1
0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Commit Graph

5381 Commits

Author SHA1 Message Date
Eric Covener
9a29cd5f65 SECURITY: CVE-2007-1862 (cve.mitre.org)
mod_mem_cache: Copy headers into longer lived storage; header names and
values could previously point to cleaned up storage

PR: 41551
Submitted by: Davi Arnaut <davi haxent.com.br>
Reviewed by: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@543515 13f79535-47bb-0310-9956-ffa450edef68
2007-06-01 15:50:12 +00:00
Ruediger Pluem
5ebab647ff * Prevent running through the error stack by returning OK and setting r->status
accordingly if ret is HTTP_NOT_MODIFIED as this breaks mod_cache validating a
  stale entity.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@541990 13f79535-47bb-0310-9956-ffa450edef68
2007-05-27 13:57:46 +00:00
Nick Kew
d09a836fb0 PR#39710 - badly broken errordocuments for CGI
We've just had another duplicate report of this on bugzilla.
We've got a simple patch, and people asking WTF is going on
with inaction.  Noone seems clear on why the patch shouldn't
be applied (http://marc.info/?l=apache-httpd-dev&m=117760311129386&w=2).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@541926 13f79535-47bb-0310-9956-ffa450edef68
2007-05-26 18:50:18 +00:00
Chris Darroch
af98980f19 apr_dbd_check_conn() just returns APR_SUCCESS or APR_EGENERAL, so we
don't actually have a driver-specific value to pass to apr_dbd_error(),
but that's OK because most/all drivers just ignore this value anyway


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@539687 13f79535-47bb-0310-9956-ffa450edef68
2007-05-19 05:01:44 +00:00
Justin Erenkrantz
3019f9a87b mod_cache: Do not set Date or Expires when they are missing from the original
response or are invalid.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@539621 13f79535-47bb-0310-9956-ffa450edef68
2007-05-18 22:42:59 +00:00
Justin Erenkrantz
cd208845d6 mod_cache: Correctly handle HEAD requests on expired cache content. PR 41230.
* modules/cache/mod_cache.c
  (cache_save_filter): Properly handle HEAD responses when we have a stale handle.

(This patch was revised by Justin/Ruediger.)

Submitted by: Niklas Edmundsson
Reviewed by: Justin, Ruediger


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@539620 13f79535-47bb-0310-9956-ffa450edef68
2007-05-18 22:38:08 +00:00
Justin Erenkrantz
1b7508dd21 mod_cache: Let Cache-Control max-age set the expiration of the cached
representation if Expires is not set.

* modules/cache/mod_cache.c
  (cache_save_filter): If Cache-Control max-age is set and Expires isn't,
  let that value control our expiration.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@539063 13f79535-47bb-0310-9956-ffa450edef68
2007-05-17 18:25:13 +00:00
Justin Erenkrantz
c795f75fea mod_disk_cache: If the Vary'd content is stale, we can handle it via our
freshness tests which will attempt to revalidate the content.

* modules/cache/mod_disk_cache.c
  (open_entity): If the root Vary index is stale, we don't need to throw away
  potentially stale content - we can try to refresh it.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@539054 13f79535-47bb-0310-9956-ffa450edef68
2007-05-17 18:17:23 +00:00
Justin Erenkrantz
9b5dff0669 mod_disk_cache: When renegotiating an already cached Vary'd response, do not
let us later throw away the renegotiated content due to a name mismatch.

We do not need to update the ->name field just before writing the headers as
the computed ->name on open and create is sufficient.  Updating ->name here is
essentially a no-op - except in the case of Vary where the key has internally
changed (to account for the Vary prefix), but the original name has not.
However, writing the Vary'd-accounted key means that when we read the cache
next that we will error out and disregard the just renegotiated response and
fetch the content all over again - oops!

(This is largely a case where I think we may have overthought ourselves; hence
the explanation is here in the commit rather than in the file itself.)

* modules/cache/mod_disk_cache.c
  (store_headers): The originally opened ->name is sufficient.
* CHANGES: Combined with r538992, note that renegotiation for Vary's seem to
  work far better.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@538997 13f79535-47bb-0310-9956-ffa450edef68
2007-05-17 16:20:06 +00:00
Justin Erenkrantz
c1150a199a mod_disk_cache: When renegotiating an already cached Vary'd response, create
the refreshed .vary structure in the right directory.  Otherwise, we'll create
a new .vary layout underneath the already existing one - oops!

