"); ++ return HTTP_FORBIDDEN; ++ } ++ ++ old_state = sslconn->reneg_state; ++ sslconn->reneg_state = RENEG_ALLOW; ++ modssl_set_app_data2(ssl, r); ++ ++ SSL_do_handshake(ssl); ++ /* Need to trigger renegotiation handshake by reading. ++ * Peeking 0 bytes actually works. ++ * See: http://marc.info/?t=145493359200002&r=1&w=2 ++ */ ++ SSL_peek(ssl, peekbuf, 0); ++ ++ sslconn->reneg_state = old_state; ++ modssl_set_app_data2(ssl, NULL); ++ ++ /* ++ * Finally check for acceptable renegotiation results ++ */ ++ if (OK != (rc = ssl_check_post_client_verify(r, sc, dc, sslconn, ssl))) { ++ return rc; ++ } ++ } ++ } ++ ++ return DECLINED; ++} ++#endif ++ ++int ssl_hook_Access(request_rec *r) ++{ ++ SSLDirConfigRec *dc = myDirConfig(r); ++ SSLSrvConfigRec *sc = mySrvConfig(r->server); ++ SSLConnRec *sslconn = myConnConfig(r->connection); ++ SSL *ssl = sslconn ? sslconn->ssl : NULL; ++ apr_array_header_t *requires; ++ ssl_require_t *ssl_requires; ++ int ok, i, ret; ++ ++ /* On a slave connection, we do not expect to have an SSLConnRec, but ++ * our master connection might have one. */ ++ if (!(sslconn && ssl) && r->connection->master) { ++ sslconn = myConnConfig(r->connection->master); ++ ssl = sslconn ? sslconn->ssl : NULL; ++ } ++ ++ /* ++ * We should have handshaken here, otherwise we are being ++ * redirected (ErrorDocument) from a renegotiation failure below. ++ * The access is still forbidden in the latter case, let ap_die() handle ++ * this recursive (same) error. ++ */ ++ if (ssl && !SSL_is_init_finished(ssl)) { ++ return HTTP_FORBIDDEN; ++ } ++ ++ /* ++ * Support for SSLRequireSSL directive ++ */ ++ if (dc->bSSLRequired && !ssl) { ++ if ((sc->enabled == SSL_ENABLED_OPTIONAL) && !r->connection->master) { ++ /* This vhost was configured for optional SSL, just tell the ++ * client that we need to upgrade. ++ */ ++ apr_table_setn(r->err_headers_out, "Upgrade", "TLS/1.0, HTTP/1.1"); ++ apr_table_setn(r->err_headers_out, "Connection", "Upgrade"); ++ ++ return HTTP_UPGRADE_REQUIRED; ++ } ++ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02219) ++ "access to %s failed, reason: %s", ++ r->filename, "SSL connection required"); ++ ++ /* remember forbidden access for strict require option */ ++ apr_table_setn(r->notes, "ssl-access-forbidden", "1"); ++ ++ return HTTP_FORBIDDEN; ++ } ++ ++ /* ++ * Check to see whether SSL is in use; if it's not, then no ++ * further access control checks are relevant. (the test for ++ * sc->enabled is probably strictly unnecessary) ++ */ ++ if (sc->enabled == SSL_ENABLED_FALSE || !ssl) { ++ return DECLINED; ++ } ++ ++#if SSL_HAVE_PROTOCOL_TLSV1_3 ++ /* TLSv1.3+ is less complicated here. Branch off into a new codeline ++ * and avoid messing with the past. */ ++ if (SSL_version(ssl) >= TLS1_3_VERSION) { ++ ret = ssl_hook_Access_modern(r, sc, dc, sslconn, ssl); ++ } ++ else ++#endif ++ { ++ ret = ssl_hook_Access_classic(r, sc, dc, sslconn, ssl); ++ } ++ ++ if (ret != DECLINED) { ++ return ret; ++ } ++ + /* If we're trying to have the user name set from a client + * certificate then we need to set it here. This should be safe as + * the user name probably isn't important from an auth checking point +@@ -2080,31 +2246,43 @@ + { + conn_rec *c; + server_rec *s; +- SSLConnRec *scr; + + /* Retrieve the conn_rec and the associated SSLConnRec. */ + if ((c = (conn_rec *)SSL_get_app_data((SSL *)ssl)) == NULL) { + return; + } + +- if ((scr = myConnConfig(c)) == NULL) { +- return; +- } ++ /* With TLS 1.3 this callback may be called multiple times on the first ++ * negotiation, so the below logic to detect renegotiations can't work. ++ * Fortunately renegotiations are forbidden starting with TLS 1.3, and ++ * this is enforced by OpenSSL so there's nothing to be done