Return-Path: Delivered-To: apmail-perl-modperl-archive@www.apache.org Received: (qmail 66944 invoked from network); 21 May 2009 18:40:16 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3) by minotaur.apache.org with SMTP; 21 May 2009 18:40:16 -0000 Received: (qmail 99615 invoked by uid 500); 21 May 2009 18:40:27 -0000 Delivered-To: apmail-perl-modperl-archive@perl.apache.org Received: (qmail 99595 invoked by uid 500); 21 May 2009 18:40:27 -0000 Mailing-List: contact modperl-help@perl.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list modperl@perl.apache.org Received: (qmail 99587 invoked by uid 99); 21 May 2009 18:40:27 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 21 May 2009 18:40:27 +0000 X-ASF-Spam-Status: No, hits=2.2 required=10.0 tests=HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of trawick@gmail.com designates 72.14.220.155 as permitted sender) Received: from [72.14.220.155] (HELO fg-out-1718.google.com) (72.14.220.155) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 21 May 2009 18:40:19 +0000 Received: by fg-out-1718.google.com with SMTP id e21so467305fga.11 for ; Thu, 21 May 2009 11:39:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=PfWwAuR6AqI0WL60FKaNd6VRDsswjVGVJa6XM37pTAE=; b=b1D9sWVUyefZoGJKoZKLND/EZLwLJG+fhzpMDV688uSla5JmAexiIXduZu74k5tXWz dHlqVliFZSYY3JGtD+81EpAacEvKXisavuZof4z0sYQ36cgQtKtXpsBtWdZnPMFinqt7 +nR61owkiyLOD7zXhibEsbYu+/7cN3js+eFIY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=ZjQvgV74oVIhAb9S4ZUfIjYNJEoSbbCy+LPzjpdR9FPXuh50r9ZI6nhUHgFOFKSprZ sEWhniuz2yDsrAlt0zUh+qY+Ew4UdUGj6V5yGE1Curm1Ua93jYn6xS6yIPonU2aihxr3 IIzZp0z5a/7Irx08Su70WAFpmNYBFr9NKnLio= MIME-Version: 1.0 Received: by 10.86.70.3 with SMTP id s3mr2468108fga.16.1242931197727; Thu, 21 May 2009 11:39:57 -0700 (PDT) In-Reply-To: <20090520125319.GB2601@redhat.com> References: <20090512131730.1F03F2388842@eris.apache.org> <20090520125319.GB2601@redhat.com> Date: Thu, 21 May 2009 14:39:57 -0400 Message-ID: Subject: Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c From: Jeff Trawick To: dev@httpd.apache.org, modperl@perl.apache.org Content-Type: multipart/alternative; boundary=000e0cd25016855441046a70786d X-Virus-Checked: Checked by ClamAV on apache.org --000e0cd25016855441046a70786d Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On Wed, May 20, 2009 at 8:53 AM, Joe Orton wrote: > On Sun, May 17, 2009 at 11:15:00AM -0400, Jeff Trawick wrote: > > On Tue, May 12, 2009 at 9:17 AM, wrote: > > > > > Author: covener > > > Date: Tue May 12 13:17:29 2009 > > > New Revision: 773881 > > > > > > URL: http://svn.apache.org/viewvc?rev=773881&view=rev > > > Log: > > > backport 772997, 773322, 773342 from trunk. > > > Reviewed By: jorton, rpluem, covener > > > > > > Security fix for CVE-2009-1195: fix Options handling such that > > > 'AllowOverride Options=IncludesNoExec' does not permit Includes with > > > exec= enabled to be configured in an .htaccess file: > > > > > > * include/http_core.h: Change semantics of Includes/IncludeNoExec > > > options bits to be additive; OPT_INCLUDES now means SSI is enabled > > > without exec=. OPT_INCLUDES|OPT_INC_WITH_EXEC means SSI is enabled > > > with exec=. > > > > > > Current mod_perl tarballs reference OPT_INC_WITH_EXEC as part of mapping > the > > httpd API into perl, and the mod_perl build fails because of this. > > > > ("modperl_config.c", line 525: undefined symbol: OPT_INCNOEXEC) > > Ick :( For some reason I thought this was hidden by CORE_PRIVATE, for > what little that's worth. > > > While I don't understand why the mod_perl mappings are created at release > > time against who knows what httpd, it brings up an interesting httpd > issue > > anyway. > > > > If some module does have OPT_INCNOEXEC baked in (32), it matches what > > 2.2.12+ thinks is OPT_INC_WITH_EXEC. Similarly, the old > OPT_INC_WITH_EXEC > > (previously called OPT_INCLUDES), maps what 2.2.12+ thinks is > > OPT_INCLUDES-without-exec. > > > > We could swap the values of OPT_INCLUDES and OPT_INC_WITH_EXEC to lessen > the > > chance of some theoretical module making the wrong decision. > > > > We can also define OPT_INCNOEXEC to something (either the new > OPT_INCLUDES > > or "Get your mod_perl patch at XXX"). > > Given that the semantics of the options has changed, I don't think it's > worth changing httpd to maintain any pretence of compile-time or > run-time compatibility here. Any code using the OPT_* constants as > exposed by mod_perl cannot work as expected any more. > > Regards, Joe > Is the change in semantics required to fix the bug, or is it simply the current implementation? As these constants and the related ap_allow_options() have been exposed to the C API for eons, and passed through in API mappings such as mod_perl, it is worth making an alternate fix to avoid breaking module compiles and (potentially) module misbehavior when upgrading from 2.2.11 to 2.2.12. Unfortunately I don't have a patch :( Does somebody else care to share their opinion on this? Which of these are okay? - existing mod_perl releases (and potentially other third-party modules) won't compile with 2.2.12 - existing Perl modules (and potentially other third-party modules) will confuse include-with-exec and include-without-exec --000e0cd25016855441046a70786d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Wed, May 20, 2009 at 8:53 AM, Joe Orton <jorton@redhat.com= > wrote:
On Sun, May 17, 2009 at 11:15:00AM -0400, Jeff Trawick wr= ote:
> On Tue, May 12, 2009 at 9:17 AM, <covener@apache.org> wrote:
>
> > Author: covener
> > Date: Tue May 12 13:17:29 2009
> > New Revision: 773881
> >
> > URL: http://svn.apache.org/viewvc?rev=3D773881&vi= ew=3Drev
> > Log:
> > backport 772997, 773322, 773342 from trunk.
> > Reviewed By: jorton, rpluem, covener
> >
> > Security fix for CVE-2009-1195: fix Options handling such that > > 'AllowOverride Options=3DIncludesNoExec' does not permit = Includes with
> > exec=3D enabled to be configured in an .htaccess file:
> >
> > * include/http_core.h: Change semantics of Includes/IncludeNoExec=
> > =A0options bits to be additive; OPT_INCLUDES now means SSI is ena= bled
> > =A0without exec=3D. =A0OPT_INCLUDES|OPT_INC_WITH_EXEC means SSI i= s enabled
> > =A0with exec=3D.
>
>
> Current mod_perl tarballs reference OPT_INC_WITH_EXEC as part of mappi= ng the
> httpd API into perl, and the mod_perl build fails because of this.
>
> ("modperl_config.c", line 525: undefined symbol: OPT_INCNOEX= EC)

