs/manual/ssl/ssl_compat.html.en -@@ -31,13 +31,7 @@ - This page covers backwards compatibility between mod_ssl and other - SSL solutions. mod_ssl is not the only SSL solution for Apache; four - additional products are (or were) also available: Ben Laurie's freely --available Apache-SSL (from --where mod_ssl were originally derived in 1998), Red Hat's commercial --Secure Web Server (which was based on mod_ssl), Covalent's commercial --Raven SSL Module (also based on --mod_ssl) and finally C2Net's (now Red Hat's) commercial product Stronghold (based --on a different evolution branch, named Sioux up to Stronghold 2.x, and --based on mod_ssl since Stronghold 3.x).

-+available Apache-SSL

- -

- mod_ssl mostly provides a superset of the functionality of all the other -@@ -245,4 +239,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ -diff --git a/docs/manual/ssl/ssl_compat.html.fr.utf8 b/docs/manual/ssl/ssl_compat.html.fr.utf8 -index 1c9a0c6..a4adb34 100644 ---- a/docs/manual/ssl/ssl_compat.html.fr.utf8 -+++ b/docs/manual/ssl/ssl_compat.html.fr.utf8 -@@ -31,14 +31,7 @@ -

Ce document couvre la compatibilité ascendante entre mod_ssl et - d'autres solutions SSL. mod_ssl n'est pas la seule solution SSL pour Apache ; - quatre autres produits sont (ou ont été) également disponibles : --Apache-SSL, le produit libre de --Ben Laurie (d'où mod_ssl est issu à l'origine en 1998), Secure --Web Server, un produit commercial de Red Hat (basé sur mod_ssl), --Raven SSL Module, un produit commercial --de Covalent (basé lui aussi sur mod_ssl), et enfin Stronghold, produit --commercial de C2Net et maintenant de Red Hat, (basé sur une branche --d'évolution différente appelée Sioux jusqu'à Stronghold 2.x et basé sur --mod_ssl depuis Stronghold 3.x).

-+Apache-SSL

- -

En plus de ses fonctionnalités propres, mod_ssl rassemble la plupart de - celles des autres solutions SSL, si bien qu'il est très simple de -@@ -254,4 +247,4 @@ if (typeof(prettyPrint) !== 'undefined') { - prettyPrint(); - } - //--> -- -\ No newline at end of file -+ --- -2.18.4 - diff --git a/1001-httpd-anolis-support-loongarch64.patch b/1001-httpd-anolis-support-loongarch64.patch deleted file mode 100644 index 37efba2..0000000 --- a/1001-httpd-anolis-support-loongarch64.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -Nur httpd-2.4.37/build/config.guess httpd-2.4.37.new/build/config.guess ---- httpd-2.4.37/build/config.guess 2018-10-18 22:34:08.000000000 +0800 -+++ httpd-2.4.37.new/build/config.guess 2021-11-04 11:15:42.592000000 +0800 -@@ -897,6 +897,9 @@ - UNAME_MACHINE=aarch64_be - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} - exit ;; -+ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) -+ echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" -+ exit ;; - alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in - EV5) UNAME_MACHINE=alphaev5 ;; -diff -Nur httpd-2.4.37/build/config.sub httpd-2.4.37.new/build/config.sub ---- httpd-2.4.37/build/config.sub 2018-10-18 22:34:08.000000000 +0800 -+++ httpd-2.4.37.new/build/config.sub 2021-11-04 11:15:42.592000000 +0800 -@@ -265,6 +265,7 @@ - | k1om \ - | le32 | le64 \ - | lm32 \ -+ | loongarch32 | loongarch64 | loongarchx32 \ - | m32c | m32r | m32rle | m68000 | m68k | m88k \ - | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ - | mips | mipsbe | mipseb | mipsel | mipsle \ -@@ -390,6 +391,7 @@ - | k1om-* \ - | le32-* | le64-* \ - | lm32-* \ -+ | loongarch32-* | loongarch64-* | loongarchx32-* \ - | m32c-* | m32r-* | m32rle-* \ - | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ - | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ diff --git a/httpd-2.4.37-sslvhostsnipolicy.patch b/httpd-2.4.37-sslvhostsnipolicy.patch new file mode 100644 index 0000000..0cc6551 --- /dev/null +++ b/httpd-2.4.37-sslvhostsnipolicy.patch @@ -0,0 +1,553 @@ +From e3d1aeceb8c3a8b2f90b85b105aec678b9d062bd Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Tue, 11 Nov 2025 15:50:19 +0100 +Subject: [PATCH] mod_ssl: Add SSLVHostSNIPolicy directive to set the + compatibility level required for VirtualHost matching. + +For "secure" and "authonly" modes, a hash of the policy-relevant vhost +configuration is created and stored in the post_config hooks, reducing +the runtime code complexity (and overhead). + +* modules/ssl/ssl_engine_kernel.c (ssl_check_vhost_sni_policy): New + function, replacing ssl_server_compatible et al. + +* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLVHostSNIPolicy): New + function. + +* modules/ssl/ssl_engine_init.c (md5_strarray_cmp, md5_strarray_hash, + hash_sni_policy_pk, hash_sni_policy_auth, create_sni_policy_hash): + New functions. + (ssl_init_Module): Invoke create_sni_policy_hash to store the hash + for every SSLSrvConfigRec. + +* modules/ssl/ssl_private.h (SSLModConfigRec): Add snivh_policy field. + (SSLSrvConfigRec): Add sni_policy_hash field. + +PR: 69743 +GitHub: closes #561 +--- + docs/manual/mod/mod_ssl.html.en | 77 ++++++++++++++++++ + modules/ssl/mod_ssl.c | 2 + + modules/ssl/ssl_engine_config.c | 41 ++++++++++ + modules/ssl/ssl_engine_init.c | 107 +++++++++++++++++++++++++ + modules/ssl/ssl_engine_kernel.c | 133 ++++++-------------------------- + modules/ssl/ssl_private.h | 16 ++++ + 6 files changed, 266 insertions(+), 110 deletions(-) + +diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en +index ab72d4f..97e2e3c 100644 +--- a/docs/manual/mod/mod_ssl.html.en ++++ b/docs/manual/mod/mod_ssl.html.en +@@ -125,6 +125,7 @@ to provide the cryptography engine.

+
  • SSLUseStapling
    • +
  • SSLVerifyClient
    • +
  • SSLVerifyDepth
    • ++
  • SSLVHostSNIPolicy
    • + +

    Bugfix checklist

    See also

    +
      +@@ -2778,6 +2779,82 @@ known to the server (i.e. the CA's certificate is under +

      Example

      SSLVerifyDepth 10
      +
      + ++
    ++
    top
    ++

    SSLVHostSNIPolicy Directive

    ++ ++ ++ ++ ++ ++ ++ ++ ++
    Description:Set compatibility policy for SNI client access to virtual hosts.
    Syntax:SSLVHostSNIPolicy strict|secure|authonly|insecure
    Default:SSLVHostSNIPolicy secure
    Context:server config
    Status:Extension
    Module:mod_ssl
    Compatibility:Available in Apache HTTP Server 2.4.37 in Red Hat Enterprise Linux 8

    This directive sets the policy applied when checking whether the ++<VirtualHost> ++identified by the Host request header in an HTTP request ++is compatible with the <VirtualHost> identified from the SNI ++extension sent during the initial TLS connection handshake. If an HTTP ++request is associated with a virtual host which has an incompatible ++SSL/TLS configuration under the policy used, an HTTP error response ++with status code 421 ("Misdirected Request") will be sent.

    ++ ++

    The policy also applies to TLS connections where an SNI extension ++is not sent during the handshake, implicitly using the default or ++first virtual host definition. If the Host header in an HTTP request ++on such a connection identifies any other non-default virtual host, ++the compatibility policy is tested.

    ++ ++

    The strict policy blocks all HTTP requests which are ++identified with a different virtual host to that identifed by SNI. ++The insecure policy allows all HTTP requests regardless ++of virtual host identified; such a configuration may be vulnerable to ++CVE-2025-23048. ++

    ++ ++

    The (default) secure, and authonly ++policies compare specific aspects of the SSL configuration for the two ++virtual hosts, which are grouped into two categories: ++ ++

    ++ ++This table illustrates whether an HTTP request will be blocked or ++allowed when the virtual host configurations differ as described, ++under each different policy setting: ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++
    Policy modeAny VirtualHost mismatchServer certificate/key,
    or protocol/cipher restrictions    		Client verification/
    authentication settings
    strictblockedblockedblocked
    secureallowedblockedblocked
    authonlyallowedblockedallowed
    insecureallowedallowedallowed
    ++

