freebsd-ports/www/apache22/Makefile

188 lines
5.7 KiB
Makefile
Raw Normal View History

# $FreeBSD$
PORTNAME= apache22
PORTVERSION= 2.2.27
PORTREVISION?= 2
CATEGORIES= www ipv6
MASTER_SITES= ${MASTER_SITE_APACHE_HTTPD}
DISTNAME= httpd-${PORTVERSION}
DIST_SUBDIR= apache22
MAINTAINER?= apache@FreeBSD.org
COMMENT?= Version 2.2.x of Apache web server with ${WITH_MPM} MPM.
LIB_DEPENDS= libexpat.so:${PORTSDIR}/textproc/expat2 \
libapr-1.so:${PORTSDIR}/devel/apr1 \
libpcre.so:${PORTSDIR}/devel/pcre
2013-03-26 22:31:27 +01:00
CONFLICTS_INSTALL= caudium14-1.* \
apache-*-2.2.* apache22-*-2.2.* \
apache-*-2.4.* apache24-*-2.4.*
USE_APACHE= common22
USES= tar:bzip2 iconv perl5
USE_PERL5= run
USE_AUTOTOOLS= autoconf libtool
USE_RC_SUBR= apache22 htcacheclean
LIBTOOLFILES= configure.in
PORTDOCS= *
USERS= www
GROUPS= www
# for slave ports
.if !defined(MASTERDIR)
APACHEDIR= ${.CURDIR}
.else
APACHEDIR= ${MASTERDIR}
.endif
- update to version 2.2.24 - move mpm itk patches to itk-mpm/files dir - add sshd to REQUIRE line in the rc script to prevent boot issues in case a SSL cert is password protected [1] Changes with Apache 2.2.24 SECURITY: CVE-2012-3499 (cve.mitre.org) Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp. [Jim Jagielski, Stefan Fritsch, Niels Heinen <heinenn google com>] SECURITY: CVE-2012-4558 (cve.mitre.org) XSS in mod_proxy_balancer manager interface. [Jim Jagielski, Niels Heinen <heinenn google com>] mod_rewrite: Stop merging RewriteBase down to subdirectories unless new option 'RewriteOptions MergeBase' is configured. Merging RewriteBase was unconditionally turned on in 2.2.23. PR 53963. [Eric Covener] mod_ssl: Send the error message for speaking http to an https port using HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when using SNI. PR 50823. [Stefan Fritsch] mod_ssl: log revoked certificates at level INFO instead of DEBUG. PR 52162. [Stefan Fritsch] mod_proxy_ajp: Support unknown HTTP methods. PR 54416. [Rainer Jung] mod_dir: Add support for the value 'disabled' in FallbackResource. [Vincent Deffontaines] mod_ldap: Fix regression in handling "server unavailable" errors on Windows. PR 54140. [Eric Covener] mod_ssl: fix a regression with the string rendering of the "UID" RDN introduced in 2.2.15. PR 54510. [Kaspar Brand] ab: add TLS1.1/TLS1.2 options to -f switch, and adapt output to more accurately report the negotiated protocol. PR 53916. [Nicolás Pernas Maradei <nico emutex com>, Kaspar Brand] mod_cache: Explicitly allow cache implementations to cache a 206 Partial Response if they so choose to do so. Previously an attempt to cache a 206 was arbitrarily allowed if the response contained an Expires or Cache-Control header, and arbitrarily denied if both headers were missing Currently the disk and memory cache providers do not cache 206 Partial Responses. [Graham Leggett] core: Remove unintentional APR 1.3 dependency introduced with Apache 2.2.22. [Eric Covener] core: Use a TLS 1.0 close_notify alert for internal dummy connection if the chosen listener is configured for https. [Joe Orton] mod_ssl: Add new directive SSLCompression to disable TLS-level compression. PR 53219. [1] requested by Andrew Filonov (freebsd-apache/2012-September/002962.html) with head apache@
2013-03-02 20:31:49 +01:00
