From 10d8982782b32a3940d2b2b57927ae6978e0f472 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Tue, 9 Jan 2024 10:43:26 +0530 Subject: apache2: upgrade 2.4.57 -> 2.4.58 This upgrade incorporates the CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802 fixes and other bugfixes. The "0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch" and "CVE-2023-45802.patch" is no longer needed as it's included in this upgrade. Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.58 References: https://httpd.apache.org/security/vulnerabilities_24.html https://security-tracker.debian.org/tracker/CVE-2023-31122 https://security-tracker.debian.org/tracker/CVE-2023-43622 https://security-tracker.debian.org/tracker/CVE-2023-45802 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster --- ...pers-config9.m4-Add-server-directory-to-i.patch | 31 --- .../apache2/apache2/CVE-2023-45802.patch | 141 ------------- .../recipes-httpd/apache2/apache2_2.4.57.bb | 227 --------------------- .../recipes-httpd/apache2/apache2_2.4.58.bb | 225 ++++++++++++++++++++ 4 files changed, 225 insertions(+), 399 deletions(-) delete mode 100644 meta-webserver/recipes-httpd/apache2/apache2/0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch delete mode 100644 meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch delete mode 100644 meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb create mode 100644 meta-webserver/recipes-httpd/apache2/apache2_2.4.58.bb diff --git a/meta-webserver/recipes-httpd/apache2/apache2/0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch b/meta-webserver/recipes-httpd/apache2/apache2/0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch deleted file mode 100644 index 996eabf586..0000000000 --- a/meta-webserver/recipes-httpd/apache2/apache2/0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 5c9257fa34335ff83f7c01581cf953111072a457 Mon Sep 17 00:00:00 2001 -From: Valeria Petrov -Date: Tue, 18 Apr 2023 15:38:53 +0200 -Subject: [PATCH] * modules/mappers/config9.m4: Add 'server' directory to - include path if mod_rewrite is enabled. - -Upstream-Status: Accepted [https://svn.apache.org/viewvc?view=revision&revision=1909241] - ---- - modules/mappers/config9.m4 | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/modules/mappers/config9.m4 b/modules/mappers/config9.m4 -index 55a97ab993..7120b729b7 100644 ---- a/modules/mappers/config9.m4 -+++ b/modules/mappers/config9.m4 -@@ -14,6 +14,11 @@ APACHE_MODULE(userdir, mapping of requests to user-specific directories, , , mos - APACHE_MODULE(alias, mapping of requests to different filesystem parts, , , yes) - APACHE_MODULE(rewrite, rule based URL manipulation, , , most) - -+if test "x$enable_rewrite" != "xno"; then -+ # mod_rewrite needs test_char.h -+ APR_ADDTO(INCLUDES, [-I\$(top_builddir)/server]) -+fi -+ - APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current]) - - APACHE_MODPATH_FINISH --- -2.25.1 - diff --git a/meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch b/meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch deleted file mode 100644 index ee26e701f3..0000000000 --- a/meta-webserver/recipes-httpd/apache2/apache2/CVE-2023-45802.patch +++ /dev/null @@ -1,141 +0,0 @@ -From decce82a706abd78dfc32821a03ad93841d7758a Mon Sep 17 00:00:00 2001 -From: Stefan Eissing -Date: Mon, 16 Oct 2023 09:05:00 +0000 -Subject: [PATCH] Merge of /httpd/httpd/trunk:r1912999 - - * mod_http2: improved early cleanup of streams. - - - -git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913000 13f79535-47bb-0310-9956-ffa450edef68 ---- -Upstream-Status: Backport from [https://github.com/apache/httpd/commit/decce82a706abd78dfc32821a03ad93841d7758a] -CVE: CVE-2023-45802 -Signed-off-by: Ashish Sharma - changes-entries/h2_cleanup.txt | 2 ++ - modules/http2/h2_mplx.c | 26 ++++++++++++++++++++++---- - modules/http2/h2_mplx.h | 3 ++- - modules/http2/h2_session.c | 18 +++++++++++++++++- - modules/http2/h2_stream.c | 2 +- - 5 files changed, 44 insertions(+), 7 deletions(-) - create mode 100644 changes-entries/h2_cleanup.txt - -diff --git a/changes-entries/h2_cleanup.txt b/changes-entries/h2_cleanup.txt -new file mode 100644 -index 00000000000..5366b4adfc6 ---- /dev/null -+++ b/changes-entries/h2_cleanup.txt -@@ -0,0 +1,2 @@ -+ * mod_http2: improved early cleanup of streams. -+ [Stefan Eissing] -diff --git a/modules/http2/h2_mplx.c b/modules/http2/h2_mplx.c -index 4637a5f66ef..2aeea42b5df 100644 ---- a/modules/http2/h2_mplx.c -+++ b/modules/http2/h2_mplx.c -@@ -1119,14 +1119,32 @@ static int reset_is_acceptable(h2_stream *stream) - return 1; /* otherwise, be forgiving */ - } - --apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id) -+apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id, h2_stream *stream) - { -- h2_stream *stream; - apr_status_t status = APR_SUCCESS; -+ int registered; - - H2_MPLX_ENTER_ALWAYS(m); -- stream = h2_ihash_get(m->streams, stream_id); -- if (stream && !reset_is_acceptable(stream)) { -+ registered = (h2_ihash_get(m->streams, stream_id) != NULL); -+ if (!stream) { -+ /* a RST might arrive so late, we have already forgotten -+ * about it. Seems ok. */ -+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, m->c1, -+ H2_MPLX_MSG(m, "RST on unknown stream %d"), stream_id); -+ AP_DEBUG_ASSERT(!registered); -+ } -+ else if (!registered) { -+ /* a RST on a stream that mplx has not been told about, but -+ * which the session knows. Very early and annoying. */ -+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, m->c1, -+ H2_STRM_MSG(stream, "very early RST, drop")); -+ h2_stream_set_monitor(stream, NULL); -+ h2_stream_rst(stream, H2_ERR_STREAM_CLOSED); -+ h2_stream_dispatch(stream, H2_SEV_EOS_SENT); -+ m_stream_cleanup(m, stream); -+ m_be_annoyed(m); -+ } -+ else if (!reset_is_acceptable(stream)) { - m_be_annoyed(m); - } - H2_MPLX_LEAVE(m); -diff --git a/modules/http2/h2_mplx.h b/modules/http2/h2_mplx.h -index a2e73d9d7c3..860f9160397 100644 ---- a/modules/http2/h2_mplx.h -+++ b/modules/http2/h2_mplx.h -@@ -201,7 +201,8 @@ int h2_mplx_c1_all_streams_want_send_data(h2_mplx *m); - * any processing going on and remove from processing - * queue. - */ --apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id); -+apr_status_t h2_mplx_c1_client_rst(h2_mplx *m, int stream_id, -+ struct h2_stream *stream); - - /** - * Get readonly access to a stream for a secondary connection. -diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c -index 066c73ad98b..b6f6e7c01fb 100644 ---- a/modules/http2/h2_session.c -+++ b/modules/http2/h2_session.c -@@ -402,6 +402,10 @@ static int on_frame_recv_cb(nghttp2_session *ng2s, - H2_SSSN_STRM_MSG(session, frame->hd.stream_id, - "RST_STREAM by client, error=%d"), - (int)frame->rst_stream.error_code); -+ if (stream) { -+ rv = h2_stream_recv_frame(stream, NGHTTP2_RST_STREAM, frame->hd.flags, -+ frame->hd.length + H2_FRAME_HDR_LEN); -+ } - if (stream && stream->initiated_on) { - /* A stream reset on a request we sent it. Normal, when the - * client does not want it. */ -@@ -410,7 +414,8 @@ static int on_frame_recv_cb(nghttp2_session *ng2s, - else { - /* A stream reset on a request it sent us. Could happen in a browser - * when the user navigates away or cancels loading - maybe. */ -- h2_mplx_c1_client_rst(session->mplx, frame->hd.stream_id); -+ h2_mplx_c1_client_rst(session->mplx, frame->hd.stream_id, -+ stream); - } - ++session->streams_reset; - break; -@@ -812,6 +817,17 @@ static apr_status_t session_cleanup(h2_session *session, const char *trigger) - "goodbye, clients will be confused, should not happen")); - } - -+ if (!h2_iq_empty(session->ready_to_process)) { -+ int sid; -+ ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, -+ H2_SSSN_LOG(APLOGNO(), session, -+ "cleanup, resetting %d streams in ready-to-process"), -+ h2_iq_count(session->ready_to_process)); -+ while ((sid = h2_iq_shift(session->ready_to_process)) > 0) { -+ h2_mplx_c1_client_rst(session->mplx, sid, get_stream(session, sid)); -+ } -+ } -+ - transit(session, trigger, H2_SESSION_ST_CLEANUP); - h2_mplx_c1_destroy(session->mplx); - session->mplx = NULL; -diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c -index c419e2d8591..f6c92024519 100644 ---- a/modules/http2/h2_stream.c -+++ b/modules/http2/h2_stream.c -@@ -125,7 +125,7 @@ static int trans_on_event[][H2_SS_MAX] = { - { S_XXX, S_ERR, S_ERR, S_CL_L, S_CLS, S_XXX, S_XXX, S_XXX, },/* EV_CLOSED_L*/ - { S_ERR, S_ERR, S_ERR, S_CL_R, S_ERR, S_CLS, S_NOP, S_NOP, },/* EV_CLOSED_R*/ - { S_CLS, S_CLS, S_CLS, S_CLS, S_CLS, S_CLS, S_NOP, S_NOP, },/* EV_CANCELLED*/ --{ S_NOP, S_XXX, S_XXX, S_XXX, S_XXX, S_CLS, S_CLN, S_XXX, },/* EV_EOS_SENT*/ -+{ S_NOP, S_XXX, S_XXX, S_XXX, S_XXX, S_CLS, S_CLN, S_NOP, },/* EV_EOS_SENT*/ - { S_NOP, S_XXX, S_CLS, S_XXX, S_XXX, S_CLS, S_XXX, S_XXX, },/* EV_IN_ERROR*/ - }; - diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb deleted file mode 100644 index 2484f90eb6..0000000000 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.57.bb +++ /dev/null @@ -1,227 +0,0 @@ -DESCRIPTION = "The Apache HTTP Server is a powerful, efficient, and \ -extensible web server." -SUMMARY = "Apache HTTP Server" -HOMEPAGE = "http://httpd.apache.org/" -SECTION = "net" -LICENSE = "Apache-2.0" - -SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \ - file://0001-configure-use-pkg-config-for-PCRE-detection.patch \ - file://0002-apache2-bump-up-the-core-size-limit-if-CoreDumpDirec.patch \ - file://0003-apache2-do-not-export-apr-apr-util-symbols-when-usin.patch \ - file://0004-apache2-log-the-SELinux-context-at-startup.patch \ - file://0005-replace-lynx-to-curl-in-apachectl-script.patch \ - file://0006-apache2-fix-the-race-issue-of-parallel-installation.patch \ - file://0007-apache2-allow-to-disable-selinux-support.patch \ - file://0008-Fix-perl-install-directory-to-usr-bin.patch \ - file://0009-support-apxs.in-force-destdir-to-be-empty-string.patch \ - file://0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch \ - file://CVE-2023-45802.patch \ - " - -SRC_URI:append:class-target = " \ - file://0010-apache2-do-not-use-relative-path-for-gen_test_char.patch \ - file://init \ - file://apache2-volatile.conf \ - file://apache2.service \ - file://volatiles.04_apache2 \ - " - -LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3" -SRC_URI[sha256sum] = "dbccb84aee95e095edfbb81e5eb926ccd24e6ada55dcd83caecb262e5cf94d2a" - -S = "${WORKDIR}/httpd-${PV}" - -inherit autotools update-rc.d pkgconfig systemd update-alternatives - -DEPENDS = "openssl expat pcre apr apr-util apache2-native " - -CVE_PRODUCT = "http_server" - -SSTATE_SCAN_FILES += "apxs config_vars.mk config.nice" - -PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'selinux', d)}" -PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux,libselinux,libselinux" -PACKAGECONFIG[openldap] = "--enable-ldap --enable-authnz-ldap,--disable-ldap --disable-authnz-ldap,openldap" -PACKAGECONFIG[zlib] = "--enable-deflate,,zlib,zlib" - -CFLAGS_append = " -DPATH_MAX=4096" - -EXTRA_OECONF_class-target = "\ - --enable-layout=Debian \ - --prefix=${base_prefix} \ - --exec_prefix=${exec_prefix} \ - --includedir=${includedir}/${BPN} \ - --sysconfdir=${sysconfdir}/${BPN} \ - --datadir=${datadir}/${BPN} \ - --libdir=${libdir} \ - --libexecdir=${libexecdir}/${BPN}/modules \ - --localstatedir=${localstatedir} \ - --enable-ssl \ - --with-dbm=sdbm \ - --with-gdbm=no \ - --with-ndbm=no \ - --with-berkeley-db=no \ - --enable-info \ - --enable-rewrite \ - --enable-mpms-shared \ - ap_cv_void_ptr_lt_long=no \ - ac_cv_have_threadsafe_pollset=no \ - " - -EXTRA_OECONF_class-native = "\ - --prefix=${prefix} \ - --includedir=${includedir}/${BPN} \ - --sysconfdir=${sysconfdir}/${BPN} \ - --datadir=${datadir}/${BPN} \ - --libdir=${libdir} \ - --libexecdir=${libdir}/${BPN}/modules \ - --localstatedir=${localstatedir} \ - " - -do_configure_prepend() { - sed -i -e 's:$''{prefix}/usr/lib/cgi-bin:$''{libexecdir}/cgi-bin:g' ${S}/config.layout -} - -do_install_append_class-target() { - install -d ${D}/${sysconfdir}/init.d - - cat ${WORKDIR}/init | \ - sed -e 's,/usr/sbin/,${sbindir}/,g' \ - -e 's,/usr/bin/,${bindir}/,g' \ - -e 's,/usr/lib/,${libdir}/,g' \ - -e 's,/etc/,${sysconfdir}/,g' \ - -e 's,/usr/,${prefix}/,g' > ${D}/${sysconfdir}/init.d/${BPN} - - chmod 755 ${D}/${sysconfdir}/init.d/${BPN} - - # Remove the goofy original files... - rm -rf ${D}/${sysconfdir}/${BPN}/original - - install -d ${D}${sysconfdir}/${BPN}/conf.d - install -d ${D}${sysconfdir}/${BPN}/modules.d - - # Ensure configuration file pulls in conf.d and modules.d - printf "\nIncludeOptional ${sysconfdir}/${BPN}/conf.d/*.conf" >> ${D}/${sysconfdir}/${BPN}/httpd.conf - printf "\nIncludeOptional ${sysconfdir}/${BPN}/modules.d/*.load" >> ${D}/${sysconfdir}/${BPN}/httpd.conf - printf "\nIncludeOptional ${sysconfdir}/${BPN}/modules.d/*.conf\n\n" >> ${D}/${sysconfdir}/${BPN}/httpd.conf - - # Match with that is in init script - printf "\nPidFile /run/httpd.pid" >> ${D}/${sysconfdir}/${BPN}/httpd.conf - - # Set 'ServerName' to fix error messages when restart apache service - sed -i 's/^#ServerName www.example.com/ServerName localhost/' ${D}/${sysconfdir}/${BPN}/httpd.conf - - sed -i 's/^ServerRoot/#ServerRoot/' ${D}/${sysconfdir}/${BPN}/httpd.conf - - sed -i -e 's,${STAGING_DIR_TARGET},,g' \ - -e 's,${DEBUG_PREFIX_MAP},,g' \ - -e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ ]*,,g' \ - -e 's,${HOSTTOOLS_DIR}/,,g' \ - -e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \ - -e 's,APU_CONFIG = .