SLFO-pool/apache2
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync from SUSE:SLFO:Main apache2 revision 3122774273c66f9a28ec050b3a5807bf

Browse Source
This commit is contained in:
Adrian Schröter 2024-05-03 11:05:23 +02:00
commit 80a23ce35f
59 changed files with 20644 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
.gitattributes vendored Normal file
View File

@ -0,0 +1,23 @@
## Default LFS
*.7z filter=lfs diff=lfs merge=lfs -text
*.bsp filter=lfs diff=lfs merge=lfs -text
*.bz2 filter=lfs diff=lfs merge=lfs -text
*.gem filter=lfs diff=lfs merge=lfs -text
*.gz filter=lfs diff=lfs merge=lfs -text
*.jar filter=lfs diff=lfs merge=lfs -text
*.lz filter=lfs diff=lfs merge=lfs -text
*.lzma filter=lfs diff=lfs merge=lfs -text
*.obscpio filter=lfs diff=lfs merge=lfs -text
*.oxt filter=lfs diff=lfs merge=lfs -text
*.pdf filter=lfs diff=lfs merge=lfs -text
*.png filter=lfs diff=lfs merge=lfs -text
*.rpm filter=lfs diff=lfs merge=lfs -text
*.tbz filter=lfs diff=lfs merge=lfs -text
*.tbz2 filter=lfs diff=lfs merge=lfs -text
*.tgz filter=lfs diff=lfs merge=lfs -text
*.ttf filter=lfs diff=lfs merge=lfs -text
*.txz filter=lfs diff=lfs merge=lfs -text
*.whl filter=lfs diff=lfs merge=lfs -text
*.xz filter=lfs diff=lfs merge=lfs -text
*.zip filter=lfs diff=lfs merge=lfs -text
*.zst filter=lfs diff=lfs merge=lfs -text

14
_multibuild Normal file
View File

@ -0,0 +1,14 @@
<multibuild>
<package>event</package>
<package>worker</package>
<package>prefork</package>
<package>utils</package>
<package>devel</package>
<package>manual</package>
<package>test_event</package>
<package>test_worker</package>
<package>test_prefork</package>
<package>test_devel</package>
<package>test_main</package>
</multibuild>

12
apache-test-application-xml-type.patch Normal file
View File

@ -0,0 +1,12 @@
Index: httpd-framework/t/conf/extra.conf.in
===================================================================
--- a/httpd-framework/t/conf/extra.conf.in 2020-06-15 10:43:26.156701553 +0200
+++ b/httpd-framework/t/conf/extra.conf.in 2020-06-15 10:46:16.141693081 +0200
@@ -875,6 +875,7 @@ LimitRequestFields 32
</IfModule>
</Directory>
<Directory @SERVERROOT@/htdocs/modules/filter/bytype>
+ AddType application/xml .xml
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE text/xml

14
apache-test-turn-off-variables-in-ssl-var-lookup.patch Normal file
View File

@ -0,0 +1,14 @@
Index: httpd-framework/t/ssl/varlookup.t
===================================================================
--- a/httpd-framework/t/ssl/varlookup.t 2016-10-25 14:30:54.250707932 +0200
+++ b/httpd-framework/t/ssl/varlookup.t 2016-10-27 15:38:52.440667690 +0200
@@ -210,9 +210,7 @@ SSL_SERVER_S_DN_UID
SSL_CLIENT_S_DN_Email "$client_dn{$email_field}"
SSL_SERVER_S_DN_Email "$server_dn{$email_field}"
SSL_CLIENT_SAN_Email_0 "$san_email"
-SSL_SERVER_SAN_DNS_0 "$san_dns"
SSL_CLIENT_SAN_OTHER_msUPN_0 "$san_msupn"
-SSL_SERVER_SAN_OTHER_dnsSRV_0 "$san_dnssrv"
SSL_CLIENT_I_DN "$client_i_dn"
SSL_SERVER_I_DN "$server_i_dn"

173
apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch Normal file
View File