WITH_MPM?= prefork # or worker, event, itk, peruser
WITH_HTTP_PORT?= 80
WITH_SSL_PORT?= 443
.include "${APACHEDIR}/Makefile.options"
AUTHNZ_LDAP_CONFIGURE_ON= --enable-authnz-ldap
# http://httpd.apache.org/docs/2.2/bind.html
IPV4_MAPPED_CONFIGURE_OFF= --disable-v4-mapped
IPV4_MAPPED_CONFIGURE_ON= --enable-v4-mapped
LDAP_CONFIGURE_ON= --enable-ldap=shared
SSL_CFLAGS= -I${OPENSSLINC}
SSL_CONFIGURE_ON= --with-ssl=${OPENSSLBASE}
SSL_LDFLAGS= -L${OPENSSLLIB}
SSL_USE= OPENSSL=yes
SUEXEC_RSRCLIMIT_EXTRA_PATCHES= ${FILESDIR}/extra-patch-suexec_rsrclimit
SUEXEC_USERDIR_EXTRA_PATCHES= ${FILESDIR}/extra-patch-suexec_userdir
.include <bsd.port.options.mk>
- update to 2.2.26 - add new directory for modules (APACHEETCDIR/modules.d) New modules can be registered here with a simple file that contains the LoadModule directives. Additonal Maintaines can write instructions to the conf file and keep pkg-message short. As bonus the config file can be installed like every other config file with a .sample extention so modules are not disabled during pkg upgrades. Module config files should begin with three digits followed by '_' e.g. 100_php5.conf. The load order can be controlled via the three digits. Please wait some time before adopting the new directory so users have time to update and adjust axisting configs Changes with Apache 2.2.26 *) mod_dav: dav_resource->uri treated as unencoded. This was an unnecessary ABI changed introduced in 2.2.25 PR 55397. [Ben Reser] *) mod_dav: Do not validate locks against parent collection of COPY source URI. PR 55304. [Ben Reser] *) mod_ssl: Check SNI hostname against Host header case-insensitively. PR 49491. [Mayank Agrawal <magrawal.08 gmail.com>] *) mod_ssl: enable support for ECC keys and ECDH ciphers. Tested against OpenSSL 1.0.0b3. [Vipul Gupta vipul.gupta sun.com, Sander Temme, Stefan Fritsch] *) mod_ssl: Change default for SSLCompression to off, as compression causes security issues in most setups. (The so called "CRIME" attack). [Stefan Fritsch] *) mod_ssl: Fix compilation error when OpenSSL does not contain support for SSLv2. Problem was introduced in 2.2.25. PR 55194. [Rainer Jung, Kaspar Brand] *) mod_dav: Fix double encoding of URIs in XML and Location header (caused by unintential ABI change in 2.2.25). PR 55397. [Ben Reser]
2013-11-24 20:56:26 +01:00
ETC_SUBDIRS= Includes envvars.d extra modules.d
# PR: 182947
.if ${WITH_MPM} != "peruser"
SUB_LIST+= RELOAD_CMD=graceful
.else
SUB_LIST+= RELOAD_CMD=hrestart
.endif
.if ! ${PORT_OPTIONS:MDOCS}
MAKE_ENV+= NOPORTDOCS=yes
.endif
APR_CONFIG?= ${LOCALBASE}/bin/apr-1-config
APU_CONFIG?= ${LOCALBASE}/bin/apu-1-config
# APU modules used by AUTHN_DBD DBD
APU_DBD_MYSQL?= ${LOCALBASE}/lib/apr-util-1/apr_dbd_mysql.so
APU_DBD_PGSQL?= ${LOCALBASE}/lib/apr-util-1/apr_dbd_pgsql.so
APU_DBD_SQLITE3?= ${LOCALBASE}/lib/apr-util-1/apr_dbd_sqlite3.so
# APU module used by AUTHNZ_LDAP LDAP
APU_LDAP?= ${LOCALBASE}/lib/apr-util-1/apr_ldap.so
# APU module used by SESSION_CRYPTO
APU_CRYPTO_OPENSSL?= ${LOCALBASE}/lib/apr-util-1/apr_crypto_openssl.so
