bcb9c720c6
*) Correct win32 build issues for mod_proxy exports, OpenSSL 1.0.x headers.
Changes with Apache 2.2.30 (not released)
*) SECURITY: CVE-2015-3183 (cve.mitre.org)
core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from
the HTTP_IN filter, parse chunks in a single pass with zero copy.
Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
authorized characters.
*) http: Fix LimitRequestBody checks when there is no more bytes to read.
*) core: Allow spaces after chunk-size for compatibility with implementations
using a pre-filled buffer.
*) mod_ssl: bring SNI behavior into better conformance with RFC 6066:
no longer send warning-level unrecognized_name(112) alerts.
*) http: Make ap_die() robust against any HTTP error code and not modify
response status (finally logged) when nothing is to be done.
*) core, modules: Avoid error response/document handling by the core if some
handler or input filter already did it while reading the request (causing
a double response body).
*) FreeBSD: Disable IPv4-mapped listening sockets by default for versions
5+ instead of just for FreeBSD 5.
*) mod_proxy: use the original (non absolute) form of the request-line's URI
for requests embedded in CONNECT payloads used to connect SSL backends via
a ProxyRemote forward-proxy.
*) mpm_winnt: Accept utf-8 (Unicode) service names and descriptions for
internationalization.
*) mod_log_config: Implement logging for sub second timestamps and
request end time.
*) mod_log_config: Ensure that time data is consistent if multiple
duration patterns are used in combination, e.g. %D and %{ms}T.
*) mod_log_config: Add "%{UNIT}T" format to output request duration in
seconds, milliseconds or microseconds depending on UNIT ("s", "ms", "us").
*) In alignment with RFC 7525, the default recommended SSLCipherSuite
and SSLProxyCipherSuite now exclude RC4 as well as MD5. Also, the
default recommended SSLProtocol and SSLProxyProtocol directives now
exclude SSLv3. Existing configurations must be adjusted by the
administrator.
*) core: Avoid potential use of uninitialized (NULL) request data in
request line error path.
*) mod_proxy_http: Use the "Connection: close" header for requests to
backends not recycling connections (disablereuse), including the default
reverse and forward proxies.
*) mod_proxy: Add ap_connection_reusable() for checking if a connection
is reusable as of this point in processing.
*) mod_proxy: Reuse proxy/balancer workers' parameters and scores across
graceful restarts, even if new workers are added, old ones removed, or
the order changes.
*) mod_ssl: 'SSLProtocol ALL' was being ignored in virtual host context.
*) mod_ssl: Improve handling of ephemeral DH and ECDH keys by
allowing custom parameters to be configured via SSLCertificateFile,
and by adding standardized DH parameters for 1024/2048/3072/4096 bits.
Unless custom parameters are configured, the standardized parameters
are applied based on the certificate's RSA/DSA key size.
*) mod_ssl: drop support for export-grade ciphers with ephemeral RSA
keys, and unconditionally disable aNULL, eNULL and EXP ciphers
(not overridable via SSLCipherSuite).
*) mod_ssl: Add support for configuring persistent TLS session ticket
encryption/decryption keys (useful for clustered environments).
*) SSLProtocol and SSLCipherSuite recommendations in the example/default
conf/extra/httpd-ssl.conf file are now global in scope, affecting all
VirtualHosts (matching 2.4 default configuration).
*) mod_authn_dbd: Fix lifetime of DB lookup entries independently of the
selected DB engine.
*) Turn static function get_server_name_for_url() into public
ap_get_server_name_for_url() and use it where appropriate. This
fixes mod_rewrite generating invalid URLs for redirects to IPv6
literal addresses.
*) dav_validate_request: avoid validating locks and ETags when there are
no If headers providing them on a resource we aren't modifying.
*) mod_ssl: New directive SSLSessionTickets (On|Off).
The directive controls the use of TLS session tickets (RFC 5077),
default value is "On" (unchanged behavior).
Session ticket creation uses a random key created during web
server startup and recreated during restarts. No other key
recreation mechanism is available currently. Therefore using session
tickets without restarting the web server with an appropriate frequency
(e.g. daily) compromises perfect forward secrecy.