@ -0,0 +1,173 @@
From 530b5797af919d6d7ab7d6418d9feeb1abb914ae Mon Sep 17 00:00:00 2001
From: Justin Erenkrantz <jerenkrantz@apache.org>
Date: Mon, 30 Dec 2013 20:01:14 +0000
Subject: [PATCH] Add directives to control two protocol options:
HttpContentLengthHeadZero - allow Content-Length of 0 to be returned on HEAD
HttpExpectStrict - allow admin to control whether we must see "100-continue"
This is helpful when using Ceph's radosgw and httpd.
Inspired by: Yehuda Sadeh <yehuda@inktank.com>
See https://github.com/ceph/apache2/commits/precise
* include/http_core.h
(core_server_config): Add http_cl_head_zero and http_expect_strict fields.
* modules/http/http_filters.c
(ap_http_header_filter): Only clear out the C-L if http_cl_head_zero is not
explictly set.
* server/core.c
(merge_core_server_configs): Add new fields.
(set_cl_head_zero, set_expect_strict): New config helpers.
(HttpContentLengthHeadZero, HttpExpectStrict): Declare new directives.
* server/protocol.c
(ap_read_request): Allow http_expect_strict to control if we return 417.
* include/ap_mmn.h
(MODULE_MAGIC_NUMBER_MAJOR, MODULE_MAGIC_NUMBER_MINOR): Bump.
* CHANGES: Add a brief description.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1554303 13f79535-47bb-0310-9956-ffa450edef68
Conflicts:
CHANGES
include/ap_mmn.h
include/http_core.h
server/core.c
---
CHANGES | 3 +++
include/ap_mmn.h | 4 +++-
include/http_core.h | 9 +++++++++
modules/http/http_filters.c | 10 +++++++++-
server/core.c | 36 ++++++++++++++++++++++++++++++++++++
server/protocol.c | 25 +++++++++++++++++--------
6 files changed, 77 insertions(+), 10 deletions(-)
Index: httpd-2.4.49/modules/http/http_filters.c
===================================================================
--- httpd-2.4.49.orig/modules/http/http_filters.c 2021-05-11 17:21:43.000000000 +0200
+++ httpd-2.4.49/modules/http/http_filters.c 2021-09-17 09:33:49.496853894 +0200
@@ -1488,10 +1488,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_
* zero C-L to the client. We can't just remove the C-L filter,
* because well behaved 2.0 handlers will send their data down the stack,
* and we will compute a real C-L for the head request. RBB
+ *
+ * Allow modification of this behavior through the
+ * HttpContentLengthHeadZero directive.
+ *
+ * The default (unset) behavior is to squelch the C-L in this case.
*/
+ core_server_config *conf = ap_get_core_module_config(r->server->module_config);
if (r->header_only
&& (clheader = apr_table_get(r->headers_out, "Content-Length"))
- && !strcmp(clheader, "0")) {
+ && !strcmp(clheader, "0")
+ && conf->http_cl_head_zero != AP_HTTP_CL_HEAD_ZERO_ENABLE) {
apr_table_unset(r->headers_out, "Content-Length");
}
Index: httpd-2.4.49/server/core.c
===================================================================
--- httpd-2.4.49.orig/server/core.c 2021-05-27 15:08:21.000000000 +0200
+++ httpd-2.4.49/server/core.c 2021-09-17 09:33:49.496853894 +0200
@@ -551,6 +551,12 @@ static void *merge_core_server_configs(a
if (virt->http_methods != AP_HTTP_METHODS_UNSET)
conf->http_methods = virt->http_methods;
+ if (virt->http_cl_head_zero != AP_HTTP_CL_HEAD_ZERO_UNSET)
+ conf->http_cl_head_zero = virt->http_cl_head_zero;
+
+ if (virt->http_expect_strict != AP_HTTP_EXPECT_STRICT_UNSET)
+ conf->http_expect_strict = virt->http_expect_strict;
+
/* no action for virt->accf_map, not allowed per-vhost */
if (virt->protocol)
@@ -4142,6 +4148,32 @@ static const char *set_http_method(cmd_p
return NULL;
}
+static const char *set_cl_head_zero(cmd_parms *cmd, void *dummy, int arg)
+{
+ core_server_config *conf =
+ ap_get_core_module_config(cmd->server->module_config);
+
+ if (arg) {
+ conf->http_cl_head_zero = AP_HTTP_CL_HEAD_ZERO_ENABLE;
+ } else {
+ conf->http_cl_head_zero = AP_HTTP_CL_HEAD_ZERO_DISABLE;
+ }
+ return NULL;
+}
+
+static const char *set_expect_strict(cmd_parms *cmd, void *dummy, int arg)
+{
+ core_server_config *conf =
+ ap_get_core_module_config(cmd->server->module_config);
+
+ if (arg) {
+ conf->http_expect_strict = AP_HTTP_EXPECT_STRICT_ENABLE;
+ } else {
+ conf->http_expect_strict = AP_HTTP_EXPECT_STRICT_DISABLE;
+ }
+ return NULL;
+}
+
static apr_hash_t *errorlog_hash;
static int log_constant_item(const ap_errorlog_info *info, const char *arg,
@@ -4685,6 +4717,10 @@ AP_INIT_TAKE1("TraceEnable", set_trace_e
"'on' (default), 'off' or 'extended' to trace request body content"),
AP_INIT_FLAG("MergeTrailers", set_merge_trailers, NULL, RSRC_CONF,
"merge request trailers into request headers or not"),
+AP_INIT_FLAG("HttpContentLengthHeadZero", set_cl_head_zero, NULL, OR_OPTIONS,
+ "whether to permit Content-Length of 0 responses to HEAD requests"),
+AP_INIT_FLAG("HttpExpectStrict", set_expect_strict, NULL, OR_OPTIONS,
+ "whether to return a 417 if a client doesn't send 100-Continue"),
AP_INIT_ITERATE("Protocols", set_protocols, NULL, RSRC_CONF,
"Controls which protocols are allowed"),
AP_INIT_TAKE1("ProtocolsHonorOrder", set_protocols_honor_order, NULL, RSRC_CONF,
Index: httpd-2.4.49/server/protocol.c
===================================================================
--- httpd-2.4.49.orig/server/protocol.c 2021-09-17 09:33:49.496853894 +0200
+++ httpd-2.4.49/server/protocol.c 2021-09-17 10:15:28.643596021 +0200
@@ -1056,6 +1056,11 @@ AP_DECLARE(int) ap_check_request_header(
if (ap_cstr_casecmp(expect, "100-continue") == 0) {
r->expecting_100 = 1;
}
+ else if (conf->http_expect_strict == AP_HTTP_EXPECT_STRICT_DISABLE) {
+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02595)