    ++

    Example

    SSLVHostSNIPolicy authonly
    ++
    ++ ++ +
    +
    +
    +diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c +index b5f8bdf..7820ef6 100644 +--- a/modules/ssl/mod_ssl.c ++++ b/modules/ssl/mod_ssl.c +@@ -83,6 +83,8 @@ static const command_rec ssl_config_cmds[] = { + SSL_CMD_SRV(RandomSeed, TAKE23, + "SSL Pseudo Random Number Generator (PRNG) seeding source " + "('startup|connect builtin|file:/path|exec:/path [bytes]')") ++ SSL_CMD_SRV(VHostSNIPolicy, TAKE1, ++ "SSL VirtualHost SNI compatibility policy setting") + + /* + * Per-server context configuration directives +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 7b3e212..f7f0249 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -78,6 +78,9 @@ SSLModConfigRec *ssl_config_global_create(server_rec *s) + #ifdef HAVE_OPENSSL_KEYLOG + mc->keylog_file = NULL; + #endif ++#ifdef HAVE_TLSEXT ++ mc->snivh_policy = MODSSL_SNIVH_SECURE; ++#endif + + apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY, + apr_pool_cleanup_null, +@@ -1903,6 +1906,44 @@ const char *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag + #endif + } + ++const char *ssl_cmd_SSLVHostSNIPolicy(cmd_parms *cmd, void *dcfg, const char *arg) ++{ ++#ifdef HAVE_TLSEXT ++ SSLModConfigRec *mc = myModConfig(cmd->server); ++ const char *err; ++ ++ if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) { ++ return err; ++ } ++ if (!mc) { ++ return "SSLVHostSNIPolicy cannot be used inside SSLPolicyDefine"; ++ } ++ ++ if (strcEQ(arg, "secure")) { ++ mc->snivh_policy = MODSSL_SNIVH_SECURE; ++ } ++ else if (strcEQ(arg, "strict")) { ++ mc->snivh_policy = MODSSL_SNIVH_STRICT; ++ } ++ else if (strcEQ(arg, "insecure")) { ++ mc->snivh_policy = MODSSL_SNIVH_INSECURE; ++ } ++ else if (strcEQ(arg, "authonly")) { ++ mc->snivh_policy = MODSSL_SNIVH_AUTHONLY; ++ } ++ else { ++ return apr_psprintf(cmd->pool, "Invalid SSLVhostSNIPolicy " ++ "argument '%s'", arg); ++ } ++ ++ return NULL; ++#else ++ return "SSLVHostSNIPolicy cannot be used, OpenSSL is not built with " ++ "support for TLS extensions and SNI indication. Refer to the " ++ "documentation, and build a compatible version of OpenSSL." ++#endif ++} ++ + #ifdef HAVE_OCSP_STAPLING + + const char *ssl_cmd_SSLStaplingCache(cmd_parms *cmd, +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index ce8cb3a..29a3f7c 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -31,6 +31,7 @@ + #include "mod_ssl_openssl.h" + #include "mpm_common.h" + #include "mod_md.h" ++#include "util_md5.h" + + APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(ssl, SSL, int, init_server, + (server_rec *s,apr_pool_t *p,int is_proxy,SSL_CTX *ctx), +@@ -184,6 +185,110 @@ static void ssl_add_version_components(apr_pool_t *p, + modver, AP_SERVER_BASEVERSION, incver); + } + ++#ifdef HAVE_TLSEXT ++/* Helper functions to create the SNI vhost policy hash. The policy ++ * hash captures the configuration elements relevant to the mode ++ * selected at runtime by SSLVHostSNIPolicy. */ ++ ++#define md5_str_update(ctx_, pfx_, str_) do { apr_md5_update(ctx_, pfx_, strlen(pfx_)); apr_md5_update(ctx_, str_, strlen(str_)); } while (0) ++#define md5_ifstr_update(ctx_, pfx_, str_) do { apr_md5_update(ctx_, pfx_, strlen(pfx_)); if (str_) apr_md5_update(ctx_, str_, strlen(str_)); } while (0) ++#define md5_fmt_update(ctx_, fmt_, i_) do { char s_[128]; apr_snprintf(s_, sizeof s_, fmt_, i_); \ ++ apr_md5_update(ctx_, s_, strlen(s_)); } while (0) ++ ++static int md5_strarray_cmp(const void *p1, const void *p2) ++{ ++ return strcmp(*(char **)p1, *(char **)p2); ++} ++ ++/* Hashes an array of strings in sorted order. */ ++static void md5_strarray_hash(apr_pool_t *ptemp, apr_md5_ctx_t *hash, ++ const char *pfx, apr_array_header_t *s) ++{ ++ char **elts = apr_pmemdup(ptemp, s->elts, s->nelts * sizeof *elts); ++ int i; ++ ++ qsort(elts, s->nelts, sizeof(char *), md5_strarray_cmp); ++ ++ apr_md5_update(hash, pfx, strlen(pfx)); ++ for (i = 0; i < s->nelts; i++) { ++ md5_str_update(hash, "elm:", elts[i]); ++ } ++} ++ ++static void hash_sni_policy_pk(apr_pool_t *ptemp, apr_md5_ctx_t *hash, modssl_ctx_t *ctx) ++{ ++ md5_fmt_update(hash, "protocol:%d", ctx->protocol); ++ ++ md5_ifstr_update(hash, "ciphers:", ctx->auth.cipher_suite); ++ md5_ifstr_update(hash, "tls13_ciphers:", ctx->auth.tls13_ciphers); ++ ++ md5_strarray_hash(ptemp, hash, "cert_files:", ctx->pks->cert_files); ++ md5_strarray_hash(ptemp, hash, "key_files:", ctx->pks->key_files); ++} ++ ++static void hash_sni_policy_auth(apr_md5_ctx_t *hash, modssl_ctx_t *ctx) ++{ ++ modssl_pk_server_t *pks = ctx->pks; ++ modssl_auth_ctx_t *a = &ctx->auth; ++ ++ md5_fmt_update(hash, "verify_depth:%d", a->verify_depth); ++ md5_fmt_update(hash, "verify_mode:%d", a->verify_mode); ++ ++ md5_ifstr_update(hash, "ca_name_path:", pks->ca_name_path); ++ md5_ifstr_update(hash, "ca_name_file:", pks->ca_name_file); ++ md5_ifstr_update(hash, "ca_cert_path:", a->ca_cert_path); ++ md5_ifstr_update(hash, "ca_cert_file:", a->ca_cert_file); ++ md5_ifstr_update(hash, "crl_path:", ctx->crl_path); ++ md5_ifstr_update(hash, "crl_file:", ctx->crl_file); ++ md5_fmt_update(hash, "crl_check_mask:%d", ctx->crl_check_mask); ++ md5_fmt_update(hash, "ocsp_mask:%d", ctx->ocsp_mask); ++ md5_fmt_update(hash, "ocsp_force_default:%d", ctx->ocsp_force_default); ++ md5_ifstr_update(hash, "ocsp_responder:", ctx->ocsp_responder); ++ ++#ifdef HAVE_SRP ++ md5_ifstr_update(hash, "srp_vfile:", ctx->srp_vfile); ++#endif ++ ++#ifdef HAVE_SSL_CONF_CMD ++ { ++ apr_array_header_t *parms = ctx->ssl_ctx_param; ++ int n; ++ ++ for (n = 0; n < parms->nelts; n++) { ++ ssl_ctx_param_t *p = &APR_ARRAY_IDX(parms, n, ssl_ctx_param_t); ++ ++ md5_str_update(hash, "param:", p->name); ++ md5_str_update(hash, "value:", p->value); ++ } ++ } ++#endif ++} ++#endif ++ ++static char *create_sni_policy_hash(apr_pool_t *p, apr_pool_t *ptemp, ++ modssl_snivhpolicy_t policy, ++ SSLSrvConfigRec *sc) ++{ ++ char *rv = NULL; ++#ifdef HAVE_TLSEXT ++ if (policy != MODSSL_SNIVH_STRICT && policy != MODSSL_SNIVH_INSECURE) { ++ apr_md5_ctx_t hash; ++ unsigned char digest[APR_MD5_DIGESTSIZE]; ++ ++ /* Create the vhost policy hash for comparison later. */ ++ apr_md5_init(&hash); ++ hash_sni_policy_auth(&hash, sc->server); ++ if (policy == MODSSL_SNIVH_SECURE) ++ hash_sni_policy_pk(ptemp, &hash, sc->server); ++ apr_md5_final(digest, &hash); ++ ++ rv = apr_palloc(p, 2 * APR_MD5_DIGESTSIZE + 1); ++ ap_bin2hex(digest, APR_MD5_DIGESTSIZE, rv); /* sets final '\0' */ ++ } ++#endif ++ return rv; ++} ++ + /* _________________________________________________________________ + ** + ** Let other answer special connection attempts. +@@ -422,6 +527,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, + return rv; + } + } ++ ++ sc->sni_policy_hash = create_sni_policy_hash(p, ptemp, mc->snivh_policy, sc); + } + + /* +diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c +index c13e86c..f27552f 100644 +--- a/modules/ssl/ssl_engine_kernel.c ++++ b/modules/ssl/ssl_engine_kernel.c +@@ -101,112 +101,28 @@ static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc) + } + + #ifdef HAVE_TLSEXT +-static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2) ++/* Check whether a transition from vhost sc1 to sc2 from SNI to Host: ++ * vhost selection is permitted according to the SSLVHostSNIPolicy ++ * setting. Returns 1 if the policy treats the vhosts as compatible, ++ * else 0. */ ++static int ssl_check_vhost_sni_policy(SSLSrvConfigRec *sc1, ++ SSLSrvConfigRec *sc2) + { +- int i; +- const char *c; +- +- if (s1 == s2) { ++ modssl_snivhpolicy_t policy = sc1->mc->snivh_policy; ++ ++ /* Policy: insecure => allow everything. */ ++ if (policy == MODSSL_SNIVH_INSECURE) + return 1; +- } +- else if (!s1 || !s2 || (s1->nelts != s2->nelts)) { +- return 0; +- } + +- for (i = 0; i < s1->nelts; i++) { +- c = APR_ARRAY_IDX(s1, i, const char *); +- if (!c || !ap_array_str_contains(s2, c)) { +- return 0; +- } +- } +- return 1; +-} ++ /* Policy: strict => fail for any vhost transition. */ ++ if (policy == MODSSL_SNIVH_STRICT) ++ return sc1 == sc2; + +-static int ssl_pk_server_compatible(modssl_pk_server_t *pks1, +- modssl_pk_server_t *pks2) +-{ +- if (!pks1 || !pks2) { +- return 0; +- } +- /* both have the same certificates? */ +- if ((pks1->ca_name_path != pks2->ca_name_path) +- && (!pks1->ca_name_path || !pks2->ca_name_path +- || strcmp(pks1->ca_name_path, pks2->ca_name_path))) { +- return 0; +- } +- if ((pks1->ca_name_file != pks2->ca_name_file) +- && (!pks1->ca_name_file || !pks2->ca_name_file +- || strcmp(pks1->ca_name_file, pks2->ca_name_file))) { +- return 0; +- } +- if (!ap_array_same_str_set(pks1->cert_files, pks2->cert_files) +- || !ap_array_same_str_set(pks1->key_files, pks2->key_files)) { +- return 0; +- } +- return 1; +-} ++ /* For authonly/secure policy, compare the hash. */ ++ AP_DEBUG_ASSERT(sc1->sni_policy_hash); ++ AP_DEBUG_ASSERT(sc2->sni_policy_hash); + +-static int ssl_auth_compatible(modssl_auth_ctx_t *a1, +- modssl_auth_ctx_t *a2) +-{ +- if (!a1 || !a2) { +- return 0; +- } +- /* both have the same verification */ +- if ((a1->verify_depth != a2->verify_depth) +- || (a1->verify_mode != a2->verify_mode)) { +- return 0; +- } +- /* both have the same ca path/file */ +- if ((a1->ca_cert_path != a2->ca_cert_path) +- && (!a1->ca_cert_path || !a2->ca_cert_path +- || strcmp(a1->ca_cert_path, a2->ca_cert_path))) { +- return 0; +- } +- if ((a1->ca_cert_file != a2->ca_cert_file) +- && (!a1->ca_cert_file || !a2->ca_cert_file +- || strcmp(a1->ca_cert_file, a2->ca_cert_file))) { +- return 0; +- } +- /* both have the same ca cipher suite string */ +- if ((a1->cipher_suite != a2->cipher_suite) +- && (!a1->cipher_suite || !a2->cipher_suite +- || strcmp(a1->cipher_suite, a2->cipher_suite))) { +- return 0; +- } +- /* both have the same ca cipher suite string */ +- if ((a1->tls13_ciphers != a2->tls13_ciphers) +- && (!a1->tls13_ciphers || !a2->tls13_ciphers +- || strcmp(a1->tls13_ciphers, a2->tls13_ciphers))) { +- return 0; +- } +- return 1; +-} +- +-static int ssl_ctx_compatible(modssl_ctx_t *ctx1, +- modssl_ctx_t *ctx2) +-{ +- if (!ctx1 || !ctx2 +- || (ctx1->protocol != ctx2->protocol) +- || !ssl_auth_compatible(&ctx1->auth, &ctx2->auth) +- || !ssl_pk_server_compatible(ctx1->pks, ctx2->pks)) { +- return 0; +- } +- return 1; +-} +- +-static int ssl_server_compatible(server_rec *s1, server_rec *s2) +-{ +- SSLSrvConfigRec *sc1 = s1? mySrvConfig(s1) : NULL; +- SSLSrvConfigRec *sc2 = s2? mySrvConfig(s2) : NULL; +- +- /* both use the same TLS protocol? */ +- if (!sc1 || !sc2 +- || !ssl_ctx_compatible(sc1->server, sc2->server)) { +- return 0; +- } +- +- return 1; ++ return strcmp(sc1->sni_policy_hash, sc2->sni_policy_hash) == 0; + } + #endif + +@@ -275,6 +191,8 @@ int ssl_hook_ReadReq(request_rec *r) + server_rec *handshakeserver = sslconn->server; + SSLSrvConfigRec *hssc = mySrvConfig(handshakeserver); + ++ AP_DEBUG_ASSERT(hssc); ++ + if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) { + /* + * The SNI extension supplied a hostname. So don't accept requests +@@ -315,19 +233,14 @@ int ssl_hook_ReadReq(request_rec *r) + "which is required to access this server.