*) mod_deflate: Define APR_INT32_MAX when it is missing so to be able to
compile against APR-1.2.x (minimum required version).
*) mod_reqtimeout: Don't let pipelining checks interfere with the timeouts
computed for subsequent requests.
244 lines
8.7 KiB
Makefile
244 lines
8.7 KiB
Makefile
# $NetBSD: Makefile,v 1.105 2015/07/20 18:28:59 adam Exp $
|
|
|
|
DISTNAME= httpd-2.2.31
|
|
PKGNAME= ${DISTNAME:S/httpd/apache/}
|
|
CATEGORIES= www
|
|
MASTER_SITES= ${MASTER_SITE_APACHE:=httpd/} \
|
|
http://archive.apache.org/dist/httpd/ \
|
|
http://archive.eu.apache.org/dist/httpd/
|
|
EXTRACT_SUFX= .tar.bz2
|
|
|
|
MAINTAINER= pkgsrc-users@NetBSD.org
|
|
HOMEPAGE= http://httpd.apache.org/
|
|
COMMENT= Apache HTTP (Web) server, version 2.2
|
|
LICENSE= apache-2.0
|
|
|
|
BUILD_DEFS+= IPV6_READY
|
|
BUILD_DEFS+= VARBASE
|
|
|
|
USE_TOOLS+= pax perl perl:run pkg-config
|
|
USE_LIBTOOL= yes
|
|
GNU_CONFIGURE= yes
|
|
CONFIGURE_ARGS+= --enable-layout=NetBSD
|
|
CONFIGURE_ARGS+= --with-port=80
|
|
CONFIGURE_ARGS+= --enable-so
|
|
CONFIGURE_ENV+= perlbin=${PERL5:Q}
|
|
CONFIGURE_ENV+= ac_cv_path_RSYNC=/nonexistent
|
|
CONFIGURE_ARGS+= CFLAGS=${APACHE_CUSTOM_CFLAGS:M*:Q}
|
|
|
|
BUILD_DEFS+= APACHE_CUSTOM_CFLAGS
|
|
|
|
# Apache Portable Runtime library configure options
|
|
CONFIGURE_ARGS+= --with-apr=${BUILDLINK_PREFIX.apr}
|
|
CONFIGURE_ARGS+= --with-apr-util=${BUILDLINK_PREFIX.apr-util}
|
|
|
|
CHECK_INTERPRETER_SKIP+= lib/httpd/httpd.exp
|
|
CHECK_PORTABILITY_SKIP+= srclib/pcre/* \
|
|
srclib/apr-util/* \
|
|
srclib/apr/*
|
|
|
|
# the following must be set before bsd.prefs.mk in order to make += work
|
|
# in mk.conf; however, it isn't expanded until referenced, so we can
|
|
# define DFLT_APACHE_MODULES later
|
|
#
|
|
APACHE_MODULES?= ${DFLT_APACHE_MODULES}
|
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
.include "../../devel/apr/buildlink3.mk"
|
|
.include "../../devel/apr-util/buildlink3.mk"
|
|
.include "../../textproc/expat/buildlink3.mk"
|
|
.include "../../mk/dlopen.buildlink3.mk"
|
|
.include "../../mk/pthread.buildlink3.mk"
|
|
|
|
CONFIGURE_ARGS+= --disable-include
|
|
CONFIGURE_ARGS+= --disable-log-config
|
|
CONFIGURE_ARGS+= --disable-env
|
|
CONFIGURE_ARGS+= --disable-mime
|
|
CONFIGURE_ARGS+= --disable-setenvif
|
|
CONFIGURE_ARGS+= --disable-status
|
|
CONFIGURE_ARGS+= --disable-autoindex
|
|
CONFIGURE_ARGS+= --disable-asis
|
|
CONFIGURE_ARGS+= --disable-cgi
|
|
CONFIGURE_ARGS+= --disable-negotiation
|
|
CONFIGURE_ARGS+= --disable-dir
|
|
CONFIGURE_ARGS+= --disable-actions
|
|
CONFIGURE_ARGS+= --disable-userdir
|
|
CONFIGURE_ARGS+= --disable-alias
|
|
|
|
DFLT_APACHE_MODULES= all
|
|
DFLT_APACHE_MODULES+= proxy proxy_connect proxy_ftp proxy_http
|
|
DFLT_APACHE_MODULES+= ssl deflate access auth authn_alias
|
|
DFLT_APACHE_MODULES+= include log_config env mime setenvif
|
|
DFLT_APACHE_MODULES+= status autoindex asis cgi negotiation dir imap
|
|
DFLT_APACHE_MODULES+= actions userdir alias isapi file_cache
|
|
DFLT_APACHE_MODULES+= cache disk_cache mem_cache bucketeer echo
|
|
DFLT_APACHE_MODULES+= example case_filter case_filter_in
|
|
DFLT_APACHE_MODULES+= charset_lite
|
|
DFLT_APACHE_MODULES+= cgid dav_lock proxy_ajp proxy_balancer
|
|
|
|
PLIST_SRC+= ${PKGDIR}/PLIST
|
|
|
|
.include "options.mk"
|
|
|
|
# LDAP support
|
|
PLIST_VARS+= ldap
|
|
.if !empty(PKG_BUILD_OPTIONS.apr-util:Mldap)
|
|
DFLT_APACHE_MODULES+= ldap authnz_ldap
|
|
. if !empty(PKG_OPTIONS:Mapache-shared-modules)