+ "client sent an unrecognized expectation value "
+ "of Expect (not fatal): %s", expect);
+ }
else {
ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00570)
"client sent an unrecognized expectation value "
Index: httpd-2.4.49/include/http_core.h
===================================================================
--- httpd-2.4.49.orig/include/http_core.h 2021-05-27 15:08:21.000000000 +0200
+++ httpd-2.4.49/include/http_core.h 2021-09-17 09:33:49.496853894 +0200
@@ -733,6 +733,16 @@ typedef struct {
#define AP_MERGE_TRAILERS_DISABLE 2
int merge_trailers;
+#define AP_HTTP_CL_HEAD_ZERO_UNSET 0
+#define AP_HTTP_CL_HEAD_ZERO_ENABLE 1
+#define AP_HTTP_CL_HEAD_ZERO_DISABLE 2
+ int http_cl_head_zero;
+
+#define AP_HTTP_EXPECT_STRICT_UNSET 0
+#define AP_HTTP_EXPECT_STRICT_ENABLE 1
+#define AP_HTTP_EXPECT_STRICT_DISABLE 2
+ int http_expect_strict;
+
apr_array_header_t *protocols;
int protocols_honor_order;
@@ -776,7 +786,6 @@ apr_status_t ap_core_input_filter(ap_fil
apr_off_t readbytes);
apr_status_t ap_core_output_filter(ap_filter_t *f, apr_bucket_brigade *b);
-
AP_DECLARE(const char*) ap_get_server_protocol(server_rec* s);
AP_DECLARE(void) ap_set_server_protocol(server_rec* s, const char* proto);

51
apache2-LimitRequestFieldSize-limits-headers.patch Normal file
View File

@ -0,0 +1,51 @@
Index: httpd-2.4.46/server/util_script.c
===================================================================
--- httpd-2.4.46.orig/server/util_script.c 2020-07-20 07:58:49.000000000 +0200
+++ httpd-2.4.46/server/util_script.c 2020-11-10 16:10:54.525476516 +0100
@@ -468,11 +468,20 @@ AP_DECLARE(int) ap_scan_script_header_er
apr_table_t *cookie_table;
int trace_log = APLOG_R_MODULE_IS_LEVEL(r, module_index, APLOG_TRACE1);
int first_header = 1;
+ int wlen;
if (buffer) {
*buffer = '\0';
}
- w = buffer ? buffer : x;
+
+ if (r->server->limit_req_fieldsize + 2 > MAX_STRING_LEN) {
+ w = apr_palloc(r->pool, r->server->limit_req_fieldsize + 2);
+ wlen = r->server->limit_req_fieldsize + 2;
+ } else {
+ w = buffer ? buffer : x;
+ wlen = MAX_STRING_LEN;
+ }
+
/* temporary place to hold headers to merge in later */
merge = apr_table_make(r->pool, 10);
@@ -488,7 +497,7 @@ AP_DECLARE(int) ap_scan_script_header_er
while (1) {
- int rv = (*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data);
+ int rv = (*getsfunc) (w, wlen - 1, getsfunc_data);
if (rv == 0) {
const char *msg = "Premature end of script headers";
if (first_header)
@@ -603,10 +612,13 @@ AP_DECLARE(int) ap_scan_script_header_er
if (!(l = strchr(w, ':'))) {
if (!buffer) {
/* Soak up all the script output - may save an outright kill */
- while ((*getsfunc)(w, MAX_STRING_LEN - 1, getsfunc_data) > 0) {
+ while ((*getsfunc) (w, wlen - 1, getsfunc_data)) {
continue;
}
- }
+ } else if (w != buffer) {
+ strncpy(buffer, w, MAX_STRING_LEN - 1);
+ buffer[MAX_STRING_LEN - 1] = 0;
+ }
/* Intentional no APLOGNO */
ap_log_rerror(SCRIPT_LOG_MARK, APLOG_ERR|APLOG_TOCLIENT, 0, r,

66
apache2-README-access_compat.txt Normal file
View File

@ -0,0 +1,66 @@
Dear System Administrator,
with apache 2.4, some changes have been introduced that affect apache's
access control scheme.
Previously, the directives "Allow", "Deny" and "Order" have determined
if access to a resource has been granted with apache 2.2.
Example (from /etc/apache2/httpd.conf, the main apache configuration file):
<Directory />
Options None
AllowOverride None
Order deny,allow
Deny from all
</Directory>
With 2.4, these directives have been replaced by the "Require" directive,
which is contained in the mod_authz_core module, and enhanced by the
mod_authz_host module.
"Require" understands several regulative groups, such as
env access granted if an apache environment variable is set
method access granted only for given HTTP methods (GET, POST, ...)
expr access granted if the expression following expr evaluates to true
user access granted if the named users can access the resource
group analogous to user for groups
valid-user access granted if a valid user requests it
ip access granted if the client's IP address matches
all granted unconditionally accepted/granted
all denied unconditionally denied access
By consequence, the set of 2.2 directives
Order deny,allow
Deny from all
can be translated to the apache 2.4 Require directive
Require all denied
The SUSE Linux Enterprise 12 package set for apache comes with a compatibility
module called mod_access_compat, which, if loaded, causes apache to understand
the 2.2 "Allow/Deny" directives. Unfortunately, the mixed usage of the
2.2 "Allow/Deny" and the 2.4 "Require" directive will lead to either unexpected
or inconclusive results. By consequence, one should decide if the 2.2 or the
2.4 access control mimics shall be used.
Fortunately, it is easy to switch from the new back to the old scheme:
a2enmod access_compat
will enable the 2.2 scheme,
a2enmod -d access_compat
will disable the old scheme again, thereby enabling the new scheme.
Of course, an apache restart is needed:
systemctl restart apache2
The SUSE apache configuration framework can work with both the new and the
old scheme, conditional if the access_compat apache module is loaded.
Additional pointers about the access controls new in apache 2.4 and about
the access_compat module can be found here:
http://httpd.apache.org/docs/current/mod/mod_authz_core.html
http://httpd.apache.org/docs/current/mod/mod_authz_host.html
http://httpd.apache.org/docs/current/mod/mod_access_compat.html

