From 9be1d0c4af137c4a7e62bc3c793192de844de739 Mon Sep 17 00:00:00 2001 From: "deepin-community-bot[bot]" <156989552+deepin-community-bot[bot]@users.noreply.github.com> Date: Wed, 6 May 2026 02:10:46 +0000 Subject: [PATCH] feat: update apache2 to 2.4.66-1~deb13u2 --- CHANGES | 65 ++- CMakeLists.txt | 2 +- configure | 2 +- debian/apache2.NEWS | 55 ++- debian/changelog | 29 +- debian/config-dir/mods-available/ssl.conf | 2 +- .../patches/0009-From-upstream-module.patch | 229 +++++++++++ debian/patches/bug1125368.patch | 102 +++++ .../patches/old-memory-handling-http2.patch | 44 ++ debian/patches/series | 4 +- debian/perl-framework/STATUS | 2 +- .../test_pass_brigade/mod_test_pass_brigade.c | 12 +- debian/perl-framework/scripts/ldap-init.sh | 10 +- .../perl-framework/scripts/memcached-init.sh | 4 +- debian/perl-framework/scripts/redis-init.sh | 2 +- .../scripts/slapd-config-mdb.ldif | 10 + debian/perl-framework/t/apache/byterange8.t | 39 ++ debian/perl-framework/t/apache/errordoc.t | 33 +- debian/perl-framework/t/apache/snihostcheck.t | 56 +++ debian/perl-framework/t/apache/teclchunk.t | 2 +- debian/perl-framework/t/conf/extra.conf.in | 76 +++- debian/perl-framework/t/conf/proxy.conf.in | 20 +- debian/perl-framework/t/conf/ssl/ssl.conf.in | 14 +- .../t/htdocs/modules/cgi/action.sh | 9 + .../t/htdocs/modules/cgi/bogus-te.sh | 10 + .../t/htdocs/modules/cgi/nph-dripfeed.pl.PL | 2 +- .../modules/dir/fallback/fallback.magictype | 1 + .../t/htdocs/modules/dir/fallback/index.html | 1 + .../htdocs/modules/include/exec/on/cmd.shtml | 2 +- .../t/htdocs/php/cfunctions.php | 7 +- .../perl-framework/t/htdocs/php/strings2.php | 4 +- .../t/htdocs/security/CAN-2004-0959.php | 5 +- debian/perl-framework/t/modules/actions.t | 9 + debian/perl-framework/t/modules/autoindex.t | 2 +- debian/perl-framework/t/modules/cgi.t | 40 +- debian/perl-framework/t/modules/dav.t | 33 +- debian/perl-framework/t/modules/deflate.t | 6 +- debian/perl-framework/t/modules/dir.t | 21 +- debian/perl-framework/t/modules/include.t | 1 + debian/perl-framework/t/modules/proxy_fcgi.t | 55 ++- .../t/modules/proxy_websockets.t | 2 +- .../t/modules/proxy_websockets_ssl.t | 2 +- debian/perl-framework/t/modules/rewrite.t | 85 +++- debian/perl-framework/t/ssl/varlookup.t | 13 +- debian/salsa-ci.yml | 2 + debian/tests/control | 42 +- .../{run-test-suite => run-test-suite.sh} | 21 - debian/tests/run-test-suite_event | 24 ++ debian/tests/run-test-suite_prefork | 24 ++ debian/tests/run-test-suite_worker | 24 ++ docs/docroot/index.html | 10 +- docs/manual/bind.html.de | 2 +- docs/manual/bind.html.en | 2 +- docs/manual/bind.html.fr.utf8 | 2 +- docs/manual/bind.html.ja.utf8 | 2 +- docs/manual/bind.html.ko.euc-kr | 2 +- docs/manual/bind.html.tr.utf8 | 2 +- docs/manual/caching.html.en | 2 +- docs/manual/caching.html.fr.utf8 | 2 +- docs/manual/caching.html.tr.utf8 | 2 +- docs/manual/configuring.html.de | 2 +- docs/manual/configuring.html.en | 27 +- docs/manual/configuring.html.fr.utf8 | 41 +- docs/manual/configuring.html.ja.utf8 | 2 +- docs/manual/configuring.html.ko.euc-kr | 2 +- docs/manual/configuring.html.tr.utf8 | 3 +- docs/manual/content-negotiation.html.en | 2 +- docs/manual/content-negotiation.html.fr.utf8 | 2 +- docs/manual/content-negotiation.html.ja.utf8 | 2 +- .../manual/content-negotiation.html.ko.euc-kr | 2 +- docs/manual/content-negotiation.html.tr.utf8 | 2 +- docs/manual/convenience.map | 36 +- docs/manual/custom-error.html.en | 2 +- docs/manual/custom-error.html.es | 2 +- docs/manual/custom-error.html.fr.utf8 | 2 +- docs/manual/custom-error.html.ja.utf8 | 2 +- docs/manual/custom-error.html.ko.euc-kr | 2 +- docs/manual/custom-error.html.tr.utf8 | 2 +- docs/manual/developer/API.html.en | 2 +- docs/manual/developer/debugging.html.en | 2 +- docs/manual/developer/documenting.html.en | 2 +- .../developer/documenting.html.zh-cn.utf8 | 2 +- docs/manual/developer/filters.html.en | 2 +- docs/manual/developer/hooks.html.en | 2 +- docs/manual/developer/index.html.en | 2 +- docs/manual/developer/index.html.zh-cn.utf8 | 2 +- docs/manual/developer/modguide.html.en | 2 +- docs/manual/developer/modules.html.en | 2 +- docs/manual/developer/modules.html.ja.utf8 | 2 +- docs/manual/developer/new_api_2_4.html.en | 2 +- docs/manual/developer/output-filters.html.en | 2 +- docs/manual/developer/request.html.en | 2 +- docs/manual/developer/thread_safety.html.en | 2 +- docs/manual/dns-caveats.html.en | 2 +- docs/manual/dns-caveats.html.fr.utf8 | 2 +- docs/manual/dns-caveats.html.ja.utf8 | 2 +- docs/manual/dns-caveats.html.ko.euc-kr | 2 +- docs/manual/dns-caveats.html.tr.utf8 | 2 +- docs/manual/dso.html.en | 2 +- docs/manual/dso.html.fr.utf8 | 2 +- docs/manual/dso.html.ja.utf8 | 2 +- docs/manual/dso.html.ko.euc-kr | 2 +- docs/manual/dso.html.tr.utf8 | 2 +- docs/manual/env.html.en | 2 +- docs/manual/env.html.fr.utf8 | 2 +- docs/manual/env.html.ja.utf8 | 2 +- docs/manual/env.html.ko.euc-kr | 2 +- docs/manual/env.html.tr.utf8 | 2 +- docs/manual/expr.html.en | 2 +- docs/manual/expr.html.fr.utf8 | 2 +- docs/manual/faq/index.html.en | 2 +- docs/manual/faq/index.html.es | 2 +- docs/manual/faq/index.html.fr.utf8 | 2 +- docs/manual/faq/index.html.tr.utf8 | 2 +- docs/manual/faq/index.html.zh-cn.utf8 | 2 +- docs/manual/filter.html.en | 2 +- docs/manual/filter.html.es | 2 +- docs/manual/filter.html.fr.utf8 | 2 +- docs/manual/filter.html.ja.utf8 | 2 +- docs/manual/filter.html.ko.euc-kr | 2 +- docs/manual/filter.html.tr.utf8 | 2 +- docs/manual/getting-started.html.en | 2 +- docs/manual/getting-started.html.fr.utf8 | 2 +- docs/manual/getting-started.html.ru.utf8 | 2 +- docs/manual/glossary.html.de | 2 +- docs/manual/glossary.html.en | 2 +- docs/manual/glossary.html.es | 2 +- docs/manual/glossary.html.fr.utf8 | 2 +- docs/manual/glossary.html.ja.utf8 | 2 +- docs/manual/glossary.html.ko.euc-kr | 2 +- docs/manual/glossary.html.tr.utf8 | 2 +- docs/manual/handler.html.en | 2 +- docs/manual/handler.html.es | 2 +- docs/manual/handler.html.fr.utf8 | 2 +- docs/manual/handler.html.ja.utf8 | 2 +- docs/manual/handler.html.ko.euc-kr | 2 +- docs/manual/handler.html.tr.utf8 | 2 +- docs/manual/handler.html.zh-cn.utf8 | 2 +- docs/manual/howto/access.html.en | 2 +- docs/manual/howto/access.html.es | 2 +- docs/manual/howto/access.html.fr.utf8 | 2 +- docs/manual/howto/auth.html.en | 2 +- docs/manual/howto/auth.html.es | 2 +- docs/manual/howto/auth.html.fr.utf8 | 2 +- docs/manual/howto/auth.html.ja.utf8 | 2 +- docs/manual/howto/auth.html.ko.euc-kr | 2 +- docs/manual/howto/auth.html.tr.utf8 | 2 +- docs/manual/howto/cgi.html.en | 2 +- docs/manual/howto/cgi.html.es | 2 +- docs/manual/howto/cgi.html.fr.utf8 | 2 +- docs/manual/howto/cgi.html.ja.utf8 | 2 +- docs/manual/howto/cgi.html.ko.euc-kr | 2 +- docs/manual/howto/htaccess.html.en | 2 +- docs/manual/howto/htaccess.html.es | 2 +- docs/manual/howto/htaccess.html.fr.utf8 | 2 +- docs/manual/howto/htaccess.html.ja.utf8 | 2 +- docs/manual/howto/htaccess.html.ko.euc-kr | 2 +- docs/manual/howto/htaccess.html.pt-br | 2 +- docs/manual/howto/http2.html.en | 2 +- docs/manual/howto/http2.html.es | 2 +- docs/manual/howto/http2.html.fr.utf8 | 2 +- docs/manual/howto/index.html.en | 2 +- docs/manual/howto/index.html.es | 2 +- docs/manual/howto/index.html.fr.utf8 | 2 +- docs/manual/howto/index.html.ja.utf8 | 2 +- docs/manual/howto/index.html.ko.euc-kr | 2 +- docs/manual/howto/index.html.zh-cn.utf8 | 2 +- docs/manual/howto/public_html.html.en | 2 +- docs/manual/howto/public_html.html.es | 2 +- docs/manual/howto/public_html.html.fr.utf8 | 2 +- docs/manual/howto/public_html.html.ja.utf8 | 2 +- docs/manual/howto/public_html.html.ko.euc-kr | 2 +- docs/manual/howto/public_html.html.tr.utf8 | 2 +- docs/manual/howto/reverse_proxy.html.en | 2 +- docs/manual/howto/reverse_proxy.html.fr.utf8 | 2 +- docs/manual/howto/ssi.html.en | 2 +- docs/manual/howto/ssi.html.es | 2 +- docs/manual/howto/ssi.html.fr.utf8 | 2 +- docs/manual/howto/ssi.html.ja.utf8 | 2 +- docs/manual/howto/ssi.html.ko.euc-kr | 2 +- docs/manual/images/favicon.png | Bin 0 -> 4508 bytes docs/manual/index.html.da | 2 +- docs/manual/index.html.de | 2 +- docs/manual/index.html.en | 2 +- docs/manual/index.html.es | 2 +- docs/manual/index.html.fr.utf8 | 2 +- docs/manual/index.html.ja.utf8 | 2 +- docs/manual/index.html.ko.euc-kr | 2 +- docs/manual/index.html.pt-br | 2 +- docs/manual/index.html.ru.utf8 | 2 +- docs/manual/index.html.tr.utf8 | 2 +- docs/manual/index.html.zh-cn.utf8 | 2 +- docs/manual/install.html.de | 2 +- docs/manual/install.html.en | 4 +- docs/manual/install.html.es | 2 +- docs/manual/install.html.fr.utf8 | 2 +- docs/manual/install.html.ja.utf8 | 2 +- docs/manual/install.html.ko.euc-kr | 2 +- docs/manual/install.html.tr.utf8 | 3 +- docs/manual/invoking.html.de | 2 +- docs/manual/invoking.html.en | 2 +- docs/manual/invoking.html.es | 2 +- docs/manual/invoking.html.fr.utf8 | 2 +- docs/manual/invoking.html.ja.utf8 | 2 +- docs/manual/invoking.html.ko.euc-kr | 2 +- docs/manual/invoking.html.tr.utf8 | 2 +- docs/manual/license.html.en | 2 +- docs/manual/logs.html.en | 2 +- docs/manual/logs.html.fr.utf8 | 2 +- docs/manual/logs.html.ja.utf8 | 2 +- docs/manual/logs.html.ko.euc-kr | 2 +- docs/manual/logs.html.tr.utf8 | 2 +- docs/manual/misc/index.html.en | 2 +- docs/manual/misc/index.html.es | 2 +- docs/manual/misc/index.html.fr.utf8 | 2 +- docs/manual/misc/index.html.ko.euc-kr | 2 +- docs/manual/misc/index.html.tr.utf8 | 2 +- docs/manual/misc/index.html.zh-cn.utf8 | 2 +- docs/manual/misc/password_encryptions.html.en | 2 +- .../misc/password_encryptions.html.fr.utf8 | 2 +- docs/manual/misc/perf-tuning.html.en | 2 +- docs/manual/misc/perf-tuning.html.fr.utf8 | 2 +- docs/manual/misc/perf-tuning.html.ko.euc-kr | 2 +- docs/manual/misc/perf-tuning.html.tr.utf8 | 2 +- docs/manual/misc/relevant_standards.html.en | 2 +- .../misc/relevant_standards.html.fr.utf8 | 2 +- .../misc/relevant_standards.html.ko.euc-kr | 2 +- docs/manual/misc/security_tips.html.en | 2 +- docs/manual/misc/security_tips.html.fr.utf8 | 2 +- docs/manual/misc/security_tips.html.ko.euc-kr | 2 +- docs/manual/misc/security_tips.html.tr.utf8 | 2 +- docs/manual/mod/core.html.de | 2 +- docs/manual/mod/core.html.en | 2 +- docs/manual/mod/core.html.es | 2 +- docs/manual/mod/core.html.fr.utf8 | 2 +- docs/manual/mod/core.html.ja.utf8 | 2 +- docs/manual/mod/core.html.tr.utf8 | 2 +- docs/manual/mod/directive-dict.html.en | 2 +- docs/manual/mod/directive-dict.html.es | 2 +- docs/manual/mod/directive-dict.html.fr.utf8 | 2 +- docs/manual/mod/directive-dict.html.ja.utf8 | 2 +- docs/manual/mod/directive-dict.html.ko.euc-kr | 2 +- docs/manual/mod/directive-dict.html.tr.utf8 | 2 +- docs/manual/mod/directives.html.de | 7 +- docs/manual/mod/directives.html.en | 7 +- docs/manual/mod/directives.html.es | 7 +- docs/manual/mod/directives.html.fr.utf8 | 7 +- docs/manual/mod/directives.html.ja.utf8 | 7 +- docs/manual/mod/directives.html.ko.euc-kr | 7 +- docs/manual/mod/directives.html.tr.utf8 | 7 +- docs/manual/mod/directives.html.zh-cn.utf8 | 7 +- docs/manual/mod/event.html.en | 2 +- docs/manual/mod/event.html.fr.utf8 | 2 +- docs/manual/mod/index.html.de | 2 +- docs/manual/mod/index.html.en | 2 +- docs/manual/mod/index.html.es | 2 +- docs/manual/mod/index.html.fr.utf8 | 2 +- docs/manual/mod/index.html.ja.utf8 | 2 +- docs/manual/mod/index.html.ko.euc-kr | 2 +- docs/manual/mod/index.html.tr.utf8 | 2 +- docs/manual/mod/index.html.zh-cn.utf8 | 2 +- docs/manual/mod/mod_access_compat.html.en | 2 +- .../manual/mod/mod_access_compat.html.fr.utf8 | 2 +- .../manual/mod/mod_access_compat.html.ja.utf8 | 2 +- docs/manual/mod/mod_actions.html.de | 2 +- docs/manual/mod/mod_actions.html.en | 2 +- docs/manual/mod/mod_actions.html.fr.utf8 | 2 +- docs/manual/mod/mod_actions.html.ja.utf8 | 2 +- docs/manual/mod/mod_actions.html.ko.euc-kr | 2 +- docs/manual/mod/mod_alias.html.en | 2 +- docs/manual/mod/mod_alias.html.fr.utf8 | 2 +- docs/manual/mod/mod_alias.html.ja.utf8 | 2 +- docs/manual/mod/mod_alias.html.ko.euc-kr | 2 +- docs/manual/mod/mod_alias.html.tr.utf8 | 2 +- docs/manual/mod/mod_allowmethods.html.en | 2 +- docs/manual/mod/mod_allowmethods.html.fr.utf8 | 2 +- docs/manual/mod/mod_asis.html.en | 2 +- docs/manual/mod/mod_asis.html.fr.utf8 | 2 +- docs/manual/mod/mod_asis.html.ja.utf8 | 2 +- docs/manual/mod/mod_asis.html.ko.euc-kr | 2 +- docs/manual/mod/mod_auth_basic.html.en | 2 +- docs/manual/mod/mod_auth_basic.html.fr.utf8 | 2 +- docs/manual/mod/mod_auth_basic.html.ja.utf8 | 2 +- docs/manual/mod/mod_auth_basic.html.ko.euc-kr | 2 +- docs/manual/mod/mod_auth_digest.html.en | 2 +- docs/manual/mod/mod_auth_digest.html.fr.utf8 | 2 +- .../manual/mod/mod_auth_digest.html.ko.euc-kr | 2 +- docs/manual/mod/mod_auth_form.html.en | 2 +- docs/manual/mod/mod_auth_form.html.fr.utf8 | 2 +- docs/manual/mod/mod_authn_anon.html.en | 2 +- docs/manual/mod/mod_authn_anon.html.fr.utf8 | 2 +- docs/manual/mod/mod_authn_anon.html.ja.utf8 | 2 +- docs/manual/mod/mod_authn_anon.html.ko.euc-kr | 2 +- docs/manual/mod/mod_authn_core.html.en | 2 +- docs/manual/mod/mod_authn_core.html.fr.utf8 | 2 +- docs/manual/mod/mod_authn_dbd.html.en | 2 +- docs/manual/mod/mod_authn_dbd.html.fr.utf8 | 2 +- docs/manual/mod/mod_authn_dbm.html.en | 2 +- docs/manual/mod/mod_authn_dbm.html.fr.utf8 | 2 +- docs/manual/mod/mod_authn_dbm.html.ja.utf8 | 2 +- docs/manual/mod/mod_authn_dbm.html.ko.euc-kr | 2 +- docs/manual/mod/mod_authn_file.html.en | 2 +- docs/manual/mod/mod_authn_file.html.fr.utf8 | 2 +- docs/manual/mod/mod_authn_file.html.ja.utf8 | 2 +- docs/manual/mod/mod_authn_file.html.ko.euc-kr | 2 +- docs/manual/mod/mod_authn_socache.html.en | 2 +- .../manual/mod/mod_authn_socache.html.fr.utf8 | 2 +- docs/manual/mod/mod_authnz_fcgi.html.en | 2 +- docs/manual/mod/mod_authnz_fcgi.html.fr.utf8 | 2 +- docs/manual/mod/mod_authnz_ldap.html.en | 2 +- docs/manual/mod/mod_authnz_ldap.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_core.html.en | 2 +- docs/manual/mod/mod_authz_core.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_dbd.html.en | 2 +- docs/manual/mod/mod_authz_dbd.