Ick :( For some reason I thought this was hidden by CORE_PRIVATE, for=
what little that's worth.

> While I don't understand why the mod_perl mappings are created at = release
> time against who knows what httpd, it brings up an interesting httpd i= ssue
> anyway.
>
> If some module does have OPT_INCNOEXEC baked in (32), it matches what<= br> > 2.2.12+ thinks is OPT_INC_WITH_EXEC. =A0Similarly, the old OPT_INC_WIT= H_EXEC
> (previously called OPT_INCLUDES), maps what 2.2.12+ thinks is
> OPT_INCLUDES-without-exec.
>
> We could swap the values of OPT_INCLUDES and OPT_INC_WITH_EXEC to less= en the
> chance of some theoretical module making the wrong decision.
>
> We can also define OPT_INCNOEXEC to something (either the new OPT_INCL= UDES
> or "Get your mod_perl patch at XXX").

Given that the semantics of the options has changed, I don't thin= k it's
worth changing httpd to maintain any pretence of compile-time or
run-time compatibility here. =A0Any code using the OPT_* constants as
exposed by mod_perl cannot work as expected any more.

Regards, Joe

Is the change in semantics required to fix the bug, = or is it simply the current implementation?

As these constants and t= he related ap_allow_options() have been exposed to the C API for eons, and = passed through in API mappings such as mod_perl, it is worth making an alte= rnate fix to avoid breaking module compiles and (potentially) module misbeh= avior when upgrading from 2.2.11 to 2.2.12.

Unfortunately I don't have a patch :(

Does somebody else car= e to share their opinion on this?=A0 Which of these are okay?

- exis= ting mod_perl releases (and potentially other third-party modules) won'= t compile with 2.2.12
- existing Perl modules (and potentially other third-party modules) will co= nfuse include-with-exec and include-without-exec

--000e0cd25016855441046a70786d--