*,APU_CONFIG = ,g' ${D}${datadir}/apache2/build/config_vars.mk - - sed -i -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \ - -e 's,${DEBUG_PREFIX_MAP},,g' \ - -e 's,${RECIPE_SYSROOT},,g' \ - -e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ ]*,,g' \ - -e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \ - -e 's,".*/configure","configure",g' ${D}${datadir}/apache2/build/config.nice - - if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then - install -d ${D}${sysconfdir}/tmpfiles.d/ - install -m 0644 ${WORKDIR}/apache2-volatile.conf ${D}${sysconfdir}/tmpfiles.d/ - - install -d ${D}${systemd_unitdir}/system - install -m 0644 ${WORKDIR}/apache2.service ${D}${systemd_unitdir}/system - sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/apache2.service - sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' ${D}${systemd_unitdir}/system/apache2.service - elif ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then - install -d ${D}${sysconfdir}/default/volatiles - install -m 0644 ${WORKDIR}/volatiles.04_apache2 ${D}${sysconfdir}/default/volatiles/04_apache2 - fi - - rm -rf ${D}${localstatedir} ${D}${sbindir}/envvars* - chown -R root:root ${D} -} - -do_install_append_class-native() { - install -d ${D}${bindir} ${D}${libdir} - install -m 755 server/gen_test_char ${D}${bindir} -} - -SYSROOT_PREPROCESS_FUNCS_append_class-target = " apache_sysroot_preprocess" - -apache_sysroot_preprocess() { - install -d ${SYSROOT_DESTDIR}${bindir_crossscripts} - install -m 755 ${D}${bindir}/apxs ${SYSROOT_DESTDIR}${bindir_crossscripts} - install -d ${SYSROOT_DESTDIR}${sbindir} - install -m 755 ${D}${sbindir}/apachectl ${SYSROOT_DESTDIR}${sbindir} - sed -i 's!my $installbuilddir = .*!my $installbuilddir = "${STAGING_DIR_HOST}/${datadir}/${BPN}/build";!' ${SYSROOT_DESTDIR}${bindir_crossscripts}/apxs - sed -i 's!my $libtool = .*!my $libtool = "${STAGING_BINDIR_CROSS}/${HOST_SYS}-libtool";!' ${SYSROOT_DESTDIR}${bindir_crossscripts}/apxs - - sed -i 's!^APR_CONFIG = .*!APR_CONFIG = ${STAGING_BINDIR_CROSS}/apr-1-config!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk - sed -i 's!^APU_CONFIG = .*!APU_CONFIG = ${STAGING_BINDIR_CROSS}/apu-1-config!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk - sed -i 's!^includedir = .*!includedir = ${STAGING_INCDIR}/apache2!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk - sed -i 's!^CFLAGS = -I[^ ]*!CFLAGS = -I${STAGING_INCDIR}/openssl!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk - sed -i 's!^EXTRA_LDFLAGS = .*!EXTRA_LDFLAGS = -L${STAGING_LIBDIR}!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk - sed -i 's!^EXTRA_INCLUDES = .*!EXTRA_INCLUDES = -I$(includedir) -I. -I${STAGING_INCDIR}!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk - sed -i 's!--sysroot=[^ ]*!--sysroot=${STAGING_DIR_HOST}!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk -} - -# Implications - used by update-rc.d scripts -INITSCRIPT_NAME = "apache2" -INITSCRIPT_PARAMS = "defaults 91 20" - -SYSTEMD_SERVICE_${PN} = "apache2.service" -SYSTEMD_AUTO_ENABLE_${PN} = "enable" - -ALTERNATIVE_${PN}-doc = "htpasswd.1" -ALTERNATIVE_LINK_NAME[htpasswd.1] = "${mandir}/man1/htpasswd.1" - -PACKAGES = "${PN}-scripts ${PN}-doc ${PN}-dev ${PN}-dbg ${PN}" - -CONFFILES_${PN} = "${sysconfdir}/${BPN}/httpd.conf \ - ${sysconfdir}/${BPN}/magic \ - ${sysconfdir}/${BPN}/mime.types \ - ${sysconfdir}/${BPN}/extra/*" - -# We override here rather than append so that .so links are -# included in the runtime package rather than here (-dev) -# and to get build, icons, error