- update to version 2.2.24 - move mpm itk patches to itk-mpm/files dir - add sshd to REQUIRE line in the rc script to prevent boot issues in case a SSL cert is password protected [1] Changes with Apache 2.2.24 SECURITY: CVE-2012-3499 (cve.mitre.org) Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp. [Jim Jagielski, Stefan Fritsch, Niels Heinen <heinenn google com>] SECURITY: CVE-2012-4558 (cve.mitre.org) XSS in mod_proxy_balancer manager interface. [Jim Jagielski, Niels Heinen <heinenn google com>] mod_rewrite: Stop merging RewriteBase down to subdirectories unless new option 'RewriteOptions MergeBase' is configured. Merging RewriteBase was unconditionally turned on in 2.2.23. PR 53963. [Eric Covener] mod_ssl: Send the error message for speaking http to an https port using HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when using SNI. PR 50823. [Stefan Fritsch] mod_ssl: log revoked certificates at level INFO instead of DEBUG. PR 52162. [Stefan Fritsch] mod_proxy_ajp: Support unknown HTTP methods. PR 54416. [Rainer Jung] mod_dir: Add support for the value 'disabled' in FallbackResource. [Vincent Deffontaines] mod_ldap: Fix regression in handling "server unavailable" errors on Windows. PR 54140. [Eric Covener] mod_ssl: fix a regression with the string rendering of the "UID" RDN introduced in 2.2.15. PR 54510. [Kaspar Brand] ab: add TLS1.1/TLS1.2 options to -f switch, and adapt output to more accurately report the negotiated protocol. PR 53916. [Nicolás Pernas Maradei <nico emutex com>, Kaspar Brand] mod_cache: Explicitly allow cache implementations to cache a 206 Partial Response if they so choose to do so. Previously an attempt to cache a 206 was arbitrarily allowed if the response contained an Expires or Cache-Control header, and arbitrarily denied if both headers were missing Currently the disk and memory cache providers do not cache 206 Partial Responses. [Graham Leggett] core: Remove unintentional APR 1.3 dependency introduced with Apache 2.2.22. [Eric Covener] core: Use a TLS 1.0 close_notify alert for internal dummy connection if the chosen listener is configured for https. [Joe Orton] mod_ssl: Add new directive SSLCompression to disable TLS-level compression. PR 53219. [1] requested by Andrew Filonov (freebsd-apache/2012-September/002962.html) with head apache@
2013-03-02 20:31:49 +01:00
APU_CRYPTO_NSS?= ${LOCALBASE}/lib/apr-util-1/apr_crypto_nss.so
CONFIGURE_ARGS+=--prefix=${PREFIX} \
--enable-layout=FreeBSD \
--with-port=${WITH_HTTP_PORT} \
--with-sslport=${WITH_SSL_PORT} \
--with-expat=${LOCALBASE} \
--with-iconv=${ICONV_PREFIX} \
--enable-http \
--with-pcre=${LOCALBASE} \
--with-apr=${APR_CONFIG} \
--with-apr-util=${APU_CONFIG}
CONFIGURE_ENV= \
2010-05-06 00:17:13 +02:00
CONFIG_SHELL="${SH}" \
LOCALBASE="${LOCALBASE}"
MAKE_ENV+= EXPR_COMPAT=yes \
INSTALL_MAN="${INSTALL_MAN}" \
EXAMPLESDIR=${EXAMPLESDIR}
#=====================================================
- update to version 2.2.24 - move mpm itk patches to itk-mpm/files dir - add sshd to REQUIRE line in the rc script to prevent boot issues in case a SSL cert is password protected [1] Changes with Apache 2.2.24 SECURITY: CVE-2012-3499 (cve.mitre.org) Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp. [Jim Jagielski, Stefan Fritsch, Niels Heinen <heinenn google com>] SECURITY: CVE-2012-4558 (cve.mitre.org) XSS in mod_proxy_balancer manager interface. [Jim Jagielski, Niels Heinen <heinenn google