27
apache2-README-configuration.txt Normal file
View File

@ -0,0 +1,27 @@
httpd configuration @ SUSE
==========================
`httpd` command can stand for `httpd-prefork`, `httpd-worker`
and `httpd-event`, depending on which httpd mpm rpm package is
installed. In case more such mpm packages are installed, `httpd`
points to one with higher priority defined in update alternatives.
There are several levels of configuration possible:
1. systemctl start apache2
When httpd is run trough systemctl service, /etc/apache2/httpd.conf
is used as a base and sysconfig varibables translated into
/etc/apache2/sysconfig.d/ used.
2. httpd -f /etc/apache2/httpd.conf
/etc/apache2/httpd.conf can be used directly, without systemd
assistance. /etc/apache2/sysconfig.d is not included in that
case.
3. httpd -f /usr/share/doc/package/apache2/conf/httpd.conf
It is possible to experiment with upstream example
configuration. Do not forgot
For more configuration tips, install documentation package
apache-rex.

42
apache2-README-instances.txt Normal file
View File

@ -0,0 +1,42 @@
Dear System Administrator,
SUSE Apache package comes with the possibility to run more instances
of Apache process on one system.
As always,
sytemctl start apache2
activates default instance of the server, which expects sysconfig setting
in /etc/sysconfig/apache2. If this file is not present, or APACHE_HTTPD_CONF
in there is not set, then it requires /etc/apache2/httpd.conf.
Any other instance can be activated via
systemctl start apache2@<instancename>
where <instancename> is ASCII identifier of the instance. For example
systemctl start apache2@myweb.org
This call tries to read /etc/sysconfig/apache2@<instancename> and if this
file is not present or APACHE_HTTPD_CONF is not set there, it requires
/etc/apache2@<instancename>/httpd.conf.
NOTES:
* /etc/sysconfig/apache2@<instancename> can hold any sysconfig variable
/etc/sysconfig/apache2 can, including module loading and MPM setting,
* default instance does not have to run when running other instances
* a2enmod, a2dismod and apachectl operates over default instance if
not specified otherwise via HTTPD_INSTANCE. For example,
export HTTPD_INSTANCE=myweb.org
a2enmod access_compat
a2enmod status
apachectl start
will add access_compat and status modules to APACHE_MODULES
variable of /etc/sysconfig/apache2@myweb.org and then starts
myweb.org instance.
* /usr/sbin/httpd link is created according to setup of default
instance (/etc/sysconfig/apache2:APACHE_MPM)

55
apache2-a2enflag Normal file
View File

@ -0,0 +1,55 @@
#!/bin/bash
# Copyright 2005 Peter Poeml <apache@suse.de>. All Rights Reserved.
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
function usage() {
echo "$(basename $0): enable/disable a flag in $var in $sysconf"
echo
echo "usage: $(basename $0) [-d] flag"
echo
echo "HTTPD_INSTANCE=<instance_name> environment variable can be used to specify"
echo "apache instance (see README-instances.txt); sysconfig file is expected"
echo "at /etc/sysconfig/apache2@<instance_name> ."
exit 1
}
unset instance_suffix
if [ -n "$HTTPD_INSTANCE" ]; then
instance_suffix="@$HTTPD_INSTANCE"
fi
sysconf=/etc/sysconfig/apache2$instance_suffix
var=APACHE_SERVER_FLAGS
PATH="$PATH:/usr/bin:/usr/sbin:/usr/share/apache2"
if [ $# -lt 1 ]; then
usage
fi
action=enable
case "$1" in
-d) action=disable; shift;;
-*) usage;;
esac
case $(basename $0) in
a2disflag) action=disable;;
esac
flag=$1
if [ $action = enable ]; then
sysconf_addword $sysconf $var $flag
exit $?
else
sysconf_addword -r $sysconf $var $flag
exit $?
fi

68
apache2-a2enmod Normal file
View File

@ -0,0 +1,68 @@
#!/bin/bash
# Copyright 2005 Peter Poeml <apache@suse.de>. All Rights Reserved.
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
function usage() {
echo "$(basename $0): enable/disable an apache module in $var in $sysconf"
echo
echo "usage: $(basename $0) [-d] module"
echo " $(basename $0) -l list modules"
echo " $(basename $0) -q module query if module is installed"
echo
echo "HTTPD_INSTANCE=<instance_name> environment variable can be used to specify"
echo "apache instance (see README-instances.txt); sysconfig file is expected"
echo "at /etc/sysconfig/apache2@<instance_name> ."
exit 1
}
unset instance_suffix
if [ -n "$HTTPD_INSTANCE" ]; then
instance_suffix="@$HTTPD_INSTANCE"
fi
sysconf=/etc/sysconfig/apache2$instance_suffix
var=APACHE_MODULES
PATH="$PATH:/usr/bin:/usr/sbin:/usr/share/apache2"
if [ $# -lt 1 ]; then
usage
fi
action=enable
case "$1" in
-d) action=disable; shift;;
-l) action=list; shift;;
-q) action=query; shift;;
-*) usage;;
esac
case $(basename $0) in
a2dismod) action=disable;;
esac
mod=$1
if [ $action = enable ]; then
sysconf_addword $sysconf $var $mod
exit $?
elif [ $action = disable ]; then
sysconf_addword -r $sysconf $var $mod
exit $?
elif [ $action = query ]; then
if a2enmod -l | grep -q "\<$mod\>"; then
exit 0
else
exit 1
fi
else
source $sysconf
eval echo \$$var
fi

27
apache2-apachectl.patch Normal file
View File

@ -0,0 +1,27 @@
Index: httpd-2.4.46/support/apachectl.in
===================================================================
--- httpd-2.4.46.orig/support/apachectl.in 2012-02-01 04:47:28.000000000 +0100
+++ httpd-2.4.46/support/apachectl.in 2020-11-09 15:29:52.479823800 +0100
@@ -42,7 +42,7 @@ ARGV="$@"
# -------------------- --------------------
#
# the path to your httpd binary, including options if necessary
-HTTPD='@exp_sbindir@/@progname@'
+HTTPD='@exp_sbindir@/start_apache2'
#
# pick up any necessary environment variables
if test -f @exp_sbindir@/envvars; then
@@ -52,7 +52,11 @@ fi
# a command that outputs a formatted text version of the HTML at the
# url given on the command line. Designed for lynx, however other
# programs may work.
-LYNX="@LYNX_PATH@ -dump"
+if [ -x "`which w3m`" ]; then
+ LYNX="w3m -dump -cols ${COLUMNS:-80}"
+elif [ -x "`which lynx`" ]; then
+ LYNX="lynx -dump -width=${COLUMNS:-80}"
+fi
#
# the URL to your server's mod_status status page. If you do not
# have one, then status and fullstatus will not work.