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_dbm.html.en | 2 +- docs/manual/mod/mod_authz_dbm.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_dbm.html.ko.euc-kr | 2 +- docs/manual/mod/mod_authz_groupfile.html.en | 2 +- .../mod/mod_authz_groupfile.html.fr.utf8 | 2 +- .../mod/mod_authz_groupfile.html.ja.utf8 | 2 +- .../mod/mod_authz_groupfile.html.ko.euc-kr | 2 +- docs/manual/mod/mod_authz_host.html.en | 2 +- docs/manual/mod/mod_authz_host.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_owner.html.en | 2 +- docs/manual/mod/mod_authz_owner.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_owner.html.ja.utf8 | 2 +- .../manual/mod/mod_authz_owner.html.ko.euc-kr | 2 +- docs/manual/mod/mod_authz_user.html.en | 2 +- docs/manual/mod/mod_authz_user.html.fr.utf8 | 2 +- docs/manual/mod/mod_authz_user.html.ja.utf8 | 2 +- docs/manual/mod/mod_authz_user.html.ko.euc-kr | 2 +- docs/manual/mod/mod_autoindex.html.en | 2 +- docs/manual/mod/mod_autoindex.html.fr.utf8 | 2 +- docs/manual/mod/mod_autoindex.html.ja.utf8 | 2 +- docs/manual/mod/mod_autoindex.html.ko.euc-kr | 2 +- docs/manual/mod/mod_autoindex.html.tr.utf8 | 2 +- docs/manual/mod/mod_brotli.html.en | 2 +- docs/manual/mod/mod_brotli.html.fr.utf8 | 2 +- docs/manual/mod/mod_buffer.html.en | 2 +- docs/manual/mod/mod_buffer.html.fr.utf8 | 2 +- docs/manual/mod/mod_cache.html.en | 2 +- docs/manual/mod/mod_cache.html.fr.utf8 | 2 +- docs/manual/mod/mod_cache.html.ja.utf8 | 2 +- docs/manual/mod/mod_cache.html.ko.euc-kr | 2 +- docs/manual/mod/mod_cache_disk.html.en | 2 +- docs/manual/mod/mod_cache_disk.html.fr.utf8 | 2 +- docs/manual/mod/mod_cache_disk.html.ja.utf8 | 2 +- docs/manual/mod/mod_cache_disk.html.ko.euc-kr | 2 +- docs/manual/mod/mod_cache_socache.html.en | 2 +- .../manual/mod/mod_cache_socache.html.fr.utf8 | 2 +- docs/manual/mod/mod_cern_meta.html.en | 2 +- docs/manual/mod/mod_cern_meta.html.fr.utf8 | 2 +- docs/manual/mod/mod_cern_meta.html.ko.euc-kr | 2 +- docs/manual/mod/mod_cgi.html.en | 2 +- docs/manual/mod/mod_cgi.html.fr.utf8 | 2 +- docs/manual/mod/mod_cgi.html.ja.utf8 | 2 +- docs/manual/mod/mod_cgi.html.ko.euc-kr | 2 +- docs/manual/mod/mod_cgid.html.en | 2 +- docs/manual/mod/mod_cgid.html.fr.utf8 | 2 +- docs/manual/mod/mod_cgid.html.ja.utf8 | 2 +- docs/manual/mod/mod_cgid.html.ko.euc-kr | 2 +- docs/manual/mod/mod_charset_lite.html.en | 2 +- docs/manual/mod/mod_charset_lite.html.fr.utf8 | 2 +- .../mod/mod_charset_lite.html.ko.euc-kr | 2 +- docs/manual/mod/mod_data.html.en | 2 +- docs/manual/mod/mod_data.html.fr.utf8 | 2 +- docs/manual/mod/mod_dav.html.en | 2 +- docs/manual/mod/mod_dav.html.fr.utf8 | 2 +- docs/manual/mod/mod_dav.html.ja.utf8 | 2 +- docs/manual/mod/mod_dav.html.ko.euc-kr | 2 +- docs/manual/mod/mod_dav_fs.html.en | 2 +- docs/manual/mod/mod_dav_fs.html.fr.utf8 | 2 +- docs/manual/mod/mod_dav_fs.html.ja.utf8 | 2 +- docs/manual/mod/mod_dav_fs.html.ko.euc-kr | 2 +- docs/manual/mod/mod_dav_lock.html.en | 2 +- docs/manual/mod/mod_dav_lock.html.fr.utf8 | 2 +- docs/manual/mod/mod_dav_lock.html.ja.utf8 | 2 +- docs/manual/mod/mod_dbd.html.en | 2 +- docs/manual/mod/mod_dbd.html.fr.utf8 | 2 +- docs/manual/mod/mod_deflate.html.en | 2 +- docs/manual/mod/mod_deflate.html.fr.utf8 | 2 +- docs/manual/mod/mod_deflate.html.ja.utf8 | 2 +- docs/manual/mod/mod_deflate.html.ko.euc-kr | 2 +- docs/manual/mod/mod_dialup.html.en | 2 +- docs/manual/mod/mod_dialup.html.fr.utf8 | 2 +- docs/manual/mod/mod_dir.html.en | 2 +- docs/manual/mod/mod_dir.html.fr.utf8 | 2 +- docs/manual/mod/mod_dir.html.ja.utf8 | 2 +- docs/manual/mod/mod_dir.html.ko.euc-kr | 2 +- docs/manual/mod/mod_dir.html.tr.utf8 | 2 +- docs/manual/mod/mod_dumpio.html.en | 2 +- docs/manual/mod/mod_dumpio.html.fr.utf8 | 2 +- docs/manual/mod/mod_dumpio.html.ja.utf8 | 2 +- docs/manual/mod/mod_echo.html.en | 2 +- docs/manual/mod/mod_echo.html.fr.utf8 | 2 +- docs/manual/mod/mod_echo.html.ja.utf8 | 2 +- docs/manual/mod/mod_echo.html.ko.euc-kr | 2 +- docs/manual/mod/mod_env.html.en | 2 +- docs/manual/mod/mod_env.html.fr.utf8 | 2 +- docs/manual/mod/mod_env.html.ja.utf8 | 2 +- docs/manual/mod/mod_env.html.ko.euc-kr | 2 +- docs/manual/mod/mod_env.html.tr.utf8 | 2 +- docs/manual/mod/mod_example_hooks.html.en | 2 +- .../manual/mod/mod_example_hooks.html.fr.utf8 | 2 +- .../mod/mod_example_hooks.html.ko.euc-kr | 2 +- docs/manual/mod/mod_expires.html.en | 2 +- docs/manual/mod/mod_expires.html.fr.utf8 | 2 +- docs/manual/mod/mod_expires.html.ja.utf8 | 2 +- docs/manual/mod/mod_expires.html.ko.euc-kr | 2 +- docs/manual/mod/mod_ext_filter.html.en | 2 +- docs/manual/mod/mod_ext_filter.html.fr.utf8 | 2 +- docs/manual/mod/mod_ext_filter.html.ja.utf8 | 2 +- docs/manual/mod/mod_ext_filter.html.ko.euc-kr | 2 +- docs/manual/mod/mod_file_cache.html.en | 2 +- docs/manual/mod/mod_file_cache.html.fr.utf8 | 2 +- docs/manual/mod/mod_file_cache.html.ko.euc-kr | 2 +- docs/manual/mod/mod_filter.html.en | 2 +- docs/manual/mod/mod_filter.html.fr.utf8 | 2 +- docs/manual/mod/mod_headers.html.en | 2 +- docs/manual/mod/mod_headers.html.fr.utf8 | 2 +- docs/manual/mod/mod_headers.html.ja.utf8 | 2 +- docs/manual/mod/mod_headers.html.ko.euc-kr | 2 +- docs/manual/mod/mod_heartbeat.html.en | 2 +- docs/manual/mod/mod_heartbeat.html.fr.utf8 | 2 +- docs/manual/mod/mod_heartmonitor.html.en | 2 +- docs/manual/mod/mod_heartmonitor.html.fr.utf8 | 2 +- docs/manual/mod/mod_http2.html.en | 28 +- docs/manual/mod/mod_http2.html.fr.utf8 | 31 +- docs/manual/mod/mod_ident.html.en | 2 +- docs/manual/mod/mod_ident.html.fr.utf8 | 2 +- docs/manual/mod/mod_ident.html.ja.utf8 | 2 +- docs/manual/mod/mod_ident.html.ko.euc-kr | 2 +- docs/manual/mod/mod_imagemap.html.en | 2 +- docs/manual/mod/mod_imagemap.html.fr.utf8 | 2 +- docs/manual/mod/mod_imagemap.html.ko.euc-kr | 2 +- docs/manual/mod/mod_include.html.en | 2 +- docs/manual/mod/mod_include.html.fr.utf8 | 2 +- docs/manual/mod/mod_include.html.ja.utf8 | 2 +- docs/manual/mod/mod_info.html.en | 2 +- docs/manual/mod/mod_info.html.fr.utf8 | 2 +- docs/manual/mod/mod_info.html.ja.utf8 | 2 +- docs/manual/mod/mod_info.html.ko.euc-kr | 2 +- docs/manual/mod/mod_isapi.html.en | 2 +- docs/manual/mod/mod_isapi.html.fr.utf8 | 2 +- docs/manual/mod/mod_isapi.html.ko.euc-kr | 2 +- .../mod/mod_lbmethod_bybusyness.html.en | 2 +- .../mod/mod_lbmethod_bybusyness.html.fr.utf8 | 2 +- .../mod/mod_lbmethod_byrequests.html.en | 2 +- .../mod/mod_lbmethod_byrequests.html.fr.utf8 | 2 +- .../manual/mod/mod_lbmethod_bytraffic.html.en | 2 +- .../mod/mod_lbmethod_bytraffic.html.fr.utf8 | 2 +- .../manual/mod/mod_lbmethod_heartbeat.html.en | 2 +- .../mod/mod_lbmethod_heartbeat.html.fr.utf8 | 2 +- docs/manual/mod/mod_ldap.html.en | 2 +- docs/manual/mod/mod_ldap.html.fr.utf8 | 2 +- docs/manual/mod/mod_log_config.html.en | 2 +- docs/manual/mod/mod_log_config.html.fr.utf8 | 2 +- docs/manual/mod/mod_log_config.html.ja.utf8 | 2 +- docs/manual/mod/mod_log_config.html.ko.euc-kr | 2 +- docs/manual/mod/mod_log_config.html.tr.utf8 | 2 +- docs/manual/mod/mod_log_debug.html.en | 2 +- docs/manual/mod/mod_log_debug.html.fr.utf8 | 2 +- docs/manual/mod/mod_log_forensic.html.en | 2 +- docs/manual/mod/mod_log_forensic.html.fr.utf8 | 2 +- docs/manual/mod/mod_log_forensic.html.ja.utf8 | 2 +- docs/manual/mod/mod_log_forensic.html.tr.utf8 | 2 +- docs/manual/mod/mod_logio.html.en | 2 +- docs/manual/mod/mod_logio.html.fr.utf8 | 2 +- docs/manual/mod/mod_logio.html.ja.utf8 | 2 +- docs/manual/mod/mod_logio.html.ko.euc-kr | 2 +- docs/manual/mod/mod_logio.html.tr.utf8 | 2 +- docs/manual/mod/mod_lua.html.en | 2 +- docs/manual/mod/mod_lua.html.fr.utf8 | 2 +- docs/manual/mod/mod_macro.html.en | 2 +- docs/manual/mod/mod_macro.html.fr.utf8 | 2 +- docs/manual/mod/mod_md.html.en | 86 ++-- docs/manual/mod/mod_md.html.fr.utf8 | 97 +++-- docs/manual/mod/mod_mime.html.en | 2 +- docs/manual/mod/mod_mime.html.fr.utf8 | 2 +- docs/manual/mod/mod_mime.html.ja.utf8 | 2 +- docs/manual/mod/mod_mime_magic.html.en | 2 +- docs/manual/mod/mod_mime_magic.html.fr.utf8 | 2 +- docs/manual/mod/mod_negotiation.html.en | 2 +- docs/manual/mod/mod_negotiation.html.fr.utf8 | 2 +- docs/manual/mod/mod_negotiation.html.ja.utf8 | 2 +- docs/manual/mod/mod_nw_ssl.html.en | 2 +- docs/manual/mod/mod_nw_ssl.html.fr.utf8 | 2 +- docs/manual/mod/mod_privileges.html.en | 2 +- docs/manual/mod/mod_privileges.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy.html.en | 2 +- docs/manual/mod/mod_proxy.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy.html.ja.utf8 | 2 +- docs/manual/mod/mod_proxy_ajp.html.en | 2 +- docs/manual/mod/mod_proxy_ajp.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_ajp.html.ja.utf8 | 2 +- docs/manual/mod/mod_proxy_balancer.html.en | 2 +- .../mod/mod_proxy_balancer.html.fr.utf8 | 2 +- .../mod/mod_proxy_balancer.html.ja.utf8 | 2 +- docs/manual/mod/mod_proxy_connect.html.en | 2 +- .../manual/mod/mod_proxy_connect.html.fr.utf8 | 2 +- .../manual/mod/mod_proxy_connect.html.ja.utf8 | 2 +- docs/manual/mod/mod_proxy_express.html.en | 2 +- .../manual/mod/mod_proxy_express.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_fcgi.html.en | 2 +- docs/manual/mod/mod_proxy_fcgi.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_fdpass.html.en | 2 +- docs/manual/mod/mod_proxy_fdpass.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_ftp.html.en | 2 +- docs/manual/mod/mod_proxy_ftp.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_hcheck.html.en | 2 +- docs/manual/mod/mod_proxy_hcheck.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_html.html.en | 2 +- docs/manual/mod/mod_proxy_html.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_http.html.en | 2 +- docs/manual/mod/mod_proxy_http.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_http2.html.en | 2 +- docs/manual/mod/mod_proxy_http2.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_scgi.html.en | 2 +- docs/manual/mod/mod_proxy_scgi.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_uwsgi.html.en | 2 +- docs/manual/mod/mod_proxy_uwsgi.html.fr.utf8 | 2 +- docs/manual/mod/mod_proxy_wstunnel.html.en | 2 +- .../mod/mod_proxy_wstunnel.html.fr.utf8 | 2 +- docs/manual/mod/mod_ratelimit.html.en | 2 +- docs/manual/mod/mod_ratelimit.html.fr.utf8 | 2 +- docs/manual/mod/mod_reflector.html.en | 2 +- docs/manual/mod/mod_reflector.html.fr.utf8 | 2 +- docs/manual/mod/mod_remoteip.html.en | 2 +- docs/manual/mod/mod_remoteip.html.fr.utf8 | 2 +- docs/manual/mod/mod_reqtimeout.html.en | 2 +- docs/manual/mod/mod_reqtimeout.html.fr.utf8 | 2 +- docs/manual/mod/mod_request.html.en | 2 +- docs/manual/mod/mod_request.html.fr.utf8 | 2 +- docs/manual/mod/mod_request.html.tr.utf8 | 2 +- docs/manual/mod/mod_rewrite.html.en | 2 +- docs/manual/mod/mod_rewrite.html.fr.utf8 | 2 +- docs/manual/mod/mod_sed.html.en | 2 +- docs/manual/mod/mod_sed.html.fr.utf8 | 2 +- docs/manual/mod/mod_session.html.en | 2 +- docs/manual/mod/mod_session.html.fr.utf8 | 2 +- docs/manual/mod/mod_session_cookie.html.en | 2 +- .../mod/mod_session_cookie.html.fr.utf8 | 2 +- docs/manual/mod/mod_session_crypto.html.en | 2 +- .../mod/mod_session_crypto.html.fr.utf8 | 2 +- docs/manual/mod/mod_session_dbd.html.en | 2 +- docs/manual/mod/mod_session_dbd.html.fr.utf8 | 2 +- docs/manual/mod/mod_setenvif.html.en | 2 +- docs/manual/mod/mod_setenvif.html.fr.utf8 | 2 +- docs/manual/mod/mod_setenvif.html.ja.utf8 | 2 +- docs/manual/mod/mod_setenvif.html.ko.euc-kr | 2 +- docs/manual/mod/mod_setenvif.html.tr.utf8 | 2 +- docs/manual/mod/mod_slotmem_plain.html.en | 2 +- .../manual/mod/mod_slotmem_plain.html.fr.utf8 | 2 +- docs/manual/mod/mod_slotmem_shm.html.en | 2 +- docs/manual/mod/mod_slotmem_shm.html.fr.utf8 | 2 +- docs/manual/mod/mod_so.html.en | 2 +- docs/manual/mod/mod_so.html.fr.utf8 | 2 +- docs/manual/mod/mod_so.html.ja.utf8 | 2 +- docs/manual/mod/mod_so.html.ko.euc-kr | 2 +- docs/manual/mod/mod_so.html.tr.utf8 | 2 +- docs/manual/mod/mod_socache_dbm.html.en | 2 +- docs/manual/mod/mod_socache_dbm.html.fr.utf8 | 2 +- docs/manual/mod/mod_socache_dc.html.en | 2 +- docs/manual/mod/mod_socache_dc.html.fr.utf8 | 2 +- docs/manual/mod/mod_socache_memcache.html.en | 2 +- .../mod/mod_socache_memcache.html.fr.utf8 | 2 +- docs/manual/mod/mod_socache_redis.html.en | 2 +- .../manual/mod/mod_socache_redis.html.fr.utf8 | 2 +- docs/manual/mod/mod_socache_shmcb.html.en | 2 +- .../manual/mod/mod_socache_shmcb.html.fr.utf8 | 2 +- docs/manual/mod/mod_speling.html.en | 2 +- docs/manual/mod/mod_speling.html.fr.utf8 | 2 +- docs/manual/mod/mod_speling.html.ja.utf8 | 2 +- docs/manual/mod/mod_speling.html.ko.euc-kr | 2 +- docs/manual/mod/mod_ssl.html.en | 78 +++- docs/manual/mod/mod_ssl.html.fr.utf8 | 80 +++- docs/manual/mod/mod_status.html.en | 2 +- docs/manual/mod/mod_status.html.fr.utf8 | 2 +- docs/manual/mod/mod_status.html.ja.utf8 | 2 +- docs/manual/mod/mod_status.html.ko.euc-kr | 2 +- docs/manual/mod/mod_status.html.tr.utf8 | 2 +- docs/manual/mod/mod_substitute.html.en | 2 +- docs/manual/mod/mod_substitute.html.fr.utf8 | 2 +- docs/manual/mod/mod_suexec.html.en | 2 +- docs/manual/mod/mod_suexec.html.fr.utf8 | 2 +- docs/manual/mod/mod_suexec.html.ja.utf8 | 2 +- docs/manual/mod/mod_suexec.html.ko.euc-kr | 2 +- docs/manual/mod/mod_suexec.html.tr.utf8 | 2 +- docs/manual/mod/mod_systemd.html.en | 2 +- docs/manual/mod/mod_systemd.html.fr.utf8 | 2 +- docs/manual/mod/mod_unique_id.html.en | 2 +- docs/manual/mod/mod_unique_id.html.fr.utf8 | 2 +- docs/manual/mod/mod_unique_id.html.ja.utf8 | 2 +- docs/manual/mod/mod_unique_id.html.ko.euc-kr | 2 +- docs/manual/mod/mod_unixd.html.en | 2 +- docs/manual/mod/mod_unixd.html.fr.utf8 | 2 +- docs/manual/mod/mod_unixd.html.tr.utf8 | 2 +- docs/manual/mod/mod_userdir.html.en | 2 +- docs/manual/mod/mod_userdir.html.fr.utf8 | 2 +- docs/manual/mod/mod_userdir.html.ja.utf8 | 2 +- docs/manual/mod/mod_userdir.html.ko.euc-kr | 2 +- docs/manual/mod/mod_userdir.html.tr.utf8 | 2 +- docs/manual/mod/mod_usertrack.html.en | 2 +- docs/manual/mod/mod_usertrack.html.fr.utf8 | 2 +- docs/manual/mod/mod_version.html.en | 2 +- docs/manual/mod/mod_version.html.fr.utf8 | 2 +- docs/manual/mod/mod_version.html.ja.utf8 | 2 +- docs/manual/mod/mod_version.html.ko.euc-kr | 2 +- docs/manual/mod/mod_vhost_alias.html.en | 2 +- docs/manual/mod/mod_vhost_alias.html.fr.utf8 | 2 +- docs/manual/mod/mod_vhost_alias.html.tr.utf8 | 2 +- docs/manual/mod/mod_watchdog.html.en | 2 +- docs/manual/mod/mod_watchdog.html.fr.utf8 | 2 +- docs/manual/mod/mod_xml2enc.html.en | 2 +- docs/manual/mod/mod_xml2enc.html.fr.utf8 | 2 +- docs/manual/mod/module-dict.html.en | 2 +- docs/manual/mod/module-dict.html.fr.utf8 | 2 +- docs/manual/mod/module-dict.html.ja.utf8 | 2 +- docs/manual/mod/module-dict.html.ko.euc-kr | 2 +- docs/manual/mod/module-dict.html.tr.utf8 | 2 +- docs/manual/mod/mpm_common.html.de | 16 +- docs/manual/mod/mpm_common.html.en | 23 +- docs/manual/mod/mpm_common.html.fr.utf8 | 23 +- docs/manual/mod/mpm_common.html.ja.utf8 | 16 +- docs/manual/mod/mpm_common.html.tr.utf8 | 16 +- docs/manual/mod/mpm_netware.html.en | 2 +- docs/manual/mod/mpm_netware.html.fr.utf8 | 2 +- docs/manual/mod/mpm_winnt.html.de | 2 +- docs/manual/mod/mpm_winnt.html.en | 2 +- docs/manual/mod/mpm_winnt.html.fr.utf8 | 2 +- docs/manual/mod/mpm_winnt.html.ja.utf8 | 2 +- docs/manual/mod/mpmt_os2.html.en | 2 +- docs/manual/mod/mpmt_os2.html.fr.utf8 | 2 +- docs/manual/mod/overrides.html.en | 2 +- docs/manual/mod/overrides.html.fr.utf8 | 2 +- docs/manual/mod/prefork.html.de | 2 +- docs/manual/mod/prefork.html.en | 2 +- docs/manual/mod/prefork.html.fr.utf8 | 2 +- docs/manual/mod/prefork.html.ja.utf8 | 2 +- docs/manual/mod/prefork.html.tr.utf8 | 2 +- docs/manual/mod/quickreference.html.de | 327 +++++++-------- docs/manual/mod/quickreference.html.en | 327 +++++++-------- docs/manual/mod/quickreference.html.es | 327 +++++++-------- docs/manual/mod/quickreference.html.fr.utf8 | 337 +++++++-------- docs/manual/mod/quickreference.html.ja.utf8 | 323 +++++++-------- docs/manual/mod/quickreference.html.ko.euc-kr | 325 +++++++-------- docs/manual/mod/quickreference.html.tr.utf8 | 329 +++++++-------- .../manual/mod/quickreference.html.zh-cn.utf8 | 327 +++++++-------- docs/manual/mod/worker.html.de | 2 +- docs/manual/mod/worker.html.en | 2 +- docs/manual/mod/worker.html.fr.utf8 | 2 +- docs/manual/mod/worker.html.ja.utf8 | 2 +- docs/manual/mod/worker.html.tr.utf8 | 2 +- docs/manual/mpm.html.de | 2 +- docs/manual/mpm.html.en | 2 +- docs/manual/mpm.html.es | 2 +- docs/manual/mpm.html.fr.utf8 | 2 +- docs/manual/mpm.html.ja.utf8 | 2 +- docs/manual/mpm.html.ko.euc-kr | 2 +- docs/manual/mpm.html.tr.utf8 | 2 +- docs/manual/mpm.html.zh-cn.utf8 | 2 +- docs/manual/new_features_2_0.html.de | 2 +- docs/manual/new_features_2_0.html.en | 2 +- docs/manual/new_features_2_0.html.fr.utf8 | 2 +- docs/manual/new_features_2_0.html.ja.utf8 | 2 +- docs/manual/new_features_2_0.html.ko.euc-kr | 2 +- docs/manual/new_features_2_0.html.pt-br | 2 +- docs/manual/new_features_2_0.html.tr.utf8 | 2 +- docs/manual/new_features_2_2.html.en | 2 +- docs/manual/new_features_2_2.html.fr.utf8 | 2 +- docs/manual/new_features_2_2.html.ko.euc-kr | 2 +- docs/manual/new_features_2_2.html.pt-br | 2 +- docs/manual/new_features_2_2.html.tr.utf8 | 2 +- docs/manual/new_features_2_4.html.en | 2 +- docs/manual/new_features_2_4.html.fr.utf8 | 2 +- docs/manual/new_features_2_4.html.tr.utf8 | 2 +- docs/manual/platform/ebcdic.html.en | 2 +- docs/manual/platform/ebcdic.html.ko.euc-kr | 2 +- docs/manual/platform/index.html.en | 2 +- docs/manual/platform/index.html.fr.utf8 | 2 +- docs/manual/platform/index.html.ko.euc-kr | 2 +- docs/manual/platform/index.html.zh-cn.utf8 | 2 +- docs/manual/platform/netware.html.en | 2 +- docs/manual/platform/netware.html.fr.utf8 | 2 +- docs/manual/platform/netware.html.ko.euc-kr | 2 +- docs/manual/platform/perf-hp.html.en | 2 +- docs/manual/platform/perf-hp.html.fr.utf8 | 2 +- docs/manual/platform/perf-hp.html.ko.euc-kr | 2 +- docs/manual/platform/rpm.html.en | 2 +- docs/manual/platform/rpm.html.fr.utf8 | 2 +- docs/manual/platform/win_compiling.html.en | 2 +- .../platform/win_compiling.html.fr.utf8 | 2 +- .../platform/win_compiling.html.ko.euc-kr | 2 +- docs/manual/platform/windows.html.en | 2 +- docs/manual/platform/windows.html.fr.utf8 | 2 +- docs/manual/platform/windows.html.ko.euc-kr | 2 +- docs/manual/programs/ab.html.en | 2 +- docs/manual/programs/ab.html.fr.utf8 | 2 +- docs/manual/programs/ab.html.ko.euc-kr | 2 +- docs/manual/programs/ab.html.tr.utf8 | 2 +- docs/manual/programs/apachectl.html.en | 2 +- docs/manual/programs/apachectl.html.fr.utf8 | 2 +- docs/manual/programs/apachectl.html.ko.euc-kr | 2 +- docs/manual/programs/apachectl.html.tr.utf8 | 2 +- docs/manual/programs/apxs.html.en | 2 +- docs/manual/programs/apxs.html.fr.utf8 | 2 +- docs/manual/programs/apxs.html.ko.euc-kr | 2 +- docs/manual/programs/apxs.html.tr.utf8 | 2 +- docs/manual/programs/configure.html.en | 2 +- docs/manual/programs/configure.html.fr.utf8 | 2 +- docs/manual/programs/configure.html.ko.euc-kr | 2 +- docs/manual/programs/configure.html.tr.utf8 | 2 +- docs/manual/programs/dbmmanage.html.en | 2 +- docs/manual/programs/dbmmanage.html.fr.utf8 | 2 +- docs/manual/programs/dbmmanage.html.ko.euc-kr | 2 +- docs/manual/programs/dbmmanage.html.tr.utf8 | 2 +- docs/manual/programs/fcgistarter.html.en | 2 +- docs/manual/programs/fcgistarter.html.fr.utf8 | 2 +- docs/manual/programs/fcgistarter.html.tr.utf8 | 2 +- docs/manual/programs/htcacheclean.html.en | 2 +- .../manual/programs/htcacheclean.html.fr.utf8 | 2 +- .../programs/htcacheclean.html.ko.euc-kr | 2 +- .../manual/programs/htcacheclean.html.tr.utf8 | 2 +- docs/manual/programs/htdbm.html.en | 2 +- docs/manual/programs/htdbm.html.fr.utf8 | 2 +- docs/manual/programs/htdbm.html.tr.utf8 | 2 +- docs/manual/programs/htdigest.html.en | 2 +- docs/manual/programs/htdigest.html.fr.utf8 | 2 +- docs/manual/programs/htdigest.html.ko.euc-kr | 2 +- docs/manual/programs/htdigest.html.tr.utf8 | 2 +- docs/manual/programs/htpasswd.html.en | 2 +- docs/manual/programs/htpasswd.html.fr.utf8 | 2 +- docs/manual/programs/htpasswd.html.ko.euc-kr | 2 +- docs/manual/programs/htpasswd.html.tr.utf8 | 2 +- docs/manual/programs/httpd.html.en | 2 +- docs/manual/programs/httpd.html.fr.utf8 | 2 +- docs/manual/programs/httpd.html.ko.euc-kr | 2 +- docs/manual/programs/httpd.html.tr.utf8 | 2 +- docs/manual/programs/httxt2dbm.html.en | 2 +- docs/manual/programs/httxt2dbm.html.fr.utf8 | 2 +- docs/manual/programs/httxt2dbm.html.tr.utf8 | 2 +- docs/manual/programs/index.html.en | 2 +- docs/manual/programs/index.html.es | 2 +- docs/manual/programs/index.html.fr.utf8 | 2 +- docs/manual/programs/index.html.ko.euc-kr | 2 +- docs/manual/programs/index.html.tr.utf8 | 2 +- docs/manual/programs/index.html.zh-cn.utf8 | 2 +- .../manual/programs/log_server_status.html.en | 2 +- .../programs/log_server_status.html.fr.utf8 | 2 +- docs/manual/programs/logresolve.html.en | 2 +- docs/manual/programs/logresolve.html.fr.utf8 | 2 +- .../manual/programs/logresolve.html.ko.euc-kr | 2 +- docs/manual/programs/logresolve.html.tr.utf8 | 2 +- docs/manual/programs/other.html.en | 2 +- docs/manual/programs/other.html.fr.utf8 | 2 +- docs/manual/programs/other.html.ko.euc-kr | 2 +- docs/manual/programs/other.html.tr.utf8 | 2 +- docs/manual/programs/rotatelogs.html.en | 2 +- docs/manual/programs/rotatelogs.html.fr.utf8 | 2 +- .../manual/programs/rotatelogs.html.ko.euc-kr | 2 +- docs/manual/programs/rotatelogs.html.tr.utf8 | 2 +- docs/manual/programs/split-logfile.html.en | 2 +- .../programs/split-logfile.html.fr.utf8 | 2 +- docs/manual/programs/suexec.html.en | 2 +- docs/manual/programs/suexec.html.fr.utf8 | 2 +- docs/manual/programs/suexec.html.ko.euc-kr | 2 +- docs/manual/programs/suexec.html.tr.utf8 | 2 +- docs/manual/rewrite/access.html.en | 2 +- docs/manual/rewrite/access.html.fr.utf8 | 2 +- docs/manual/rewrite/advanced.html.en | 2 +- docs/manual/rewrite/advanced.html.fr.utf8 | 2 +- docs/manual/rewrite/avoid.html.en | 2 +- docs/manual/rewrite/avoid.html.fr.utf8 | 2 +- docs/manual/rewrite/flags.html.en | 2 +- docs/manual/rewrite/flags.html.fr.utf8 | 2 +- docs/manual/rewrite/htaccess.html.en | 2 +- docs/manual/rewrite/htaccess.html.fr.utf8 | 2 +- docs/manual/rewrite/index.html.en | 2 +- docs/manual/rewrite/index.html.fr.utf8 | 2 +- docs/manual/rewrite/index.html.tr.utf8 | 2 +- docs/manual/rewrite/index.html.zh-cn.utf8 | 2 +- docs/manual/rewrite/intro.html.en | 2 +- docs/manual/rewrite/intro.html.fr.utf8 | 2 +- docs/manual/rewrite/proxy.html.en | 2 +- docs/manual/rewrite/proxy.html.fr.utf8 | 2 +- docs/manual/rewrite/remapping.html.en | 2 +- docs/manual/rewrite/remapping.html.fr.utf8 | 2 +- docs/manual/rewrite/rewritemap.html.en | 2 +- docs/manual/rewrite/rewritemap.html.fr.utf8 | 2 +- docs/manual/rewrite/tech.html.en | 2 +- docs/manual/rewrite/tech.html.fr.utf8 | 2 +- docs/manual/rewrite/vhosts.html.en | 2 +- docs/manual/rewrite/vhosts.html.fr.utf8 | 2 +- docs/manual/sections.html.en | 2 +- docs/manual/sections.html.fr.utf8 | 2 +- docs/manual/sections.html.ja.utf8 | 2 +- docs/manual/sections.html.ko.euc-kr | 2 +- docs/manual/sections.html.tr.utf8 | 2 +- docs/manual/server-wide.html.en | 2 +- docs/manual/server-wide.html.fr.utf8 | 2 +- docs/manual/server-wide.html.ja.utf8 | 2 +- docs/manual/server-wide.html.ko.euc-kr | 2 +- docs/manual/server-wide.html.tr.utf8 | 2 +- docs/manual/sitemap.html.de | 2 +- docs/manual/sitemap.html.en | 2 +- docs/manual/sitemap.html.es | 2 +- docs/manual/sitemap.html.fr.utf8 | 2 +- docs/manual/sitemap.html.ja.utf8 | 2 +- docs/manual/sitemap.html.ko.euc-kr | 2 +- docs/manual/sitemap.html.tr.utf8 | 2 +- docs/manual/sitemap.html.zh-cn.utf8 | 2 +- docs/manual/socache.html.en | 2 +- docs/manual/socache.html.fr.utf8 | 2 +- docs/manual/ssl/index.html.en | 2 +- docs/manual/ssl/index.html.fr.utf8 | 2 +- docs/manual/ssl/index.html.ja.utf8 | 2 +- docs/manual/ssl/index.html.tr.utf8 | 2 +- docs/manual/ssl/index.html.zh-cn.utf8 | 2 +- docs/manual/ssl/ssl_compat.html.en | 2 +- docs/manual/ssl/ssl_compat.html.fr.utf8 | 2 +- docs/manual/ssl/ssl_faq.html.en | 2 +- docs/manual/ssl/ssl_faq.html.fr.utf8 | 2 +- docs/manual/ssl/ssl_howto.html.en | 2 +- docs/manual/ssl/ssl_howto.html.fr.utf8 | 2 +- docs/manual/ssl/ssl_intro.html.en | 2 +- docs/manual/ssl/ssl_intro.html.fr.utf8 | 2 +- docs/manual/ssl/ssl_intro.html.ja.utf8 | 2 +- docs/manual/stopping.html.de | 2 +- docs/manual/stopping.html.en | 2 +- docs/manual/stopping.html.es | 2 +- docs/manual/stopping.html.fr.utf8 | 2 +- docs/manual/stopping.html.ja.utf8 | 2 +- docs/manual/stopping.html.ko.euc-kr | 2 +- docs/manual/stopping.html.tr.utf8 | 2 +- docs/manual/style/version.ent | 2 +- docs/manual/suexec.html.en | 2 +- docs/manual/suexec.html.fr.utf8 | 2 +- docs/manual/suexec.html.ja.utf8 | 2 +- docs/manual/suexec.html.ko.euc-kr | 2 +- docs/manual/suexec.html.tr.utf8 | 2 +- docs/manual/upgrading.html.en | 2 +- docs/manual/upgrading.html.fr.utf8 | 2 +- docs/manual/urlmapping.html.en | 2 +- docs/manual/urlmapping.html.fr.utf8 | 2 +- docs/manual/urlmapping.html.ja.utf8 | 2 +- docs/manual/urlmapping.html.ko.euc-kr | 2 +- docs/manual/urlmapping.html.tr.utf8 | 2 +- docs/manual/vhosts/details.html.en | 2 +- docs/manual/vhosts/details.html.fr.utf8 | 2 +- docs/manual/vhosts/details.html.ko.euc-kr | 2 +- docs/manual/vhosts/details.html.tr.utf8 | 2 +- docs/manual/vhosts/examples.html.en | 2 +- docs/manual/vhosts/examples.html.fr.utf8 | 2 +- docs/manual/vhosts/examples.html.ja.utf8 | 2 +- docs/manual/vhosts/examples.html.ko.euc-kr | 2 +- docs/manual/vhosts/examples.html.tr.utf8 | 2 +- docs/manual/vhosts/fd-limits.html.en | 2 +- docs/manual/vhosts/fd-limits.html.fr.utf8 | 2 +- docs/manual/vhosts/fd-limits.html.ja.utf8 | 2 +- docs/manual/vhosts/fd-limits.html.ko.euc-kr | 2 +- docs/manual/vhosts/fd-limits.html.tr.utf8 | 2 +- docs/manual/vhosts/index.html.de | 2 +- docs/manual/vhosts/index.html.en | 2 +- docs/manual/vhosts/index.html.fr.utf8 | 2 +- docs/manual/vhosts/index.html.ja.utf8 | 2 +- docs/manual/vhosts/index.html.ko.euc-kr | 2 +- docs/manual/vhosts/index.html.tr.utf8 | 2 +- docs/manual/vhosts/index.html.zh-cn.utf8 | 2 +- docs/manual/vhosts/ip-based.html.en | 2 +- docs/manual/vhosts/ip-based.html.fr.utf8 | 2 +- docs/manual/vhosts/ip-based.html.ja.utf8 | 2 +- docs/manual/vhosts/ip-based.html.ko.euc-kr | 2 +- docs/manual/vhosts/ip-based.html.tr.utf8 | 2 +- docs/manual/vhosts/mass.html.en | 2 +- docs/manual/vhosts/mass.html.fr.utf8 | 2 +- docs/manual/vhosts/mass.html.ko.euc-kr | 2 +- docs/manual/vhosts/mass.html.tr.utf8 | 2 +- docs/manual/vhosts/name-based.html.de | 2 +- docs/manual/vhosts/name-based.html.en | 2 +- docs/manual/vhosts/name-based.html.fr.utf8 | 2 +- docs/manual/vhosts/name-based.html.ja.utf8 | 2 +- docs/manual/vhosts/name-based.html.ko.euc-kr | 2 +- docs/manual/vhosts/name-based.html.tr.utf8 | 2 +- httpd.spec | 2 +- include/ap_listen.h | 5 +- include/ap_release.h | 2 +- include/httpd.h | 4 + include/mpm_common.h | 8 + modules/examples/mod_example_hooks.c | 2 +- modules/generators/mod_autoindex.c | 2 +- modules/generators/mod_cgid.c | 7 +- modules/generators/mod_status.c | 2 +- modules/http/http_protocol.c | 2 +- modules/http2/h2_config.c | 23 ++ modules/http2/h2_config.h | 1 + modules/http2/h2_mplx.c | 11 +- modules/http2/h2_proxy_session.c | 10 + modules/http2/h2_proxy_util.c | 2 +- modules/http2/h2_proxy_util.h | 2 +- modules/http2/h2_session.c | 42 +- modules/http2/h2_session.h | 5 +- modules/http2/h2_stream.c | 8 +- modules/http2/h2_util.c | 18 +- modules/http2/h2_util.h | 2 +- modules/http2/h2_version.h | 4 +- modules/http2/mod_proxy_http2.c | 21 +- modules/ldap/util_ldap.c | 2 +- modules/mappers/mod_imagemap.c | 2 +- modules/mappers/mod_userdir.c | 4 +- modules/md/config2.m4 | 1 - modules/md/md.h | 3 + modules/md/md_acme.c | 22 +- modules/md/md_acme.h | 4 +- modules/md/md_acme_authz.c | 8 +- modules/md/md_acme_drive.c | 153 ++++++- modules/md/md_acme_order.c | 24 +- modules/md/md_acme_order.h | 2 +- modules/md/md_acmev2_drive.c | 37 +- modules/md/md_core.c | 8 +- modules/md/md_crypt.c | 108 ++++- modules/md/md_crypt.h | 7 + modules/md/md_curl.c | 21 +- modules/md/md_http.c | 12 +- modules/md/md_json.c | 10 +- modules/md/md_ocsp.c | 3 +- modules/md/md_reg.c | 78 +++- modules/md/md_reg.h | 11 + modules/md/md_status.c | 46 ++- modules/md/md_store.c | 2 +- modules/md/md_tailscale.c | 383 ------------------ modules/md/md_tailscale.h | 25 -- modules/md/md_time.c | 67 +++ modules/md/md_time.h | 3 + modules/md/md_util.c | 16 +- modules/md/md_util.h | 10 + modules/md/md_version.h | 5 +- modules/md/mod_md.c | 6 +- modules/md/mod_md.dsp | 4 - modules/md/mod_md_config.c | 84 +++- modules/md/mod_md_config.h | 3 + modules/md/mod_md_drive.c | 79 +++- modules/md/mod_md_status.c | 6 +- modules/metadata/mod_headers.c | 6 +- modules/proxy/mod_proxy_balancer.c | 2 +- modules/proxy/mod_proxy_ftp.c | 2 +- modules/ssl/mod_ssl.c | 2 + modules/ssl/ssl_engine_config.c | 38 ++ modules/ssl/ssl_engine_init.c | 108 +++++ modules/ssl/ssl_engine_kernel.c | 133 ++---- modules/ssl/ssl_private.h | 17 + server/core.c | 4 +- server/listen.c | 24 +- server/util_script.c | 26 +- test/modules/md/md_conf.py | 2 + test/modules/md/test_702_auto.py | 3 +- test/modules/md/test_710_profiles.py | 2 +- test/modules/md/test_730_static.py | 10 + test/modules/md/test_780_tailscale.py | 198 --------- test/modules/md/test_920_status.py | 5 + 960 files changed, 4929 insertions(+), 3252 deletions(-) create mode 100644 debian/patches/0009-From-upstream-module.patch create mode 100644 debian/patches/bug1125368.patch create mode 100644 debian/patches/old-memory-handling-http2.patch create mode 100644 debian/perl-framework/scripts/slapd-config-mdb.ldif create mode 100644 debian/perl-framework/t/apache/byterange8.t create mode 100644 debian/perl-framework/t/apache/snihostcheck.t create mode 100755 debian/perl-framework/t/htdocs/modules/cgi/action.sh create mode 100755 debian/perl-framework/t/htdocs/modules/cgi/bogus-te.sh create mode 100644 debian/perl-framework/t/htdocs/modules/dir/fallback/fallback.magictype create mode 100644 debian/perl-framework/t/htdocs/modules/dir/fallback/index.html rename debian/tests/{run-test-suite => run-test-suite.sh} (70%) create mode 100755 debian/tests/run-test-suite_event create mode 100755 debian/tests/run-test-suite_prefork create mode 100755 debian/tests/run-test-suite_worker create mode 100644 docs/manual/images/favicon.png delete mode 100644 modules/md/md_tailscale.c delete mode 100644 modules/md/md_tailscale.h delete mode 100644 test/modules/md/test_780_tailscale.py diff --git a/CHANGES b/CHANGES index 506de40f..37f337e6 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,68 @@ -*- coding: utf-8 -*- +Changes with Apache 2.4.66 + + *) mod_http2: Fix handling of 304 responses from mod_cache. PR 69580. + [Stefan Eissing] + + *) mod_http2/mod_proxy_http2: fix a bug in calculating the log2 value of + integers, used in push diaries and proxy window size calculations. + PR69741 [Benjamin P. Kallus] + + *) mod_md: update to version 2.6.5 + - New directive `MDInitialDelay`, controlling how longer to wait after + a server restart before checking certificates for renewal. + [Michael Kaufmann] + - Hardening: when build with OpenSSL older than 1.0.2 or old libressl + versions, the parsing of ASN.1 time strings did not do a length check. + - Hardening: when reading back OCSP responses stored in the local JSON + store, missing 'valid' key led to uninitialized values, resulting in + wrong refresh behaviour. + + *) mod_md: update to version 2.6.6 + - Fix a small memory leak when using OpenSSL's BIGNUMs. [Theo Buehler] + - Fix reuse of curl easy handles by resetting them. [Michael Kaufmann] + + *) mod_http2: update to version 2.0.35 + New directive `H2MaxStreamErrors` to control how much bad behaviour + by clients is tolerated before the connection is closed. + [Stefan Eissing] + + * mod_proxy_http2: add support for ProxyErrorOverride directive. PR69771 + + *) mpm_common: Add new ListenTCPDeferAccept directive that allows to specify + the value set for the TCP_DEFER_ACCEPT socket option on listen sockets. + [Ruediger Pluem] + + *) mod_ssl: Add SSLVHostSNIPolicy directive to control the virtual + host compatibility policy. PR 69743. [Joe Orton] + + *) mod_md: update to version 2.6.2 + - Fix error retry delay calculation to not already doubling the wait + on the first error. + + *) mod_md: update to version 2.6.1 + - Increasing default `MDRetryDelay` to 30 seconds to generate less bursty + traffic on errored renewals for the ACME CA. This leads to error retries + of 30s, 1 minute, 2, 4, etc. up to daily attempts. + - Checking that configuring `MDRetryDelay` will result in a positive + duration. A delay of 0 is not accepted. + - Fix a bug in checking Content-Type of responses from the ACME server. + - Added ACME ARI support (rfc9773) to the module. Enabled by default. New + directive "MDRenewViaARI on|off" for controlling this. + - Removing tailscale support. It has not been working for a long time + as the company decided to change their APIs. Away with the dead code, + documentation and tests. + - Fixed a compilation issue with pre-industrial versions of libcurl. + Changes with Apache 2.4.65 + *) SECURITY: CVE-2025-54090: Apache HTTP Server: 'RewriteCond expr' + always evaluates to true in 2.4.64 (cve.mitre.org) + A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond + expr ..." tests evaluating as "true". + Users are recommended to upgrade to version 2.4.65, which fixes + the issue. + Changes with Apache 2.4.64 *) SECURITY: CVE-2025-53020: Apache HTTP Server: HTTP/2 DoS by @@ -541,7 +603,8 @@ Changes with Apache 2.4.59 *) htpasswd: Add support for passwords using SHA-2. [Joe Orton, Yann Ylavic] - *) core: Allow mod_env to override system environment vars. [Joe Orton] + *) core: Allow mod_env to override system environment vars. PR 63117. + [Joe Orton] *) Allow mod_dav_fs to tolerate race conditions between PROPFIND and an operation which removes a directory/file between apr_dir_read() and diff --git a/CMakeLists.txt b/CMakeLists.txt index 170076bd..8e6c13f2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -502,7 +502,7 @@ SET(mod_md_extra_sources modules/md/md_ocsp.c modules/md/md_util.c modules/md/mod_md_config.c modules/md/mod_md_drive.c modules/md/mod_md_os.c modules/md/mod_md_status.c - modules/md/mod_md_ocsp.c modules/md/md_tailscale.c + modules/md/mod_md_ocsp.c ) SET(mod_optional_hook_export_extra_defines AP_DECLARE_EXPORT) # bogus reuse of core API prefix SET(mod_proxy_extra_defines PROXY_DECLARE_EXPORT) diff --git a/configure b/configure index bb082db5..380bf29e 100755 --- a/configure +++ b/configure @@ -33942,7 +33942,7 @@ EOF > $modpath_current/modules.mk -md_objs="md_acme.lo md_acme_acct.lo md_acme_authz.lo md_acme_drive.lo md_acmev2_drive.lo md_acme_order.lo md_core.lo md_curl.lo md_crypt.lo md_event.lo md_http.lo md_json.lo md_jws.lo md_log.lo md_ocsp.lo md_result.lo md_reg.lo md_status.lo md_store.lo md_store_fs.lo md_tailscale.lo md_time.lo md_util.lo mod_md.lo mod_md_config.lo mod_md_drive.lo mod_md_ocsp.lo mod_md_os.lo mod_md_status.lo " +md_objs="md_acme.lo md_acme_acct.lo md_acme_authz.lo md_acme_drive.lo md_acmev2_drive.lo md_acme_order.lo md_core.lo md_curl.lo md_crypt.lo md_event.lo md_http.lo md_json.lo md_jws.lo md_log.lo md_ocsp.lo md_result.lo md_reg.lo md_status.lo md_store.lo md_store_fs.lo md_time.lo md_util.lo mod_md.lo mod_md_config.lo mod_md_drive.lo mod_md_ocsp.lo mod_md_os.lo mod_md_status.lo " # Ensure that other modules can pick up mod_md.h diff --git a/debian/apache2.NEWS b/debian/apache2.NEWS index 00fe1bc7..ad51a83f 100644 --- a/debian/apache2.NEWS +++ b/debian/apache2.NEWS @@ -1,3 +1,56 @@ +apache2 (2.4.65-2) unstable; urgency=medium + + Following the resolution of CVE-2025-23048, + some SSL-enabled websites may begin encountering + the error (AH02032): + . + Misdirected Request: + The client needs a new connection for this request as the + requested host name does not match the Server Name Indication + (SNI) in use for this connection. + . + This behavior is particularly noticeable with AWS Application + Load Balancers. Although they support intelligent SNI handling, + they do not (as of this writing) relay SNI data to the target + server, resulting in failed connections when hostnames don’t align. + . + Without an SNI provided by the client, there is nothing httpd + can do to determine which vhost/configuration should be + used to provide the correct certificate (and TLS authentication + eventually) whenever multiple vhosts listen on the same IP:port. + . + That's because reading the HTTP Host header necessarily has to + happen after the TLS handshake/auth/decryption (and later + renegotiation is not an option with TLSv1.3). + . + So those connections fall back to the first vhost declared on + the IP:port for the TLS handshake part, and if the request + Host header finally matches a different vhost with a different + TLS configuration it's rejected with AH02032. + . + Before 2.4.64 the check was not accurate and would allow that, + with security implications. + . + As a workaround, you may (after a risk analysis) generate a + wildcard certificate. If you’re managing multiple domains, + consolidate them into a single certificate by including each + wildcard domain as an alias. Then, update the Apache configuration + to reference this unified certificate. + . + Another possible workaround is to configure each virtual host to + listen on a separate port. This approach avoids SNI-related issues + by ensuring that each vhost is uniquely addressed through its own + connection endpoint, thereby allowing distinct TLS configurations + without ambiguity. + . + This error may also stem from a misconfigured HAProxy setup. + In such cases, enabling dynamic SNI handling on HAProxy might be + necessary to ensure that the correct hostname is passed through + during the TLS handshake. After risk analysis, it could be done + by using "sni req.hdr(Host)" directive. + + -- Bastien Roucariès Fri, 25 Jul 2025 20:33:38 +0200 + apache2 (2.4.64-2) unstable; urgency=medium RFC 8996 published by the IETF in March 2021, @@ -7,7 +60,7 @@ apache2 (2.4.64-2) unstable; urgency=medium These older protocols lack support for modern cryptographic algorithms and are prone to exploits that threaten data confidentiality and integrity. In alignment with RFC 8996, - we disable by default this protocols. + we disable by default these protocols. . This change can cause older applications or systems to break if they haven't been updated to support diff --git a/debian/changelog b/debian/changelog index 131e7984..b7c3b60e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,30 @@ +apache2 (2.4.66-1~deb13u2) trixie; urgency=medium + + * Team upload + * Fix a regression on http2 + (Closes: #1125713, #1125368, #1126177, #1128831) + * Split testsuite avoiding timeout (Closes: #1126571) + + -- Bastien Roucariès Sun, 01 Mar 2026 14:26:45 +0100 + +apache2 (2.4.66-1~deb13u1) trixie; urgency=medium + + * Team upload + * New upstream version (Closes: #1121926, CVE-2025-55753, CVE-2025-58098, + CVE-2025-59775, CVE-2025-65082, CVE-2025-66200) + * Update test framework + + -- Yadd Fri, 05 Dec 2025 19:52:34 +0100 + +apache2 (2.4.65-2) unstable; urgency=high + + * Fix SSLProtocol has a duplicate "all" + (Closes: #1109839) + * Warn about misconfigured load balancer following fix of + CVE-2025-23048. + + -- Bastien Roucariès Tue, 29 Jul 2025 19:52:31 +0200 + apache2 (2.4.65-1) unstable; urgency=medium * New upstream version 2.4.65 (Closes: CVE-2025-54090) @@ -5,7 +32,7 @@ apache2 (2.4.65-1) unstable; urgency=medium -- Yadd Wed, 23 Jul 2025 16:05:45 +0200 -apache2 (2.4.64-2) unstable; urgency=medium +apache2 (2.4.64-2) UNRELEASED; urgency=medium * Per RFC 8996 disable by default TLS 1.0 and TLS 1.1 (Closes: #943415) diff --git a/debian/config-dir/mods-available/ssl.conf b/debian/config-dir/mods-available/ssl.conf index aa9e5e1e..58241d55 100644 --- a/debian/config-dir/mods-available/ssl.conf +++ b/debian/config-dir/mods-available/ssl.conf @@ -68,7 +68,7 @@ SSLCipherSuite HIGH:!aNULL # The protocols to enable. # Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 # SSL v2 is no longer supported -SSLProtocol all all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 # Allow insecure renegotiation with clients which do not yet support the # secure renegotiation protocol. Default: Off diff --git a/debian/patches/0009-From-upstream-module.patch b/debian/patches/0009-From-upstream-module.patch new file mode 100644 index 00000000..587dffc8 --- /dev/null +++ b/debian/patches/0009-From-upstream-module.patch @@ -0,0 +1,229 @@ +From: =?utf-8?q?Bastien_Roucari=C3=A8s?