add revision 1209432 from http://svn.apache.org/ as patches:

fix for CVE-2011-4317

4 files changed, 75 insertions, 3 deletions

diff --git a/www/apache22/Makefile b/www/apache22/Makefile
index 64aa4ac5742..346f203791e 100644
--- a/www/apache22/Makefile
+++ b/www/apache22/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.75 2011/12/07 22:58:12 tron Exp $
+# $NetBSD: Makefile,v 1.76 2011/12/13 15:37:56 spz Exp $
 
 DISTNAME=	httpd-2.2.21
 
 PKGNAME=	${DISTNAME:S/httpd/apache/}
-PKGREVISION=	4
+PKGREVISION=	5
 CATEGORIES=	www
 MASTER_SITES=	${MASTER_SITE_APACHE:=httpd/} \
 		http://archive.apache.org/dist/httpd/ \
diff --git a/www/apache22/distinfo b/www/apache22/distinfo
index 35c9cebfda7..35ebfae7192 100644
--- a/www/apache22/distinfo
+++ b/www/apache22/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.46 2011/12/12 18:43:14 tron Exp $
+$NetBSD: distinfo,v 1.47 2011/12/13 15:37:56 spz Exp $
 
 SHA1 (httpd-2.2.21.tar.bz2) = c02f9b05da9a7e316ff37d9053dc76a57ba51cb4
 RMD160 (httpd-2.2.21.tar.bz2) = 6464a03d78ab858b1288ea9eef4cd5f73b60a9f1
@@ -15,6 +15,8 @@ SHA1 (patch-al) = 56b9f5c2f6fd01fe5067f9210e328cbf674c68f1
 SHA1 (patch-am) = ab4a2f7e5a1a3064e908b61157e7fd349c0b0c08
 SHA1 (patch-aw) = ca53d67beeb2c2c4d9adb04d3d79e24a8c427fd4
 SHA1 (patch-lock.c) = 770ca03f1cb4421879bd5baa5a7c30cc91acb6e1
+SHA1 (patch-modules_mappers_mod_rewrite.c) = de7bbdf02dda38e2542e4967ee6f22745ec0f118
+SHA1 (patch-modules_proxy_mod_proxy.c) = bab58b70eee22d7c08be9a4a9ada3fad886fa796
 SHA1 (patch-repos.c) = 0e0361b91d4b0fe6c7c55a12fdfd2e6aacc710e1
 SHA1 (patch-server_protocol.c) = 2be3e4fc08da717fa55b058eb32e398f6546d457
 SHA1 (patch-server_util.c) = b63f73e2a482facd188eecb0864fc612d1b7b3a5
diff --git a/www/apache22/patches/patch-modules_mappers_mod_rewrite.c b/www/apache22/patches/patch-modules_mappers_mod_rewrite.c
new file mode 100644
index 00000000000..47396c88531
--- /dev/null
+++ b/www/apache22/patches/patch-modules_mappers_mod_rewrite.c
@@ -0,0 +1,35 @@
+$NetBSD: patch-modules_mappers_mod_rewrite.c,v 1.1 2011/12/13 15:37:56 spz Exp $
+
+revision 1209432 from http://svn.apache.org/:
+	Fix for additional cases of URL rewriting with ProxyPassMatch or
+	RewriteRule, where particular request-URIs could result in undesired
+	backend network exposure in some configurations. (CVE-2011-4317)
+
+	Thanks to Prutha Parikh from Qualys for reporting this issue.
+
+	* modules/proxy/mod_proxy.c (proxy_trans): Decline to handle the "*"
+	  request-URI.  Fail for cases where r->uri does not begin with a "/".
+
+	* modules/mappers/mod_rewrite.c (hook_uri2file): Likewise.
+
+--- modules/mappers/mod_rewrite.c.orig	2011-09-03 22:54:25.000000000 +0000
++++ modules/mappers/mod_rewrite.c
+@@ -4266,6 +4266,18 @@ static int hook_uri2file(request_rec *r)
+         return DECLINED;
+     }
+ 
++    if (strcmp(r->unparsed_uri, "*") == 0) {
++        /* Don't apply rewrite rules to "*". */
++        return DECLINED;
++    }
++
++    /* Check that the URI is valid. */
++    if (!r->uri || r->uri[0] != '/') {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
++                     "Invalid URI in request %s", r->the_request);
++        return HTTP_BAD_REQUEST;
++    }
++
+     /*
+      *  add the SCRIPT_URL variable to the env. this is a bit complicated
+      *  due to the fact that apache uses subrequests and internal redirects
diff --git a/www/apache22/patches/patch-modules_proxy_mod_proxy.c b/www/apache22/patches/patch-modules_proxy_mod_proxy.c
new file mode 100644
index 00000000000..e75f25b9e29
--- /dev/null
+++ b/www/apache22/patches/patch-modules_proxy_mod_proxy.c
@@ -0,0 +1,35 @@
+$NetBSD: patch-modules_proxy_mod_proxy.c,v 1.1 2011/12/13 15:37:57 spz Exp $
+
+revision 1209432 from http://svn.apache.org/:
+        Fix for additional cases of URL rewriting with ProxyPassMatch or
+        RewriteRule, where particular request-URIs could result in undesired
+        backend network exposure in some configurations. (CVE-2011-4317)
+
+        Thanks to Prutha Parikh from Qualys for reporting this issue.
+
+        * modules/proxy/mod_proxy.c (proxy_trans): Decline to handle the "*"
+          request-URI.  Fail for cases where r->uri does not begin with a "/".
+
+        * modules/mappers/mod_rewrite.c (hook_uri2file): Likewise.
+
+--- modules/proxy/mod_proxy.c.orig	2010-10-07 18:51:18.000000000 +0000
++++ modules/proxy/mod_proxy.c
+@@ -566,6 +566,18 @@ static int proxy_trans(request_rec *r)
+         return OK;
+     }
+ 
++    if (strcmp(r->unparsed_uri, "*") == 0) {
++        /* "*" cannot be proxied. */
++        return DECLINED;
++    }
++
++    /* Check that the URI is valid. */
++    if (!r->uri || r->uri[0] != '/') {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
++                     "Invalid URI in request %s", r->the_request);
++        return HTTP_BAD_REQUEST;
++    }
++
+     /* XXX: since r->uri has been manipulated already we're not really
+      * compliant with RFC1945 at this point.  But this probably isn't
+      * an issue because this is a hybrid proxy/origin server.