23
apache2-check_forensic Normal file
View File

@ -0,0 +1,23 @@
#!/bin/sh
# check_forensic <forensic log file>
# Author: Peter Poeml <apache@suse.de>
# check the forensic log for requests that did not complete
# output the request log for each one
# This script is based on Ben Laurie's check_forensic, but is adjusted for GNU
# tools (as used on Linux) and it works in a safe tmpdir directory.
# todo: rewrite in a form that allows running on more operating systems.
F=${1:?give filename as argument. cannot read from stdin.}
tmpprefix=${TMPDIR:-/tmp}/check_forensic.XXXXXX
tdir=$(mktemp -d $tmpprefix); test $? = 0 || { echo >&2 Could not create tmpdir. Exiting; exit 1; }
cut -f 1 -d '|' $F > $tdir/fc-all.$$
grep ^+ < $tdir/fc-all.$$ | cut -c2- | sort > $tdir/fc-in.$$
grep -- ^- < $tdir/fc-all.$$ | cut -c2- | sort > $tdir/fc-out.$$
join -v 1 $tdir/fc-in.$$ $tdir/fc-out.$$ | xargs -ixx egrep "^\\+xx" $F
rm $tdir/fc-all.$$ $tdir/fc-in.$$ $tdir/fc-out.$$
rmdir $tdir

123
apache2-default-server.conf Normal file
View File

@ -0,0 +1,123 @@
#
# Global configuration that will be applicable for all virtual hosts, unless
# deleted here, or overriden elswhere.
#
DocumentRoot "/srv/www/htdocs"
#
# Configure the DocumentRoot
#
<Directory "/srv/www/htdocs">
# Possible values for the Options directive are "None", "All",
# or any combination of:
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
#
# Note that "MultiViews" must be named *explicitly* --- "Options All"
# doesn't give it to you.
#
# The Options directive is both complicated and important. Please see
# https://httpd.apache.org/docs/2.4/mod/core.html#options
# for more information.
# NOTE: For directories where RewriteRule is used, FollowSymLinks
# or SymLinksIfOwnerMatch needs to be set in Options directive.
Options None
# AllowOverride controls what directives may be placed in .htaccess files.
# It can be "All", "None", or any combination of the keywords:
# Options FileInfo AuthConfig Limit
AllowOverride None
# Controls who can get stuff from this server.
<IfModule !mod_access_compat.c>
Require all granted
</IfModule>
<IfModule mod_access_compat.c>
Order allow,deny
Allow from all
</IfModule>
</Directory>
# Aliases: aliases can be added as needed (with no limit). The format is
# Alias fakename realname
#
# Note that if you include a trailing / on fakename then the server will
# require it to be present in the URL. So "/icons" isn't aliased in this
# example, only "/icons/". If the fakename is slash-terminated, then the
# realname must also be slash terminated, and if the fakename omits the
# trailing slash, the realname must also omit it.
#
# We include the /icons/ alias for FancyIndexed directory listings. If you
# do not use FancyIndexing, you may comment this out.
#
Alias /icons/ "/usr/share/apache2/icons/"
<Directory "/usr/share/apache2/icons">
Options Indexes MultiViews
AllowOverride None
<IfModule !mod_access_compat.c>
Require all granted
</IfModule>
<IfModule mod_access_compat.c>
Order allow,deny
Allow from all
</IfModule>
</Directory>
# ScriptAlias: This controls which directories contain server scripts.
# ScriptAliases are essentially the same as Aliases, except that
# documents in the realname directory are treated as applications and
# run by the server when requested rather than as documents sent to the client.
# The same rules about trailing "/" apply to ScriptAlias directives as to
# Alias.
#
ScriptAlias /cgi-bin/ "/srv/www/cgi-bin/"
# "/srv/www/cgi-bin" should be changed to whatever your ScriptAliased
# CGI directory exists, if you have that configured.
#
<Directory "/srv/www/cgi-bin">
AllowOverride None
Options +ExecCGI -Includes
<IfModule !mod_access_compat.c>
Require all granted
</IfModule>
<IfModule mod_access_compat.c>
Order allow,deny
Allow from all
</IfModule>
</Directory>
# UserDir: The name of the directory that is appended onto a user's home
# directory if a ~user request is received.
#
# To disable it, simply remove userdir from the list of modules in APACHE_MODULES
# in /etc/sysconfig/apache2.
#
<IfModule mod_userdir.c>
# Note that the name of the user directory ("public_html") cannot simply be
# changed here, since it is a compile time setting. The apache package
# would have to be rebuilt. You could work around by deleting
# /usr/sbin/suexec, but then all scripts from the directories would be
# executed with the UID of the webserver.
UserDir public_html
# The actual configuration of the directory is in
# /etc/apache2/mod_userdir.conf.
Include /etc/apache2/mod_userdir.conf
# You can, however, change the ~ if you find it awkward, by mapping e.g.
# http://www.example.com/users/karl-heinz/ --> /home/karl-heinz/public_html/
#AliasMatch ^/users/([a-zA-Z0-9-_.]*)/?(.*) /home/$1/public_html/$2
</IfModule>
# Include all *.conf files from /etc/apache2/conf.d/.
#
# This is mostly meant as a place for other RPM packages to drop in their
# configuration snippet.
#
# You can comment this out here if you want those bits include only in a
# certain virtual host, but not here.
#
IncludeOptional /etc/apache2/conf.d/*.conf
# The manual... if it is installed ('?' means it won't complain)
IncludeOptional /etc/apache2/conf.d/apache2-manual?conf

73
apache2-errors.conf Normal file
View File

@ -0,0 +1,73 @@
#
# Customizable error responses come in three flavors:
# 1) plain text 2) local redirects 3) external redirects
#
# Some examples:
#ErrorDocument 500 "The server made a boo boo."
#ErrorDocument 404 /missing.html
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
#ErrorDocument 402 http://www.example.com/subscription_info.html
#
#
# Putting this all together, we can internationalize error responses.
#
# We use Alias to redirect any /error/HTTP_<error>.html.var response to
# our collection of by-error message multi-language collections. We use
# includes to substitute the appropriate text.
#
# You can modify the messages' appearance without changing any of the
# default HTTP_<error>.html.var files by adding the line:
#
# Alias /error/include/ "/your/include/path/"
#
# which allows you to create your own set of files by starting with the
# /usr/share/apache2/error/include/ files and copying them to /your/include/path/,
# even on a per-VirtualHost basis. The default include files will display
# your Apache version number and your ServerAdmin email address regardless
# of the setting of ServerSignature.
#
# The internationalized error documents require mod_alias, mod_include
# and mod_negotiation. To activate them, uncomment the following 30 lines.
Alias /error/ "/usr/share/apache2/error/"
<IfModule mod_negotiation.c>
<IfModule mod_include.c>
<Directory "/usr/share/apache2/error">
AllowOverride None
Options IncludesNoExec
AddOutputFilter Includes html
AddHandler type-map var
<IfModule !mod_access_compat.c>
Require all granted
</IfModule>
<IfModule mod_access_compat.c>
Order allow,deny
Allow from all
</IfModule>
LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
ForceLanguagePriority Prefer Fallback
</Directory>
ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
ErrorDocument 410 /error/HTTP_GONE.html.var
ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
</IfModule>
</IfModule>