* modules/cache/mod_disk_cache.c
  (store_headers): Temporarily clear dobj->prefix if it is set to ensure that
  we create the .vary structure underneath the cache root.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@538992 13f79535-47bb-0310-9956-ffa450edef68
2007-05-17 16:10:29 +00:00
Justin Erenkrantz
35713c177f RFC 2616 13.2.1 calls out max-age as being a valid 'explicit expiration time',
so per Sec. 13.9 permit queries with just max-age instead of only Expires.

* modules/cache/mod_cache.c
  (cache_save_filter): Be closer to RFC 2616's intent for query arguments.
* CHANGES: Update.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@538807 13f79535-47bb-0310-9956-ffa450edef68
2007-05-17 05:43:18 +00:00
Jim Jagielski
09c3cbe87b Fold in ProxyPassMatch directive with docs. Support
full regex substitution but also allow for "simple"
cases (ala JkMount) to work as well.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@537599 13f79535-47bb-0310-9956-ffa450edef68
2007-05-13 15:28:29 +00:00
Jim Jagielski
5fdd230cc1 Add regex pattern matching to ProxyPass, allowing,
for example:

   ProxyPass ~ \.gif balancer://imagecluster




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@537429 13f79535-47bb-0310-9956-ffa450edef68
2007-05-12 14:12:24 +00:00
Ruediger Pluem
63351a529b - In AP_MODE_SPECULATIVE ap_core_input_filter returns APR_SUCCESS and an empty
brigade in the case that a non blocking read from the socket returned
  APR_EAGAIN. So getting an empty brigade also shows that no data is present
  in the input filter.
  While this reduces the number of false positives for "real data" in the input
  filter the behaviour is not as good as before 533820 because if there are
  only CRLF's in the input filter we do not flush, but we should. To fix this
  it seems that a simulation of AP_MODE_EATCRLF is needed inside of
  check_pipeline.
- Destroy brigade bb at the end of the function.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@535879 13f79535-47bb-0310-9956-ffa450edef68
2007-05-07 14:20:09 +00:00
Ruediger Pluem
6ad514ccc1 * Prevent a segmentation fault if one of the Cache-Control headers
s-maxage, max-age, min-fresh, max-stale has no value assigned.
  In this case ignore s-maxage, max-age, min-fresh. For max-stale
  it is valid to set no value. In this case set max-stale to 1 year
  to signal that the client is accepting a stale response of any age.

Submitted by: Niklas Edmundsson <nikke acc.umu.se>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@535617 13f79535-47bb-0310-9956-ffa450edef68
2007-05-06 14:35:02 +00:00
Jim Jagielski
1c8f89ea65 Abstract out (kinda) MSG_PEEK. This way when we
actually update APR and apr_socket_recvfrom()
to know about APR_MSG_OOB, APR_MSG_PEEK, etc...
this code won't need to be adjusted. Also,
make nicer for 2.2 backport.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@535354 13f79535-47bb-0310-9956-ffa450edef68
2007-05-04 19:12:38 +00:00
Bradley Nicholes
2874d54f16 re-introduce ap_satisfies API back into core and modify how the access_checker, check_user_id and auth_checker hooks are called so that they respect the precedence that is set through the satisfy ALL/ANY directive. This also restores the directives order, allow, deny, satisfyas supported directives rather than being deprecated. These directives still remain in mod_access_compat however.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@534533 13f79535-47bb-0310-9956-ffa450edef68
2007-05-02 16:31:39 +00:00
Ruediger Pluem
9d24ba2573 * Rework the error handling logic to make it more readable.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@534031 13f79535-47bb-0310-9956-ffa450edef68
2007-05-01 12:17:30 +00:00
Greg Ames
2c91e92953 check_pipeline: use AP_MODE_SPECULATIVE to check for data in the input filters
to accomodate mod_ssl's input filter.  AP_MODE_EATCRLF is essentially a no-op
in that filter.