= +Date: Tue, 27 Jan 2026 23:54:33 +0100 +Subject: From upstream module + +http2 module was mismerged and some segfault still occurs. Fix mismerge by importing current +HEAD + +origin: backport, https://github.com/icing/mod_h2/commit/b282ffb05cfdfb53c3fdcfb4a66cb79608a46c85 +forwarded: not-needed +bug: https://github.com/icing/mod_h2/issues/313 +debian-bug: http://bugs.debian.org/1126177 +--- + modules/http2/h2_c1.c | 5 ++++- + modules/http2/h2_c2_filter.c | 4 ++-- + modules/http2/h2_mplx.c | 8 +++++--- + modules/http2/h2_proxy_session.c | 4 ++-- + modules/http2/h2_proxy_util.c | 6 +++--- + modules/http2/h2_session.c | 4 ++-- + modules/http2/h2_util.h | 2 +- + modules/http2/h2_version.h | 2 +- + modules/http2/h2_workers.c | 5 +++++ + modules/http2/h2_ws.c | 2 +- + modules/http2/h2_ws.h | 2 +- + 11 files changed, 27 insertions(+), 17 deletions(-) + +diff --git a/modules/http2/h2_c1.c b/modules/http2/h2_c1.c +index 626e665..f4604a4 100644 +--- a/modules/http2/h2_c1.c ++++ b/modules/http2/h2_c1.c +@@ -47,7 +47,10 @@ + + static struct h2_workers *workers; + +-static int async_mpm, mpm_can_waitio; ++static int async_mpm; ++#ifdef AP_MPMQ_CAN_WAITIO ++static int mpm_can_waitio; ++#endif + + APR_OPTIONAL_FN_TYPE(ap_logio_add_bytes_in) *h2_c_logio_add_bytes_in; + APR_OPTIONAL_FN_TYPE(ap_logio_add_bytes_out) *h2_c_logio_add_bytes_out; +diff --git a/modules/http2/h2_c2_filter.c b/modules/http2/h2_c2_filter.c +index 554f88b..523a941 100644 +--- a/modules/http2/h2_c2_filter.c ++++ b/modules/http2/h2_c2_filter.c +@@ -204,7 +204,7 @@ static int uniq_field_values(void *d, const char *key, const char *val) + */ + for (i = 0, strpp = (char **) values->elts; i < values->nelts; + ++i, ++strpp) { +- if (*strpp && apr_strnatcasecmp(*strpp, start) == 0) { ++ if (*strpp && ap_cstr_casecmp(*strpp, start) == 0) { + break; + } + } +@@ -312,7 +312,7 @@ static h2_headers *create_response(request_rec *r) + + while (field && (token = ap_get_list_item(r->pool, &field)) != NULL) { + for (i = 0; i < r->content_languages->nelts; ++i) { +- if (!apr_strnatcasecmp(token, languages[i])) ++ if (!ap_cstr_casecmp(token, languages[i])) + break; + } + if (i == r->content_languages->nelts) { +diff --git a/modules/http2/h2_mplx.c b/modules/http2/h2_mplx.c +index 75518f4..8053f60 100644 +--- a/modules/http2/h2_mplx.c ++++ b/modules/http2/h2_mplx.c +@@ -398,10 +398,11 @@ apr_status_t h2_mplx_c1_streams_do(h2_mplx *m, h2_mplx_stream_cb *cb, void *ctx) + { + stream_iter_ctx_t x; + +- H2_MPLX_ENTER(m); +- + x.cb = cb; + x.ctx = ctx; ++ ++ H2_MPLX_ENTER(m); ++ + h2_ihash_iter(m->streams, m_stream_iter_wrap, &x); + + H2_MPLX_LEAVE(m); +@@ -1033,7 +1034,8 @@ static void s_c2_done(h2_mplx *m, conn_rec *c2, h2_conn_ctx_t *conn_ctx) + int i; + + for (i = 0; i < m->spurge->nelts; ++i) { +- if (stream == APR_ARRAY_IDX(m->spurge, i, h2_stream*)) { ++ stream = APR_ARRAY_IDX(m->spurge, i, h2_stream*); ++ if (stream && (stream->id == conn_ctx->stream_id)) { + ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, c2, + H2_STRM_LOG(APLOGNO(03517), stream, "already in spurge")); + ap_assert("stream should not be in spurge" == NULL); +diff --git a/modules/http2/h2_proxy_session.c b/modules/http2/h2_proxy_session.c +index acb17a5..3561c24 100644 +--- a/modules/http2/h2_proxy_session.c ++++ b/modules/http2/h2_proxy_session.c +@@ -866,8 +866,8 @@ static apr_status_t open_stream(h2_proxy_session *session, const char *url, + * Host: header */ + authority = r->server->server_hostname; + ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10511) +- "HTTP/0.9 request (with no host line) " +- "on incoming request and preserve host set " ++ "incoming HTTP/0.9 request (with no Host header) " ++ "and preserve host set, " + "forcing hostname to be %s for uri %s", + authority, r->uri); + apr_table_setn(r->headers_in, "Host", authority); +diff --git a/modules/http2/h2_proxy_util.c b/modules/http2/h2_proxy_util.c +index bb384b9..c0b3948 100644 +--- a/modules/http2/h2_proxy_util.c ++++ b/modules/http2/h2_proxy_util.c +@@ -381,7 +381,7 @@ static int iq_bubble_down(h2_proxy_iqueue *q, int i, int bottom, + * h2_proxy_ngheader + ******************************************************************************/ + #define H2_HD_MATCH_LIT_CS(l, name) \ +- ((strlen(name) == sizeof(l) - 1) && !apr_strnatcasecmp(l, name)) ++ ((strlen(name) == sizeof(l) - 1) && !ap_cstr_casecmp(l, name)) + + static int h2_util_ignore_header(const char *name) + { +@@ -500,7 +500,7 @@ static int ignore_header(const literal *lits, size_t llen, + + for (i = 0; i < llen; ++i) { + lit = &lits[i]; +- if (lit->len == nlen && !apr_strnatcasecmp(lit->name, name)) { ++ if (lit->len == nlen && !ap_cstr_casecmp(lit->name, name)) { + return 1; + } + } +@@ -542,7 +542,7 @@ void h2_proxy_util_camel_case_header(char *s, size_t len) + + /** Match a header value against a string constance, case insensitive */ + #define H2_HD_MATCH_LIT(l, name, nlen) \ +- ((nlen == sizeof(l) - 1) && !apr_strnatcasecmp(l, name)) ++ ((nlen == sizeof(l) - 1) && !ap_cstr_casecmp(l, name)) + + static apr_status_t h2_headers_add_h1(apr_table_t *headers, apr_pool_t *pool, + const char *name, size_t nlen, +diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c +index 21ede5c..2f92150 100644 +--- a/modules/http2/h2_session.c ++++ b/modules/http2/h2_session.c +@@ -125,7 +125,7 @@ static h2_stream *h2_session_open_stream(h2_session *session, int stream_id, + apr_allocator_t *allocator; + apr_pool_t *stream_pool; + apr_status_t rv; +- ++ + rv = apr_allocator_create(&allocator); + if (rv != APR_SUCCESS) + return NULL; +@@ -135,7 +135,7 @@ static h2_stream *h2_session_open_stream(h2_session *session, int stream_id, + apr_allocator_owner_set(allocator, stream_pool); + apr_pool_abort_set(abort_on_oom, stream_pool); + apr_pool_tag(stream_pool, "h2_stream"); +- ++ + stream = h2_stream_create(stream_id, stream_pool, session, + session->monitor, initiated_on); + if (stream) { +diff --git a/modules/http2/h2_util.h b/modules/http2/h2_util.h +index 29d1799..e813bf5 100644 +--- a/modules/http2/h2_util.h ++++ b/modules/http2/h2_util.h +@@ -337,7 +337,7 @@ apr_size_t h2_util_table_bytes(apr_table_t *t, apr_size_t pair_extra); + + /** Match a header value against a string constance, case insensitive */ + #define H2_HD_MATCH_LIT(l, name, nlen) \ +- ((nlen == sizeof(l) - 1) && !apr_strnatcasecmp(l, name)) ++ ((nlen == sizeof(l) - 1) && !ap_cstr_casecmp(l, name)) + + /******************************************************************************* + * HTTP/2 header helpers +diff --git a/modules/http2/h2_version.h b/modules/http2/h2_version.h +index 8bcaf69..5c95a7d 100644 +--- a/modules/http2/h2_version.h ++++ b/modules/http2/h2_version.h +@@ -27,7 +27,7 @@ + * @macro + * Version number of the http2 module as c string + */ +-#define MOD_HTTP2_VERSION "2.0.37" ++#define MOD_HTTP2_VERSION "2.0.37-git" + + /** + * @macro +diff --git a/modules/http2/h2_workers.c b/modules/http2/h2_workers.c +index e7e2039..192dbc0 100644 +--- a/modules/http2/h2_workers.c ++++ b/modules/http2/h2_workers.c +@@ -131,8 +131,13 @@ static apr_status_t activate_slot(h2_workers *workers) + apr_pool_tag(pool, "h2_worker_slot"); + slot->pool = pool; + ++#if defined(AP_HAS_THREAD_LOCAL) + rv = ap_thread_create(&slot->thread, workers->thread_attr, + slot_run, slot, slot->pool); ++#else ++ rv = apr_thread_create(&slot->thread, workers->thread_attr, ++ slot_run, slot, slot->pool); ++#endif + + cleanup: + if (rv != APR_SUCCESS) { +diff --git a/modules/http2/h2_ws.c b/modules/http2/h2_ws.c +index 3715225..4643660 100644 +--- a/modules/http2/h2_ws.c ++++ b/modules/http2/h2_ws.c +@@ -239,7 +239,7 @@ static void ws_handle_resp(conn_rec *c2, h2_conn_ctx_t *conn_ctx, + * or in the request processings implementation of WebSockets */ + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c2, APLOGNO(10463) + "h2_c2(%s-%d): websocket CONNECT, 101 response " +- "with 'Sec-WebSocket-Accept: %s' but expected %s", ++ "without 'Sec-WebSocket-Accept: %s' but expected %s", + conn_ctx->id, conn_ctx->stream_id, hd, + ws_ctx->ws_accept_base64); + } +diff --git a/modules/http2/h2_ws.h b/modules/http2/h2_ws.h +index a94d300..4e8967c 100644 +--- a/modules/http2/h2_ws.h ++++ b/modules/http2/h2_ws.h +@@ -23,7 +23,7 @@ + * Rewrite a websocket request. + * + * @param req the h2 request to rewrite +- * @param c2 the connection to process the request on ++ * @param conn the connection to process the request on + * @param no_body != 0 iff the request is known to have no body + * @return the websocket request for internal submit + */ diff --git a/debian/patches/bug1125368.patch b/debian/patches/bug1125368.patch new file mode 100644 index 00000000..29abfcb2 --- /dev/null +++ b/debian/patches/bug1125368.patch @@ -0,0 +1,102 @@ +From: Stefan Eissing +Date: Thu, 11 Dec 2025 08:45:15 +0000 +Subject: *) mod_http2: update to version 2.0.37 Prevent double purge of a + stream, resulting in a double free. Fixes PR 69899. + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1930444 13f79535-47bb-0310-9956-ffa450edef68 + +origin: https://github.com/apache/httpd/commit/542e0da07048d3934ef18c22b44cf8d62e64067f +bug-debian: https://bugs.debian.org/1125368 +bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=69899 +--- + changes-entries/h2_v2.0.37.txt | 4 ++++ + modules/http2/h2_mplx.c | 23 ++++++++++++++++++----- + modules/http2/h2_version.h | 4 ++-- + 3 files changed, 24 insertions(+), 7 deletions(-) + create mode 100644 changes-entries/h2_v2.0.37.txt + +diff --git a/changes-entries/h2_v2.0.37.txt b/changes-entries/h2_v2.0.37.txt +new file mode 100644 +index 0000000..8f22cde +--- /dev/null ++++ b/changes-entries/h2_v2.0.37.txt +@@ -0,0 +1,4 @@ ++ *) mod_http2: update to version 2.0.37 ++ Prevent double purge of a stream, resulting in a double free. ++ Fixes PR 69899. ++ [Stefan Eissing] +diff --git a/modules/http2/h2_mplx.c b/modules/http2/h2_mplx.c +index f9616ab..75518f4 100644 +--- a/modules/http2/h2_mplx.c ++++ b/modules/http2/h2_mplx.c +@@ -126,12 +126,24 @@ int h2_mplx_c1_stream_is_running(h2_mplx *m, h2_stream *stream) + return rv; + } + ++static int add_for_purge(h2_mplx *m, h2_stream *stream) ++{ ++ int i; ++ for (i = 0; i < m->spurge->nelts; ++i) { ++ h2_stream *s = APR_ARRAY_IDX(m->spurge, i, h2_stream*); ++ if (s == stream) /* already scheduled for purging */ ++ return FALSE; ++ } ++ APR_ARRAY_PUSH(m->spurge, h2_stream *) = stream; ++ return TRUE; ++} ++ + static void c1c2_stream_joined(h2_mplx *m, h2_stream *stream) + { + ap_assert(!stream_is_running(stream)); + + h2_ihash_remove(m->shold, stream->id); +- APR_ARRAY_PUSH(m->spurge, h2_stream *) = stream; ++ add_for_purge(m, stream); + } + + static void m_stream_cleanup(h2_mplx *m, h2_stream *stream) +@@ -164,7 +176,7 @@ static void m_stream_cleanup(h2_mplx *m, h2_stream *stream) + ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, m->c1, + H2_STRM_MSG(stream, "cleanup, c2 is done, move to spurge")); + /* processing has finished */ +- APR_ARRAY_PUSH(m->spurge, h2_stream *) = stream; ++ add_for_purge(m, stream); + } + else { + ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, m->c1, +@@ -178,9 +190,10 @@ static void m_stream_cleanup(h2_mplx *m, h2_stream *stream) + } + else { + /* never started */ +- ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, m->c1, +- H2_STRM_MSG(stream, "cleanup, never started, move to spurge")); +- APR_ARRAY_PUSH(m->spurge, h2_stream *) = stream; ++ int added = add_for_purge(m, stream); ++ if (added) ++ ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, m->c1, ++ H2_STRM_MSG(stream, "cleanup, never started, move to spurge")); + } + } + +diff --git a/modules/http2/h2_version.h b/modules/http2/h2_version.h +index 8d38c34..8bcaf69 100644 +--- a/modules/http2/h2_version.h ++++ b/modules/http2/h2_version.h +@@ -27,7 +27,7 @@ + * @macro + * Version number of the http2 module as c string + */ +-#define MOD_HTTP2_VERSION "2.0.35" ++#define MOD_HTTP2_VERSION "2.0.37" + + /** + * @macro +@@ -35,7 +35,7 @@ + * release. This is a 24 bit number with 8 bits for major number, 8 bits + * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203. + */ +-#define MOD_HTTP2_VERSION_NUM 0x020023 ++#define MOD_HTTP2_VERSION_NUM 0x020025 + + + #endif /* mod_h2_h2_version_h */ diff --git a/debian/patches/old-memory-handling-http2.patch b/debian/patches/old-memory-handling-http2.patch new file mode 100644 index 00000000..c259807e --- /dev/null +++ b/debian/patches/old-memory-handling-http2.patch @@ -0,0 +1,44 @@ +From: Thorsten Glaser +Date: Sun, 1 Mar 2026 18:04:39 +0100 +Subject: Fix http2 segfault + +origin: from https://github.com/icing/mod_h2/issues/313#issuecomment-3834622658 +--- + modules/http2/h2_session.c | 18 +----------------- + 1 file changed, 1 insertion(+), 17 deletions(-) + +diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c +index 2f92150..dda6c77 100644 +--- a/modules/http2/h2_session.c ++++ b/modules/http2/h2_session.c +@@ -111,29 +111,13 @@ static void cleanup_unprocessed_streams(h2_session *session) + h2_mplx_c1_streams_do(session->mplx, rst_unprocessed_stream, session); + } + +-/* APR callback invoked if allocation fails. */ +-static int abort_on_oom(int retcode) +-{ +- ap_abort_on_oom(); +- return retcode; /* unreachable, hopefully. */ +-} +- + static h2_stream *h2_session_open_stream(h2_session *session, int stream_id, + int initiated_on) + { + h2_stream * stream; +- apr_allocator_t *allocator; + apr_pool_t *stream_pool; +- apr_status_t rv; +- +- rv = apr_allocator_create(&allocator); +- if (rv != APR_SUCCESS) +- return NULL; + +- apr_allocator_max_free_set(allocator, ap_max_mem_free); +- apr_pool_create_ex(&stream_pool, session->pool, NULL, allocator); +- apr_allocator_owner_set(allocator, stream_pool); +- apr_pool_abort_set(abort_on_oom, stream_pool); ++ apr_pool_create(&stream_pool, session->pool); + apr_pool_tag(stream_pool, "h2_stream"); + + stream = h2_stream_create(stream_id, stream_pool, session, diff --git a/debian/patches/series b/debian/patches/series index 68907dca..36c316c8 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -5,4 +5,6 @@ customize_apxs.patch build_suexec-custom.patch reproducible_builds.diff fix-macro.patch -#0017-When-a-rewrite-to-proxy-is-configured-in-the-server-.patch +bug1125368.patch +0009-From-upstream-module.patch +old-memory-handling-http2.patch diff --git a/debian/perl-framework/STATUS b/debian/perl-framework/STATUS index 9975ca79..add26419 100644 --- a/debian/perl-framework/STATUS +++ b/debian/perl-framework/STATUS @@ -1,5 +1,5 @@ httpd-test/perl-framework STATUS: -*-text-*- -Last modified at [$Date: 2018-10-10 18:23:46 +0400 (Wed, 10 Oct 2018) $] +Last modified at [$Date$] Stuff to do: * finish the t/TEST exit code issue (ORed with 0x2C if diff --git a/debian/perl-framework/c-modules/test_pass_brigade/mod_test_pass_brigade.c b/debian/perl-framework/c-modules/test_pass_brigade/mod_test_pass_brigade.c index 99bc95a8..369b8179 100644 --- a/debian/perl-framework/c-modules/test_pass_brigade/mod_test_pass_brigade.c +++ b/debian/perl-framework/c-modules/test_pass_brigade/mod_test_pass_brigade.c @@ -60,20 +60,18 @@ static int test_pass_brigade_handler(request_rec *r) bucket = apr_bucket_eos_create(c->bucket_alloc); APR_BRIGADE_INSERT_TAIL(bb, bucket); -#if 0 - /* ###### A FLUSH should not be strictly necessary here - * but inserting one apears to work around intermittent - * failures when running t/apache/pass_brigade.t under - * worker. */ bucket = apr_bucket_flush_create(c->bucket_alloc); APR_BRIGADE_INSERT_TAIL(bb, bucket); -#endif ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, "[mod_test_pass_brigade] sending EOS"); } - status = ap_pass_brigade(r->output_filters->next, bb); + ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, + "[mod_test_pass_brigade] passing to output filter %s", + r->output_filters->frec->name); + + status = ap_pass_brigade(r->output_filters, bb); if (status != APR_SUCCESS) { apr_brigade_destroy(bb); diff --git a/debian/perl-framework/scripts/ldap-init.sh b/debian/perl-framework/scripts/ldap-init.sh index 148a9d0a..ae4d1360 100755 --- a/debian/perl-framework/scripts/ldap-init.sh +++ b/debian/perl-framework/scripts/ldap-init.sh @@ -6,8 +6,14 @@ sleep 5 # For the CentOS slapd configuration, load some default schema: if ${DOCKER} exec -i $cid1 test -f /etc/centos-release; then - ${DOCKER} exec -i $cid1 /usr/bin/ldapadd -Y EXTERNAL -H ldapi:// < scripts/slapd-config.ldif - ${DOCKER} exec -i $cid2 /usr/bin/ldapadd -Y EXTERNAL -H ldapi:// < scripts/slapd-config.ldif + : Adjusting CentOS-style OpenLDAP configuration + if ${DOCKER} exec -i $cid1 grep 'CentOS Stream' /etc/centos-release; then + ${DOCKER} exec -i $cid1 /usr/bin/ldapadd -Y EXTERNAL -H ldapi:// < scripts/slapd-config-mdb.ldif + ${DOCKER} exec -i $cid2 /usr/bin/ldapadd -Y EXTERNAL -H ldapi:// < scripts/slapd-config-mdb.ldif + else + ${DOCKER} exec -i $cid1 /usr/bin/ldapadd -Y EXTERNAL -H ldapi:// < scripts/slapd-config.ldif + ${DOCKER} exec -i $cid2 /usr/bin/ldapadd -Y EXTERNAL -H ldapi:// < scripts/slapd-config.ldif + fi for sc in cosine inetorgperson nis; do fn=/etc/openldap/schema/${sc}.ldif diff --git a/debian/perl-framework/scripts/memcached-init.sh b/debian/perl-framework/scripts/memcached-init.sh index f90f0553..b3f01fd2 100755 --- a/debian/perl-framework/scripts/memcached-init.sh +++ b/debian/perl-framework/scripts/memcached-init.sh @@ -1,8 +1,8 @@ #!