into the -dev package -FILES_${PN}-dev = "${datadir}/${BPN}/build \ - ${datadir}/${BPN}/icons \ - ${datadir}/${BPN}/error \ - ${includedir}/${BPN} \ - ${bindir}/apxs \ - " - -# Add the manual to -doc -FILES_${PN}-doc += " ${datadir}/${BPN}/manual" - -FILES_${PN}-scripts += "${bindir}/dbmmanage" - -# Override this too - here is the default, less datadir -FILES_${PN} = "${bindir} ${sbindir} ${libexecdir} ${libdir} \ - ${sysconfdir} ${libdir}/${BPN}" - -# We want htdocs and cgi-bin to go with the binary -FILES_${PN} += "${datadir}/${BPN}/ ${libdir}/cgi-bin" - -FILES_${PN}-dbg += "${libdir}/${BPN}/modules/.debug" - -RDEPENDS_${PN} += "openssl libgcc" -RDEPENDS_${PN}-scripts += "perl ${PN}" -RDEPENDS_${PN}-dev = "perl" - -BBCLASSEXTEND = "native" - -pkg_postinst_${PN}() { - if [ -z "$D" ]; then - if type systemd-tmpfiles >/dev/null; then - systemd-tmpfiles --create - elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then - ${sysconfdir}/init.d/populate-volatile.sh update - fi - fi -} diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.58.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.58.bb new file mode 100644 index 0000000000..746db4ac0a --- /dev/null +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.58.bb @@ -0,0 +1,225 @@ +DESCRIPTION = "The Apache HTTP Server is a powerful, efficient, and \ +extensible web server." +SUMMARY = "Apache HTTP Server" +HOMEPAGE = "http://httpd.apache.org/" +SECTION = "net" +LICENSE = "Apache-2.0" + +SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \ + file://0001-configure-use-pkg-config-for-PCRE-detection.patch \ + file://0002-apache2-bump-up-the-core-size-limit-if-CoreDumpDirec.patch \ + file://0003-apache2-do-not-export-apr-apr-util-symbols-when-usin.patch \ + file://0004-apache2-log-the-SELinux-context-at-startup.patch \ + file://0005-replace-lynx-to-curl-in-apachectl-script.patch \ + file://0006-apache2-fix-the-race-issue-of-parallel-installation.patch \ + file://0007-apache2-allow-to-disable-selinux-support.patch \ + file://0008-Fix-perl-install-directory-to-usr-bin.patch \ + file://0009-support-apxs.in-force-destdir-to-be-empty-string.patch \ + " + +SRC_URI:append:class-target = " \ + file://0010-apache2-do-not-use-relative-path-for-gen_test_char.patch \ + file://init \ + file://apache2-volatile.conf \ + file://apache2.service \ + file://volatiles.04_apache2 \ + " + +LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3" +SRC_URI[sha256sum] = "fa16d72a078210a54c47dd5bef2f8b9b8a01d94909a51453956b3ec6442ea4c5" + +S = "${WORKDIR}/httpd-${PV}" + +inherit autotools update-rc.d pkgconfig systemd update-alternatives + +DEPENDS = "openssl expat pcre apr apr-util apache2-native " + +CVE_PRODUCT = "http_server" + +SSTATE_SCAN_FILES += "apxs config_vars.mk config.nice" + +PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'selinux', d)}" +PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux,libselinux,libselinux" +PACKAGECONFIG[openldap] = "--enable-ldap --enable-authnz-ldap,--disable-ldap --disable-authnz-ldap,openldap" +PACKAGECONFIG[zlib] = "--enable-deflate,,zlib,zlib" + +CFLAGS_append = " -DPATH_MAX=4096" + +EXTRA_OECONF_class-target = "\ + --enable-layout=Debian \ + --prefix=${base_prefix} \ + --exec_prefix=${exec_prefix} \ + --includedir=${includedir}/${BPN} \ + --sysconfdir=${sysconfdir}/${BPN} \ + --datadir=${datadir}/${BPN} \ + --libdir=${libdir} \ + --libexecdir=${libexecdir}/${BPN}/modules \ + --localstatedir=${localstatedir} \ + --enable-ssl \ + --with-dbm=sdbm \ + --with-gdbm=no \ + --with-ndbm=no \ + --with-berkeley-db=no \ + --enable-info \ + --enable-rewrite \ + --enable-mpms-shared \ + ap_cv_void_ptr_lt_long=no \ + ac_cv_have_threadsafe_pollset=no \ + " + +EXTRA_OECONF_class-native = "\ + --prefix=${prefix} \ + --includedir=${includedir}/${BPN} \ + --sysconfdir=${sysconfdir}/${BPN} \ + --datadir=${datadir}/${BPN} \ + --libdir=${libdir} \ + --libexecdir=${libdir}/${BPN}/modules \ + --localstatedir=${localstatedir} \ + " + +do_configure_prepend() { + sed -i -e 's:$''{prefix}/usr/lib/cgi-bin:$''{libexecdir}/cgi-bin:g' ${S}/config.layout +} + +do_install_append_class-target() { + install -d ${D}/${sysconfdir}/init.d + + cat ${WORKDIR}/init | \ + sed -e 's,/usr/sbin/,${sbindir}/,g' \ + -e 's,/usr/bin/,${bindir}/,g' \ + -e 's,/usr/lib/,${libdir}/,g' \ + -e 's,/etc/,${sysconfdir}/,g' \ + -e 's,/usr/,${prefix}/,g' > ${D}/${sysconfdir}/init.d/${BPN} + + chmod 755 ${D}/${sysconfdir}/init.d/${BPN} + + # Remove the goofy original files... + rm -rf ${D}/${sysconfdir}/${BPN}/original + + install -d ${D}${sysconfdir}/${BPN}/conf.d + install -d ${D}${sysconfdir}/${BPN}/modules.d + + # Ensure configuration file pulls in conf.d and modules.d + printf "\nIncludeOptional ${sysconfdir}/${BPN}/conf.d/*.conf" >> ${D}/${sysconfdir}/${BPN}/httpd.conf + printf "\nIncludeOptional ${sysconfdir}/${BPN}/modules.d/*.load" >> ${D}/${sysconfdir}/${BPN}/httpd.conf + printf "\nIncludeOptional ${sysconfdir}/${BPN}/modules.d/*.conf\n\n" >> ${D}/${sysconfdir}/${BPN}/httpd.conf + + # Match with that is in init script + printf "\nPidFile /run/httpd.pid" >> ${D}/${sysconfdir}/${BPN}/httpd.conf + + # Set 'ServerName' to fix error messages when restart apache service + sed -i 's/^#ServerName www.example.com/ServerName localhost/' ${D}/${sysconfdir}/${BPN}/httpd.conf + + sed -i 's/^ServerRoot/#ServerRoot/' ${D}/${sysconfdir}/${BPN}/httpd.conf + + sed -i -e 's,${STAGING_DIR_TARGET},,g' \ + -e 's,${DEBUG_PREFIX_MAP},,g' \ + -e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ ]*,,g' \ + -e 's,${HOSTTOOLS_DIR}/,,g' \ + -e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \ + -e 's,APU_CONFIG = .*,APU_CONFIG = ,g' ${D}${datadir}/apache2/build/config_vars.mk + + sed -i -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \ + -e 's,${DEBUG_PREFIX_MAP},,g' \ + -e 's,${RECIPE_SYSROOT},,g' \ + -e 's,-fdebug-prefix-map[^ ]*,,g; s,-fmacro-prefix-map[^ ]*,,g' \ + -e 's,APU_INCLUDEDIR = .*,APU_INCLUDEDIR = ,g' \ + -e 's,".*/configure","configure",g' ${D}${datadir}/apache2/build/config.nice + + if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + install -d ${D}${sysconfdir}/tmpfiles.d/ + install -m 0644 ${WORKDIR}/apache2-volatile.conf ${D}${sysconfdir}/tmpfiles.d/ + + install -d ${D}${systemd_unitdir}/system + install -m 0644 ${WORKDIR}/apache2.service ${D}${systemd_unitdir}/system + sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/apache2.service + sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' ${D}${systemd_unitdir}/system/apache2.service + elif ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then + install -d ${D}${sysconfdir}/default/volatiles + install -m 0644 ${WORKDIR}/volatiles.04_apache2 ${D}${sysconfdir}/default/volatiles/04_apache2 + fi + + rm -rf ${D}${localstatedir} ${D}${sbindir}/envvars* + chown -R