com>] mod_rewrite: Stop merging RewriteBase down to subdirectories unless new option 'RewriteOptions MergeBase' is configured. Merging RewriteBase was unconditionally turned on in 2.2.23. PR 53963. [Eric Covener] mod_ssl: Send the error message for speaking http to an https port using HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when using SNI. PR 50823. [Stefan Fritsch] mod_ssl: log revoked certificates at level INFO instead of DEBUG. PR 52162. [Stefan Fritsch] mod_proxy_ajp: Support unknown HTTP methods. PR 54416. [Rainer Jung] mod_dir: Add support for the value 'disabled' in FallbackResource. [Vincent Deffontaines] mod_ldap: Fix regression in handling "server unavailable" errors on Windows. PR 54140. [Eric Covener] mod_ssl: fix a regression with the string rendering of the "UID" RDN introduced in 2.2.15. PR 54510. [Kaspar Brand] ab: add TLS1.1/TLS1.2 options to -f switch, and adapt output to more accurately report the negotiated protocol. PR 53916. [Nicolás Pernas Maradei <nico emutex com>, Kaspar Brand] mod_cache: Explicitly allow cache implementations to cache a 206 Partial Response if they so choose to do so. Previously an attempt to cache a 206 was arbitrarily allowed if the response contained an Expires or Cache-Control header, and arbitrarily denied if both headers were missing Currently the disk and memory cache providers do not cache 206 Partial Responses. [Graham Leggett] core: Remove unintentional APR 1.3 dependency introduced with Apache 2.2.22. [Eric Covener] core: Use a TLS 1.0 close_notify alert for internal dummy connection if the chosen listener is configured for https. [Joe Orton] mod_ssl: Add new directive SSLCompression to disable TLS-level compression. PR 53219. [1] requested by Andrew Filonov (freebsd-apache/2012-September/002962.html) with head apache@
2013-03-02 20:31:49 +01:00
# CONFIGURE_ARGS will be handled in Makefile.modules,
# here we do only OPTIONS fixups
.if ${PORT_OPTIONS:MSUEXEC_RSRCLIMIT} && !${PORT_OPTIONS:MSUEXEC}
IGNORE= suEXEC resource limit patch requires mod_suexec.\
Please (re)run 'make config' and choose SUEXEC option also
.endif
.if ${PORT_OPTIONS:MSUEXEC_USERDIR} && !${PORT_OPTIONS:MSUEXEC}
IGNORE= suEXEC UserDir patch requires mod_suexec.\
Please (re)run 'make config' and choose SUEXEC option also
.endif
.include <bsd.port.pre.mk>
.include "${APACHEDIR}/Makefile.modules"
show-options:
@${SED} -ne 's/^##//p' ${APACHEDIR}/Makefile.doc
post-extract:
# remove possible leftover .svn directories in the sources
@${FIND} ${WRKSRC} -type d -name .svn -print | ${XARGS} ${RM} -rf
# limit grep results ...
@${FIND} ${WRKSRC} -type f \( -name 'NWGNU*' -o -name '*.ds?' -o -name '*.dep' -o -name '*.mak' -o -name '*.win' \) -delete
post-patch:
@${REINPLACE_CMD} -e 's," PLATFORM ",FreeBSD,' ${WRKSRC}/server/core.c
# IPv4_mapping fix: https://issues.apache.org/bugzilla/show_bug.cgi?id=53824
@${REINPLACE_CMD} -e 's|freebsd5|freebsd|' \
-e 's|^perlbin=.*|perlbin=${PERL}|' \
${WRKSRC}/configure.in ${WRKSRC}/configure
@${RM} -f ${WRKSRC}/docs/docroot/*.bak
@${INSTALL_DATA} ${WRKSRC}/NOTICE ${WRKSRC}/docs/manual
# we use devel/apr and devel/pcre
@${RM} -rf ${WRKSRC}/srclib
@${REINPLACE_CMD} -e 's/srclib//' ${WRKSRC}/Makefile.in
pre-configure::
@${ECHO_MSG} ""