here. ++ */ ++#if SSL_HAVE_PROTOCOL_TLSV1_3 ++ if (SSL_version(ssl) < TLS1_3_VERSION) ++#endif ++ { ++ SSLConnRec *sslconn; ++ ++ if ((sslconn = myConnConfig(c)) == NULL) { ++ return; ++ } + +- /* If the reneg state is to reject renegotiations, check the SSL +- * state machine and move to ABORT if a Client Hello is being +- * read. */ +- if (!scr->is_proxy && +- (where & SSL_CB_HANDSHAKE_START) && +- scr->reneg_state == RENEG_REJECT) { +- scr->reneg_state = RENEG_ABORT; ++ /* If the reneg state is to reject renegotiations, check the SSL ++ * state machine and move to ABORT if a Client Hello is being ++ * read. */ ++ if (!sslconn->is_proxy && ++ (where & SSL_CB_HANDSHAKE_START) && ++ sslconn->reneg_state == RENEG_REJECT) { ++ sslconn->reneg_state = RENEG_ABORT; + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02042) + "rejecting client initiated renegotiation"); +- } +- /* If the first handshake is complete, change state to reject any +- * subsequent client-initiated renegotiation. */ +- else if ((where & SSL_CB_HANDSHAKE_DONE) && scr->reneg_state == RENEG_INIT) { +- scr->reneg_state = RENEG_REJECT; ++ } ++ /* If the first handshake is complete, change state to reject any ++ * subsequent client-initiated renegotiation. */ ++ else if ((where & SSL_CB_HANDSHAKE_DONE) ++ && sslconn->reneg_state == RENEG_INIT) { ++ sslconn->reneg_state = RENEG_REJECT; ++ } + } + + s = mySrvFromConn(c); +--- httpd-2.4.34/modules/ssl/ssl_private.h.r1827912+ ++++ httpd-2.4.34/modules/ssl/ssl_private.h +@@ -132,13 +132,14 @@ + SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) + #define SSL_CTX_set_max_proto_version(ctx, version) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) +-#endif +-/* LibreSSL declares OPENSSL_VERSION_NUMBER == 2.0 but does not include most +- * changes from OpenSSL >= 1.1 (new functions, macros, deprecations, ...), so +- * we have to work around this... ++#elif LIBRESSL_VERSION_NUMBER < 0x2070000f ++/* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not ++ * include most changes from OpenSSL >= 1.1 (new functions, macros, ++ * deprecations, ...), so we have to work around this... + */ + #define MODSSL_USE_OPENSSL_PRE_1_1_API (1) +-#else ++#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */ ++#else /* defined(LIBRESSL_VERSION_NUMBER) */ + #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) + #endif + +@@ -238,7 +239,8 @@ + void free_bio_methods(void); + #endif + +-#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER) ++#if OPENSSL_VERSION_NUMBER < 0x10002000L || \ ++ (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000f) + #define X509_STORE_CTX_get0_store(x) (x->ctx) + #endif + +@@ -372,8 +374,17 @@ + #ifdef HAVE_TLSV1_X + #define SSL_PROTOCOL_TLSV1_1 (1<<3) + #define SSL_PROTOCOL_TLSV1_2 (1<<4) ++#define SSL_PROTOCOL_TLSV1_3 (1<<5) ++ ++#ifdef SSL_OP_NO_TLSv1_3 ++#define SSL_HAVE_PROTOCOL_TLSV1_3 (1) ++#define SSL_PROTOCOL_ALL (SSL_PROTOCOL_BASIC| \ ++ SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2|SSL_PROTOCOL_TLSV1_3) ++#else ++#define SSL_HAVE_PROTOCOL_TLSV1_3 (0) + #define SSL_PROTOCOL_ALL (SSL_PROTOCOL_BASIC| \ + SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2) ++#endif + #else + #define SSL_PROTOCOL_ALL (SSL_PROTOCOL_BASIC) + #endif +@@ -646,6 +657,11 @@ + /** for client or downstream server authentication */ + int verify_depth; + ssl_verify_t verify_mode; ++ ++ /** TLSv1.3 has its separate cipher list, separate from the ++ settings for older TLS protocol versions. Since which one takes ++ effect is a matter of negotiation, we need separate settings */ ++ const char *tls13_ciphers; + } modssl_auth_ctx_t; + + #ifdef HAVE_TLS_SESSION_TICKETS +@@ -801,7 +817,7 @@ + const char *ssl_cmd_SSLCryptoDevice(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLRandomSeed(cmd_parms *, void *, const char *, const char *, const char *); + const char *ssl_cmd_SSLEngine(cmd_parms *, void *, const char *); +-const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *); ++const char *ssl_cmd_SSLCipherSuite(cmd_parms *, void *, const char *, const char *); + const char *ssl_cmd_SSLCertificateFile(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLCertificateKeyFile(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLCertificateChainFile(cmd_parms *, void *, const char *); +@@ -830,7 +846,7 @@ + + const char *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag); + const char *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *); +-const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *); ++const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *, void *, const char *, const char *); + const char *ssl_cmd_SSLProxyVerify(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLProxyVerifyDepth(cmd_parms *, void *, const char *); + const char *ssl_cmd_SSLProxyCACertificatePath(cmd_parms *, void *, const char *); diff --git a/httpd-2.4.34-sslciphdefault.patch b/httpd-2.4.34-sslciphdefault.patch new file mode 100644 index 0000000..6060f24 --- /dev/null +++ b/httpd-2.4.34-sslciphdefault.patch @@ -0,0 +1,34 @@ + +https://bugzilla.redhat.com/show_bug.cgi?id=1109119 + +Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite. + +--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault ++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c +@@ -774,9 +774,11 @@ + } + + if (!strcmp("SSL", arg1)) { +- /* always disable null and export ciphers */ +- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + if (cmd->path) { ++ /* Disable null and export ciphers by default, except for PROFILE= ++ * configs where the parser doesn't cope. */ ++ if (strncmp(arg2, "PROFILE=", 8) != 0) ++ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + dc->szCipherSuite = arg2; + } + else { +@@ -1540,8 +1542,10 @@ + } + + if (!strcmp("SSL", arg1)) { +- /* always disable null and export ciphers */ +- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); ++ /* Disable null and export ciphers by default, except for PROFILE= ++ * configs where the parser doesn't cope. */ ++ if (strncmp(arg2, "PROFILE=", 8) != 0) ++ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + dc->proxy->auth.cipher_suite = arg2; + return NULL; + } diff --git a/httpd-2.4.34-sslprotdefault.patch b/httpd-2.4.34-sslprotdefault.patch new file mode 100644 index 0000000..65f8d40 --- /dev/null +++ b/httpd-2.4.34-sslprotdefault.patch @@ -0,0 +1,53 @@ + +https://bugzilla.redhat.com/show_bug.cgi?id=1618371 + +--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslprotdefault ++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c +@@ -119,7 +119,7 @@ + mctx->ticket_key = NULL; + #endif + +- mctx->protocol = SSL_PROTOCOL_DEFAULT; ++ mctx->protocol = SSL_PROTOCOL_NONE; + mctx->protocol_set = 0; + + mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; +--- httpd-2.4.34/modules/ssl/ssl_engine_init.c.sslprotdefault ++++ httpd-2.4.34/modules/ssl/ssl_engine_init.c +@@ -555,9 +555,8 @@ + * Create the new per-server SSL context + */ + if (protocol == SSL_PROTOCOL_NONE) { +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); ++ ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, ++ "Using OpenSSL/system default SSL/TLS protocols"); + } + + cp = apr_pstrcat(p, +@@ -673,14 +672,8 @@ + } else if (protocol & SSL_PROTOCOL_SSLV3) { + prot = SSL3_VERSION; + #endif +- } else { +- SSL_CTX_free(ctx); +- mctx->ssl_ctx = NULL; +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); + } +- SSL_CTX_set_max_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot); + + /* Next