|
|
PLIST.ldap= yes
|
|
. endif
|
|
.endif
|
|
|
|
APACHE_USER?= www
|
|
APACHE_GROUP?= www
|
|
PKG_GROUPS= ${APACHE_GROUP}
|
|
PKG_USERS= ${APACHE_USER}:${APACHE_GROUP}
|
|
PKG_GROUPS_VARS+= APACHE_GROUP
|
|
PKG_USERS_VARS+= APACHE_USER
|
|
|
|
PKG_SYSCONFVAR= apache
|
|
PKG_SYSCONFSUBDIR?= httpd
|
|
EGDIR= ${PREFIX}/share/examples/httpd
|
|
SBINDIR= ${PREFIX}/sbin
|
|
CONF_FILES+= ${EGDIR}/httpd.conf ${PKG_SYSCONFDIR}/httpd.conf
|
|
.for f in autoindex dav default info languages manual mpm \
|
|
multilang-errordoc ssl userdir vhosts
|
|
CONF_FILES+= ${EGDIR}/extra/httpd-${f}.conf \
|
|
${PKG_SYSCONFDIR}/httpd-${f}.conf
|
|
.endfor
|
|
CONF_FILES+= ${EGDIR}/magic ${PKG_SYSCONFDIR}/magic
|
|
CONF_FILES+= ${EGDIR}/mime.types ${PKG_SYSCONFDIR}/mime.types
|
|
RCD_SCRIPTS= apache
|
|
|
|
REQD_DIRS= ${PREFIX}/share/httpd
|
|
REQD_DIRS+= ${PREFIX}/share/httpd/htdocs
|
|
OWN_DIRS= ${VARBASE}/log/httpd
|
|
OWN_DIRS+= ${VARBASE}/db/httpd
|
|
OWN_DIRS_PERMS+= ${VARBASE}/db/httpd/proxy ${APACHE_USER} ${APACHE_GROUP} 0755
|
|
FIX_PERMS= apachectl apxs dbmmanage envvars-std mkcert
|
|
FIX_MAN_PERMS= man1/htdbm.1 man1/htpasswd.1 man1/htdigest.1
|
|
FIX_MAN_PERMS+= man1/dbmmanage.1 man8/httpd.8 man8/suexec.8
|
|
FIX_MAN_PERMS+= man8/rotatelogs.8 man1/logresolve.1 man1/apxs.1
|
|
FIX_MAN_PERMS+= man8/apachectl.8 man1/ab.1 man1/httxt2dbm.1
|
|
|
|
# Fix paths in the apache manpages.
|
|
SUBST_CLASSES+= man
|
|
SUBST_STAGE.man= post-patch
|
|
SUBST_FILES.man= docs/man/*.1 docs/man/*.8
|
|
SUBST_SED.man= -e 's,/usr/local/etc/apache,${PKG_SYSCONFDIR},'
|
|
SUBST_SED.man+= -e 's,/path/to/apache/etc,${PKG_SYSCONFDIR},'
|
|
SUBST_SED.man+= -e 's,/usr/local/apache2,${PREFIX}/share/httpd/htdocs,'
|
|
SUBST_SED.man+= -e 's,/usr/web,${PREFIX}/share/httpd/htdocs,'
|
|
|
|
SUBST_CLASSES+= paths
|
|
SUBST_STAGE.paths= pre-configure
