Blame SOURCES/httpd-2.4.35-r1738878.patch

e71654
diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
e71654
index c119a7e..267150a 100644
e71654
--- a/modules/proxy/ajp.h
e71654
+++ b/modules/proxy/ajp.h
e71654
@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
e71654
  * @param sock      backend socket
e71654
  * @param r         current request
e71654
  * @param buffsize  max size of the AJP packet.
e71654
+ * @param secret    authentication secret
e71654
  * @param uri       requested uri
e71654
  * @return          APR_SUCCESS or error
e71654
  */
e71654
 apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
e71654
                              apr_size_t buffsize,
e71654
-                             apr_uri_t *uri);
e71654
+                             apr_uri_t *uri,
e71654
+                             const char *secret);
e71654
 
e71654
 /**
e71654
  * Read the ajp message and return the type of the message.
e71654
diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
e71654
index 67353a7..680a8f3 100644
e71654
--- a/modules/proxy/ajp_header.c
e71654
+++ b/modules/proxy/ajp_header.c
e71654
@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
e71654
 
e71654
 static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
e71654
                                           request_rec *r,
e71654
-                                          apr_uri_t *uri)
e71654
+                                          apr_uri_t *uri,
e71654
+                                          const char *secret)
e71654
 {
e71654
     int method;
e71654
     apr_uint32_t i, num_headers = 0;
e71654
@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
e71654
                    i, elts[i].key, elts[i].val);
e71654
     }
e71654
 
e71654
-/* XXXX need to figure out how to do this
e71654
-    if (s->secret) {
e71654
+    if (secret) {
e71654
         if (ajp_msg_append_uint8(msg, SC_A_SECRET) ||
e71654
-            ajp_msg_append_string(msg, s->secret)) {
e71654
+            ajp_msg_append_string(msg, secret)) {
e71654
             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(03228)
e71654
-                   "Error ajp_marshal_into_msgb - "
e71654
+                   "ajp_marshal_into_msgb: "
e71654
                    "Error appending secret");
e71654
             return APR_EGENERAL;
e71654
         }
e71654
     }
e71654
- */
e71654
 
e71654
     if (r->user) {
e71654
         if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
e71654
@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
e71654
 apr_status_t ajp_send_header(apr_socket_t *sock,
e71654
                              request_rec *r,
e71654
                              apr_size_t buffsize,
e71654
-                             apr_uri_t *uri)
e71654
+                             apr_uri_t *uri,
e71654
+                             const char *secret)
e71654
 {
e71654
     ajp_msg_t *msg;
e71654
     apr_status_t rc;
e71654
@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
e71654
         return rc;
e71654
     }
e71654
 
e71654
-    rc = ajp_marshal_into_msgb(msg, r, uri);
e71654
+    rc = ajp_marshal_into_msgb(msg, r, uri, secret);
e71654
     if (rc != APR_SUCCESS) {
e71654
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
e71654
                "ajp_send_header: ajp_marshal_into_msgb failed");
e71654
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
e71654
index 69a35ce..800ede1 100644
e71654
--- a/modules/proxy/mod_proxy.c
e71654
+++ b/modules/proxy/mod_proxy.c
e71654
@@ -327,6 +327,12 @@ static const char *set_worker_param(apr_pool_t *p,
e71654
         worker->s->response_field_size = (s ? s : HUGE_STRING_LEN);
e71654
         worker->s->response_field_size_set = 1;
e71654
     }
e71654
+    else if (!strcasecmp(key, "secret")) {
e71654
+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
e71654
+            return apr_psprintf(p, "Secret length must be < %d characters",
e71654
+                                (int)sizeof(worker->s->secret));
e71654
+        }
e71654
+    }
e71654
     else {
e71654
         if (set_worker_hc_param_f) {
e71654
             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
e71654
diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
e71654
index aabd09f..3419023 100644
e71654
--- a/modules/proxy/mod_proxy.h
e71654
+++ b/modules/proxy/mod_proxy.h
e71654
@@ -357,6 +357,7 @@ PROXY_WORKER_HC_FAIL )
e71654
 #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
e71654
 #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
e71654
 #define PROXY_BALANCER_MAX_STICKY_SIZE  64
e71654
+#define PROXY_WORKER_MAX_SECRET_SIZE    64
e71654
 
e71654
 #define PROXY_RFC1035_HOSTNAME_SIZE	256
e71654
 
e71654
@@ -450,6 +451,7 @@ typedef struct {
e71654
     hcmethod_t      method;     /* method to use for health check */
e71654
     apr_interval_time_t interval;
e71654
     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
e71654
+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
e71654
     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
e71654
     apr_size_t   response_field_size; /* Size of proxy response buffer in bytes. */
e71654
     unsigned int response_field_size_set:1;
e71654
diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
e71654
index 73716af..6faabea 100644
e71654
--- a/modules/proxy/mod_proxy_ajp.c
e71654
+++ b/modules/proxy/mod_proxy_ajp.c
e71654
@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
e71654
     apr_off_t content_length = 0;
e71654
     int original_status = r->status;
e71654
     const char *original_status_line = r->status_line;
e71654
+    const char *secret = NULL;
e71654
 
e71654
     if (psf->io_buffer_size_set)
e71654
        maxsize = psf->io_buffer_size;
e71654
@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
e71654
        maxsize = AJP_MSG_BUFFER_SZ;
e71654
     maxsize = APR_ALIGN(maxsize, 1024);
e71654
 
e71654
+    if (*conn->worker->s->secret)
e71654
+        secret = conn->worker->s->secret;
e71654
+
e71654
     /*
e71654
      * Send the AJP request to the remote server
e71654
      */
e71654
 
e71654
     /* send request headers */
e71654
-    status = ajp_send_header(conn->sock, r, maxsize, uri);
e71654
+    status = ajp_send_header(conn->sock, r, maxsize, uri, secret);
e71654
     if (status != APR_SUCCESS) {
e71654
         conn->close = 1;
e71654
         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)