we scan for the minimal protocol version we should provide, + * but we do not allow holes between max and min */ +@@ -700,7 +693,7 @@ + prot = SSL3_VERSION; + } + #endif +- SSL_CTX_set_min_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot); + #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */ + + #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE diff --git a/httpd-2.4.34.tar.bz2 b/httpd-2.4.34.tar.bz2 new file mode 100644 index 0000000..dd0f24c Binary files /dev/null and b/httpd-2.4.34.tar.bz2 differ diff --git a/httpd-2.4.4-cachehardmax.patch b/httpd-2.4.4-cachehardmax.patch new file mode 100644 index 0000000..de360ce --- /dev/null +++ b/httpd-2.4.4-cachehardmax.patch @@ -0,0 +1,82 @@ +diff --git a/modules/cache/cache_util.h b/modules/cache/cache_util.h +index eec38f3..1a2d5ee 100644 +--- a/modules/cache/cache_util.h ++++ b/modules/cache/cache_util.h +@@ -194,6 +194,9 @@ typedef struct { + unsigned int store_nostore_set:1; + unsigned int enable_set:1; + unsigned int disable_set:1; ++ /* treat maxex as hard limit */ ++ unsigned int hardmaxex:1; ++ unsigned int hardmaxex_set:1; + } cache_dir_conf; + + /* A linked-list of authn providers. */ +diff --git a/modules/cache/mod_cache.c b/modules/cache/mod_cache.c +index 4f2d3e0..30c88f4 100644 +--- a/modules/cache/mod_cache.c ++++ b/modules/cache/mod_cache.c +@@ -1299,6 +1299,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in) + exp = date + dconf->defex; + } + } ++ /* else, forcibly cap the expiry date if required */ ++ else if (dconf->hardmaxex && (date + dconf->maxex) < exp) { ++ exp = date + dconf->maxex; ++ } ++ + info->expire = exp; + + /* We found a stale entry which wasn't really stale. */ +@@ -1717,7 +1722,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy) + + /* array of providers for this URL space */ + dconf->cacheenable = apr_array_make(p, 10, sizeof(struct cache_enable)); +- ++ /* flag; treat maxex as hard limit */ ++ dconf->hardmaxex = 0; ++ dconf->hardmaxex_set = 0; + return dconf; + } + +@@ -1767,7 +1774,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) { + new->enable_set = add->enable_set || base->enable_set; + new->disable = (add->disable_set == 0) ? base->disable : add->disable; + new->disable_set = add->disable_set || base->disable_set; +- ++ new->hardmaxex = ++ (add->hardmaxex_set == 0) ++ ? base->hardmaxex ++ : add->hardmaxex; + return new; + } + +@@ -2096,12 +2106,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy, + } + + static const char *set_cache_maxex(cmd_parms *parms, void *dummy, +- const char *arg) ++ const char *arg, const char *hard) + { + cache_dir_conf *dconf = (cache_dir_conf *)dummy; + + dconf->maxex = (apr_time_t) (atol(arg) * MSEC_ONE_SEC); + dconf->maxex_set = 1; ++ ++ if (hard && strcasecmp(hard, "hard") == 0) { ++ dconf->hardmaxex = 1; ++ dconf->hardmaxex_set = 1; ++ } ++ + return NULL; + } + +@@ -2309,7 +2325,7 @@ static const command_rec cache_cmds[] = + "caching is enabled"), + AP_INIT_TAKE1("CacheDisable", add_cache_disable, NULL, RSRC_CONF|ACCESS_CONF, + "A partial URL prefix below which caching is disabled"), +- AP_INIT_TAKE1("CacheMaxExpire", set_cache_maxex, NULL, RSRC_CONF|ACCESS_CONF, ++ AP_INIT_TAKE12("CacheMaxExpire", set_cache_maxex, NULL, RSRC_CONF|ACCESS_CONF, + "The maximum time in seconds to cache a document"), + AP_INIT_TAKE1("CacheMinExpire", set_cache_minex, NULL, RSRC_CONF|ACCESS_CONF, + "The minimum time in seconds to cache a document"), diff --git a/httpd-2.4.4-r1337344+.patch b/httpd-2.4.4-r1337344+.patch new file mode 100644 index 0000000..6e5c3e7 --- /dev/null +++ b/httpd-2.4.4-r1337344+.patch @@ -0,0 +1,250 @@ +# ./pullrev.sh 1337344 1341905 1342065 1341930 + +suexec enhancements: + +1) use syslog for