    \n"); + return HTTP_FORBIDDEN; + } +- if (r->server != handshakeserver +- && !ssl_server_compatible(sslconn->server, r->server)) { +- /* +- * The request does not select the virtual host that was +- * selected for handshaking and its SSL parameters are different +- */ +- ++ /* Enforce SSL SNI vhost compatibility policy. */ ++ if (!ssl_check_vhost_sni_policy(sc, hssc)) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02032) + "Hostname %s %s and hostname %s provided" +- " via HTTP have no compatible SSL setup", ++ " via HTTP have no compatible SSL setup for policy '%s'", + servername ? servername : handshakeserver->server_hostname, + servername ? "provided via SNI" : "(default host as no SNI was provided)", +- r->hostname); ++ r->hostname, MODSSL_SNIVH_NAME(sc->mc->snivh_policy)); + return HTTP_MISDIRECTED_REQUEST; + } + } +diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h +index 2f8d4d3..eafd97b 100644 +--- a/modules/ssl/ssl_private.h ++++ b/modules/ssl/ssl_private.h +@@ -498,6 +498,19 @@ typedef struct { + int nBytes; + } ssl_randseed_t; + ++/* SNI vhost compatibility policy. */ ++typedef enum { ++ MODSSL_SNIVH_STRICT = 0, ++ MODSSL_SNIVH_SECURE = 1, ++ MODSSL_SNIVH_AUTHONLY = 2, ++ MODSSL_SNIVH_INSECURE = 3 ++} modssl_snivhpolicy_t; ++ ++/* Maps modssl_snivhpolicy_t back into a config option string. */ ++#define MODSSL_SNIVH_NAME(p_) ((p_) == MODSSL_SNIVH_STRICT ? "strict" : \ ++ ((p_) == MODSSL_SNIVH_SECURE ? "secure" : \ ++ ((p_) == MODSSL_SNIVH_AUTHONLY ? "authonly" : "insecure" ))) ++ + /** + * Define the structure of an ASN.1 anything + */ +@@ -632,6 +645,7 @@ typedef struct { + apr_file_t *keylog_file; + #endif + ++ modssl_snivhpolicy_t snivh_policy; + } SSLModConfigRec; + + /** Structure representing configured filenames for certs and keys for +@@ -782,6 +796,7 @@ struct SSLSrvConfigRec { + modssl_ctx_t *server; + #ifdef HAVE_TLSEXT + ssl_enabled_t strict_sni_vhost_check; ++ const char *sni_policy_hash; + #endif + #ifdef HAVE_FIPS + BOOL fips; +@@ -860,6 +875,7 @@ const char *ssl_cmd_SSLRequire(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLUserName(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLRenegBufferSize(cmd_parms *cmd, void *dcfg, const char *arg); + const char *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag); ++const char *ssl_cmd_SSLVHostSNIPolicy(cmd_parms *cmd, void *dcfg, const char *arg); + const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag); + + const char *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag); +-- +2.44.0 + diff --git a/httpd-2.4.37-sw.patch b/httpd-2.4.37-sw.patch deleted file mode 100644 index 0951329..0000000 --- a/httpd-2.4.37-sw.patch +++ /dev/null @@ -1,66 +0,0 @@ -diff -Naur httpd-2.4.37.org/configure httpd-2.4.37.sw/configure ---- httpd-2.4.37.org/configure 2018-10-18 22:34:09.000000000 +0800 -+++ httpd-2.4.37.sw/configure 2023-07-21 14:55:43.876595734 +0800 -@@ -29566,6 +29566,10 @@ - # ulimit only accepts English "unlimited" on input - APACHECTL_ULIMIT="ulimit -S -n unlimited" - ;; -+ *sw_64*-dec-osf*) -+ # Tru64: -H is for setting, not retrieving -+ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" -+ ;; - *alpha*-dec-osf*) - # Tru64: -H is for setting, not retrieving - APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" -diff -Naur httpd-2.4.37.org/support/config.m4 httpd-2.4.37.sw/support/config.m4 ---- httpd-2.4.37.org/support/config.m4 2011-04-08 03:32:49.000000000 +0800 -+++ httpd-2.4.37.sw/support/config.m4 2023-07-21 14:56:03.520289713 +0800 -@@ -136,6 +136,10 @@ - # ulimit only accepts English "unlimited" on input - APACHECTL_ULIMIT="ulimit -S -n unlimited" - ;; -+ *sw_64*-dec-osf*) -+ # Tru64: -H is for setting, not retrieving -+ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" -+ ;; - *alpha*-dec-osf*) - # Tru64: -H is for setting, not retrieving - APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" - -diff -Nuar httpd-2.4.37.org/build/config.guess httpd-2.4.37.sw/build/config.guess ---- httpd-2.4.37.org/build/config.guess 2023-08-09 16:22:45.045389206 +0800 -+++ httpd-2.4.37.sw/build/config.guess 2023-08-09 16:24:04.103173784 +0800 -@@ -900,6 +900,14 @@ - loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) - echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" - exit ;; -+ sw_64:Linux:*:*) -+ case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in -+ sw) UNAME_MACHINE=sw_64 ;; -+ esac -+ objdump --private-headers /bin/sh | grep -q ld.so.1 -+ if test "$?" = 0 ; then LIBC=gnulibc1 ; fi -+ echo ${UNAME_MACHINE}-sunway-linux-${LIBC} -+ exit ;; - alpha:Linux:*:*) - case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in - EV5) UNAME_MACHINE=alphaev5 ;; -diff -Nuar httpd-2.4.37.org/build/config.sub httpd-2.4.37.sw/build/config.sub ---- httpd-2.4.37.org/build/config.sub 2023-08-09 16:22:45.045389206 +0800 -+++ httpd-2.4.37.sw/build/config.sub 2023-08-09 16:23:26.159837338 +0800 -@@ -245,6 +245,7 @@ - 1750a | 580 \ - | a29k \ - | aarch64 | aarch64_be \ -+ | sw_64 \ - | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ - | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ - | am33_2.0 \ -@@ -370,6 +371,7 @@ - 580-* \ - | a29k-* \ - | aarch64-* | aarch64_be-* \ -+ | sw_64-* \ - | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ - | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ - | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ diff --git a/httpd.spec b/httpd.spec index d71a5fb..2002f62 100644 --- a/httpd.spec +++ b/httpd.spec @@ -1,299 +1,298 @@ -%define anolis_release .0.1 %define contentdir %{_datadir}/httpd %define docroot /var/www %define suexec_caller apache %define mmn 20120211 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} %define vstring %(source /etc/os-release; echo ${NAME}) -%if 0%{?fedora} > 26 || 0%{?rhel} > 7 || 0%{?anolis} +%define vprefix %(source /etc/os-release; echo ${ID}) +%if 0%{?fedora} > 26 || 0%{?rhel} > 7 %global mpm event %else %global mpm prefork %endif -Summary: Apache HTTP Server -Name: httpd -Version: 2.4.37 -Release: 655%{anolis_release}%{?dist}.5 -URL: https://httpd.apache.org/ -Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 -Source2: httpd.logrotate -Source3: instance.conf -Source4: httpd-ssl-pass-dialog -Source5: httpd.tmpfiles -Source6: httpd.service -Source7: action-graceful.sh -Source8: action-configtest.sh -Source10: httpd.conf -Source11: 00-base.conf -Source12: 00-mpm.conf -Source13: 00-lua.conf -Source14: 01-cgi.conf -Source15: 00-dav.conf -Source16: 00-proxy.conf -Source17: 00-ssl.conf -Source18: 01-ldap.conf -Source19: 00-proxyhtml.conf -Source20: userdir.conf -Source21: ssl.conf -Source22: welcome.conf -Source23: manual.conf -Source24: 00-systemd.conf -Source25: 01-session.conf -Source26: 10-listen443.conf -Source27: httpd.socket -Source28: 00-optional.conf +Summary: Apache HTTP Server +Name: httpd +Version: 2.4.37 +Release: 65%{?dist}.6 +URL: https://httpd.apache.org/ +Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 +Source2: httpd.logrotate +Source3: instance.conf +Source4: httpd-ssl-pass-dialog +Source5: httpd.tmpfiles +Source6: httpd.service +Source7: action-graceful.sh +Source8: action-configtest.sh +Source10: httpd.conf +Source11: 00-base.conf +Source12: 00-mpm.conf +Source13: 00-lua.conf +Source14: 01-cgi.conf +Source15: 00-dav.conf +Source16: 00-proxy.conf +Source17: 00-ssl.conf +Source18: 01-ldap.conf +Source19: 00-proxyhtml.conf +Source20: userdir.conf +Source21: ssl.conf +Source22: welcome.conf +Source23: manual.conf +Source24: 00-systemd.conf +Source25: 01-session.conf +Source26: 10-listen443.conf +Source27: httpd.socket +Source28: 00-optional.conf +Source29: snipolicy.conf # Documentation -Source30: README.confd -Source31: README.confmod -Source32: httpd.service.xml -Source33: htcacheclean.service.xml -Source34: httpd.conf.xml -Source40: htcacheclean.service -Source41: htcacheclean.sysconf -Source42: httpd-init.service -Source43: httpd-ssl-gencerts -Source44: httpd@.service -Source45: config.layout -Source46: apache-poweredby.png +Source30: README.confd +Source31: README.confmod +Source32: httpd.service.xml +Source33: htcacheclean.service.xml +Source34: httpd.conf.xml +Source40: htcacheclean.service +Source41: htcacheclean.sysconf +Source42: httpd-init.service +Source43: httpd-ssl-gencerts +Source44: httpd@.service +Source45: config.layout +Source46: apache-poweredby.png # build/scripts patches # http://bugzilla.redhat.com/show_bug.cgi?id=1231924 # http://bugzilla.redhat.com/show_bug.cgi?id=842736 # http://bugzilla.redhat.com/show_bug.cgi?id=1214401 -Patch1: httpd-2.4.35-apachectl.patch -Patch2: httpd-2.4.28-apxs.patch -Patch3: httpd-2.4.35-deplibs.patch +Patch1: httpd-2.4.35-apachectl.patch +Patch2: httpd-2.4.28-apxs.patch +Patch3: httpd-2.4.35-deplibs.patch # Needed for socket activation and mod_systemd patch -Patch19: httpd-2.4.35-detect-systemd.patch +Patch19: httpd-2.4.35-detect-systemd.patch # Features/functional changes -Patch20: httpd-2.4.32-export.patch -Patch21: httpd-2.4.35-corelimit.patch -Patch22: httpd-2.4.35-selinux.patch +Patch20: httpd-2.4.32-export.patch +Patch21: httpd-2.4.35-corelimit.patch +Patch22: httpd-2.4.35-selinux.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1170215 -Patch23: httpd-2.4.28-icons.patch -Patch24: httpd-2.4.35-systemd.patch -Patch25: httpd-2.4.35-cachehardmax.patch -Patch26: httpd-2.4.28-socket-activation.patch +Patch23: httpd-2.4.28-icons.patch +Patch24: httpd-2.4.35-systemd.patch +Patch25: httpd-2.4.35-cachehardmax.patch +Patch26: httpd-2.4.28-socket-activation.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1109119 -Patch27: httpd-2.4.35-sslciphdefault.patch +Patch27: httpd-2.4.35-sslciphdefault.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1332242 -Patch28: httpd-2.4.28-statements-comment.patch +Patch28: httpd-2.4.28-statements-comment.patch # https://bugzilla.redhat.com/show_bug.cgi?id=811714 -Patch29: httpd-2.4.35-full-release.patch -Patch30: httpd-2.4.35-freebind.patch -Patch31: httpd-2.4.35-r1830819+.patch +Patch29: httpd-2.4.35-full-release.patch +Patch30: httpd-2.4.35-freebind.patch +Patch31: httpd-2.4.35-r1830819+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1638738 -Patch32: httpd-2.4.37-sslprotdefault.patch +Patch32: httpd-2.4.37-sslprotdefault.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1747898 -Patch33: httpd-2.4.37-mod-md-mod-ssl-hooks.patch +Patch33: httpd-2.4.37-mod-md-mod-ssl-hooks.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1725031 -Patch34: httpd-2.4.37-r1861793+.patch +Patch34: httpd-2.4.37-r1861793+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1704317 -Patch35: httpd-2.4.37-sslkeylogfile-support.patch +Patch35: httpd-2.4.37-sslkeylogfile-support.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1794728 -Patch36: httpd-2.4.37-session-expiry-updt-int.patch +Patch36: httpd-2.4.37-session-expiry-updt-int.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1209162 -Patch37: httpd-2.4.37-logjournal.patch +Patch37: httpd-2.4.37-logjournal.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1869576 -Patch38: httpd-2.4.37-pr37355.patch +Patch38: httpd-2.4.37-pr37355.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1896176 -Patch39: httpd-2.4.37-proxy-ws-idle-timeout.patch +Patch39: httpd-2.4.37-proxy-ws-idle-timeout.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1883648 -Patch40: httpd-2.4.37-ssl-proxy-chains.patch +Patch40: httpd-2.4.37-ssl-proxy-chains.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1935742 -Patch41: httpd-2.4.37-usertrack-samesite.patch +Patch41: httpd-2.4.37-usertrack-samesite.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 -Patch61: httpd-2.4.35-r1738878.patch +Patch61: httpd-2.4.35-r1738878.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1170206 -Patch62: httpd-2.4.35-r1633085.patch +Patch62: httpd-2.4.35-r1633085.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1448892 -Patch63: httpd-2.4.28-r1811831.patch +Patch63: httpd-2.4.28-r1811831.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1602548 -Patch65: httpd-2.4.35-r1842888.patch +Patch65: httpd-2.4.35-r1842888.