*) SECURITY: CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.
[Edward Lu <Chaosed0 gmail.com>]
Discovered by Guido Vranken <guidovranken gmail.com>
Submitted by: Edward Lu
Committed by: covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1664118 13f79535-47bb-0310-9956-ffa450edef68
Fix bit-shifting of websockets frame fields that would yield wrong opcodes
when the FIN bit was set. Results in PING not being recognized
by mod_lua. PR57524
Submitted By: Edward Lu
Committed By: covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1664117 13f79535-47bb-0310-9956-ffa450edef68
Add missing APLOGNO.
Refactor to keep APLOGNO on the same line as ap_log_error, when applicable.
Add missing APLOGNO.
Refactor some lines to keep APLOGNO on the same line as ap_log_error, when applicable.
Split lines longer than 80.
Improve alignment.
Submitted by: jailletc36
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1622706 13f79535-47bb-0310-9956-ffa450edef68
SECURITY (CVE-2014-0226): Fix a race condition in scoreboard handling,
which could lead to a heap buffer overflow. Thanks to Marek Kroemeke
working with HP's Zero Day Initiative for reporting this.
* include/scoreboard.h: Add ap_copy_scoreboard_worker.
* server/scoreboard.c (ap_copy_scoreboard_worker): New function.
* modules/generators/mod_status.c (status_handler): Use it.
* modules/lua/lua_request.c (lua_ap_scoreboard_worker): Likewise.
Reviewed by: trawick, jorton, covener, jim
Submitted by: jorton, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1610499 13f79535-47bb-0310-9956-ffa450edef68
- IVM changed to use shm
- More verbose error logging (no functional change)
- Miscellaneous refactoring that was in trunk but not in 2.4.x (no functional change as such)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1604339 13f79535-47bb-0310-9956-ffa450edef68
mod_lua: Fix r:setcookie() to add, rather than replace,
the Set-Cookie header. PR56105
Submitted By: Kevin J Walters <kjw ms com>, Edward Lu <Chaosed0 gmail com>
Committed By: covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1567328 13f79535-47bb-0310-9956-ffa450edef68
mod_lua: Fix compiler warning by using correct
APR_SIZE_T_FMT and APR_OFF_T_FMT format macro
in debug logging.
Submitted by: rjung
Reviewed/backported by: jim
NOTE: Not sure about CHANGES... is there a BUGZ on this?
In general, CHANGES is for userland visible changes or
BUGZ bug fixes, and not sure if this really applies
here. But it's OK if someone wants to add something
to CHANGES.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1546976 13f79535-47bb-0310-9956-ffa450edef68
r1201460: Add some todos from apachecon notes.
Submitted by: covener
r1351012: Change prototype of vm_construct, to work around gcc bug which
causes a segfault. PR: 52779
Submitted by: Dick Snippe <Dick Snippe tech omroep nl>
r1351013: Allow tail call optimization in log methods, remove foo method.
Submitted by: sf
r1351014: Add a few missing request_rec fields. Rename remote_ip to
client_ip to match conn_rec.
Submitted by: sf
r1351017: Change various strings from char * to const char *.
Submitted by: sf
r1351018: Factor common code into utility function.
Also improve logging a bit and adjust some log levels.
Submitted by: sf
r1351019: Use macro to make definition of integer fields more compact.
Submitted by: sf
Reviewed by: humbedooh, covener, sf
Backported by: humbedooh, rjung
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1369494 13f79535-47bb-0310-9956-ffa450edef68
Add the missing parsebody function to mod_lua, for parsing POST data.
PR 53064.
- Define LUA_COMPAT_ALL so mod_lua will be compatible with Lua 5.2
- Add an optional integer argument for parsebody, specifying the maximum size of POST that will be accepted.
Submitted by: humbedooh
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1365539 13f79535-47bb-0310-9956-ffa450edef68
Further clarify the naming of the entity that originates the request by
calling that entity a useragent instead of a client.
Further clarify the naming of the entity that directly connects to us by
calling that entity a client instead of a peer.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1214022 13f79535-47bb-0310-9956-ffa450edef68
Introduce a per request version of the remote IP address, which can be
optionally modified by a module when the effective IP of the client
is not the same as the real IP of the client (such as a load balancer).
Introduce a per connection "peer_ip" and a per request "client_ip" to
distinguish between the raw IP address of the connection and the effective
IP address of the request.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1208378 13f79535-47bb-0310-9956-ffa450edef68
fix issue with incorrect munging of the lua package path -- LuaPackagePath directives were not working
Default to not allowing htaccess in /, instead of just the documentroot, which gets a nice 10% performance boost by default for me.
* modules/ssl/ssl_private.h, modules/ssl/ssl_engine_kernel.c
(ssl_callback_tlsext_tickets): Use unsigned char * to fix gcc
-Wpointer-sign warnings.
Only load the really imporant modules (i.e. those enabled by the 'few'
selection) by default. Don't handle modules enabled with --enable-foo
specially.
This fixes problems with module dependencies until someone implements a
mechanism for resolving module dependencies.
remove last traces of the code cache
* modules/proxy/mod_proxy_html.c (comp_urlmap): Fix const-ness warning.
* modules/lua/mod_lua.c (ap_lua_ssl_is_https): New function.
(lua_post_config): Pick up ssl_is_https optional function.
* modules/lua/lua_request.c (req_ssl_is_https_field): New function.
(ap_lua_load_request): Map is_https field to above.
remove some debug logging which snuck in
remove ability to set min and max pool sizes for server scope in prep for removing server scope
remove lingering reslist references before killing server scope
replace server scope with thread scope
use a sub-pool for scope_once
Fix installation of conf/extra/proxy-html.conf.
Otherwise httpd does no longer start, because
it is the only extra file required in the main
config at the moment.
Rebuild xdoc transform
Clarify docs for LimitRequestLine, as per bug #51665.
Rebuild doc transforms.
Submitted by: brianm, pquerna, jorton, sf, brianm, jorton, jorton, sf, pquerna, brianm, brianm, brianm, brianm, brianm, jorton, rjung, rbowen, rbowen, rbowen
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1200981 13f79535-47bb-0310-9956-ffa450edef68