|
|
SUBST_FILES.paths= config.layout Makefile.in support/apxs.in
|
|
SUBST_SED.paths= -e "s|@PREFIX@|${PREFIX}|g"
|
|
SUBST_SED.paths+= -e "s|@VARBASE@|${VARBASE}|g"
|
|
SUBST_SED.paths+= -e "s|@SYSCONFDIR@|${PKG_SYSCONFDIR}|g"
|
|
SUBST_SED.paths+= -e "s|@PAX@|${PAX}|g"
|
|
SUBST_SED.paths+= -e "s|@LOCALBASE@|${LOCALBASE}|g"
|
|
SUBST_MESSAGE.paths= Fixing paths.
|
|
|
|
SUBST_CLASSES+= apr-lt
|
|
SUBST_STAGE.apr-lt= post-configure
|
|
SUBST_FILES.apr-lt= build/config_vars.mk
|
|
SUBST_SED.apr-lt= -e 's|^\(LIBTOOL =\) [^ ]*|\1 $$(SHELL) $$(top_builddir)/build/libtool|g'
|
|
SUBST_MESSAGE.apr-lt= Fixing libtool references.
|
|
|
|
SUBST_CLASSES+= confs
|
|
SUBST_STAGE.confs= post-configure
|
|
SUBST_MESSAGE.confs= Fixing configuration files.
|
|
SUBST_FILES.confs= docs/conf/httpd.conf
|
|
SUBST_FILES.confs+= docs/conf/extra/httpd-ssl.conf
|
|
SUBST_SED.confs= -e "s|${EGDIR}|${PKG_SYSCONFDIR}|g"
|
|
SUBST_SED.confs+= -e "s|${PREFIX}/htdocs|${PREFIX}/share/httpd/htdocs|g"
|
|
SUBST_SED.confs+= -e "s|${PREFIX}/conf|${PKG_SYSCONFDIR}|g"
|
|
SUBST_SED.confs+= -e "s|logs/|${VARBASE}/log/httpd/|g"
|
|
SUBST_SED.confs+= -e 's|/var/log/httpd/foo\.log|logs/foo.log/|g'
|
|
SUBST_SED.confs+= -e 's|^\(User[ ]\).*|\1${APACHE_USER}|g'
|
|
SUBST_SED.confs+= -e 's|^\(Group[ ]\).*|\1${APACHE_GROUP}|g'
|
|
SUBST_SED.confs+= -e 's|^Listen \(.*\)|Listen 0.0.0.0:\1|g'
|
|
|
|
# abs_srcdir in config_vars.mk is used during install so needs to reference
|
|
# the work dir path, and by other packages such as ap2-fastcgi after install,
|
|
# so we fix after install to reference the installed path
|
|
SUBST_CLASSES+= abs_srcdir
|
|
SUBST_STAGE.abs_srcdir= post-install
|
|
SUBST_FILES.abs_srcdir= ${DESTDIR}${PREFIX}/share/httpd/build/config_vars.mk
|
|
SUBST_SED.abs_srcdir= -e 's|^\(abs_srcdir =\) .*|\1 ${PREFIX}/share/httpd|'