logging +2) use capabilities not setuid/setgid root binary + +http://svn.apache.org/viewvc?view=revision&revision=1337344 +http://svn.apache.org/viewvc?view=revision&revision=1341905 +http://svn.apache.org/viewvc?view=revision&revision=1342065 +http://svn.apache.org/viewvc?view=revision&revision=1341930 + +--- httpd-2.4.4/configure.in.r1337344+ ++++ httpd-2.4.4/configure.in +@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin, + + AC_ARG_WITH(suexec-logfile, + APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[ +- AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] ) ++ if test "x$withval" = "xyes"; then ++ AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file]) ++ fi ++]) ++ ++AC_ARG_WITH(suexec-syslog, ++APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[ ++ if test $withval = "yes"; then ++ if test "x${with_suexec_logfile}" != "xno"; then ++ AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"]) ++ AC_MSG_ERROR([suexec does not support both logging to file and syslog]) ++ fi ++ AC_CHECK_FUNCS([vsyslog], [], [ ++ AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])]) ++ AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog]) ++ fi ++]) ++ + + AC_ARG_WITH(suexec-safepath, + APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[ +@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask, + APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[ + AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] ) + ++INSTALL_SUEXEC=setuid ++AC_ARG_ENABLE([suexec-capabilities], ++APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [ ++INSTALL_SUEXEC=caps ++AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, ++ [Enable if suexec is installed with Linux capabilities, not setuid]) ++]) ++APACHE_SUBST(INSTALL_SUEXEC) ++ + dnl APR should go after the other libs, so the right symbols can be picked up + if test x${apu_found} != xobsolete; then + AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`" +--- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+ ++++ httpd-2.4.4/docs/manual/suexec.html.en +@@ -372,6 +372,21 @@ + together with the
--enable-suexec option to let
+ APACI accept your request for using the suEXEC feature.
+
++ --enable-suexec-capabilitiessuexec binary is installed "setuid/setgid
++ root", which allows it to run with the full privileges of the
++ root user. If this option is used, the suexec
++ binary will instead be installed with only the setuid/setgid
++ "capability" bits set, which is the subset of full root
++ priviliges required for suexec operation. Note that
++ the suexec binary may not be able to write to a log
++ file in this mode; it is recommended that the
++ --with-suexec-syslog --without-suexec-logfile
++ options are used in conjunction with this mode, so that syslog
++ logging is used instead.--with-suexec-bin=PATHsuexec binary must be hard-coded
+@@ -433,6 +448,12 @@
+ "suexec_log" and located in your standard logfile
+ directory (--logfiledir).--with-suexec-syslog--without-suexec-logfile.--with-suexec-safepath=PATHThe suEXEC wrapper will write log information
+ to the file defined with the --with-suexec-logfile
+- option as indicated above. If you feel you have configured and
+- installed the wrapper properly, have a look at this log and the
+- error_log for the server to see where you may have gone astray.
--with-suexec-syslog
++ is used. If you feel you have configured and
++ installed the wrapper properly, have a look at the log and the
++ error_log for the server to see where you may have gone astray.
++ The output of "suexec -V" will show the options
++ used to compile suexec, if using a binary distribution.
+
+ 
+@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined')
+ prettyPrint();
+ }
+ //-->
+-