pass a server_rec to ap_log_error on two interim response messages
use ap_log_rerror instead of r->server per niq's comments
Submitted by: covener
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@733756 13f79535-47bb-0310-9956-ffa450edef68
* Use distinct char pointers for sending and receiving buffers to avoid
destroying the pointer to the sending buffer in the ajp message if
data is received from the backend before all data is sent to the
backend.
PR: 45911
Submitted by: rpluem
Reviewed by: rpluem, jim, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@714273 13f79535-47bb-0310-9956-ffa450edef68
Add force recovery for balancer.
In case all balancer members were in error state 503
was returned until the recovery timeout expired.
The patch forces recovery in case all balancer members
are in error state regardless of recovery timeout
directive.
This fixes the time gap when 503 was returned and
backend was already up and running.
Submitted by: mturk
Reviewed by: jim, rpluem, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@714270 13f79535-47bb-0310-9956-ffa450edef68
AJP was dropping pre-existing cookies. Use same logic
as HTTP to tuck them away
* save_table needs to be declared first before it can be used.
Reviewed by: rpluem, jim, mturk
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@711850 13f79535-47bb-0310-9956-ffa450edef68
ap_proxy_determine_connection modifies the url if we are retrying the result we should retry using the orginal url.
Submitted by: jfclere
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@708194 13f79535-47bb-0310-9956-ffa450edef68
* Introduce environment variable proxy-initial-not-pooled to avoid reusing
pooled connections if the client connection is an initial connection.
This avoids the "proxy: error reading status line from remote server"
error caused by the race condition that the backend server closed the
connection after the connection check on our side and before our data
reached the backend. Yes, this downgrades performance, especially with
HTTP/1.0 clients. Hence it is configurable and off by default.
PR: 37770
* Add missing documentation for proxy-initial-not-pooled (r684351).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@691230 13f79535-47bb-0310-9956-ffa450edef68
* Ensure that the SSL filters are not inserted on FTP data connections even
if the virtual host that causes the proxy request has SSL enabled.
Submitted by: rpluem
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@686393 13f79535-47bb-0310-9956-ffa450edef68
* Remove call to apr_reslist_destroy. With the latest trunk version of
apr-util this causes a lock during shutdown as at the point of time we would
execute apr_reslist_destroy the reslist is already destroyed, because we are
in a cleanup of the same pool where the reslist registered itself as
precleanup.
With apr-util 1.3.x calling apr_reslist_destroy is not really useful and
needed in this case as we are in a cleanup that was registered against the
same pool that is used by the reslist. As it was registered *after* the
reslist was created it just runs *before* the reslist cleanup would run. This
is somewhat pointless here and we could leave the job of destroying the
reslist to the reslist cleanup.
Submitted by: rpluem
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@686390 13f79535-47bb-0310-9956-ffa450edef68
* Prevent XSS attacks when using wildcards in the path of the FTP URL.
Discovered by Marc Bevand of Rapid7.
CVE: CVE-2008-2939
Submitted by: rpluem
Reviewed by: rpluem, mjc, jim, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@682870 13f79535-47bb-0310-9956-ffa450edef68
* According to RFC 2616 8.2.3 we are not allowed to forward an
Expect: 100-continue to an HTTP/1.0 server. Instead we MUST return
a HTTP_EXPECTATION_FAILED.
Submitted by: rpluem
Reviewed by: jim, rpluem, niq
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@678203 13f79535-47bb-0310-9956-ffa450edef68
Make mod_proxy_ajp aware of the nocanon envvar
handle ? in cases where nocanon is in effect
* Do not add the query string again in the case that we are using the
unparsed uri.
PR: 44803
Set at init time, and combine comments
Typo.
* Do not add the query string again in the case that we are using the
unparsed uri.
PR: 44803
* Set at init time and combine comments.
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@663593 13f79535-47bb-0310-9956-ffa450edef68
Prevent CSRF attacks against the balancer-manager (CVE-2007-6420)
* modules/proxy/mod_proxy_balancer.c (balancer_init): New function.
(balancer_handler): Place a nonce in the form output, and check that
the submitted form data includes that nonce.
(ap_proxy_balancer_register_hook): Register the new post_config hook.