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1653009 # https://bugzilla.redhat.com/show_bug.cgi?id=1672977 # https://bugzilla.redhat.com/show_bug.cgi?id=1673022 -Patch66: httpd-2.4.37-r1842929+.patch +Patch66: httpd-2.4.37-r1842929+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1630432 -Patch67: httpd-2.4.35-r1825120.patch +Patch67: httpd-2.4.35-r1825120.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1670716 -Patch68: httpd-2.4.37-fips-segfault.patch +Patch68: httpd-2.4.37-fips-segfault.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1669221 -Patch70: httpd-2.4.37-r1840554.patch +Patch70: httpd-2.4.37-r1840554.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1673022 -Patch71: httpd-2.4.37-mod-md-perms.patch +Patch71: httpd-2.4.37-mod-md-perms.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1724549 -Patch72: httpd-2.4.37-mod-mime-magic-strdup.patch +Patch72: httpd-2.4.37-mod-mime-magic-strdup.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1724034 -Patch73: httpd-2.4.35-ocsp-wrong-ctx.patch +Patch73: httpd-2.4.35-ocsp-wrong-ctx.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1633224 -Patch74: httpd-2.4.37-r1828172+.patch +Patch74: httpd-2.4.37-r1828172+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1775158 -Patch75: httpd-2.4.37-r1870095+.patch +Patch75: httpd-2.4.37-r1870095+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1771847 -Patch76: httpd-2.4.37-proxy-continue.patch -Patch77: httpd-2.4.37-balancer-failover.patch +Patch76: httpd-2.4.37-proxy-continue.patch +Patch77: httpd-2.4.37-balancer-failover.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1875844 -Patch78: httpd-2.4.37-r1881459.patch +Patch78: httpd-2.4.37-r1881459.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1891829 -Patch79: httpd-2.4.37-r1864000.patch +Patch79: httpd-2.4.37-r1864000.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1868608 -Patch80: httpd-2.4.37-r1872790.patch +Patch80: httpd-2.4.37-r1872790.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1861380 -Patch81: httpd-2.4.37-r1879224.patch +Patch81: httpd-2.4.37-r1879224.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1680118 -Patch82: httpd-2.4.37-r1877397.patch +Patch82: httpd-2.4.37-r1877397.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1847585 -Patch83: httpd-2.4.37-r1878890.patch +Patch83: httpd-2.4.37-r1878890.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1918741 -Patch84: httpd-2.4.37-r1878280.patch +Patch84: httpd-2.4.37-r1878280.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1891594 -Patch85: httpd-2.4.37-htcacheclean-dont-break.patch +Patch85: httpd-2.4.37-htcacheclean-dont-break.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1937334 -Patch86: httpd-2.4.37-r1873907.patch +Patch86: httpd-2.4.37-r1873907.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1680111 -Patch87: httpd-2.4.37-reply-two-tls-rec.patch +Patch87: httpd-2.4.37-reply-two-tls-rec.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1905613 -Patch88: httpd-2.4.37-r1845768+.patch +Patch88: httpd-2.4.37-r1845768+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2001046 -Patch89: httpd-2.4.37-r1862410.patch +Patch89: httpd-2.4.37-r1862410.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1984828 -Patch90: httpd-2.4.37-hcheck-mem-issues.patch +Patch90: httpd-2.4.37-hcheck-mem-issues.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2017543 -Patch91: httpd-2.4.37-add-SNI-support.patch +Patch91: httpd-2.4.37-add-SNI-support.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2159603 -Patch92: httpd-2.4.37-mod_status-duplicate-key.patch +Patch92: httpd-2.4.37-mod_status-duplicate-key.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2221083 -Patch93: httpd-2.4.37-r1885607.patch +Patch93: httpd-2.4.37-r1885607.patch # https://issues.redhat.com/browse/RHEL-14321 -Patch94: httpd-2.4.57-r1884505+.patch +Patch94: httpd-2.4.57-r1884505+.patch # https://bz.apache.org/bugzilla/show_bug.cgi?id=69197 -Patch95: httpd-2.4.37-r1919325.patch +Patch95: httpd-2.4.37-r1919325.patch # https://issues.redhat.com/browse/RHEL-56068 -Patch96: httpd-2.4.37-r1922080.patch +Patch96: httpd-2.4.37-r1922080.patch # https://issues.redhat.com/browse/RHEL-87641 -Patch97: httpd-2.4.37-r1855391.patch +Patch97: httpd-2.4.37-r1855391.patch # Security fixes -Patch200: httpd-2.4.37-r1851471.patch +Patch200: httpd-2.4.37-r1851471.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1694980 -Patch201: httpd-2.4.37-CVE-2019-0211.patch +Patch201: httpd-2.4.37-CVE-2019-0211.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1695025 -Patch202: httpd-2.4.37-CVE-2019-0215.patch +Patch202: httpd-2.4.37-CVE-2019-0215.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1696141 -Patch203: httpd-2.4.37-CVE-2019-0217.patch +Patch203: httpd-2.4.37-CVE-2019-0217.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1696097 -Patch204: httpd-2.4.37-CVE-2019-0220.patch +Patch204: httpd-2.4.37-CVE-2019-0220.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1741860 # https://bugzilla.redhat.com/show_bug.cgi?id=1741864 # https://bugzilla.redhat.com/show_bug.cgi?id=1741868 -Patch205: httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch +Patch205: httpd-2.4.34-CVE-2019-9511-and-9516-and-9517.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1823259 # https://bugzilla.redhat.com/show_bug.cgi?id=1747284 # fixes both CVE-2020-1927 and CVE-2019-10098 -Patch206: httpd-2.4.37-CVE-2019-10098.patch +Patch206: httpd-2.4.37-CVE-2019-10098.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1747281 -Patch207: httpd-2.4.37-CVE-2019-10092.patch +Patch207: httpd-2.4.37-CVE-2019-10092.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1747291 -Patch208: httpd-2.4.37-CVE-2019-10097.patch +Patch208: httpd-2.4.37-CVE-2019-10097.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1820772 -Patch209: httpd-2.4.37-CVE-2020-1934.patch +Patch209: httpd-2.4.37-CVE-2020-1934.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1668493 -Patch210: httpd-2.4.37-CVE-2018-17199.patch +Patch210: httpd-2.4.37-CVE-2018-17199.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1866563 -Patch211: httpd-2.4.37-CVE-2020-11984.patch +Patch211: httpd-2.4.37-CVE-2020-11984.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1972500 -Patch212: httpd-2.4.37-CVE-2021-30641.patch +Patch212: httpd-2.4.37-CVE-2021-30641.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1968307 -Patch213: httpd-2.4.37-CVE-2021-26690.patch +Patch213: httpd-2.4.37-CVE-2021-26690.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2005117 -Patch214: httpd-2.4.37-CVE-2021-40438.patch +Patch214: httpd-2.4.37-CVE-2021-40438.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1966732 -Patch215: httpd-2.4.37-CVE-2021-26691.patch +Patch215: httpd-2.4.37-CVE-2021-26691.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1968278 -Patch216: httpd-2.4.37-CVE-2020-35452.patch +Patch216: httpd-2.4.37-CVE-2020-35452.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2005128 -Patch217: httpd-2.4.37-CVE-2021-34798.patch +Patch217: httpd-2.4.37-CVE-2021-34798.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2005119 -Patch218: httpd-2.4.37-CVE-2021-39275.patch +Patch218: httpd-2.4.37-CVE-2021-39275.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2005124 -Patch219: httpd-2.4.37-CVE-2021-36160.patch +Patch219: httpd-2.4.37-CVE-2021-36160.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1966728 -Patch220: httpd-2.4.37-CVE-2021-33193.patch +Patch220: httpd-2.4.37-CVE-2021-33193.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2034674 -Patch221: httpd-2.4.37-CVE-2021-44790.patch +Patch221: httpd-2.4.37-CVE-2021-44790.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2034672 -Patch222: httpd-2.4.37-CVE-2021-44224.patch +Patch222: httpd-2.4.37-CVE-2021-44224.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2064321 -Patch223: httpd-2.4.37-CVE-2022-22720.patch +Patch223: httpd-2.4.37-CVE-2022-22720.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1966738 -Patch224: httpd-2.4.37-CVE-2020-13950.patch +Patch224: httpd-2.4.37-CVE-2020-13950.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2064322 -Patch225: httpd-2.4.37-CVE-2022-22719.patch +Patch225: httpd-2.4.37-CVE-2022-22719.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2064320 -Patch226: httpd-2.4.37-CVE-2022-22721.patch +Patch226: httpd-2.4.37-CVE-2022-22721.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2065324 -Patch227: httpd-2.4.37-CVE-2022-23943.patch +Patch227: httpd-2.4.37-CVE-2022-23943.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2095002 -Patch228: httpd-2.4.37-CVE-2022-28614.patch +Patch228: httpd-2.4.37-CVE-2022-28614.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2095006 -Patch229: httpd-2.4.37-CVE-2022-28615.patch +Patch229: httpd-2.4.37-CVE-2022-28615.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2095015 -Patch230: httpd-2.4.37-CVE-2022-30522.patch +Patch230: httpd-2.4.37-CVE-2022-30522.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2095018 -Patch231: httpd-2.4.37-CVE-2022-30556.patch +Patch231: httpd-2.4.37-CVE-2022-30556.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2095020 -Patch232: httpd-2.4.37-CVE-2022-31813.patch +Patch232: httpd-2.4.37-CVE-2022-31813.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2095012 -Patch233: httpd-2.4.37-CVE-2022-29404.patch +Patch233: httpd-2.4.37-CVE-2022-29404.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2094997 -Patch234: httpd-2.4.37-CVE-2022-26377.patch +Patch234: httpd-2.4.37-CVE-2022-26377.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2161773 -Patch235: httpd-2.4.37-CVE-2022-37436.patch +Patch235: httpd-2.4.37-CVE-2022-37436.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2161774 -Patch236: httpd-2.4.37-CVE-2006-20001.patch +Patch236: httpd-2.4.37-CVE-2006-20001.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2161777 -Patch237: httpd-2.4.37-CVE-2022-36760.patch +Patch237: httpd-2.4.37-CVE-2022-36760.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2176209 -Patch238: httpd-2.4.37-CVE-2023-25690.patch +Patch238: httpd-2.4.37-CVE-2023-25690.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2176211 -Patch239: httpd-2.4.37-CVE-2023-27522.patch +Patch239: httpd-2.4.37-CVE-2023-27522.patch # https://issues.redhat.com/browse/RHEL-14448 -Patch240: httpd-2.4.37-CVE-2023-31122.patch +Patch240: httpd-2.4.37-CVE-2023-31122.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2273491 -Patch241: httpd-2.4.37-CVE-2023-38709.patch +Patch241: httpd-2.4.37-CVE-2023-38709.patch # CVE-2024-38474 and CVE-2024-38475 fixed in one patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295013 # https://bugzilla.redhat.com/show_bug.cgi?id=2295014 -Patch242: httpd-2.4.37-CVE-2024-38474+.patch +Patch242: httpd-2.4.37-CVE-2024-38474+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295012 -Patch243: httpd-2.4.37-CVE-2024-38473.patch +Patch243: httpd-2.4.37-CVE-2024-38473.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295016 -Patch244: httpd-2.4.37-CVE-2024-38477.patch +Patch244: httpd-2.4.37-CVE-2024-38477.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295022 -Patch245: httpd-2.4.37-CVE-2024-39573.patch +Patch245: httpd-2.4.37-CVE-2024-39573.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2295015 -Patch246: httpd-2.4.37-CVE-2024-38476.patch +Patch246: httpd-2.4.37-CVE-2024-38476.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2297362 # https://bugzilla.redhat.com/show_bug.cgi?id=2295761 -Patch247: httpd-2.4.37-CVE-2024-39884+.patch +Patch247: httpd-2.4.37-CVE-2024-39884+.