151
apache2-find_directives Normal file
View File

@ -0,0 +1,151 @@
#!/bin/bash
exit_code=1
function usage
{
echo "Check for directives in apache configuration (including"
echo "potentially reachable .htaccess files)"
echo ""
echo "Usage: $0 [options]"
echo ""
echo " options: "
echo " -s string system configuration root"
echo " [default: $system_conf_root]"
echo " -d string directives to search"
echo " [default: $check_directives]"
echo " -n string htaccess file name(s)"
echo " [default: $htaccess_names]"
echo " -q do not print where directive(s) was found"
echo " -v as -v plus trace and matched lines"
echo " -h this help"
echo ""
echo "Return Value: 0 at least one occurence found in apache config"
echo " 1 no occurence found"
echo " 2 wrong arguments"
echo ""
echo "Example: "
echo " $ $0 -s '/etc/apache2/default-server.conf' -n '.htaccess .htconfig' -d 'Require' -v"
echo " Checking /etc/apache2/default-server.conf .. FOUND"
echo " Checking /srv/www/htdocs/foo/.htaccess .. FOUND"
echo " Checking /etc/apache2/conf.d/gitweb.conf .. FOUND"
echo " $"
}
function find_directives_in_file
{
file=$1
pattern=$(echo $check_directives |
sed 's:\([^ \t]\+\):\\b\1\\b:g' |
sed 's:\s\+:\\|:g')
output=$(cat $file | sed 's:#.*::' | grep -i "$pattern")
if [ $? -eq 0 ]; then
[ $verbosity -ge 1 ] && echo " Checking $file .. FOUND"
[ $verbosity -ge 2 ] && echo " Output: [$output]"
exit_code=0
else
[ $verbosity -ge 2 ] && echo " Checking $file .. NOT FOUND"
fi
}
function check_conf_file
{
conf_file=$1
[ $verbosity -ge 2 ] && echo "CONFIG FILE: $conf_file"
find_directives_in_file $conf_file
# check all directories with AllowOverride not None
# for .htaccess files
directories=$(grep -i '<directory' $conf_file |
sed 's:#.*::' |
sed 's:.*<directory\s*\([^ \t]*\)\s*>:\1:I' |
tr -d '"')
find_names=$(echo $htaccess_names |
sed 's:^\s\+::' |
sed 's:\s\+$::' |
sed 's:\s\+: -o -name :g' |
sed 's:^:-name :')
for dir in $directories; do
[ $verbosity -ge 2 ] && echo " Directory: $dir"
allow_override=$(grep -i -Pzo "(?s)<directory[\s\"]*$dir.*?</directory>" $conf_file |
sed 's:#.*::'|
grep AllowOverride)
[ $verbosity -ge 2 ] && echo " override: $allow_override"
shopt -s nocasematch
if [[ ! $allow_override =~ allowoverride.*none ]]; then
for htfile in $(find $dir $find_names); do
find_directives_in_file $htfile
done
fi
shopt -u nocasematch
done
# check all Include or IncludeOptional files recursively
include_files=$(grep '^\s*Include' $conf_file |
sed 's:#.*::' |
sed 's:Include[^ ]*\s\+::' |
tr '\n' ' ')
[ $verbosity -ge 2 ] && echo " Include Files: [$include_files]"
for ifile in $include_files; do
if [ -f $ifile ]; then
check_conf_file $ifile
fi
done
}
system_conf_root="/etc/apache2/httpd.conf"
check_directives="allow deny order satisfy"
htaccess_names=".htaccess"
verbosity=1
while getopts ":hs:d:n:vq" opt; do
case $opt in
s)
system_conf_root=$OPTARG
;;
d)
check_directives=$OPTARG
;;
n)
htaccess_names=$OPTARG
;;
q)
verbosity=0
;;
v)
verbosity=2
;;
h)
usage
exit 0
;;
\?)
echo "ERROR: Invalid option: -$OPTARG" >&2
usage
exit 2
;;
:)
echo "ERROR: Option -$OPTARG requires an argument." >&2
usage
exit 2
;;
esac
done
check_conf_file $system_conf_root
exit $exit_code

225
apache2-gensslcert Normal file
View File

@ -0,0 +1,225 @@
#!/bin/bash
# Peter Poeml <apache@suse.de>
#
# Script to generate ssl keys for mod_ssl, without requiring user input
# most of it is copied from mkcert.sh of the mod_ssl distribution
#
# XXX This is just a hack, it won't be able to do anything you want!
#
function usage
{
cat <<-EOF
`basename $0` will generate a test certificate "the quick way", i.e. without interaction.
You can change some defaults however.
It will overwrite /root/.mkcert.cfg
These options are recognized: Default:
-N comment "$comment"
-c country (two letters, e.g. DE) $C
-s state $ST
-l city $L
-o organisation "$O"
-u organisational unit "$U"
-n fully qualified domain name $CN (hostname -f)
-e email address of webmaster webmaster@$CN
-a subject alternative name $altName
-y days server cert is valid for $srvdays
-Y days CA cert is valid for $CAdays
-d run in debug mode
-h show usage
EOF
}
test -t && { BRIGHT=''; RED=''; NORMAL=''; }
function myecho { echo $BRIGHT$@$NORMAL; }
function error { echo $RED$@$NORMAL; }
function myexit { error something ugly seems to have happened in line $1...; exit $2; }
hostname=/usr/bin/hostname
FQHOSTNAME=""
if [ -x $hostname ]; then
FQHOSTNAME=`$hostname -f 2>/dev/null`
# bsc#1035829
fqlength=`echo -n $FQHOSTNAME|wc -c`
if [ $fqlength -gt 64 ]; then
FQHOSTNAME=`$hostname 2>/dev/null`
fi
fi
# bsc#1057406
if [ -z $FQHOSTNAME ]; then
FQHOSTNAME='localhost'
fi
# defaults
comment="mod_ssl server certificate"
C=XY
ST=unknown
L=unknown
U="web server"
O="SUSE Linux Web Server"
CN=$FQHOSTNAME
email=webmaster@$FQHOSTNAME
altName=DNS:$CN
CAdays=$((365 * 6))
srvdays=$((365 * 2))
while getopts C:N:c:s:l:o:u:n:e:a:y:Y:dh OPT; do
case $OPT in
N) comment=$OPTARG;;
c) C=$OPTARG;;
s) ST=$OPTARG;;
l) L=$OPTARG;;
u) U=$OPTARG;;
o) O=$OPTARG;;
n) CN=$OPTARG;;
e) email=$OPTARG;;
a) altName=$OPTARG;;
y) srvdays=$OPTARG;;
Y) CAdays=$OPTARG;;
d) set -x;;
h) usage; exit 2;;
*) echo unrecognized option: $OPT; usage; exit 2;;
esac
done
GO_LEFT="\033[80D"
GO_MIDDLE="$GO_LEFT\033[15C"
for i in comment C ST L U O CN email altName srvdays CAdays; do
eval "echo -e $i\"$GO_MIDDLE\" \$$i;"
done
openssl=/usr/bin/openssl
sslcrtdir=/etc/apache2/ssl.crt
sslcsrdir=/etc/apache2/ssl.csr
sslkeydir=/etc/apache2/ssl.key
sslprmdir=/etc/apache2/ssl.prm
name="$CN-"
#
# CA
#
echo;myecho creating CA key ...
(umask 0377 ; $openssl genrsa -rand /dev/urandom -out $sslkeydir/${name}ca.key 2048 || myexit $LINENO $?)
cat >/root/.mkcert.cfg <<EOT
[ req ]
default_bits = 2048
default_keyfile = keyfile.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
prompt = no
output_password = mypass
x509_extensions = req_v3_ca
[ req_distinguished_name ]
C = $C
ST = $ST
L = $L
O = $O
OU = CA
CN = $CN
emailAddress = $email
[ req_attributes ]
challengePassword = $RANDOM$RANDOMA challenge password
[req_v3_ca]
# bsc#1180530
basicConstraints = critical,CA:true
EOT
echo;myecho creating CA request/certificate ...
(umask 0377 ; $openssl req -config /root/.mkcert.cfg -new -x509 -days $CAdays -key $sslkeydir/${name}ca.key -out $sslcrtdir/${name}ca.crt || myexit $LINENO $?)
cp -pv $sslcrtdir/${name}ca.crt /srv/www/htdocs/$(echo $name | tr 'a-z' 'A-Z')CA.crt
#
# Server CERT
#
echo;myecho creating server key ...
(umask 0377 ; $openssl genrsa -rand /dev/urandom -out $sslkeydir/${name}server.key 2048 || myexit $LINENO $?)
cat >/root/.mkcert.cfg <<EOT
[ req ]
default_bits = 2048
default_keyfile = keyfile.pem
distinguished_name = req_distinguished_name
attributes = req_attributes
prompt = no
output_password = mypass
req_extensions = x509v3
[ req_distinguished_name ]
C = $C
ST = $ST
L = $L
O = $O
OU = $U
CN = $CN
emailAddress = $email
[ x509v3 ]
subjectAltName = $altName
nsComment = $comment
nsCertType = server
[ req_attributes ]
challengePassword = $RANDOM$RANDOMA challenge password
EOT
echo;myecho creating server request ...
(umask 0377 ; $openssl req -config /root/.mkcert.cfg -new -key $sslkeydir/${name}server.key -out $sslcsrdir/${name}server.csr || myexit $LINENO $?)
cat >/root/.mkcert.cfg <<EOT
extensions = x509v3
[ x509v3 ]
subjectAltName = $altName
nsComment = $comment
nsCertType = server
EOT
test -f /root/.mkcert.serial || echo 01 >/root/.mkcert.serial
myecho "creating server certificate ..."
(umask 0377 ; $openssl x509 \
-extfile /root/.mkcert.cfg \
-days $srvdays \
-CAserial /root/.mkcert.serial \
-CA $sslcrtdir/${name}ca.crt \
-CAkey $sslkeydir/${name}ca.key \
-in $sslcsrdir/${name}server.csr -req \
-out $sslcrtdir/${name}server.crt || myexit $LINENO $?)
rm -f /root/.mkcert.cfg
echo;myecho "Verify: matching certificate & key modulus"
modcrt=`$openssl x509 -noout -modulus -in $sslcrtdir/${name}server.crt | sed -e 's;.*Modulus=;;' || myexit $LINENO $?`
modkey=`$openssl rsa -noout -modulus -in $sslkeydir/${name}server.key | sed -e 's;.*Modulus=;;' || myexit $LINENO $?`
if [ ".$modcrt" != ".$modkey" ]; then
error "gensslcert:Error: Failed to verify modulus on resulting X.509 certificate" 1>&2
myexit $LINENO $?
fi
echo;myecho Verify: matching certificate signature
$openssl verify -CAfile $sslcrtdir/${name}ca.crt $sslcrtdir/${name}server.crt || myexit $LINENO $?
if [ $? -ne 0 ]; then
error "gensslcert:Error: Failed to verify signature on resulting X.509 certificate" 1>&2
myexit $LINENO $?
fi
echo;myecho generating dhparams and appending it to the server certificate file...
openssl dhparam 2048 >> $sslcrtdir/${name}server.crt
exit 0