Submitted by: jorton
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@663514 13f79535-47bb-0310-9956-ffa450edef68
* mod_proxy_http.c
Ensure that the EOC bucket is inserted BEFORE an EOS bucket in bb as
some resource filters like mod_deflate pass everything up to the EOS
down the chain immediately and sent the remainder of the brigade later
(or even never). But in this case the ap_http_header_filter does not
get out of our way soon enough.
http_filters.c
Remove all data buckets that are in a brigade after an EOC bucket
was seen, as an EOC bucket tells us that no (further) resource
and protocol data should go out to the client. OTOH meta buckets
are still welcome as they might trigger needed actions down in
the chain (e.g. in network filters like SSL).
Remark 1: It is needed to dump ALL data buckets in the brigade
since an filter in between might have inserted data
buckets BEFORE the EOC bucket sent by the original
sender and we do NOT want this data to be sent.
Remark 2: Dumping all data buckets here does not necessarily mean
that no further data is send to the client as:
1. Network filters like SSL can still be triggered via
meta buckets to talk with the client e.g. for a
clean shutdown.
2. There could be still data that was buffered before
down in the chain that gets flushed by a FLUSH or an
EOS bucket.
PR: 37770
Submitted by: rpluem
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@660936 13f79535-47bb-0310-9956-ffa450edef68
* Do not retry a request in the case that we either failed to sent a part of the
request body or if the request is not idempotent.
PR: 44334
* As per niq's comment, better destinct the types of idempotence.
* Introduce a flag to decide whether we sent an body to the backend or not.
Submitted by: rpluem
Reviewed by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@660580 13f79535-47bb-0310-9956-ffa450edef68
* In the case that we fail to read the response line from the backend and if
we are a reverse proxy request shutdown the connection WITHOUT ANY response
to trigger a retry by the client if allowed (as for idempotent requests).
BUT currently we should not do this if the request is the first request on
a keepalive connection as browsers like seamonkey only display an empty page
in this case and do not do a retry.
Related to PR 37770
Submitted by: rpluem
Reviewed by: rpluem, jim, fielding
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@657443 13f79535-47bb-0310-9956-ffa450edef68
r605838 from trunk:
* Enable the proxy to keep connections persistent in the HTTPS case.
Basicly the persistence is created by keeping the conn_rec structure
created for our backend connection (whether http or https) in the connection
pool. This required to adjust scoreboard.c in a way that its functions can
properly deal with a NULL scoreboard handle by ignoring the call or returning
an error code.
* Use a separate subpool to manage the data for the socket and the connection
member of the proxy_conn_rec struct as we destroy this data more frequently
than other data in the proxy_conn_rec struct like hostname and addr (at least
in the case where we have keepalive connections that timed out and were
closed by the backend).
This fixes a memory leak with short lived and broken connections.
* Fix another memory leak related to PR 44026. Now that we keep the connection
data structure alive in the reslist, the live time of c->pool is too long.
r->pool has the correct live time since rp dies before r.
* Do not register connection_cleanup as cleanup for the conn->pool. In the past
it was needed to register connection_cleanup as a cleanup for the frontend
connection memory pool (c->pool) to ensure that connection returns into the
connection pool if the memory pool of the frontend connection memory pool
gets destroyed / cleared. Now we ensure explicitly the connection returns
to the connection pool once we finished handling the request.
* Tag the pools appropriately to ease memory debugging.
* Only sent a flush bucket down the chain if buckets where sent down the chain
before that could still be buffered in the network filter. This is the case
if we have sent an EOS bucket or if we actually sent buckets with
data down the chain. In all other cases we either have not sent any
buckets at all down the chain or we only sent meta buckets that are
not EOS buckets down the chain. The only meta bucket that remains in
this case is the flush bucket which would have removed all possibly
buffered buckets in the network filter.
If we sent a flush bucket in the case where not ANY buckets were
sent down the chain, we break error handling which happens AFTER us.
* Using the reslist pool for the proxy_conn_rec structure introduces a memory
leak when connections get created and destroyed frequently by the reslist
(e.g. destroying idle elements of the reslist). So use the subpool
dedicated for the proxy_conn_rec structure to allocate the memory for the
structure itself.
PR: 44026, 44543
Submitted by: rpluem
Reviewed by: jim, rpluem, fielding
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@657440 13f79535-47bb-0310-9956-ffa450edef68