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2374576 -Patch248: httpd-2.4.37-CVE-2025-23048.patch +Patch248: httpd-2.4.37-CVE-2025-23048.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2374571 -Patch249: httpd-2.4.37-CVE-2024-47252.patch +Patch249: httpd-2.4.37-CVE-2024-47252.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2374580 -Patch250: httpd-2.4.37-CVE-2025-49812.patch - -# Add by Anolis -Patch1000: 1000-httpd-anolis-rebrand.patch -Patch1001: 1001-httpd-anolis-support-loongarch64.patch -Patch2000: httpd-2.4.37-sw.patch -# End +Patch250: httpd-2.4.37-CVE-2025-49812.patch +# CVE-2025-23048 follow-up +# https://github.com/apache/httpd/pull/561 +# https://bz.apache.org/bugzilla/show_bug.cgi?id=69743 +Patch251: httpd-2.4.37-sslvhostsnipolicy.patch License: ASL 2.0 Group: System Environment/Daemons @@ -304,7 +303,7 @@ BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= BuildRequires: systemd-devel # web server testpage added to redhat-logos in 82.0 (rhbz1896319) # new logo requires new footer copyring which was added in rhbz1934800 -Requires: /etc/mime.types, system-logos-httpd +Requires: /etc/mime.types, system-logos(httpd-logo-ng) Obsoletes: httpd-suexec Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} @@ -316,17 +315,17 @@ Requires(pre): httpd-filesystem Requires(preun): systemd-units Requires(postun): systemd-units Requires(post): systemd-units -Conflicts: apr < 1.5.0-1 +Conflicts: apr < 1.5.0-1 %description The Apache HTTP Server is a powerful, efficient, and extensible web server. %package devel -Group: Development/Libraries -Summary: Development interfaces for the Apache HTTP server -Requires: apr-devel, apr-util-devel, pkgconfig -Requires: httpd = %{version}-%{release} +Group: Development/Libraries +Summary: Development interfaces for the Apache HTTP server +Requires: apr-devel, apr-util-devel, pkgconfig +Requires: httpd = %{version}-%{release} %description devel The httpd-devel package contains the APXS binary and other files @@ -338,11 +337,11 @@ able to compile or develop additional modules for Apache, you need to install this package. %package manual -Group: Documentation -Summary: Documentation for the Apache HTTP server -Requires: httpd = %{version}-%{release} -Obsoletes: secureweb-manual, apache-manual -BuildArch: noarch +Group: Documentation +Summary: Documentation for the Apache HTTP server +Requires: httpd = %{version}-%{release} +Obsoletes: secureweb-manual, apache-manual +BuildArch: noarch %description manual The httpd-manual package contains the complete manual and @@ -350,9 +349,9 @@ reference guide for the Apache HTTP server. The information can also be found at http://httpd.apache.org/docs/2.2/. %package filesystem -Group: System Environment/Daemons -Summary: The basic directory layout for the Apache HTTP server -BuildArch: noarch +Group: System Environment/Daemons +Summary: The basic directory layout for the Apache HTTP server +BuildArch: noarch Requires(pre): /usr/sbin/useradd %description filesystem @@ -361,24 +360,24 @@ for the Apache HTTP server including the correct permissions for the directories. %package tools -Group: System Environment/Daemons -Summary: Tools for use with the Apache HTTP Server +Group: System Environment/Daemons +Summary: Tools for use with the Apache HTTP Server %description tools The httpd-tools package contains tools which can be used with the Apache HTTP Server. %package -n mod_ssl -Group: System Environment/Daemons -Summary: SSL/TLS module for the Apache HTTP Server -Epoch: 1 -BuildRequires: openssl-devel +Group: System Environment/Daemons +Summary: SSL/TLS module for the Apache HTTP Server +Epoch: 1 +BuildRequires: openssl-devel Requires(pre): httpd-filesystem -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: sscg >= 3.0.0-7, /usr/bin/hostname -Obsoletes: stronghold-mod_ssl +Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: sscg >= 3.0.0-7, /usr/bin/hostname +Obsoletes: stronghold-mod_ssl # Require an OpenSSL which supports PROFILE=SYSTEM -Conflicts: openssl-libs < 1:1.0.1h-4 +Conflicts: openssl-libs < 1:1.0.1h-4 %description -n mod_ssl The mod_ssl module provides strong cryptography for the Apache Web @@ -386,31 +385,31 @@ server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. %package -n mod_proxy_html -Group: System Environment/Daemons -Summary: HTML and XML content filters for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -BuildRequires: libxml2-devel -Epoch: 1 -Obsoletes: mod_proxy_html < 1:2.4.1-2 +Group: System Environment/Daemons +Summary: HTML and XML content filters for the Apache HTTP Server +Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +BuildRequires: libxml2-devel +Epoch: 1 +Obsoletes: mod_proxy_html < 1:2.4.1-2 %description -n mod_proxy_html The mod_proxy_html and mod_xml2enc modules provide filters which can transform and modify HTML and XML content. %package -n mod_ldap -Group: System Environment/Daemons -Summary: LDAP authentication modules for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} -Requires: apr-util-ldap +Group: System Environment/Daemons +Summary: LDAP authentication modules for the Apache HTTP Server +Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Requires: apr-util-ldap %description -n mod_ldap The mod_ldap and mod_authnz_ldap modules add support for LDAP authentication to the Apache HTTP Server. %package -n mod_session -Group: System Environment/Daemons -Summary: Session interface for the Apache HTTP Server -Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} +Group: System Environment/Daemons +Summary: Session interface for the Apache HTTP Server +Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa} %description -n mod_session The mod_session module and associated backends provide an abstract @@ -534,11 +533,7 @@ interface for storing and accessing per-user session data. %patch248 -p1 -b .CVE-2025-23048 %patch249 -p1 -b .CVE-2024-47252 %patch250 -p1 -b .CVE-2025-49812 -# Add by Anolis -%patch1000 -p1 -%patch1001 -p1 -%patch2000 -p1 -# End +%patch251 -p1 -b .sslvhostsnipolicy %patch96 -p1 -b .r1922080 @@ -585,7 +580,7 @@ xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml xmlto man $RPM_SOURCE_DIR/httpd.service.xml : Building with MMN %{mmn}, MMN-ISA %{mmnisa} -: Default MPM is %{mpm}, vendor string is '%{vstring}' +: Default MPM is %{mpm}, vendor string is '%{vstring}', prefix is '%{vprefix}' %build # forcibly prevent use of bundled apr, apr-util, pcre @@ -687,10 +682,12 @@ mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \ $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf -for f in welcome.conf ssl.conf manual.conf userdir.conf; do +for f in welcome.conf ssl.conf manual.conf userdir.conf snipolicy.conf; do install -m 644 -p $RPM_SOURCE_DIR/$f \ $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/$f done +mv $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/snipolicy.conf \ + $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/%{vprefix}-snipolicy.conf # Split-out extra config shipped as default in conf.d: for f in autoindex; do @@ -923,6 +920,7 @@ rm -rf $RPM_BUILD_ROOT %config(noreplace) %{_sysconfdir}/httpd/conf.d/*.conf %exclude %{_sysconfdir}/httpd/conf.d/ssl.conf +%exclude %{_sysconfdir}/httpd/conf.d/*snipolicy.conf %exclude %{_sysconfdir}/httpd/conf.d/manual.conf %dir %{_sysconfdir}/httpd/conf.modules.d @@ -1011,6 +1009,7 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/httpd/modules/mod_ssl.so %config(noreplace) %{_sysconfdir}/httpd/conf.modules.d/00-ssl.conf %config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf +%config(noreplace) %{_sysconfdir}/httpd/conf.d/*snipolicy.conf %attr(0700,apache,root) %dir %{_localstatedir}/cache/httpd/ssl %{_unitdir}/httpd-init.service %{_libexecdir}/httpd-ssl-pass-dialog @@ -1046,12 +1045,10 @@ rm -rf $RPM_BUILD_ROOT %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Tue Sep 09 2025 zhangbinchen - 2.4.37-65.0.1.5 -- Rebrand for Anolis OS -- Requires system-logos-httpd -- Support loongarch64 platform(Liwei Ge) - cherry-pick `add sw patch #400077d851a81ce23aa39db271e26c3df254ae53`. (nijie@wxiat.com) - cherry-pick `change sw patch #bdacf2efe00d8445328f798df8c5520728801e8c`. (nijie@wxiat.com) +* Fri Nov 07 2025 Luboš Uhliarik - 2.4.37-65.6 +- Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check + to avoid unnecessary 421 errors after CVE-2025-23048 fix +- mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default * Mon Jul 28 2025 Luboš Uhliarik - 2.4.37-65.5 - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade @@ -1176,6 +1173,7 @@ rm -rf $RPM_BUILD_ROOT * Fri Jun 10 2022 Luboš Uhliarik - 2.4.37-49 - Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer + dereference * Mon Mar 21 2022 Luboš Uhliarik - 2.4.37-48 - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling diff --git a/snipolicy.conf b/snipolicy.conf new file mode 100644 index 0000000..48d44f9 --- /dev/null +++ b/snipolicy.conf @@ -0,0 +1,15 @@ +# +# Vendor override: Set the default SNI virtual host policy to "authonly" +# to preserve compatibility between virtual hosts which differ only in +# certificate or key configuration. This overrides the hard-coded +# mod_ssl default mode of "secure". +# +# See the directive documentation for more information: +# https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslvhostsnipolicy +# +# NOTE: if this file is removed, it will be restored on upgrades. +# To disable the override, comment-out the lines below. +# + + SSLVHostSNIPolicy authonly + -- Gitee From fdf8d38730cd95dac0638399b649ff7a8b742b86 Mon Sep 17 00:00:00 2001 From: Zhao Hang Date: Fri, 17 Dec 2021 06:31:15 +0000 Subject: [PATCH 2/5] rebrand for anolis and requires system-logos-httpd --- 10000-htppd-anolis-rebrand.patch | 370 +++++++++++++++++++++++++++++++ httpd.spec | 17 +- 2 files changed, 384 insertions(+), 3 deletions(-) create mode 100644 10000-htppd-anolis-rebrand.patch diff --git a/10000-htppd-anolis-rebrand.patch b/10000-htppd-anolis-rebrand.patch new file mode 100644 index 0000000..94aa798 --- /dev/null +++ b/10000-htppd-anolis-rebrand.patch @@ -0,0 +1,370 @@ +From de0dd0e04d3045426c4b0fd1d681c3a80575376b Mon Sep 17 00:00:00 2001 +From: zhangbinchen +Date: Tue, 16 Mar 2021 18:17:35 +0800 +Subject: [PATCH] rebrand-for-anolis + +Signed-off-by: zhangbinchen +--- + docs/manual/developer/thread_safety.html.en | 2 +- + docs/manual/index.html.de | 4 ++-- + docs/manual/index.html.en | 4 ++-- + docs/manual/index.html.es | 4 ++-- + docs/manual/index.html.fr.utf8 | 4 ++-- + docs/manual/index.html.ja.utf8 | 4 ++-- + docs/manual/index.html.tr.utf8 | 4 ++-- + docs/manual/index.html.zh-cn.utf8 | 4 ++-- + docs/manual/install.html.fr.utf8 | 4 ++-- + docs/manual/install.html.tr.utf8 | 4 ++-- + docs/manual/platform/index.html.en | 4 ++-- + docs/manual/platform/index.html.fr.utf8 | 4 ++-- + docs/manual/platform/rpm.html.en | 6 +++--- + docs/manual/platform/rpm.html.fr.utf8 | 6 +++--- + docs/manual/ssl/ssl_compat.html.en | 10 ++-------- + docs/manual/ssl/ssl_compat.html.fr.utf8 | 11 ++--------- + 16 files changed, 33 insertions(+), 46 deletions(-) + +diff --git a/docs/manual/developer/thread_safety.html.en b/docs/manual/developer/thread_safety.html.en +index e9e2130..e3fb303 100644 +--- a/docs/manual/developer/thread_safety.html.en ++++ b/docs/manual/developer/thread_safety.html.en +@@ -304,4 +304,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.de b/docs/manual/index.html.de +index 84032a9..d039a72 100644 +--- a/docs/manual/index.html.de ++++ b/docs/manual/index.html.de +@@ -93,7 +93,7 @@ + +