/bin/bash -ex DOCKER=${DOCKER:-`which docker 2>/dev/null || which podman 2>/dev/null`} ${DOCKER} build -t httpd_memcached - </dev/null || which podman 2>/dev/null`} ${DOCKER} build -t httpd_redis - < 'all'; + +use Apache::Test; +use Apache::TestRequest; +use Apache::TestUtil; + +my $url = "/apache/chunked/byteranges.txt"; +my $file = Apache::Test::vars('serverroot') . "/htdocs$url"; + +my $content = ""; +$content .= sprintf("%04d", $_) for (1 .. 100); +t_write_file($file, $content); +my $real_clen = length($content); + +# +# test cases for PR 69831 +# + +my @space = (" ", "\t"); +my @tc; + +for (my $k = 0; $k < 2; $k++) { + for (my $i = 0; $i < 3; $i++) { + for (my $j = 0 ; $j < 3; $j++) { + $tc[ $k * 9 + $i * 3 + $j ] = "1-2" . $space[$k] x $i . "," . + $space[$k] x $j . "3-4"; + } + } +} + +plan tests => scalar(@tc), + need need_lwp, need_min_apache_version('2.5.1'); + +foreach my $range (@tc) { + print "Sending '$range', expecting 206\n"; + my $result = GET $url, "Range" => "bytes=$range"; + ok t_cmp($result->code, 206); +} diff --git a/debian/perl-framework/t/apache/errordoc.t b/debian/perl-framework/t/apache/errordoc.t index 405924bb..849dbcd8 100644 --- a/debian/perl-framework/t/apache/errordoc.t +++ b/debian/perl-framework/t/apache/errordoc.t @@ -7,7 +7,7 @@ use Apache::TestUtil; Apache::TestRequest::module('error_document'); -plan tests => 14, need_lwp; +plan tests => 17, need_lwp; # basic ErrorDocument tests @@ -106,3 +106,34 @@ plan tests => 14, need_lwp; qr!expire test!, '/bounce/notfound.html content'); } + +{ + my $l = Apache::TestRequest::resolve_url('/trace/notallowed.html'); + my $req = HTTP::Request->new('TRACE', $l); + my $ua = LWP::UserAgent->new(); + my $response = $ua->request($req); + chomp(my $content = $response->content); + + ok t_cmp($response->code, + 405, + '/trace/notallowed.html code'); + + if (need_min_apache_version("2.5.1")) { + ok t_cmp($content, + qr!The requested method TRACE is not allowed for this URL.!, + '/trace/notallowed.html content'); + } + else { + skip "Skipping test" + } + + if (need_min_apache_version("2.5.1")) { + ok t_cmp($content, + qr!Additionally, a 404 Not Found!, + '/trace/notallowed.html content'); + } + else { + skip "Skipping test" + } + +} diff --git a/debian/perl-framework/t/apache/snihostcheck.t b/debian/perl-framework/t/apache/snihostcheck.t new file mode 100644 index 00000000..b1bddc61 --- /dev/null +++ b/debian/perl-framework/t/apache/snihostcheck.t @@ -0,0 +1,56 @@ +use strict; +use warnings FATAL => 'all'; + +use Apache::Test; +use Apache::TestRequest; +use Apache::TestUtil; +use MIME::Base64; +use Data::Dumper; +use HTTP::Response; +use Socket; + +Apache::TestRequest::scheme('https'); +my $vars = Apache::Test::vars(); + +my @ssl_test_cases = ( + [ "unmatched" => 200, "no hop, stays on default vhost"], + # To run without SSLVHostSNIPolicy, prefix t/TEST with env NO_TEST_SNIPOLICY=/tmp (any file or dir) + [ "nvh" => defined($ENV{'NO_TEST_SNIPOLICY'}) ? 421 : 200, "hop allowed by global directive"], +); + +plan tests => scalar(@ssl_test_cases); + + +foreach my $vhosts (([$vars->{ssl_module_name} => 1])) { + my $vhost = $vhosts->[0]; + + foreach my $t (@ssl_test_cases) { + my $host = $t->[0]; + my $expect = $t->[1]; + my $desc = $t->[2]; + + my $r = GET("/", 'Host' => $host); + ok t_cmp($r->code, $expect, $desc); + } +} + +sub escape +{ + my $in = shift; + $in =~ s{\\}{\\\\}g; + $in =~ s{\r}{\\r}g; + $in =~ s{\n}{\\n}g; + $in =~ s{\t}{\\t}g; + $in =~ s{([\x00-\x1f])}{sprintf("\\x%02x", ord($1))}ge; + return $in; +} + +sub peer +{ + my $sock = shift; + my $hersockaddr = getpeername($sock); + my ($port, $iaddr) = sockaddr_in($hersockaddr); + my $herhostname = gethostbyaddr($iaddr, AF_INET); + my $herstraddr = inet_ntoa($iaddr); + return "$herstraddr:$port"; +} diff --git a/debian/perl-framework/t/apache/teclchunk.t b/debian/perl-framework/t/apache/teclchunk.t index b8043683..1b4fb1ed 100644 --- a/debian/perl-framework/t/apache/teclchunk.t +++ b/debian/perl-framework/t/apache/teclchunk.t @@ -8,7 +8,7 @@ use Apache::TestRequest (); my $module = 'default'; -if (!have_min_apache_version('2.5.0')) { +if (!have_min_apache_version('2.4.47')) { print "1..0 # skip: Not supported yet"; exit 0; } diff --git a/debian/perl-framework/t/conf/extra.conf.in b/debian/perl-framework/t/conf/extra.conf.in index 27199858..8ab6ab9f 100644 --- a/debian/perl-framework/t/conf/extra.conf.in +++ b/debian/perl-framework/t/conf/extra.conf.in @@ -275,7 +275,18 @@ RewriteRule ^/modules/rewrite/escaping/qsd-like/(.*) /$1? [R] RewriteRule ^/modules/rewrite/escaping/qsd-like-plus-qsa/(.*) /$1? [R,QSA] + # For the following rule, UnsafeAllow3F is needed from 2.4.60 to 2.4.62 only + RewriteRule ^/modules/rewrite/escaping/qsd-like-plus-qsa-qsl/(.*) /$1? [R,QSA,QSL] + + = 2.4.60> + 2.4.62> + RewriteRule ^/modules/rewrite/escaping/qsd-like-plus-qsa-qsl/(.*) /$1? [R,QSA,QSL] + + + RewriteRule ^/modules/rewrite/escaping/qsd-like-plus-qsa-qsl/(.*) /$1? [R,QSA,QSL,UnsafeAllow3F] + + = 2.4.57> RewriteRule ^/modules/rewrite/escaping/local_bctls/(.*) /?$1 [BCTLS] @@ -295,9 +306,51 @@ RewriteRule proxy_ne/(.*) http://@SERVERNAME@:@PORT@/?$1 [P,NE] - + + RewriteCond expr false + RewriteRule ^/modules/rewrite/expr/notgone/false$ - [G] + + RewriteCond expr !true + RewriteRule ^/modules/rewrite/expr/notgone/nottrue$ - [G] + + RewriteCond expr true + RewriteRule ^/modules/rewrite/expr/shouldredir/true$ /dummy [R=303] + + RewriteCond expr !false + RewriteRule ^/modules/rewrite/expr/shouldredir/notfalse$ /dummy [R=303] + + Header always set rewritten-query "expr=%{QUERY_STRING}" + + + # This can go beyond the default LimitRequestLine of 128 depending on ServerRoot + LimitRequestLine 1024 + # If the prefix stat fails, it would become docroot-relative and 404. Note the at-serverroot is a literal in the generated httpd.conf + RewriteRule ^/modules/rewrite/prefixstat/index.html @SERVERROOT@/htdocs/index.html + RewriteRule ^/modules/rewrite/prefixstat/query/index.html %{QUERY_STRING} + = 2.4.60> + RewriteRule ^/modules/rewrite/prefixstat/query-optin/index.html %{QUERY_STRING} [UnsafePrefixStat] + + + + RewriteRule ^/modules/rewrite/badquery/literal /modules/rewrite/badquery/literal?theval [PT] + RewriteRule ^/modules/rewrite/badquery/literal /modules/rewrite/badquery/literal?theval [PT] + + # Should fail if the capture has %3f + RewriteRule ^/modules/rewrite/badquery/backref/(.*)$ /modules/rewrite/badquery/backref$1 [PT] + RewriteRule ^/modules/rewrite/badquery/backref-map/(.*)$ /modules/rewrite/badquery/backref${lower:$1} [PT] + # Non opt-in safe substitutions from from PR69197 + RewriteRule ^/modules/rewrite/badquery/backref-qsa/(.*)$ /modules/rewrite/badquery/backref?query=$1 [QSA,PT] + RewriteRule ^/modules/rewrite/badquery/backref-qsalike/(.*)$ /modules/rewrite/badquery/backref?query=$1&%{QUERY_STRING} [PT] + RewriteRule ^/modules/rewrite/badquery/backref-noqsa/(.*)$ /modules/rewrite/badquery/backref?query=$1 [PT] + RewriteRule ^/modules/rewrite/badquery/backref-noqsa-map/(.*)$ /modules/rewrite/badquery/backref?query=${lower:$1} [PT] + RewriteRule ^/modules/rewrite/badquery/backref-qslast/(.*)/(.*)$ /modules/rewrite/badquery/backref$2?query=$1 [QSL,PT] + = 2.4.60> + RewriteRule ^/modules/rewrite/badquery/backref-optin/(.*)$ /modules/rewrite/badquery/backref$1 [PT,UnsafeAllow3F] + + + DocumentRoot @SERVERROOT@/htdocs/modules/proxy RewriteEngine On @@ -378,9 +431,14 @@ AddHandler cgi-script .sh AddHandler cgi-script .pl ScriptLog @SERVERROOT@/logs/mod_cgi.log - ScriptLogLength 40960 + ScriptLogLength 51200 ScriptLogBuffer 256 + + SetEnv GATEWAY?INTERFACE "dummy/1.0" + SetEnv HTTP?host "localhost" + + Options +ExecCGI @@ -532,6 +590,16 @@ Alias /manual @inherit_documentroot@/manual AllowOverride Indexes + + + Options +MultiViews + + + AddType server-status .magictype + + DirectoryIndex fallback.magictype + # FallBackResource /modules/dir/fallback/fallback.magictype + ## @@ -881,6 +949,9 @@ LimitRequestFields 32 ErrorDocument 500 "hmph + TraceEnable off + ErrorDocument 405 /i/dont/exist + @@ -1519,7 +1590,6 @@ LimitRequestFields 32 Alias /modules/xml2enc/back @SERVERROOT@/htdocs/modules/xml2enc - Alias /modules/xml2enc/back/iso @SERVERROOT@/htdocs/modules/xml2enc AddType application/foo+xml fooxml AddType application/notreallyxml notxml diff --git a/debian/perl-framework/t/conf/proxy.conf.in b/debian/perl-framework/t/conf/proxy.conf.in index a199ca86..99f08435 100644 --- a/debian/perl-framework/t/conf/proxy.conf.in +++ b/debian/perl-framework/t/conf/proxy.conf.in @@ -180,11 +180,21 @@ ProxyPassReverse /php-fpm-pp/ fcgi://localhost:9001/@SERVERROOT@/htdocs/ + + # PR69168 + + BalancerMember "fcgi://localhost:${FCGI_PORT}" route=localhost + + # reuse content, but the CGI on FCGI_PORT doesn't care what file we map to + Alias /modules/proxy/fcgi-balancer/ @SERVERROOT@/htdocs/modules/proxy/fcgi/ + + SetHandler "proxy:balancer://test" + + ProxyPass /proxy/wsoc ws://@SERVERNAME@:@PORT@/modules/lua/websockets.lua - @@ -192,3 +202,11 @@ AllowOverride All + +ProxyPass /modules/proxy/fcgi-uds "unix:/tmp/apache-test-builtinfcgi.sock|fcgi://unused" +Alias /modules/proxy/fcgi-uds-sethandler @SERVERROOT@/htdocs/modules/proxy/fcgi + + SetHandler "proxy:unix:/tmp/apache-test-builtinfcgi.sock|fcgi://unused" + + + diff --git a/debian/perl-framework/t/conf/ssl/ssl.conf.in b/debian/perl-framework/t/conf/ssl/ssl.conf.in index 6fadf333..7c90141d 100644 --- a/debian/perl-framework/t/conf/ssl/ssl.conf.in +++ b/debian/perl-framework/t/conf/ssl/ssl.conf.in @@ -5,6 +5,13 @@ AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl .crl + # hack to allow environment variable to affect test config + + = 2.4.66> + SSLVHostSNIPolicy insecure + + + SSLSessionCache ${SSL_SESSCACHE} @@ -77,7 +84,8 @@ SSLCARevocationCheck chain - + # any string other than _default_ causes an NVH set to be created + SSLEngine on #t/ssl/verify.t @@ -220,6 +228,10 @@ + + ServerAlias nvh + + # An SSL vhost which does optional ccert checks at vhost level, to # check for CVE CAN-2005-2700. diff --git a/debian/perl-framework/t/htdocs/modules/cgi/action.sh b/debian/perl-framework/t/htdocs/modules/cgi/action.sh new file mode 100755 index 00000000..1a4b04d7 --- /dev/null +++ b/debian/perl-framework/t/htdocs/modules/cgi/action.sh @@ -0,0 +1,9 @@ +#!/bin/sh + +CT=$(echo ${QUERY_STRING}|awk -F: '{print $1'}) +LOC=$(echo ${QUERY_STRING}|awk -F: '{print $2'}) + +echo Content-type: ${CT} +echo Location: ${LOC} +echo +echo "this is action.sh" diff --git a/debian/perl-framework/t/htdocs/modules/cgi/bogus-te.sh b/debian/perl-framework/t/htdocs/modules/cgi/bogus-te.sh new file mode 100755 index 00000000..c10998ba --- /dev/null +++ b/debian/perl-framework/t/htdocs/modules/cgi/bogus-te.sh @@ -0,0 +1,10 @@ +#!