https://bz.apache.org/bugzilla/show_bug.cgi?id=70277
Bug ID: 70277
Summary: mod_autht_jwt: HAVE_APU_JOSE gate evaluated before
apu_version.h is included → module compiles as a no-op
stub
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_autht_jwt
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
SUMMARY
-------
The feature gate that enables mod_autht_jwt tests APU_MAJOR_VERSION before any
APR/APU header is included. At that point the macro is undefined (= 0), so the
real module body is compiled out and mod_autht_jwt is built as an empty stub:
its directives (AuthtJwtVerify, AuthtJwtDriver, ...) do not exist, and any
config using them makes httpd fail to start.
ROOT CAUSE
----------
Top of modules/aaa/mod_autht_jwt.c:
23 /* apr_jose support requires >= 1.7 */
24 #if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION
> 6)
26 #define HAVE_APU_JOSE 1
27 #endif
28
29 #include "httpd.h" /* nothing before line 24 defines
APU_MAJOR_VERSION */
...
32 #ifdef HAVE_APU_JOSE
... <entire real module>
1100 #else
... <stub: empty command table, no hooks>
1122 #endif
Because no header is included before line 24, APU_MAJOR_VERSION is undefined,
the #if is false, HAVE_APU_JOSE is never defined, and the #else stub is built.
STEPS TO REPRODUCE
------------------
1. Build httpd trunk against an apr-util that provides JOSE (APR 2.0, or
apr-util >= 1.7): standard ./configure --enable-autht-jwt, then make.
2. Inspect the built module -- it is the stub:
$ nm -D -u modules/mod_autht_jwt.so | grep -i jose
(no output: no apr_jose_* symbols referenced)
$ ls -l modules/mod_autht_jwt.so
(~23 KB -- far smaller than the real module, ~85 KB)
3. Start httpd with a JWT config:
AuthtJwtDriver openssl
<Location "/jwt"> AuthType bearer ... AuthtJwtVerify HS256 file s
</Location>
httpd refuses to start:
AH00526: Syntax error ...: Invalid command 'AuthtJwtDriver', perhaps
misspelled or defined by a module not included in the server configuration
(For comparison: adding -DHAVE_APU_JOSE=1 to the module's compile flags builds
the real module -- ~85 KB, references apr_jose_decode / apr_crypto_digest_* --
and the directives are then accepted.)
EXPECTED
--------
With a JOSE-capable apr-util, mod_autht_jwt should build as the real module and
its directives should be available.
IMPACT
------
The JWT authentication feature is silently unavailable in affected builds
(fail-safe: the server will not start with a JWT config, rather than run
insecurely). A build/packaging correctness defect.
FIX
---
Include the header that defines APU_MAJOR_VERSION before the gate, e.g. add
#include "apu_version.h" (or "apr.h")
immediately before the #if at line 24.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