    Plattform-spezifische Anmerkungen

    + +@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.en b/docs/manual/index.html.en +index 493be56..294258c 100644 +--- a/docs/manual/index.html.en ++++ b/docs/manual/index.html.en +@@ -91,7 +91,7 @@ Documentation + +

    Platform Specific Notes

    + +@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.es b/docs/manual/index.html.es +index 0256bec..68aa346 100644 +--- a/docs/manual/index.html.es ++++ b/docs/manual/index.html.es +@@ -94,7 +94,7 @@ Documentaci + +

    Notas Sobre Plataformas Específicas

    + +

    Otros Temas

    +@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.fr.utf8 b/docs/manual/index.html.fr.utf8 +index e729674..4eb6d0a 100644 +--- a/docs/manual/index.html.fr.utf8 ++++ b/docs/manual/index.html.fr.utf8 +@@ -93,7 +93,7 @@ + +

    Notes spécifiques aux différentes plateformes

    + +@@ -125,4 +125,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.ja.utf8 b/docs/manual/index.html.ja.utf8 +index 37b85d3..1a62301 100644 +--- a/docs/manual/index.html.ja.utf8 ++++ b/docs/manual/index.html.ja.utf8 +@@ -93,7 +93,7 @@ + +

    プラットフォーム固有ã®æƒ…å ±

    + +@@ -124,4 +124,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.tr.utf8 b/docs/manual/index.html.tr.utf8 +index 70a7f31..1036391 100644 +--- a/docs/manual/index.html.tr.utf8 ++++ b/docs/manual/index.html.tr.utf8 +@@ -91,7 +91,7 @@ Belgeleri + +