@${ECHO_MSG} " You can check your modules configuration by using make show-modules"
@${ECHO_MSG} ""
# Fix build on FreeBSD-10+ with OpenSSL from ports
.if ${PORT_OPTIONS:MSSL}
. if ${OPSYS} == FreeBSD && ${OSVERSION} > 1000000
. if defined(OPENSSL_INSTALLED) && ${OPENSSL_INSTALLED} != ""
@${ECHO_MSG} "===> apply fix for FreeBSD-${OSREL} (${OSVERSION}) for usage with ${OPENSSL_INSTALLED}"
@${ECHO_MSG} ""
${REINPLACE_CMD} -e "s|(ALL_CFLAGS)|(ALL_CFLAGS) -L${OPENSSLLIB}|" ${WRKSRC}/build/rules.mk.in
. endif
. endif
.endif
post-configure:
@FTPUSERS=`${EGREP} -v '^#' /etc/ftpusers| ${TR} -s "\n" " "` ;\
2010-05-06 00:17:13 +02:00
${REINPLACE_CMD} -e "s,%%FTPUSERS%%,$${FTPUSERS}," ${WRKSRC}/docs/conf/extra/httpd-userdir.conf
@${REINPLACE_CMD} -e "s,%%WWWOWN%%,${WWWOWN}," -e "s,%%WWWGRP%%,${WWWGRP}," ${WRKSRC}/docs/conf/httpd.conf
2010-05-06 00:17:13 +02:00
@${REINPLACE_CMD} -e "s,%%PREFIX%%,${PREFIX}," ${WRKSRC}/support/envvars-std
post-install:
@${MKDIR} ${ETC_SUBDIRS:S|^|${STAGEDIR}${ETCDIR}/|}
- update to 2.2.26 - add new directory for modules (APACHEETCDIR/modules.d) New modules can be registered here with a simple file that contains the LoadModule directives. Additonal Maintaines can write instructions to the conf file and keep pkg-message short. As bonus the config file can be installed like every other config file with a .sample extention so modules are not disabled during pkg upgrades. Module config files should begin with three digits followed by '_' e.g. 100_php5.conf. The load order can be controlled via the three digits. Please wait some time before adopting the new directory so users have time to update and adjust axisting configs Changes with Apache 2.2.26 *) mod_dav: dav_resource->uri treated as unencoded. This was an unnecessary ABI changed introduced in 2.2.25 PR 55397. [Ben Reser] *) mod_dav: Do not validate locks against parent collection of COPY source URI. PR 55304. [Ben Reser] *) mod_ssl: Check SNI hostname against Host header case-insensitively. PR 49491. [Mayank Agrawal <magrawal.08 gmail.com>] *) mod_ssl: enable support for ECC keys and ECDH ciphers. Tested against OpenSSL 1.0.0b3. [Vipul Gupta vipul.gupta sun.com, Sander Temme, Stefan Fritsch] *) mod_ssl: Change default for SSLCompression to off, as compression causes security issues in most setups. (The so called "CRIME" attack). [Stefan Fritsch] *) mod_ssl: Fix compilation error when OpenSSL does not contain support for SSLv2. Problem was introduced in 2.2.25. PR 55194. [Rainer Jung, Kaspar Brand] *) mod_dav: Fix double encoding of URIs in XML and Location header (caused by unintential ABI change in 2.2.25). PR 55397. [Ben Reser]
2013-11-24 20:56:26 +01:00
${INSTALL_DATA} ${FILESDIR}/no-accf.conf ${STAGEDIR}${ETCDIR}/Includes/
${INSTALL_DATA} ${FILESDIR}/README_modules.d ${STAGEDIR}/${ETCDIR}/modules.d/
.if ${PORT_OPTIONS:MLOG_FORENSIC}
@${INSTALL_SCRIPT} ${WRKSRC}/support/check_forensic ${STAGEDIR}${PREFIX}/sbin
.endif
# maintainer only, check for new modules
modlist: extract
@${AWK} '/: checking whether to enable mod_/ \
{printf "%%%%%s%%%%libexec/apache22/%s.so\n", \
toupper($$8), $$8}' ${WRKSRC}/configure \
| ${TR} -d '"' \
| ${SORT} -u \
| ${GREP} -E -v '^%%MOD_(ECHO|EXAMPLE|HTTP|IDENT|ISAPI|SO)%%'
.include <bsd.port.post.mk>