this fixes missing imbedded graphics etc when using the Event MPM with mod_ssl
with HTTP pipelining enabled in the browser.  the pipelined requests after the
first were never read from mod_ssl's input filter.  it might reduce unneeded 
flushes with other MPMs.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@533820 13f79535-47bb-0310-9956-ffa450edef68
2007-04-30 18:16:06 +00:00
André Malo
ff601f03ec newlines
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@531920 13f79535-47bb-0310-9956-ffa450edef68
2007-04-24 13:07:44 +00:00
Jeff Trawick
0082457202 log the uri for some access-denied paths when r->filename is
unset


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@529626 13f79535-47bb-0310-9956-ffa450edef68
2007-04-17 14:36:12 +00:00
Jeff Trawick
8b9efbf9ca HTTP proxy ProxyErrorOverride: Leave 1xx and 3xx responses alone. Only
processing of error responses (4xx, 5xx) will be altered.

PR: 39245

This is based on a patch submitted by Bart van der Schans <schans hippo.nl>
and tweaked slightly by me based on discussions on dev@ since April 2006.
I think rpleum was the first to mention the 1xx issue.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@527969 13f79535-47bb-0310-9956-ffa450edef68
2007-04-12 15:07:11 +00:00
Sander Temme
4db3a3a75a Move the thread locking upcall initialization before the hardware library init,
so the hardware library can pick up the locking callbacks. Fixes PR 20951.
Tested on Linux with trunk and an nCipher nShield card, and on Solaris 10/Sparc
on 2.0.55 with an nCipher NetHSM.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@525709 13f79535-47bb-0310-9956-ffa450edef68
2007-04-05 05:43:25 +00:00
Guenter Knauf
47fff8d790 removed obsolete -prefix; minor cosmetic changes.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@521264 13f79535-47bb-0310-9956-ffa450edef68
2007-03-22 13:45:54 +00:00
Guenter Knauf
5679e48e5a added proper error message for NetWare.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@521230 13f79535-47bb-0310-9956-ffa450edef68
2007-03-22 11:58:20 +00:00
Guenter Knauf
d6a691ccec added mod_sedfilter; minor cosmetic changes.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@521054 13f79535-47bb-0310-9956-ffa450edef68
2007-03-21 23:56:29 +00:00
Guenter Knauf
6e83ac1801 removed obsolete -prefix; minor cosmetic changes.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@521052 13f79535-47bb-0310-9956-ffa450edef68
2007-03-21 23:53:31 +00:00
Guenter Knauf
034c4c5f73 removed obsolete -prefix; minor cosmetic changes.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@521049 13f79535-47bb-0310-9956-ffa450edef68
2007-03-21 23:33:35 +00:00
Joe Orton
ea188b0032 * modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_version): constify
where possible.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520839 13f79535-47bb-0310-9956-ffa450edef68
2007-03-21 11:08:14 +00:00
William A. Rowe Jr
c94f40a236 Too many users are baffled by this message. Some days even the devs are ;-)
Votes to backport to 2.2 and 2.0?

New resulting message is

bin/httpd -f /dev/null -C "LoadModule ftp_module ../apache22/modules/mod_ftp.so"

Syntax error in -C/-c directive:
API module structure 'ftp_module' in file /usr/local/apache22/modules/mod_ftp.so 
is garbled - expected signature 41503230 but saw 41503232 - perhaps this is not 
an Apache module DSO, or was compiled for a different Apache version?


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520733 13f79535-47bb-0310-9956-ffa450edef68
2007-03-21 03:46:50 +00:00
William A. Rowe Jr
95f79e87b6 *) adds compile-time/run time SSL-C version support
*) simplify a ton of overly-verbose legacy code
*) split the compiled-against v.s. runtime library
*) precache the results of the version string touchup



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520701 13f79535-47bb-0310-9956-ffa450edef68
2007-03-21 01:55:29 +00:00
Jim Jagielski
460714ed85 Even though we don't let our bb grow too large, still
honor flush buckets anyway... Note: maybe now we
should use something a little larger that AP_MIN_BYTES_TO_WRITE??