|
|
SUBST_MESSAGE.abs_srcdir= Fixing abs_srcdir
|
|
|
|
REPLACE_PERL= docs/cgi-examples/printenv
|
|
|
|
# Add dependencies for the modules that will be built. For each module
|
|
# ap_mod listed in ${APACHE_MODULES}, _AP_DEPENDS.ap_mod is a whitespace
|
|
# separated list of dependencies or buildlink3.mk files needed to build
|
|
# ap_mod, and _AP_CFG_ARGS.ap_mod is a whitespace separated list of
|
|
# configure script options for ap_mod.
|
|
#
|
|
AP_DEPENDS.ssl= ../../security/openssl/buildlink3.mk
|
|
AP_DEPENDS.deflate= ../../devel/zlib/buildlink3.mk
|
|
|
|
AP_CFG_ARGS.ssl= --with-ssl=${BUILDLINK_PREFIX.openssl}
|
|
AP_CFG_ARGS.deflate= --with-z=${BUILDLINK_PREFIX.zlib}
|
|
|
|
#.if ${APACHE_MODULES} == "all-shared"
|
|
.if !empty(PKG_OPTIONS:Mapache-shared-modules)
|
|
. include "${AP_DEPENDS.ssl}"
|
|
. include "${AP_DEPENDS.deflate}"
|
|
CONFIGURE_ARGS+= ${AP_CFG_ARGS.ssl} ${AP_CFG_ARGS.deflate}
|
|
.else
|
|
. for ap_mod in ${APACHE_MODULES}
|
|
. if defined(AP_DEPENDS.${ap_mod}) && !empty(AP_DEPENDS.${ap_mod})
|
|
. for ap_depend in ${AP_DEPENDS.${ap_mod}}
|
|
. if exists(${ap_depend})
|
|
. include "${ap_depend}"
|
|
. else
|
|
DEPENDS+= ${ap_depend}
|
|
. endif
|
|
. endfor
|
|
. endif
|
|
. if defined(AP_CFG_ARGS.${ap_mod}) && !empty(AP_CFG_ARGS.${ap_mod})
|
|
CONFIGURE_ARGS+= ${AP_CFG_ARGS.${ap_mod}}
|
|
. endif
|
|
. endfor
|
|
.endif
|
|
|
|
post-extract:
|
|
${TOUCH} ${WRKSRC}/build/libtool
|
|
${ECHO} "" >> ${WRKSRC}/docs/conf/extra/httpd-languages.conf.in
|
|
|
|
post-build:
|
|
${SED} "s#@PKG_SYSCONFDIR@#${PKG_SYSCONFDIR}#g" \
|
|
< ${FILESDIR}/mkcert.sh > ${WRKDIR}/mkcert
|
|
|
|
INSTALL_TARGET= install-conf install
|
|
INSTALL_MAKE_FLAGS+= sysconfdir="${EGDIR}"
|
|
|
|
post-install:
|
|
${LN} -sf ${LOCALBASE}/libexec/apr/libtool ${DESTDIR}${PREFIX}/share/httpd/build
|
|
${LN} -sf ${SBINDIR}/envvars-std ${DESTDIR}${SBINDIR}/envvars
|
|
|
|
${INSTALL_SCRIPT} ${WRKDIR}/mkcert ${DESTDIR}${PREFIX}/sbin
|
|
|
|
for file in ${FIX_PERMS}; do \
|
|
${CHOWN} ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/sbin/$$file && \
|
|
${CHMOD} ${BINMODE} ${DESTDIR}${PREFIX}/sbin/$$file; \
|
|
done
|
|
|
|
${CHOWN} -RP ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/share/httpd
|
|
${CHOWN} -RP ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/include/httpd
|
|
${CHOWN} -RP ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/lib/httpd
|
|
${CHOWN} ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/libexec/cgi-bin/test-cgi
|
|
${CHOWN} ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/libexec/cgi-bin/printenv
|
|
|
|
for file in ${FIX_MAN_PERMS}; do \
|
|
${CHOWN} ${MANOWN}:${MANGRP} ${DESTDIR}${PREFIX}/${PKGMANDIR}/$$file; \
|
|
done
|
|
|
|
${CHMOD} -x ${DESTDIR}${PREFIX}/sbin/envvars-std
|
|
${TEST} ! -f ${DESTDIR}${PREFIX}/sbin/suexec || ${CHMOD} -w ${DESTDIR}${PREFIX}/sbin/suexec
|
|
|
|
.include "../../mk/pthread.buildlink3.mk"
|
|
.include "../../mk/bsd.pkg.mk"
|