root:root ${D} +} + +do_install_append_class-native() { + install -d ${D}${bindir} ${D}${libdir} + install -m 755 server/gen_test_char ${D}${bindir} +} + +SYSROOT_PREPROCESS_FUNCS_append_class-target = " apache_sysroot_preprocess" + +apache_sysroot_preprocess() { + install -d ${SYSROOT_DESTDIR}${bindir_crossscripts} + install -m 755 ${D}${bindir}/apxs ${SYSROOT_DESTDIR}${bindir_crossscripts} + install -d ${SYSROOT_DESTDIR}${sbindir} + install -m 755 ${D}${sbindir}/apachectl ${SYSROOT_DESTDIR}${sbindir} + sed -i 's!my $installbuilddir = .*!my $installbuilddir = "${STAGING_DIR_HOST}/${datadir}/${BPN}/build";!' ${SYSROOT_DESTDIR}${bindir_crossscripts}/apxs + sed -i 's!my $libtool = .*!my $libtool = "${STAGING_BINDIR_CROSS}/${HOST_SYS}-libtool";!' ${SYSROOT_DESTDIR}${bindir_crossscripts}/apxs + + sed -i 's!^APR_CONFIG = .*!APR_CONFIG = ${STAGING_BINDIR_CROSS}/apr-1-config!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk + sed -i 's!^APU_CONFIG = .*!APU_CONFIG = ${STAGING_BINDIR_CROSS}/apu-1-config!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk + sed -i 's!^includedir = .*!includedir = ${STAGING_INCDIR}/apache2!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk + sed -i 's!^CFLAGS = -I[^ ]*!CFLAGS = -I${STAGING_INCDIR}/openssl!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk + sed -i 's!^EXTRA_LDFLAGS = .*!EXTRA_LDFLAGS = -L${STAGING_LIBDIR}!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk + sed -i 's!^EXTRA_INCLUDES = .*!EXTRA_INCLUDES = -I$(includedir) -I. -I${STAGING_INCDIR}!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk + sed -i 's!--sysroot=[^ ]*!--sysroot=${STAGING_DIR_HOST}!' ${SYSROOT_DESTDIR}${datadir}/${BPN}/build/config_vars.mk +} + +# Implications - used by update-rc.d scripts +INITSCRIPT_NAME = "apache2" +INITSCRIPT_PARAMS = "defaults 91 20" + +SYSTEMD_SERVICE_${PN} = "apache2.service" +SYSTEMD_AUTO_ENABLE_${PN} = "enable" + +ALTERNATIVE_${PN}-doc = "htpasswd.1" +ALTERNATIVE_LINK_NAME[htpasswd.1] = "${mandir}/man1/htpasswd.1" + +PACKAGES = "${PN}-scripts ${PN}-doc ${PN}-dev ${PN}-dbg ${PN}" + +CONFFILES_${PN} = "${sysconfdir}/${BPN}/httpd.conf \ + ${sysconfdir}/${BPN}/magic \ + ${sysconfdir}/${BPN}/mime.types \ + ${sysconfdir}/${BPN}/extra/*" + +# We override here rather than append so that .so links are +# included in the runtime package rather than here (-dev) +# and to get build, icons, error into the -dev package +FILES_${PN}-dev = "${datadir}/${BPN}/build \ + ${datadir}/${BPN}/icons \ + ${datadir}/${BPN}/error \ + ${includedir}/${BPN} \ + ${bindir}/apxs \ + " + +# Add the manual to -doc +FILES_${PN}-doc += " ${datadir}/${BPN}/manual" + +FILES_${PN}-scripts += "${bindir}/dbmmanage" + +# Override this too - here is the default, less datadir +FILES_${PN} = "${bindir} ${sbindir} ${libexecdir} ${libdir} \ + ${sysconfdir} ${libdir}/${BPN}" + +# We want htdocs and cgi-bin to go with the binary +FILES_${PN} += "${datadir}/${BPN}/ ${libdir}/cgi-bin" + +FILES_${PN}-dbg += "${libdir}/${BPN}/modules/.debug" + +RDEPENDS_${PN} += "openssl libgcc" +RDEPENDS_${PN}-scripts += "perl ${PN}" +RDEPENDS_${PN}-dev = "perl" + +BBCLASSEXTEND = "native" + +pkg_postinst_${PN}() { + if [ -z "$D" ]; then + if type systemd-tmpfiles >/dev/null; then + systemd-tmpfiles --create + elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then + ${sysconfdir}/init.d/populate-volatile.sh update + fi + fi +} -- cgit v1.2.3-54-g00ecf