    Platformlara Özgü Bilgiler

    + +@@ -122,4 +122,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/index.html.zh-cn.utf8 b/docs/manual/index.html.zh-cn.utf8 +index 1f7f63f..76b88d8 100644 +--- a/docs/manual/index.html.zh-cn.utf8 ++++ b/docs/manual/index.html.zh-cn.utf8 +@@ -88,7 +88,7 @@ + +

    å¹³å°ç›¸å…³è¯´æ˜Ž

    + +@@ -119,4 +119,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/install.html.fr.utf8 b/docs/manual/install.html.fr.utf8 +index ccf39a2..5a0fd01 100644 +--- a/docs/manual/install.html.fr.utf8 ++++ b/docs/manual/install.html.fr.utf8 +@@ -69,7 +69,7 @@ +

    Aperçu pour les plus pressés

    + +
    +-
    Installation sous Fedora/CentOS/Red Hat Enterprise Linux
    ++
    Installation sous AnolisOS/Fedora/CentOS/Red Hat Enterprise Linux
    +
    + 
    sudo yum install httpd
+ sudo service httpd start
    +@@ -525,4 +525,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/install.html.tr.utf8 b/docs/manual/install.html.tr.utf8 +index fdb89ea..fd6d691 100644 +--- a/docs/manual/install.html.tr.utf8 ++++ b/docs/manual/install.html.tr.utf8 +@@ -66,7 +66,7 @@ +
    +

    Tez canlılar için genel bir bakış

    +
    +-
    Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum
    ++
    AnolisoS/Fedora/CentOS/Red Hat Enterprise Linux üzerinde kurulum
    +
    + 
    sudo yum install httpd
+ sudo systemctl enable httpd
+@@ -494,4 +494,4 @@ if (typeof(prettyPrint) !== 'undefined') {
+     prettyPrint();
+ }
+ //-->
+-
+\ No newline at end of file
++
+diff --git a/docs/manual/platform/index.html.en b/docs/manual/platform/index.html.en
+index 07af003..8949d4d 100644
+--- a/docs/manual/platform/index.html.en
++++ b/docs/manual/platform/index.html.en
+@@ -66,7 +66,7 @@
+     
+ 
+     
    
+-      
    RPM Based Systems (Redhat / CentOS / Fedora)
    
++	    
    RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)
    
+       
    
+         
    This document explains how to build, install, and run Apache 2.4
+         on systems supporting the RPM packaging format.
    
+@@ -121,4 +121,4 @@ if (typeof(prettyPrint) !== 'undefined') {
+     prettyPrint();
+ }
+ //-->
+-
+\ No newline at end of file
++
+diff --git a/docs/manual/platform/index.html.fr.utf8 b/docs/manual/platform/index.html.fr.utf8
+index 03404a5..bc0a8a8 100644
+--- a/docs/manual/platform/index.html.fr.utf8
++++ b/docs/manual/platform/index.html.fr.utf8
+@@ -67,7 +67,7 @@
+     
+ 
+     
    
+-      
    Systèmes à base de paquets RPM (Redhat / CentOS / Fedora)
    
++	    
    Systèmes à base de paquets RPM (AnolisOS / Redhat / CentOS / Fedora)
    
+       
    
+         
    Ce document explique comment installer, configurer et
+ 	exécuter Apache 2.4 sur des systèmes qui supportent le format de
+@@ -127,4 +127,4 @@ if (typeof(prettyPrint) !== 'undefined') {
+     prettyPrint();
+ }
+ //-->
+-
+\ No newline at end of file
++
+diff --git a/docs/manual/platform/rpm.html.en b/docs/manual/platform/rpm.html.en
+index 992fe9e..bc1c696 100644
+--- a/docs/manual/platform/rpm.html.en
++++ b/docs/manual/platform/rpm.html.en
+@@ -7,7 +7,7 @@
+               This file is generated from xml source: DO NOT EDIT
+         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+       -->
+-Using Apache With RPM Based Systems (Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4
++Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora) - Apache HTTP Server Version 2.4
+ 
+ 
+ 
+@@ -21,7 +21,7 @@
+
    +
    <-
    +

    Using Apache With RPM Based Systems (Redhat / CentOS / Fedora)

    ++ Apache > HTTP Server > Documentation > Version 2.4 > Platform Specific Notes

    Using Apache With RPM Based Systems (AnolisOS / Redhat / CentOS / Fedora)

    +
    +

    Available Languages:  en  | +  fr 

    +@@ -245,4 +245,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/platform/rpm.html.fr.utf8 b/docs/manual/platform/rpm.html.fr.utf8 +index 3ae9ee3..78e6f77 100644 +--- a/docs/manual/platform/rpm.html.fr.utf8 ++++ b/docs/manual/platform/rpm.html.fr.utf8 +@@ -7,7 +7,7 @@ + This file is generated from xml source: DO NOT EDIT + XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX + --> +-Utiliser Apache sur les systèmes à base de paquets RPM (Redhat ++<title>Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat + / CentOS / Fedora) - Serveur HTTP Apache Version 2.4 + + +@@ -23,7 +23,7 @@ +
    <-
    +

    Utiliser Apache sur les systèmes à base de paquets RPM (Redhat ++ plateformes

    Utiliser Apache sur les systèmes à base de paquets RPM (AnolisOS / Redhat + / CentOS / Fedora)

    +
    +

    Langues Disponibles:  en  | +@@ -261,4 +261,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/ssl/ssl_compat.html.en b/docs/manual/ssl/ssl_compat.html.en +index fb7b888..122f52d 100644 +--- a/docs/manual/ssl/ssl_compat.html.en ++++ b/docs/manual/ssl/ssl_compat.html.en +@@ -31,13 +31,7 @@ + This page covers backwards compatibility between mod_ssl and other + SSL solutions. mod_ssl is not the only SSL solution for Apache; four + additional products are (or were) also available: Ben Laurie's freely +-available Apache-SSL (from +-where mod_ssl were originally derived in 1998), Red Hat's commercial +-Secure Web Server (which was based on mod_ssl), Covalent's commercial +-Raven SSL Module (also based on +-mod_ssl) and finally C2Net's (now Red Hat's) commercial product Stronghold (based +-on a different evolution branch, named Sioux up to Stronghold 2.x, and +-based on mod_ssl since Stronghold 3.x).

    ++available Apache-SSL

    + +

    + mod_ssl mostly provides a superset of the functionality of all the other +@@ -245,4 +239,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +diff --git a/docs/manual/ssl/ssl_compat.html.fr.utf8 b/docs/manual/ssl/ssl_compat.html.fr.utf8 +index 1c9a0c6..a4adb34 100644 +--- a/docs/manual/ssl/ssl_compat.html.fr.utf8 ++++ b/docs/manual/ssl/ssl_compat.html.fr.utf8 +@@ -31,14 +31,7 @@ +

    Ce document couvre la compatibilité ascendante entre mod_ssl et + d'autres solutions SSL. mod_ssl n'est pas la seule solution SSL pour Apache ; + quatre autres produits sont (ou ont été) également disponibles : +-Apache-SSL, le produit libre de +-Ben Laurie (d'où mod_ssl est issu à l'origine en 1998), Secure +-Web Server, un produit commercial de Red Hat (basé sur mod_ssl), +-Raven SSL Module, un produit commercial +-de Covalent (basé lui aussi sur mod_ssl), et enfin Stronghold, produit +-commercial de C2Net et maintenant de Red Hat, (basé sur une branche +-d'évolution différente appelée Sioux jusqu'à Stronghold 2.x et basé sur +-mod_ssl depuis Stronghold 3.x).