7
apache2-global.conf Normal file
View File

@ -0,0 +1,7 @@
ServerSignature off
UseCanonicalName off
ServerTokens ProductOnly
TraceEnable off
LogLevel warn
CustomLog /var/log/apache2/access_log combined

234
apache2-httpd.conf Normal file
View File

@ -0,0 +1,234 @@
#
# /etc/apache2/httpd.conf
#
# This is the main Apache server configuration file. It contains the
# configuration directives that give the server its instructions.
# See <URL:https://httpd.apache.org/docs/2.4/> for detailed information about
# the directives.
# Based upon the default apache configuration file that ships with apache,
# which is based upon the NCSA server configuration files originally by Rob
# McCool. This file was knocked together by Peter Poeml <poeml+apache@suse.de>.
# If possible, avoid changes to this file. It does mainly contain Include
# statements and global settings that can/should be overridden in the
# configuration of your virtual hosts.
# Quickstart guide:
# https://en.opensuse.org/SDB:Apache_installation
# Overview of include files, chronologically:
#
# httpd.conf
# |
# |-- uid.conf . . . . . . . . . . . . . . UserID/GroupID to run under
# |-- server-tuning.conf . . . . . . . . . sizing of the server (how many processes to start, ...)
# |-- loadmodule.conf . . . . . . . . . . . [*] load these modules
# |-- listen.conf . . . . . . . . . . . . . IP adresses / ports to listen on
# |-- mod_log_config.conf . . . . . . . . . define logging formats
# |-- global.conf . . . . . . . . . . . . . [*] server-wide general settings
# |-- mod_status.conf . . . . . . . . . . . restrict access to mod_status (server monitoring)
# |-- mod_info.conf . . . . . . . . . . . . restrict access to mod_info
# |-- mod_reqtimeout.conf . . . . . . . . . set timeout and minimum data rate for receiving requests
# |-- mod_cgid-timeout.conf . . . . . . . . set CGIDScriptTimeout if mod_cgid is loaded/active
# |-- mod_usertrack.conf . . . . . . . . . defaults for cookie-based user tracking
# |-- mod_autoindex-defaults.conf . . . . . defaults for displaying of server-generated directory listings
# |-- mod_mime-defaults.conf . . . . . . . defaults for mod_mime configuration
# |-- errors.conf . . . . . . . . . . . . . customize error responses
# |-- ssl-global.conf . . . . . . . . . . . SSL conf that applies to default server _and all_ virtual hosts
# |-- protocols.conf . . . . . . . . . . . Protocol settings that applies to default server _and all_ virtual hosts
# |
# |-- default-server.conf . . . . . . . . . set up the default server that replies to non-virtual-host requests
# | |--mod_userdir.conf . . . . . . . . enable UserDir (if mod_userdir is loaded)
# | `--conf.d/apache2-manual?conf . . . add the docs ('?' = if installed)
# |
# `-- vhosts.d/ . . . . . . . . . . . . . . for each virtual host, place one file here
# `-- *.conf . . . . . . . . . . . . . (*.conf is automatically included)
#
#
# Files marked [*] are NOT read when server is started via systemd service. When server
# is started via service, defaults from /etc/sysconfig/apache2 are taken into account.
#
# Filesystem layout:
#
# /etc/apache2/
# |-- charset.conv . . . . . . . . . . . . for mod_auth_ldap
# |-- conf.d/
# | |-- apache2-manual.conf . . . . . . . conf that comes with apache2-doc
# | |-- mod_php4.conf . . . . . . . . . . (example) conf that comes with apache2-mod_php4
# | `-- ... . . . . . . . . . . . . . . . other configuration added by packages
# |-- default-server.conf
# |-- errors.conf
# |-- httpd.conf . . . . . . . . . . . . . top level configuration file
# |-- listen.conf
# |-- magic
# |-- mime.types -> ../mime.types
# |-- mod_autoindex-defaults.conf
# |-- mod_info.conf
# |-- mod_log_config.conf
# |-- mod_mime-defaults.conf
# |-- mod_perl-startup.pl
# |-- mod_status.conf
# |-- mod_userdir.conf
# |-- mod_usertrack.conf
# |-- server-tuning.conf
# |-- ssl-global.conf
# |-- protocols.conf
# |-- ssl.crl/ . . . . . . . . . . . . . . PEM-encoded X.509 Certificate Revocation Lists (CRL)
# |-- ssl.crt/ . . . . . . . . . . . . . . PEM-encoded X.509 Certificates
# |-- ssl.csr/ . . . . . . . . . . . . . . PEM-encoded X.509 Certificate Signing Requests
# |-- ssl.key/ . . . . . . . . . . . . . . PEM-encoded RSA Private Keys
# |-- ssl.prm/ . . . . . . . . . . . . . . public DSA Parameter Files
# |-- global.conf
# |-- loadmodule.conf
# |-- uid.conf
# `-- vhosts.d/ . . . . . . . . . . . . . . put your virtual host configuration (*.conf) here
# |-- vhost-ssl.template
# `-- vhost.template
### Global Environment ######################################################
#
# The directives in this section affect the overall operation of Apache,
# such as the number of concurrent requests.
# run under this user/group id
Include /etc/apache2/uid.conf
# - how many server processes to start (server pool regulation)
# - usage of KeepAlive
Include /etc/apache2/server-tuning.conf
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here. If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
ErrorLog /var/log/apache2/error_log
# generated from default value of APACHE_MODULES in /etc/sysconfig/apache2
<IfDefine !SYSCONFIG>
Include /etc/apache2/loadmodule.conf
</IfDefine>
# IP addresses / ports to listen on
Include /etc/apache2/listen.conf
# predefined logging formats
Include /etc/apache2/mod_log_config.conf
# generated from default values of global settings in /etc/sysconfig/apache2
<IfDefine !SYSCONFIG>
Include /etc/apache2/global.conf
</IfDefine>
# optional mod_status, mod_info
Include /etc/apache2/mod_status.conf
Include /etc/apache2/mod_info.conf
# mod_reqtimeout protects the server from the so-called "slowloris"
# attack: The server is not swamped with requests in fast succession,
# but with slowly transmitted request headers and body, thereby filling up
# the request slots until the server runs out of them.
# mod_reqtimeout is lightweight and should deliver good results
# with the configured default values. You shouldn't notice it at all.
Include /etc/apache2/mod_reqtimeout.conf
# Fix for CVE-2014-0231 introduces new configuration parameter
# CGIDScriptTimeout. This directive and its effect prevent request
# workers to be eaten until starvation if cgi programs do not send
# output back to the server within the timout set by CGIDScriptTimeout.
Include /etc/apache2/mod_cgid-timeout.conf
# optional cookie-based user tracking
# read the documentation before using it!!
Include /etc/apache2/mod_usertrack.conf
# configuration of server-generated directory listings
Include /etc/apache2/mod_autoindex-defaults.conf
# associate MIME types with filename extensions
TypesConfig /etc/apache2/mime.types
Include /etc/apache2/mod_mime-defaults.conf
# set up (customizable) error responses
Include /etc/apache2/errors.conf
# global (server-wide) SSL configuration, that is not specific to
# any virtual host
Include /etc/apache2/ssl-global.conf
# global (server-wide) protocol configuration, that is not specific
# to any virtual host
Include /etc/apache2/protocols.conf
# forbid access to the entire filesystem by default
<Directory />
Options None
AllowOverride None
<IfModule !mod_access_compat.c>
Require all denied
</IfModule>
<IfModule mod_access_compat.c>
Order deny,allow
Deny from all
</IfModule>
</Directory>
# use .htaccess files for overriding,
AccessFileName .htaccess
# and never show them
<Files ~ "^\.ht">
<IfModule !mod_access_compat.c>
Require all denied
</IfModule>
<IfModule mod_access_compat.c>
Order allow,deny
Deny from all
</IfModule>
</Files>
# List of resources to look for when the client requests a directory
DirectoryIndex index.html index.html.var
### 'Main' server configuration #############################################
#
# The directives in this section set up the values used by the 'main'
# server, which responds to any requests that aren't handled by a
# <VirtualHost> definition. These values also provide defaults for
# any <VirtualHost> containers you may define later in the file.
#
# All of these directives may appear inside <VirtualHost> containers,
# in which case these default settings will be overridden for the
# virtual host being defined.
#
Include /etc/apache2/default-server.conf
### Virtual server configuration ############################################
#
# VirtualHost: If you want to maintain multiple domains/hostnames on your
# machine you can setup VirtualHost containers for them. Most configurations
# use only name-based virtual hosts so the server doesn't need to worry about
# IP addresses. This is indicated by the asterisks in the directives below.
#
# Please see the documentation at
# <URL:https://httpd.apache.org/docs/2.4/vhosts/>
# for further details before you try to setup virtual hosts.
#
# You may use the command line option '-S' to verify your virtual host
# configuration.
#
IncludeOptional /etc/apache2/vhosts.d/*.conf
# Note: instead of adding your own configuration here, consider
# adding it in your own file (/etc/apache2/httpd.conf.local)
# putting its name into APACHE_CONF_INCLUDE_FILES in
# /etc/sysconfig/apache2 -- this will make system updates
# easier :)