/bin/sh +echo Content-Type: text/plain +echo Transfer-Encoding: chunked +echo +echo 5 +echo hello +echo +echo 0 +echo +echo diff --git a/debian/perl-framework/t/htdocs/modules/cgi/nph-dripfeed.pl.PL b/debian/perl-framework/t/htdocs/modules/cgi/nph-dripfeed.pl.PL index fa73355f..deaf5f69 100644 --- a/debian/perl-framework/t/htdocs/modules/cgi/nph-dripfeed.pl.PL +++ b/debian/perl-framework/t/htdocs/modules/cgi/nph-dripfeed.pl.PL @@ -1,4 +1,4 @@ -print "HTTP/1.0 200 OK\r\n"; +print "HTTP/1.1 200 OK\r\n"; print "Transfer-Encoding: chunked\r\n"; print "\r\n"; diff --git a/debian/perl-framework/t/htdocs/modules/dir/fallback/fallback.magictype b/debian/perl-framework/t/htdocs/modules/dir/fallback/fallback.magictype new file mode 100644 index 00000000..e90c0ac5 --- /dev/null +++ b/debian/perl-framework/t/htdocs/modules/dir/fallback/fallback.magictype @@ -0,0 +1 @@ +fallback file diff --git a/debian/perl-framework/t/htdocs/modules/dir/fallback/index.html b/debian/perl-framework/t/htdocs/modules/dir/fallback/index.html new file mode 100644 index 00000000..55cb19ad --- /dev/null +++ b/debian/perl-framework/t/htdocs/modules/dir/fallback/index.html @@ -0,0 +1 @@ +fallback diff --git a/debian/perl-framework/t/htdocs/modules/include/exec/on/cmd.shtml b/debian/perl-framework/t/htdocs/modules/include/exec/on/cmd.shtml index 9011ed2f..04979165 100644 --- a/debian/perl-framework/t/htdocs/modules/include/exec/on/cmd.shtml +++ b/debian/perl-framework/t/htdocs/modules/include/exec/on/cmd.shtml @@ -1 +1 @@ - + diff --git a/debian/perl-framework/t/htdocs/php/cfunctions.php b/debian/perl-framework/t/htdocs/php/cfunctions.php index 3655cd6b..1f743125 100644 --- a/debian/perl-framework/t/htdocs/php/cfunctions.php +++ b/debian/perl-framework/t/htdocs/php/cfunctions.php @@ -23,9 +23,14 @@ function dafna() class dafna_class { - function dafna_class() { + var $myname; + function __construct() { $this->myname = "Dafna"; } + # PHP4 compatibility + function dafna_class() { + self::__construct(); + } function GetMyName() { return $this->myname; } diff --git a/debian/perl-framework/t/htdocs/php/strings2.php b/debian/perl-framework/t/htdocs/php/strings2.php index ec10f4bc..9cb9da8a 100644 --- a/debian/perl-framework/t/htdocs/php/strings2.php +++ b/debian/perl-framework/t/htdocs/php/strings2.php @@ -23,7 +23,7 @@ echo "Testing strstr: "; $test = "This is a test"; -$found1 = strstr($test, 32); +$found1 = strstr($test, chr(32)); $found2 = strstr($test, "a "); if ($found1 != " is a test") { echo("failed 1\n"); @@ -36,7 +36,7 @@ echo "Testing strrchr: "; $test = "fola fola blakken"; $found1 = strrchr($test, "b"); -$found2 = strrchr($test, 102); +$found2 = strrchr($test, chr(102)); if ($found1 != "blakken") { echo("failed 1\n"); } elseif ($found2 != "fola blakken") { diff --git a/debian/perl-framework/t/htdocs/security/CAN-2004-0959.php b/debian/perl-framework/t/htdocs/security/CAN-2004-0959.php index 0f365268..51ff3f53 100644 --- a/debian/perl-framework/t/htdocs/security/CAN-2004-0959.php +++ b/debian/perl-framework/t/htdocs/security/CAN-2004-0959.php @@ -1,7 +1,8 @@ \ No newline at end of file +?> diff --git a/debian/perl-framework/t/modules/actions.t b/debian/perl-framework/t/modules/actions.t index 337d4d80..db3d4c59 100644 --- a/debian/perl-framework/t/modules/actions.t +++ b/debian/perl-framework/t/modules/actions.t @@ -18,6 +18,13 @@ my @tests_action = ( [ "modules/actions/action/test.xyz2", 200, "nada"], # Handler for .xyz2, and virtual ); +if (have_min_apache_version('2.4.60')) { + push(@tests_action, ( + [ "/cgi_mod_actions/action.sh?my-file-type2:/modules/actions/action/dummy", 404], + [ "/cgi_mod_actions/action.sh?server-status:/dne", 404], + )); +} + my @tests_script = ( [ "modules/actions/script/test.x", 404], [ "modules/actions/script/test.x?foo=bar", 200, "foo=bar"], @@ -29,6 +36,7 @@ plan tests => scalar @tests_action*2 + scalar @tests_script*(2+2+1), need_module foreach my $test (@tests_action) { $r = GET($test->[0]); + t_debug "Check $test->[0] for $test->[1]\n"; ok t_cmp($r->code, $test->[1]); if ($test->[1] == 200) { ok t_cmp($r->content, $test->[2]); @@ -40,6 +48,7 @@ foreach my $test (@tests_action) { foreach my $test (@tests_script) { $r = GET($test->[0]); + t_debug "Check $test->[0] for $test->[1]\n"; ok t_cmp($r->code, $test->[1]); if ($test->[1] == 200) { ok t_cmp($r->content, $test->[2]); diff --git a/debian/perl-framework/t/modules/autoindex.t b/debian/perl-framework/t/modules/autoindex.t index 76c9af4a..c7300214 100644 --- a/debian/perl-framework/t/modules/autoindex.t +++ b/debian/perl-framework/t/modules/autoindex.t @@ -124,7 +124,7 @@ sub ai_test ($$$$) { my $html_head; - if (have_min_apache_version('2.5.1')) { + if (have_min_apache_version('2.4.66')) { $html_head = ''; } else { diff --git a/debian/perl-framework/t/modules/cgi.t b/debian/perl-framework/t/modules/cgi.t index 9b6edc2c..65ca8cd6 100644 --- a/debian/perl-framework/t/modules/cgi.t +++ b/debian/perl-framework/t/modules/cgi.t @@ -8,8 +8,10 @@ use File::stat; my $have_apache_2 = have_apache 2; my $have_apache_2050 = have_min_apache_version "2.0.50"; +my $have_apache_2460 = have_min_apache_version "2.4.60"; -my $script_log_length = 40960; +my $script_log_length = 51200; +my $htdocs = Apache::Test::vars('documentroot'); ## mod_cgi test ## @@ -18,7 +20,7 @@ my $script_log_length = 40960; ## AddHandler cgi-script .sh ## AddHandler cgi-script .pl ## ScriptLog logs/mod_cgi.log -## ScriptLogLength 40960 +## ScriptLogLength 51200 ## ScriptLogBuffer 256 ## ## Options +ExecCGI @@ -50,6 +52,10 @@ my %test = ( 'rc' => 500, 'expect' => 'none' }, + 'bogus-te.sh' => { + 'rc' => 502, + 'expect' => 'none' + }, 'acceptpathinfoon.sh' => { 'rc' => 200, 'expect' => '' @@ -90,6 +96,15 @@ my %test = ( 'rc' => 200, 'expect' => 'this is nph-stdout' }, + 'env.pl?gateway' => { + 'rc' => 200, + 'expect' => 'GATEWAY_INTERFACE = CGI/1.1' + }, + 'env.pl?host' => { + 'rc' => 200, + 'expect' => 'HTTP_HOST = localhost' + }, + ); #XXX: find something that'll on other platforms (/bin/sh aint it) @@ -107,6 +122,11 @@ if (!$have_apache_2050 || Apache::TestConfig::WINFU()) { delete @test{qw(stderr1.pl stderr2.pl stderr3.pl nph-stderr.pl)}; } +# Test for a CGI script with Transfer-Encoding: chunked +if (1 || !$have_apache_2460 || Apache::TestConfig::WINFU()) { + delete @test{qw(bogus-te.sh)}; +} + my $tests = ((keys %test) * 2) + (@post_content * 3) + 4; plan tests => $tests, \&need_cgi; @@ -132,10 +152,18 @@ foreach (sort keys %test) { $actual = GET_BODY "$path/$_"; chomp $actual if $actual =~ /\n$/; - ok t_cmp($actual, - $expected, - "body for $_" - ); + if ($expected =~ /=/) { + t_debug("$path/$_: check for $expected within $actual"); + ok t_cmp($actual =~ /\Q$expected\E/ ? 1 : 0, + 1, + "body for $_" + ); + } else { + ok t_cmp($actual, + $expected, + "body for $_" + ); + } } elsif ($_ !~ /^bogus/) { print "# no body test for this one\n"; diff --git a/debian/perl-framework/t/modules/dav.t b/debian/perl-framework/t/modules/dav.t index 73046cda..a1b6248b 100644 --- a/debian/perl-framework/t/modules/dav.t +++ b/debian/perl-framework/t/modules/dav.t @@ -10,7 +10,7 @@ use HTTP::Date; ## mod_dav tests ## -plan tests => 19, [qw(dav HTTP::DAV)]; +plan tests => 21, [qw(dav HTTP::DAV)]; require HTTP::DAV; my $vars = Apache::Test::vars(); @@ -94,12 +94,20 @@ my $r2 = $d2->new_resource( -uri => "http://$server$uri"); ## put an unlocked resource (will work) ## $response = $r2->get; -my $b2 = $r2->get_content; -$b2 =~ s#

mod_dav test page

#

mod_dav test page take two

#; - -print "putting with 2nd dav client (on unlocked resource)\n"; -$response = $r2->put($b2); -ok $response->is_success; +ok t_cmp(defined $r2->get_content, 1, "GET failed for ".$r2->get_uri); +my $b2; +if (defined $r2->get_content) { + $b2 = $r2->get_content; + $b2 =~ s#

mod_dav test page

#

mod_dav test page take two

#; + + print "putting with 2nd dav client (on unlocked resource)\n"; + $response = $r2->put($b2); + ok $response->is_success; +} +else { + skip "Broken configuration, GET not working"; + $b2 = "---broken---"; +} $actual = GET_BODY $uri; print "getting new uri...\nexpect:\n->$b2<-\ngot:\n->$actual<-\n"; @@ -130,8 +138,15 @@ ok !$response->is_success; ## client 2 should not be able to put because the resource is already locked by client 1 ## $response = $r2->get; -my $b3 = $r2->get_content; -$b3 =~ s#mod_dav#f00#g; +ok t_cmp(defined $r2->get_content, 1, "GET failed for ".$r2->get_uri); +my $b3; +if (defined $r2->get_content) { + $b3 = $r2->get_content; + $b3 =~ s#mod_dav#f00#g; +} +else { + $b3 = "---broken---"; +} print "client 2 attempting to put resource locked by client 1\n"; $response = $r2->put($b3); diff --git a/debian/perl-framework/t/modules/deflate.t b/debian/perl-framework/t/modules/deflate.t index 3b368ce5..89937ebb 100644 --- a/debian/perl-framework/t/modules/deflate.t +++ b/debian/perl-framework/t/modules/deflate.t @@ -47,6 +47,8 @@ else { foreach (1 .. ($tests_per_uri * @server_bucketeer_uri)); } for my $server_deflate_uri (@server_deflate_uris) { + print("# testing deflate URI: $server_deflate_uri\n"); + my $original_str = GET_BODY($server_deflate_uri); my $deflated_str = GET_BODY($server_deflate_uri, @deflate_headers); @@ -106,7 +108,7 @@ for my $server_deflate_uri (@server_deflate_uris) { } # mod_deflate fixes still pending to make this work... -if (have_module('cgi') && have_min_apache_version('2.1.0')) { +if (have_cgi && have_min_apache_version('2.1.0')) { my $sock = Apache::TestRequest::vhost_socket('default'); ok $sock; @@ -133,5 +135,5 @@ if (have_module('cgi') && have_min_apache_version('2.1.0')) { my $ret = $sock->read($response, 1024); ok t_cmp($ret, 0, "expect EOF after 304 header"); } else { - skip "skipping 304/deflate tests without mod_cgi and httpd >= 2.1.0" foreach (1..$cgi_tests); + skip "skipping 304/deflate tests without cgi and httpd >= 2.1.0" foreach (1..$cgi_tests); } diff --git a/debian/perl-framework/t/modules/dir.t b/debian/perl-framework/t/modules/dir.t index 51e632e2..f9c2b2e3 100644 --- a/debian/perl-framework/t/modules/dir.t +++ b/debian/perl-framework/t/modules/dir.t @@ -3,6 +3,7 @@ use warnings FATAL => 'all'; use Apache::Test; use Apache::TestRequest; +use Apache::TestUtil; ## ## mod_dir tests @@ -20,7 +21,7 @@ sub my_chomp { $actual =~ s/[\r\n]+$//s; } -plan tests => @bad_index * @index * 5 + @bad_index + 5 + 3, need_module 'dir'; +plan tests => @bad_index * @index * 5 + @bad_index + 5 + 3 +1+1, need_module 'dir'; foreach my $bad_index (@bad_index) { @@ -106,6 +107,24 @@ else { } +if (!have_min_apache_version('2.4.61') || !have_module('mime') || !have_module('status')) { + skip("doesn't work"); +} +else { + my $body = GET_BODY "/modules/dir/fallback/"; + ok t_cmp($body, qr/Server Status/, "type->handler wasn't used"); + +} +if (!have_min_apache_version('2.4.62') || !have_module('negotiation') || !have_module('status')) { + skip("doesn't work"); +} +else { + my $body = GET_BODY "/modules/dir/fallback/fallback"; + ok t_cmp($body, qr/Server Status/, "type->handler wasn't used w/ multiviews"); + +} + + sub write_htaccess { my $string = shift; diff --git a/debian/perl-framework/t/modules/include.t b/debian/perl-framework/t/modules/include.t index 9ff24119..99644971 100644 --- a/debian/perl-framework/t/modules/include.t +++ b/debian/perl-framework/t/modules/include.t @@ -89,6 +89,7 @@ my %test = ( "exec/off/cmd.shtml" => "[an error occurred while processing this ". "directive]", "exec/on/cmd.shtml" => "pass", +"exec/on/cmd.shtml?extra" => "pass", "exec/off/cgi.shtml" => "[an error occurred while processing this ". "directive]", "exec/on/cgi.shtml" => "perl cgi", diff --git a/debian/perl-framework/t/modules/proxy_fcgi.t b/debian/perl-framework/t/modules/proxy_fcgi.t index 2f62580d..dce4a804 100644 --- a/debian/perl-framework/t/modules/proxy_fcgi.t +++ b/debian/perl-framework/t/modules/proxy_fcgi.t @@ -9,12 +9,30 @@ use Misc; my $have_fcgisetenvif = have_min_apache_version('2.4.26'); my $have_fcgibackendtype = have_min_apache_version('2.4.26'); # NOTE: This will fail if php-fpm is installed but not in $PATH -my $have_php_fpm = `php-fpm -v` =~ /fpm-fcgi/; + +my $php_fpm = 'php-fpm'; + +$php_fpm = $ENV{'PHP_FPM'} if defined $ENV{'PHP_FPM'}; + +my $have_php_fpm = `$php_fpm -v` =~ /fpm-fcgi/; + +my @udstests = ( + "/modules/proxy/fcgi-uds/index.php", + "/modules/proxy/fcgi-uds-sethandler/index.php" +); + +my @balancertests = (); +if (have_min_apache_version('2.4.62')) { + push @balancertests, { url => "/modules/proxy/fcgi-balancer/index.php", pathinfo => undef }; + push @balancertests, { url => "/modules/proxy/fcgi-balancer/index.php/my/pi", pathinfo => "/my/pi"}; +} plan tests => (7 * $have_fcgisetenvif) + (2 * $have_fcgibackendtype) + (2 * $have_fcgibackendtype * have_module('rewrite')) + (7 * have_module('rewrite')) + (7 * have_module('actions')) + - (15 * $have_php_fpm * have_module('actions')) + 2, + (15 * $have_php_fpm * have_module('actions')) + 2 + + 2*scalar(@balancertests) + + 2*(scalar(@udstests)), need ( 'mod_proxy_fcgi', 'FCGI', @@ -47,7 +65,13 @@ sub run_fcgi_handler($$) if ($pid == 0) { # Child process. Open up a listening socket. - my $sock = FCGI::OpenSocket(":$fcgi_port", 10); + my $sock; + if ($fcgi_port =~ m@/@) { + $sock = FCGI::OpenSocket("$fcgi_port", 10); # uds + } + else { + $sock = FCGI::OpenSocket(":$fcgi_port", 10); + } # Signal the parent process that we're ready. print WRITE_END 'x'; @@ -113,7 +137,7 @@ sub run_fcgi_envvar_request my $backend = shift || "FCGI"; # Launch the FCGI process. - my $child = launch_envvar_echo_daemon($fcgi_port) unless ($fcgi_port <= 0) ; + my $child = launch_envvar_echo_daemon($fcgi_port) if defined($fcgi_port); # Hit the backend. my $r = GET($uri); @@ -129,8 +153,8 @@ sub run_fcgi_envvar_request $envs{$components[0]} = $components[1]; } - if ($fcgi_port > 0) { - if ($r->code eq '500') { + if(defined($fcgi_port)) { + if ($r->code ge '500') { # Unknown failure, probably the request didn't hit the FCGI child # process, so it will hang waiting for our request kill 'TERM', $child; @@ -245,7 +269,7 @@ if (have_module('actions')) { exit; } if ($pid == 0) { - system "php-fpm -n -D -g $pid_file -p $servroot/php-fpm"; + system "$php_fpm -n -D -g $pid_file -p $servroot/php-fpm"; exit; } # Wait for php-fpm to start-up @@ -254,7 +278,7 @@ if (have_module('actions')) { exit; } sleep(1); - $envs = run_fcgi_envvar_request(0, "/php/fpm/action/sub2/test.php/foo/bar?query", "PHP-FPM"); + $envs = run_fcgi_envvar_request(undef, "/php/fpm/action/sub2/test.php/foo/bar?query", "PHP-FPM"); ok t_cmp($envs->{'SCRIPT_NAME'}, '/php/fpm/action/sub2/test.php', "Handler PHP-FPM sets correct SCRIPT_NAME"); ok t_cmp($envs->{'PATH_INFO'}, '/foo/bar', @@ -266,7 +290,7 @@ if (have_module('actions')) { ok t_cmp($envs->{'FCGI_ROLE'}, 'RESPONDER', "Handler PHP-FPM sets correct FCGI_ROLE"); - $envs = run_fcgi_envvar_request(0, "/php-fpm-pp/php/fpm/pp/sub1/test.php/foo/bar?query", "PHP-FPM"); + $envs = run_fcgi_envvar_request(undef, "/php-fpm-pp/php/fpm/pp/sub1/test.php/foo/bar?query", "PHP-FPM"); ok t_cmp($envs->{'SCRIPT_NAME'}, '/php-fpm-pp/php/fpm/pp/sub1/test.php', "ProxyPass PHP-FPM sets correct SCRIPT_NAME"); ok t_cmp($envs->{'PATH_INFO'}, '/foo/bar', @@ -278,7 +302,7 @@ if (have_module('actions')) { ok t_cmp($envs->{'FCGI_ROLE'}, 'RESPONDER', "ProxyPass PHP-FPM sets correct FCGI_ROLE"); - $envs = run_fcgi_envvar_request(0, "/php-fpm-pp/php/fpm/pp/sub1/test.php", "PHP-FPM"); + $envs = run_fcgi_envvar_request(undef, "/php-fpm-pp/php/fpm/pp/sub1/test.php", "PHP-FPM"); ok t_cmp($envs->{'PATH_INFO'}, undef, "ProxyPass PHP-FPM sets correct empty PATH_INFO"); ok t_cmp($envs->{'PATH_TRANSLATED'}, undef, @@ -298,3 +322,14 @@ if (have_module('actions')) { $envs = run_fcgi_envvar_request($fcgi_port, "/modules/proxy/fcgi/index.php"); ok t_cmp($envs->{'SCRIPT_NAME'}, '/modules/proxy/fcgi/index.php', "Server sets correct SCRIPT_NAME by default"); +foreach my $url (@udstests) { + $envs = run_fcgi_envvar_request("/tmp/apache-test-builtinfcgi.sock", "$url"); + ok t_cmp($envs->{'SCRIPT_NAME'}, "$url", "Server sets correct SCRIPT_NAME by default"); +} + +for my $t (@balancertests) { + my $url = $t->{"url"}; + my $pathinfo = $t->{"pathinfo"}; + $envs = run_fcgi_envvar_request($fcgi_port, $url); + ok t_cmp($envs->{'PATH_INFO'}, $pathinfo, "Server sets correct PATH_INFO by default"); +} diff --git a/debian/perl-framework/t/modules/proxy_websockets.t b/debian/perl-framework/t/modules/proxy_websockets.t index f2d6558f..8b25539d 100644 --- a/debian/perl-framework/t/modules/proxy_websockets.t +++ b/debian/perl-framework/t/modules/proxy_websockets.t @@ -11,7 +11,7 @@ use Apache::TestConfig (); my @test_cases = ( "ping0", "ping1" x 10, "ping2" x 100, "ping3" x 1024, "sendquit"); my $total_tests = 2; -plan tests => $total_tests, need 'AnyEvent::WebSocket::Client', +plan tests => $total_tests, need 'AnyEvent::WebSocket::Client', need 'URI::ws', need_module('proxy_http', 'lua'), need_min_apache_version('2.4.47'); require AnyEvent; diff --git a/debian/perl-framework/t/modules/proxy_websockets_ssl.t b/debian/perl-framework/t/modules/proxy_websockets_ssl.t index 793ff482..119e4a5c 100644 --- a/debian/perl-framework/t/modules/proxy_websockets_ssl.t +++ b/debian/perl-framework/t/modules/proxy_websockets_ssl.t @@ -10,7 +10,7 @@ use Apache::TestConfig (); my @test_cases = ( "ping0", "ping1" x 10, "ping2" x 100, "ping3" x 1024, "sendquit"); my $total_tests = 2; -plan tests => $total_tests, need 'AnyEvent::WebSocket::Client', +plan tests => $total_tests, need 'AnyEvent::WebSocket::Client', need 'URI::wss', need_module('ssl', 'proxy_http', 'lua'), need_min_apache_version('2.4.47'); require AnyEvent; diff --git a/debian/perl-framework/t/modules/rewrite.t b/debian/perl-framework/t/modules/rewrite.t index 46734312..082b0e2e 100644 --- a/debian/perl-framework/t/modules/rewrite.t +++ b/debian/perl-framework/t/modules/rewrite.t @@ -17,8 +17,8 @@ my $r; my @redirects_all = ( ["/modules/rewrite/escaping/qsd-like/foo", "/foo\$", have_min_apache_version('2.4.57')], # PR66547 - ["/modules/rewrite/escaping/qsd-like-plus-qsa/foo?preserve-me", "/foo\\?preserve-me\$", have_min_apache_version('2.5.1')], # PR66672 - ["/modules/rewrite/escaping/qsd-like-plus-qsa-qsl/foo/%3fbar/?preserve-me", "/foo/%3fbar/\\?preserve-me\$", have_min_apache_version('2.5.1')], # PR66672 + ["/modules/rewrite/escaping/qsd-like-plus-qsa/foo?preserve-me", "/foo\\?preserve-me\$", have_min_apache_version('2.4.58')], # PR66672 + ["/modules/rewrite/escaping/qsd-like-plus-qsa-qsl/foo/%3fbar/?preserve-me", "/foo/%3fbar/\\?preserve-me\$", have_min_apache_version('2.4.58')], # PR66672 ); my @escapes = ( @@ -58,6 +58,53 @@ if (have_min_apache_version('2.4.57')) { )); } +my @badquery = ( + [ "/modules/rewrite/badquery/literal" => "theval"], +); +if (have_min_apache_version('2.4.60')) { + push(@badquery, ( + [ "/modules/rewrite/badquery/backref/%3ftheval" => ""], + [ "/modules/rewrite/badquery/backref-map/%3ftheval" => ""], + [ "/modules/rewrite/badquery/backref-optin/%3ftheval" => "theval"], + )); +} + +if (have_min_apache_version('2.4.63')) { + # cases not requiring opt-in because the splitting ? is not from an expansion + push(@badquery, ( + # appending should be fine + [ "/modules/rewrite/badquery/backref-qsa/xxx?foo%3fbar" => "query=xxx&foo%3fbar"], + [ "/modules/rewrite/badquery/backref-qsalike/xxx?foo%3fbar" => "query=xxx&foo%3fbar"], + # %3f not used because query is discarded + [ "/modules/rewrite/badquery/backref-noqsa/xxx?foo%3fbar" => "query=xxx"], + [ "/modules/rewrite/badquery/backref-noqsa-map/xxx?foo%3fbar" => "query=xxx"], + # the first ? is from expansion, but not used to delineate query. first segment is copied to query in rule + [ "/modules/rewrite/badquery/backref-qslast/yyy/%3fzzz" => "query=yyy"], + )); +} + +my @prefixstats = ( + [ "/modules/rewrite/prefixstat/index.html" => 200], + # under docroot is permitted. + [ "/modules/rewrite/prefixstat/query/index.html?" + .Apache::Test::vars('documentroot')."/index.html" => 200], + [ "/modules/rewrite/prefixstat/query/index.html?" + .Apache::Test::vars('serverroot')."/conf/core.conf" => 404], +); + +if (have_min_apache_version('2.4.60')){ + push(@prefixstats, ( + [ "/modules/rewrite/prefixstat/query-optin/index.html?" + .Apache::Test::vars('serverroot')."/conf/core.conf" => 200], + )); +} + +my @condexpr= ( + [ "/modules/rewrite/expr/notgone/false" => 404], + [ "/modules/rewrite/expr/notgone/nottrue" => 404], + [ "/modules/rewrite/expr/shouldredir/true" => 303], + [ "/modules/rewrite/expr/shouldredir/notfalse" => 303], +); if (!have_min_apache_version('2.4.19')) { # PR 50447, server context push @todo, 26 @@ -72,7 +119,8 @@ my $vary_header_tests = (have_min_apache_version("2.4.30") ? 9 : 0) + (have_min_ my $cookie_tests = have_min_apache_version("2.4.47") ? 6 : 0; my @redirects = map {$_->[2] ? $_ : ()} @redirects_all; -plan tests => @map * @num + 16 + $vary_header_tests + $cookie_tests + scalar(@escapes) + scalar(@redirects) + scalar(@bflags), +plan tests => @map * @num + 16 + $vary_header_tests + $cookie_tests + scalar(@escapes) + scalar(@redirects) + scalar(@bflags) + + scalar(@badquery) + scalar(@prefixstats) + scalar(@condexpr), todo => \@todo, need_module 'rewrite'; foreach (@map) { @@ -254,7 +302,38 @@ foreach my $t (@redirects) { t_debug "Check $url for redir $expect\n"; $r = GET($url, redirect_ok => 0); my $loc = $r->header("location"); + $loc = "" unless defined $loc; t_debug " redirect is $loc"; ok $loc =~ /$expect/; } +foreach my $t (@badquery) { + my $url= $t->[0]; + my $expect= $t->[1]; + $expect = "" unless defined $expect; + t_debug "Check $url for $expect\n"; + $r = GET($url, redirect_ok => 0); + my $received = $r->header("rewritten-query"); + $received = "" unless defined $received; + t_debug("rewritten query $received\n"); + ok t_cmp $received, $expect; +} + +foreach my $t (@condexpr) { + my $url = $t->[0]; + my $expect = $t->[1]; + t_debug "Check $url for $expect\n"; + $r = GET($url, redirect_ok => 0); + ok t_cmp $r->code, $expect; +} + +foreach my $t (@prefixstats) { + # Uses vhost "rewrite_prefix_stat" with larger LimitRequestLine + # Seems to have a side affect for any subsequent GET's + my $url= Apache::TestRequest::module2url("rewrite_prefix_stat", { path => $t->[0] }); + my $expect = $t->[1]; + t_debug "Check $url for $expect\n"; + $r = GET($url, redirect_ok => 0); + ok t_cmp $r->code, $expect; +} + diff --git a/debian/perl-framework/t/ssl/varlookup.t b/debian/perl-framework/t/ssl/varlookup.t index e00a143a..3ea682e0 100644 --- a/debian/perl-framework/t/ssl/varlookup.t +++ b/debian/perl-framework/t/ssl/varlookup.t @@ -11,12 +11,14 @@ unless (have_lwp) { plan tests => 0, need_lwp; } -use Time::localtime; +unless (eval "require Time::localtime") { + plan tests => 0, need 'Time::localtime'; +} my $config = Apache::Test::config(); my $vars = Apache::Test::vars(); my $server = $config->server; -my $time = localtime(); +my $time = Time::localtime::localtime(); (my $mmn = $config->{httpd_info}->{MODULE_MAGIC_NUMBER}) =~ s/:\d+$//; @@ -107,6 +109,12 @@ if (not have_min_apache_version('2.5.1')) { @vars = grep(!/_B64CERT/, @vars); } +if (not have_min_apache_version('2.5.1') or + Apache::Test::normalize_vstring(Apache::TestSSLCA::version()) < + Apache::Test::normalize_vstring("3.2.0")) { + @vars = grep(!/_HANDSHAKE_RTT/, @vars); +} + plan tests => scalar (@vars), need need_lwp, need_module('test_ssl'); for my $key (@vars) { @@ -188,6 +196,7 @@ SSL_CIPHER_EXPORT 'false' SSL_CIPHER_ALGKEYSIZE qr(^\d+$) SSL_CIPHER_USEKEYSIZE qr(^\d+$) SSL_SECURE_RENEG qr(^(false|true)$) +SSL_HANDSHAKE_RTT qr(^\d+$) SSL_CLIENT_S_DN "$client_dn" SSL_SERVER_S_DN qr(^$server_dn$) diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml index 33c3a640..4992afb1 100644 --- a/debian/salsa-ci.yml +++ b/debian/salsa-ci.yml @@ -2,3 +2,5 @@ include: - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml +variables: + RELEASE: 'trixie' diff --git a/debian/tests/control b/debian/tests/control index ad51ed69..2825fce5 100644 --- a/debian/tests/control +++ b/debian/tests/control @@ -1,4 +1,44 @@ -Tests: run-test-suite +Tests: run-test-suite_prefork +Features: no-build-needed +Restrictions: allow-stderr isolation-container breaks-testbed needs-root +Depends: apache2, + apache2-dev, + build-essential, + libanyevent-perl, + libanyevent-websocket-client-perl, + libcrypt-ssleay-perl, + libdatetime-perl, + libfcgi-perl, + libhtml-parser-perl, + libhttp-dav-perl, + libnet-ssleay-perl, + libpcre2-dev, + libprotocol-http2-perl, + libtime-hires-perl, + libwww-perl, + perl-doc + +Tests: run-test-suite_worker +Features: no-build-needed +Restrictions: allow-stderr isolation-container breaks-testbed needs-root +Depends: apache2, + apache2-dev, + build-essential, + libanyevent-perl, + libanyevent-websocket-client-perl, + libcrypt-ssleay-perl, + libdatetime-perl, + libfcgi-perl, + libhtml-parser-perl, + libhttp-dav-perl, + libnet-ssleay-perl, + libpcre2-dev, + libprotocol-http2-perl, + libtime-hires-perl, + libwww-perl, + perl-doc + +Tests: run-test-suite_event Features: no-build-needed Restrictions: allow-stderr isolation-container breaks-testbed needs-root Depends: apache2, diff --git a/debian/tests/run-test-suite b/debian/tests/run-test-suite.sh similarity index 70% rename from debian/tests/run-test-suite rename to debian/tests/run-test-suite.sh index 2ee9e31e..1107104e 100644 --- a/debian/tests/run-test-suite +++ b/debian/tests/run-test-suite.sh @@ -1,23 +1,6 @@ #!/bin/bash . /etc/apache2/envvars -set -xeu -set -o pipefail -export LANG=C -export PATH=/usr/lib/ccache:$PATH -# set to "-v t/modules/ext_filter.t ..." to run only a few test, but verbose -TESTS="" -TESTUSER=tuser - -# The test framework assumes localhost resolves exclusively to 127.0.0.1 -# (and not to ::1). So remove 'localhost' from the ::1 entry. -perl -p -i -e ' if (/^\s*::1\s+/) { s/\s+localhost\s+/ /g }' /etc/hosts - -useradd --user-group --system --create-home -s /bin/bash $TESTUSER -cp -a debian/perl-framework $AUTOPKGTEST_TMP -cd $AUTOPKGTEST_TMP/perl-framework - -export HARNESS_VERBOSE=1 run_tests () { local MPM=$1 @@ -60,7 +43,3 @@ run_tests () { fi return 0 } - -run_tests mpm_prefork -run_tests mpm_worker -run_tests mpm_event diff --git a/debian/tests/run-test-suite_event b/debian/tests/run-test-suite_event new file mode 100755 index 00000000..8c52ff4a --- /dev/null +++ b/debian/tests/run-test-suite_event @@ -0,0 +1,24 @@ +#!/bin/bash + +. debian/tests/run-test-suite.sh + +set -xeu +set -o pipefail +export LANG=C +export PATH=/usr/lib/ccache:$PATH +# set to "-v t/modules/ext_filter.t ..." to run only a few test, but verbose +TESTS="" +TESTUSER=tuserevent + + +# The test framework assumes localhost resolves exclusively to 127.0.0.1 +# (and not to ::1). So remove 'localhost' from the ::1 entry. +perl -p -i -e ' if (/^\s*::1\s+/) { s/\s+localhost\s+/ /g }' /etc/hosts + +useradd --user-group --system --create-home -s /bin/bash $TESTUSER +cp -a debian/perl-framework $AUTOPKGTEST_TMP +cd $AUTOPKGTEST_TMP/perl-framework + +export HARNESS_VERBOSE=1 + +run_tests mpm_event diff --git a/debian/tests/run-test-suite_prefork b/debian/tests/run-test-suite_prefork new file mode 100755 index 00000000..174d2607 --- /dev/null +++ b/debian/tests/run-test-suite_prefork @@ -0,0 +1,24 @@ +#!/bin/bash + +. debian/tests/run-test-suite.sh + +set -xeu +set -o pipefail +export LANG=C +export PATH=/usr/lib/ccache:$PATH +# set to "-v t/modules/ext_filter.t ..." to run only a few test, but verbose +TESTS="" +TESTUSER=tuserprefork + + +# The test framework assumes localhost resolves exclusively to 127.0.0.1 +# (and not to ::1). So remove 'localhost' from the ::1 entry. +perl -p -i -e ' if (/^\s*::1\s+/) { s/\s+localhost\s+/ /g }' /etc/hosts + +useradd --user-group --system --create-home -s /bin/bash $TESTUSER +cp -a debian/perl-framework $AUTOPKGTEST_TMP +cd $AUTOPKGTEST_TMP/perl-framework + +export HARNESS_VERBOSE=1 + +run_tests mpm_prefork diff --git a/debian/tests/run-test-suite_worker b/debian/tests/run-test-suite_worker new file mode 100755 index 00000000..8820c633 --- /dev/null +++ b/debian/tests/run-test-suite_worker @@ -0,0 +1,24 @@ +#!/bin/bash + +. debian/tests/run-test-suite.sh + +set -xeu +set -o pipefail +export LANG=C +export PATH=/usr/lib/ccache:$PATH +# set to "-v t/modules/ext_filter.t ..." to run only a few test, but verbose +TESTS="" +TESTUSER=tuserworker + + +# The test framework assumes localhost resolves exclusively to 127.0.0.1 +# (and not to ::1). So remove 'localhost' from the ::1 entry. +perl -p -i -e ' if (/^\s*::1\s+/) { s/\s+localhost\s+/ /g }' /etc/hosts + +useradd --user-group --system --create-home -s /bin/bash $TESTUSER +cp -a debian/perl-framework $AUTOPKGTEST_TMP +cd $AUTOPKGTEST_TMP/perl-framework + +export HARNESS_VERBOSE=1 + +run_tests mpm_worker diff --git a/docs/docroot/index.html b/docs/docroot/index.html index f5f1c377..a4e4d11f 100644 --- a/docs/docroot/index.html +++ b/docs/docroot/index.html @@ -1 +1,9 @@ -

It works!

+ + + +It works! Apache httpd + + +

It works!

+ + diff --git a/docs/manual/bind.html.de b/docs/manual/bind.html.de index fe44ac30..8948c579 100644 --- a/docs/manual/bind.html.de +++ b/docs/manual/bind.html.de @@ -14,7 +14,7 @@ - +