    ++Apache-SSL

    + +

    En plus de ses fonctionnalités propres, mod_ssl rassemble la plupart de + celles des autres solutions SSL, si bien qu'il est très simple de +@@ -254,4 +247,4 @@ if (typeof(prettyPrint) !== 'undefined') { + prettyPrint(); + } + //--> +- +\ No newline at end of file ++ +-- +2.18.4 + diff --git a/httpd.spec b/httpd.spec index 2002f62..2accc8a 100644 --- a/httpd.spec +++ b/httpd.spec @@ -1,3 +1,4 @@ +%define anolis_release .0.1 %define contentdir %{_datadir}/httpd %define docroot /var/www %define suexec_caller apache @@ -5,7 +6,7 @@ %define mmnisa %{mmn}%{__isa_name}%{__isa_bits} %define vstring %(source /etc/os-release; echo ${NAME}) %define vprefix %(source /etc/os-release; echo ${ID}) -%if 0%{?fedora} > 26 || 0%{?rhel} > 7 +%if 0%{?fedora} > 26 || 0%{?rhel} > 7 || 0%{?anolis} %global mpm event %else %global mpm prefork @@ -14,7 +15,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.37 -Release: 65%{?dist}.6 +Release: 655%{anolis_release}%{?dist}.6 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source2: httpd.logrotate @@ -294,6 +295,10 @@ Patch250: httpd-2.4.37-CVE-2025-49812.patch # https://bz.apache.org/bugzilla/show_bug.cgi?id=69743 Patch251: httpd-2.4.37-sslvhostsnipolicy.patch +# Add by Anolis +Patch1000: 10000-htppd-anolis-rebrand.patch +# End + License: ASL 2.0 Group: System Environment/Daemons BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root @@ -534,6 +539,9 @@ interface for storing and accessing per-user session data. %patch249 -p1 -b .CVE-2024-47252 %patch250 -p1 -b .CVE-2025-49812 %patch251 -p1 -b .sslvhostsnipolicy +# Add by Anolis +%patch1000 -p1 +# End %patch96 -p1 -b .r1922080 @@ -1045,6 +1053,10 @@ rm -rf $RPM_BUILD_ROOT %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Dec 22 2025 zhangbinchen - 2.4.37-65.0.1.6 +- Rebrand for Anolis OS +- Requires system-logos-httpd + * Fri Nov 07 2025 Luboš Uhliarik - 2.4.37-65.6 - Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check to avoid unnecessary 421 errors after CVE-2025-23048 fix @@ -1173,7 +1185,6 @@ rm -rf $RPM_BUILD_ROOT * Fri Jun 10 2022 Luboš Uhliarik - 2.4.37-49 - Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer - dereference * Mon Mar 21 2022 Luboš Uhliarik - 2.4.37-48 - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling -- Gitee From b880a63b0a1b086adc537c87651518b2d0ec5b20 Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Thu, 4 Nov 2021 11:28:04 +0800 Subject: [PATCH 3/5] build: support loongarch64 platform Signed-off-by: Liwei Ge --- ...d.patch => 1000-httpd-anolis-rebrand.patch | 0 1001-httpd-anolis-support-loongarch64.patch | 32 +++++++++++++++++++ httpd.spec | 5 ++- 3 files changed, 36 insertions(+), 1 deletion(-) rename 10000-htppd-anolis-rebrand.patch => 1000-httpd-anolis-rebrand.patch (100%) create mode 100644 1001-httpd-anolis-support-loongarch64.patch diff --git a/10000-htppd-anolis-rebrand.patch b/1000-httpd-anolis-rebrand.patch similarity index 100% rename from 10000-htppd-anolis-rebrand.patch rename to 1000-httpd-anolis-rebrand.patch diff --git a/1001-httpd-anolis-support-loongarch64.patch b/1001-httpd-anolis-support-loongarch64.patch new file mode 100644 index 0000000..37efba2 --- /dev/null +++ b/1001-httpd-anolis-support-loongarch64.patch @@ -0,0 +1,32 @@ +diff -Nur httpd-2.4.37/build/config.guess httpd-2.4.37.new/build/config.guess +--- httpd-2.4.37/build/config.guess 2018-10-18 22:34:08.000000000 +0800 ++++ httpd-2.4.37.new/build/config.guess 2021-11-04 11:15:42.592000000 +0800 +@@ -897,6 +897,9 @@ + UNAME_MACHINE=aarch64_be + echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + exit ;; ++ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) ++ echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" ++ exit ;; + alpha:Linux:*:*) + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in + EV5) UNAME_MACHINE=alphaev5 ;; +diff -Nur httpd-2.4.37/build/config.sub httpd-2.4.37.new/build/config.sub +--- httpd-2.4.37/build/config.sub 2018-10-18 22:34:08.000000000 +0800 ++++ httpd-2.4.37.new/build/config.sub 2021-11-04 11:15:42.592000000 +0800 +@@ -265,6 +265,7 @@ + | k1om \ + | le32 | le64 \ + | lm32 \ ++ | loongarch32 | loongarch64 | loongarchx32 \ + | m32c | m32r | m32rle | m68000 | m68k | m88k \ + | maxq | mb | microblaze | microblazeel | mcore | mep | metag \ + | mips | mipsbe | mipseb | mipsel | mipsle \ +@@ -390,6 +391,7 @@ + | k1om-* \ + | le32-* | le64-* \ + | lm32-* \ ++ | loongarch32-* | loongarch64-* | loongarchx32-* \ + | m32c-* | m32r-* | m32rle-* \ + | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ + | m88110-* | m88k-* | maxq-* | mcore-* | metag-* \ diff --git a/httpd.spec b/httpd.spec index 2accc8a..904f693 100644 --- a/httpd.spec +++ b/httpd.spec @@ -296,7 +296,8 @@ Patch250: httpd-2.4.37-CVE-2025-49812.patch Patch251: httpd-2.4.37-sslvhostsnipolicy.patch # Add by Anolis -Patch1000: 10000-htppd-anolis-rebrand.patch +Patch1000: 1000-httpd-anolis-rebrand.patch +Patch1001: 1001-httpd-anolis-support-loongarch64.patch # End License: ASL 2.0 @@ -541,6 +542,7 @@ interface for storing and accessing per-user session data. %patch251 -p1 -b .sslvhostsnipolicy # Add by Anolis %patch1000 -p1 +%patch1001 -p1 # End %patch96 -p1 -b .r1922080 @@ -1056,6 +1058,7 @@ rm -rf $RPM_BUILD_ROOT * Mon Dec 22 2025 zhangbinchen - 2.4.37-65.0.1.6 - Rebrand for Anolis OS - Requires system-logos-httpd +- Support loongarch64 platform(Liwei Ge) * Fri Nov 07 2025 Luboš Uhliarik - 2.4.37-65.6 - Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check -- Gitee From 502b92417375906e1b874827556bbdbba35a44bc Mon Sep 17 00:00:00 2001 From: Zhao Hang Date: Tue, 30 Jan 2024 10:08:33 +0800 Subject: [PATCH 4/5] Requires system-logos-httpd Signed-off-by: Zhao Hang --- httpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/httpd.spec b/httpd.spec index 904f693..b0b2a93 100644 --- a/httpd.spec +++ b/httpd.spec @@ -309,7 +309,7 @@ BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= BuildRequires: systemd-devel # web server testpage added to redhat-logos in 82.0 (rhbz1896319) # new logo requires new footer copyring which was added in rhbz1934800 -Requires: /etc/mime.types, system-logos(httpd-logo-ng) +Requires: /etc/mime.types, system-logos-httpd Obsoletes: httpd-suexec Provides: webserver Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release} -- Gitee From b16a10b64f807a03ff0bec212adcd77a8fab1e7a Mon Sep 17 00:00:00 2001 From: wxiat Date: Fri, 21 Jul 2023 15:23:24 +0800 Subject: [PATCH 5/5] - cherry-pick `add sw patch #400077d851a81ce23aa39db271e26c3df254ae53`. - cherry-pick `change sw patch #bdacf2efe00d8445328f798df8c5520728801e8c`. Signed-off-by: wxiat Signed-off-by: Weisson --- 1002-httpd-2.4.37-sw.patch | 66 ++++++++++++++++++++++++++++++++++++++ httpd.spec | 6 +++- 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 1002-httpd-2.4.37-sw.patch diff --git a/1002-httpd-2.4.37-sw.patch b/1002-httpd-2.4.37-sw.patch new file mode 100644 index 0000000..0951329 --- /dev/null +++ b/1002-httpd-2.4.37-sw.patch @@ -0,0 +1,66 @@ +diff -Naur httpd-2.4.37.org/configure httpd-2.4.37.sw/configure +--- httpd-2.4.37.org/configure 2018-10-18 22:34:09.000000000 +0800 ++++ httpd-2.4.37.sw/configure 2023-07-21 14:55:43.876595734 +0800 +@@ -29566,6 +29566,10 @@ + # ulimit only accepts English "unlimited" on input + APACHECTL_ULIMIT="ulimit -S -n unlimited" + ;; ++ *sw_64*-dec-osf*) ++ # Tru64: -H is for setting, not retrieving ++ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" ++ ;; + *alpha*-dec-osf*) + # Tru64: -H is for setting, not retrieving + APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" +diff -Naur httpd-2.4.37.org/support/config.m4 httpd-2.4.37.sw/support/config.m4 +--- httpd-2.4.37.org/support/config.m4 2011-04-08 03:32:49.000000000 +0800 ++++ httpd-2.4.37.sw/support/config.m4 2023-07-21 14:56:03.520289713 +0800 +@@ -136,6 +136,10 @@ + # ulimit only accepts English "unlimited" on input + APACHECTL_ULIMIT="ulimit -S -n unlimited" + ;; ++ *sw_64*-dec-osf*) ++ # Tru64: -H is for setting, not retrieving ++ APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" ++ ;; + *alpha*-dec-osf*) + # Tru64: -H is for setting, not retrieving + APACHECTL_ULIMIT="ulimit -S -n \`ulimit -h -n\`" + +diff -Nuar httpd-2.4.37.org/build/config.guess httpd-2.4.37.sw/build/config.guess +--- httpd-2.4.37.org/build/config.guess 2023-08-09 16:22:45.045389206 +0800 ++++ httpd-2.4.37.sw/build/config.guess 2023-08-09 16:24:04.103173784 +0800 +@@ -900,6 +900,14 @@ + loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*) + echo "$UNAME_MACHINE"-unknown-linux-"$LIBC" + exit ;; ++ sw_64:Linux:*:*) ++ case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in ++ sw) UNAME_MACHINE=sw_64 ;; ++ esac ++ objdump --private-headers /bin/sh | grep -q ld.so.1 ++ if test "$?" = 0 ; then LIBC=gnulibc1 ; fi ++ echo ${UNAME_MACHINE}-sunway-linux-${LIBC} ++ exit ;; + alpha:Linux:*:*) + case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in + EV5) UNAME_MACHINE=alphaev5 ;; +diff -Nuar httpd-2.4.37.org/build/config.sub httpd-2.4.37.sw/build/config.sub +--- httpd-2.4.37.org/build/config.sub 2023-08-09 16:22:45.045389206 +0800 ++++ httpd-2.4.37.sw/build/config.sub 2023-08-09 16:23:26.159837338 +0800 +@@ -245,6 +245,7 @@ + 1750a | 580 \ + | a29k \ + | aarch64 | aarch64_be \ ++ | sw_64 \ + | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ + | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ + | am33_2.0 \ +@@ -370,6 +371,7 @@ + 580-* \ + | a29k-* \ + | aarch64-* | aarch64_be-* \ ++ | sw_64-* \ + | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ + | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ + | alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \ diff --git a/httpd.spec b/httpd.spec index b0b2a93..31af970 100644 --- a/httpd.spec +++ b/httpd.spec @@ -17,7 +17,7 @@ Name: httpd Version: 2.4.37 Release: 655%{anolis_release}%{?dist}.6 URL: https://httpd.apache.org/ -Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 +Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source2: httpd.logrotate Source3: instance.conf Source4: httpd-ssl-pass-dialog @@ -298,6 +298,7 @@ Patch251: httpd-2.4.37-sslvhostsnipolicy.patch # Add by Anolis Patch1000: 1000-httpd-anolis-rebrand.patch Patch1001: 1001-httpd-anolis-support-loongarch64.patch +Patch2000: 1002-httpd-2.4.37-sw.patch # End License: ASL 2.0 @@ -543,6 +544,7 @@ interface for storing and accessing per-user session data. # Add by Anolis %patch1000 -p1 %patch1001 -p1 +%patch2000 -p1 # End %patch96 -p1 -b .r1922080 @@ -1059,6 +1061,8 @@ rm -rf $RPM_BUILD_ROOT - Rebrand for Anolis OS - Requires system-logos-httpd - Support loongarch64 platform(Liwei Ge) + cherry-pick `add sw patch #400077d851a81ce23aa39db271e26c3df254ae53`. (nijie@wxiat.com) + cherry-pick `change sw patch #bdacf2efe00d8445328f798df8c5520728801e8c`. (nijie@wxiat.com) * Fri Nov 07 2025 Luboš Uhliarik - 2.4.37-65.6 - Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check -- Gitee