32
apache2-listen.conf Normal file
View File

@ -0,0 +1,32 @@
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports. See also the <VirtualHost> directive.
#
# https://httpd.apache.org/docs/2.4/mod/mpm_common.html#listen
#
# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
# When we also provide SSL we have to listen to the
# standard HTTP port (see above) and to the HTTPS port
#
# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
# Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
#
#Listen 12.34.56.78:80
#Listen 80
#Listen 443
Listen 80
<IfDefine SSL>
<IfDefine !NOSSL>
<IfModule mod_ssl.c>
Listen 443
</IfModule>
</IfDefine>
</IfDefine>

75
apache2-loadmodule.conf Normal file
View File

@ -0,0 +1,75 @@
<IfModule prefork.c>
LoadModule actions_module /usr/lib64/apache2-prefork/mod_actions.so
LoadModule alias_module /usr/lib64/apache2-prefork/mod_alias.so
LoadModule auth_basic_module /usr/lib64/apache2-prefork/mod_auth_basic.so
LoadModule authn_file_module /usr/lib64/apache2-prefork/mod_authn_file.so
LoadModule authz_host_module /usr/lib64/apache2-prefork/mod_authz_host.so
LoadModule authz_groupfile_module /usr/lib64/apache2-prefork/mod_authz_groupfile.so
LoadModule authz_user_module /usr/lib64/apache2-prefork/mod_authz_user.so
LoadModule autoindex_module /usr/lib64/apache2-prefork/mod_autoindex.so
LoadModule cgi_module /usr/lib64/apache2-prefork/mod_cgi.so
LoadModule dir_module /usr/lib64/apache2-prefork/mod_dir.so
LoadModule env_module /usr/lib64/apache2-prefork/mod_env.so
LoadModule expires_module /usr/lib64/apache2-prefork/mod_expires.so
LoadModule include_module /usr/lib64/apache2-prefork/mod_include.so
LoadModule log_config_module /usr/lib64/apache2-prefork/mod_log_config.so
LoadModule mime_module /usr/lib64/apache2-prefork/mod_mime.so
LoadModule negotiation_module /usr/lib64/apache2-prefork/mod_negotiation.so
LoadModule setenvif_module /usr/lib64/apache2-prefork/mod_setenvif.so
LoadModule ssl_module /usr/lib64/apache2-prefork/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/apache2-prefork/mod_socache_shmcb.so
LoadModule userdir_module /usr/lib64/apache2-prefork/mod_userdir.so
LoadModule reqtimeout_module /usr/lib64/apache2-prefork/mod_reqtimeout.so
LoadModule authn_core_module /usr/lib64/apache2-prefork/mod_authn_core.so
LoadModule authz_core_module /usr/lib64/apache2-prefork/mod_authz_core.so
</IfModule>
<IfModule worker.c>
LoadModule actions_module /usr/lib64/apache2-worker/mod_actions.so
LoadModule alias_module /usr/lib64/apache2-worker/mod_alias.so
LoadModule auth_basic_module /usr/lib64/apache2-worker/mod_auth_basic.so
LoadModule authn_file_module /usr/lib64/apache2-worker/mod_authn_file.so
LoadModule authz_host_module /usr/lib64/apache2-worker/mod_authz_host.so
LoadModule authz_groupfile_module /usr/lib64/apache2-worker/mod_authz_groupfile.so
LoadModule authz_user_module /usr/lib64/apache2-worker/mod_authz_user.so
LoadModule autoindex_module /usr/lib64/apache2-worker/mod_autoindex.so
LoadModule cgi_module /usr/lib64/apache2-worker/mod_cgi.so
LoadModule dir_module /usr/lib64/apache2-worker/mod_dir.so
LoadModule env_module /usr/lib64/apache2-worker/mod_env.so
LoadModule expires_module /usr/lib64/apache2-worker/mod_expires.so
LoadModule include_module /usr/lib64/apache2-worker/mod_include.so
LoadModule log_config_module /usr/lib64/apache2-worker/mod_log_config.so
LoadModule mime_module /usr/lib64/apache2-worker/mod_mime.so
LoadModule negotiation_module /usr/lib64/apache2-worker/mod_negotiation.so
LoadModule setenvif_module /usr/lib64/apache2-worker/mod_setenvif.so
LoadModule ssl_module /usr/lib64/apache2-worker/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/apache2-worker/mod_socache_shmcb.so
LoadModule userdir_module /usr/lib64/apache2-worker/mod_userdir.so
LoadModule reqtimeout_module /usr/lib64/apache2-worker/mod_reqtimeout.so
LoadModule authn_core_module /usr/lib64/apache2-worker/mod_authn_core.so
LoadModule authz_core_module /usr/lib64/apache2-worker/mod_authz_core.so
</IfModule>
<IfModule event.c>
LoadModule actions_module /usr/lib64/apache2-event/mod_actions.so
LoadModule alias_module /usr/lib64/apache2-event/mod_alias.so
LoadModule auth_basic_module /usr/lib64/apache2-event/mod_auth_basic.so
LoadModule authn_file_module /usr/lib64/apache2-event/mod_authn_file.so
LoadModule authz_host_module /usr/lib64/apache2-event/mod_authz_host.so
LoadModule authz_groupfile_module /usr/lib64/apache2-event/mod_authz_groupfile.so
LoadModule authz_user_module /usr/lib64/apache2-event/mod_authz_user.so
LoadModule autoindex_module /usr/lib64/apache2-event/mod_autoindex.so
LoadModule cgi_module /usr/lib64/apache2-event/mod_cgi.so
LoadModule dir_module /usr/lib64/apache2-event/mod_dir.so
LoadModule env_module /usr/lib64/apache2-event/mod_env.so
LoadModule expires_module /usr/lib64/apache2-event/mod_expires.so
LoadModule include_module /usr/lib64/apache2-event/mod_include.so
LoadModule log_config_module /usr/lib64/apache2-event/mod_log_config.so
LoadModule mime_module /usr/lib64/apache2-event/mod_mime.so
LoadModule negotiation_module /usr/lib64/apache2-event/mod_negotiation.so
LoadModule setenvif_module /usr/lib64/apache2-event/mod_setenvif.so
LoadModule ssl_module /usr/lib64/apache2-event/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/apache2-event/mod_socache_shmcb.so
LoadModule userdir_module /usr/lib64/apache2-event/mod_userdir.so
LoadModule reqtimeout_module /usr/lib64/apache2-event/mod_reqtimeout.so
LoadModule authn_core_module /usr/lib64/apache2-event/mod_authn_core.so
LoadModule authz_core_module /usr/lib64/apache2-event/mod_authz_core.so
</IfModule>

56
apache2-logresolve-tmp-security.patch Normal file
View File

@ -0,0 +1,56 @@
--- httpd-2.4.6.orig/support/logresolve.pl.in
+++ httpd-2.4.6/support/logresolve.pl.in
@@ -57,6 +57,7 @@ $|=1;
use FileHandle;
use Socket;
+use File::Temp;
use strict;
no strict 'refs';
@@ -71,11 +72,13 @@ my $filename;
my %hash = ();
my $parent = $$;
+my $tempdir = File::Temp::tempdir("logresolve.pl.sockets.XXXXXX", CLEANUP => 1);
+
my @children = ();
for (my $child = 1; $child <=$CHILDREN; $child++) {
my $f = fork();
if (!$f) {
- $filename = "./.socket.$parent.$child";
+ $filename = "$tempdir/socket.$parent.$child";
if (-e $filename) { unlink($filename) || warn "$filename .. $!\n";}
&child($child);
exit(0);
@@ -91,9 +94,9 @@ sub cleanup {
# die kiddies, die
kill(15, @children);
for (my $child = 1; $child <=$CHILDREN; $child++) {
- if (-e "./.socket.$parent.$child") {
- unlink("./.socket.$parent.$child")
- || warn ".socket.$parent.$child $!";
+ if (-e "$tempdir/socket.$parent.$child") {
+ unlink("$tempdir/socket.$parent.$child")
+ || warn "$tempdir/socket.$parent.$child $!";
}
}
}
@@ -113,7 +116,7 @@ sub parent {
if (!socket($CHILDSOCK{$child}, AF_UNIX, SOCK_STREAM, $PROTOCOL)) {
warn "parent socket to child failed $!";
}
- $filename = "./.socket.$parent.$child";
+ $filename = "$tempdir/socket.$parent.$child";
my $response;
do {
$response = connect($CHILDSOCK{$child}, sockaddr_un($filename));
@@ -176,7 +179,7 @@ sub child {
# create a socket to communicate with parent
socket(INBOUND, AF_UNIX, SOCK_STREAM, $PROTOCOL)
|| die "Error with Socket: !$\n";
- $filename = "./.socket.$parent.$me";
+ $filename = "$tempdir/socket.$parent.$me";
bind(INBOUND, sockaddr_un($filename))
|| die "Error Binding $filename: $!\n";
listen(INBOUND, 5) || die "Error Listening: $!\n";

28
apache2-manual.conf Normal file
View File

@ -0,0 +1,28 @@
#
# This configuration file belongs to the apache2-doc package.
#
# The alias provides the manual, even if you choose to move your DocumentRoot.
# Comment this out if you do not care for the documentation.
#
AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|ru))?(/.*)?$ "/usr/share/apache2/manual$1"
<Directory "/usr/share/apache2/manual">
Options Indexes
AllowOverride None
<IfModule !mod_access_compat.c>
Require local
</IfModule>
<IfModule mod_access_compat.c>
Order deny,allow
Deny from all
Allow from localhost 127.0.0.1
</IfModule>
<Files *.html>
SetHandler type-map
</Files>
SetEnvIf Request_URI ^/manual/(de|en|es|fr|ja|ko|ru)/ prefer-language=$1
RedirectMatch 301 ^/manual(?:/(de|en|es|fr|ja|ko|ru)){2,}(/.*)?$ /manual/$1$2
</Directory>

51
apache2-mod_autoindex-defaults.conf Normal file
View File

@ -0,0 +1,51 @@
#
# Directives controlling the display of server-generated directory listings.
#
# see https://httpd.apache.org/docs/2.4/mod/mod_autoindex.html
#
<IfModule mod_autoindex.c>
IndexOptions FancyIndexing VersionSort NameWidth=*
# Add Last-Modified and ETag values for the listed directory in the HTTP header,
# based on files' modification dates
#IndexOptions +TrackModified
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^
DefaultIcon /icons/unknown.gif
ReadmeName README.html
HeaderName HEADER.html
IndexIgnore .??* *~ *# HEADER* RCS CVS *,v *,t
</IfModule>

15
apache2-mod_cgid-timeout.conf Normal file
View File

@ -0,0 +1,15 @@
#
# The length of time in seconds to wait for more output
# from a CGI program.
#
# This will prevent a DoS if too many CGI's don't send their output quickly
# enough.
# The value for CGIDScriptTimeout defaults to the value of Timeout.
# CGIDScriptTimeout is used by mod_cgid only!
#
<IfModule mod_cgid.c>
CGIDScriptTimeout 60
</IfModule>

48
apache2-mod_example.c Normal file
View File

@ -0,0 +1,48 @@
/* Include the required headers from httpd */
#include "httpd.h"
#include "http_core.h"
#include "http_protocol.h"
#include "http_request.h"
/* Define prototypes of our functions in this module */
static void register_hooks(apr_pool_t *pool);