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520442 13f79535-47bb-0310-9956-ffa450edef68
2007-03-20 15:48:23 +00:00
Jim Jagielski
2fd85d90f0 Use macros for common code paths... this cleans it up
a bit and prevents people from worrying about
whether these 2 parts are so different or not.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520409 13f79535-47bb-0310-9956-ffa450edef68
2007-03-20 14:36:57 +00:00
Jim Jagielski
3f7eb9714c Update build system to know about sedfilter
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520075 13f79535-47bb-0310-9956-ffa450edef68
2007-03-19 20:09:00 +00:00
Jim Jagielski
053638a8f0 Some minor tweaks... return quickly if given an
empty bb, ensure EOS is the last bucket we handle
and if our chunked passing fails, then we need
to report that immediately.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@520074 13f79535-47bb-0310-9956-ffa450edef68
2007-03-19 20:04:56 +00:00
Jim Jagielski
3bf99c1314 Add comment to avoid confusion and questions :)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@519971 13f79535-47bb-0310-9956-ffa450edef68
2007-03-19 15:22:58 +00:00
Jean-Frederic Clere
d3858a5012 Make sure that we are not resending if we have received something from Tomcat.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@518938 13f79535-47bb-0310-9956-ffa450edef68
2007-03-16 11:26:33 +00:00
Jim Jagielski
7481ebf033 Initial import: mod_sedfilter.c (was mod_sed_filter.c) as
per discussion on dev@httpd.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@518807 13f79535-47bb-0310-9956-ffa450edef68
2007-03-15 23:29:23 +00:00
Bradley Nicholes
f01effcaea Remove the hardcoded size limit parameter for ldap_search_ext_s
and replace it with an APR_ defined value that is set according
to the LDAP SDK being used.

Submitted by: David Jones <oscaremma gmail com>



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@517788 13f79535-47bb-0310-9956-ffa450edef68
2007-03-13 17:53:22 +00:00
Joe Orton
aa24da9d42 * modules/http/http_etag.c (etag_uint64_to_hex): Fix maximum shift
size, thanks to Ruediger.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@517654 13f79535-47bb-0310-9956-ffa450edef68
2007-03-13 11:58:12 +00:00
Joe Orton
84d5acf53a Generate etags consistently across 32-bit and 64-bit platforms:
* modules/http/http_etag.c (etag_uint64_to_hex): Renamed from
etag_ulong_to_hex; take an apr_uint64_t argument.
(ap_make_etag): Adjust to use new function and macro names.
Pass arguments directly to etag_uint64_to_hex without casting
down to unsigned long.

PR: 40064


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@517238 13f79535-47bb-0310-9956-ffa450edef68
2007-03-12 15:05:50 +00:00
Bradley Nicholes
0526618c3d Add the case_flt experimental modules to the NetWare build
Submitted by: Guenter Knauf <fuankg apache.org>

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@516235 13f79535-47bb-0310-9956-ffa450edef68
2007-03-09 00:19:31 +00:00
Joe Orton
193a30eea0 * modules/proxy/ajp_msg.c (ajp_msg_dump, ajp_msg_check_header,
asj_msg_copy): Fix format string warnings on x86_64.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@510522 13f79535-47bb-0310-9956-ffa450edef68
2007-02-22 14:12:14 +00:00
Jeff Trawick
4d55f1f475 mod_ldap: Fix the search limit parameter to ldap_search_ext_s()
for SDKs that define LDAP_NO_LIMIT to something other than -1.

Submitted by: David Jones <oscaremma gmail.com>
Reviewed by:  trawick



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@509237 13f79535-47bb-0310-9956-ffa450edef68
2007-02-19 16:24:33 +00:00
Nick Kew
d14f70a89f Return METHOD_NOT_ALLOWED, not FORBIDDEN, to a TRACE request when
TraceEnable is Off.  This agrees with our documentation, and with
our Allow: header in response to OPTIONS.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@507526 13f79535-47bb-0310-9956-ffa450edef68
2007-02-14 13:34:38 +00:00
Nick Kew
45c507dd7c Patch for PR#11540 (submitted by Stuart Children)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@507516 13f79535-47bb-0310-9956-ffa450edef68
2007-02-14 12:56:49 +00:00
Ruediger Pluem
477744b538 * Save the key we generate during our first run of cache_generate_key_default
on each request in the request_config. During consecutive runs of
  cache_generate_key_default during processing the request we restore it
  from there as we might not be able to generate the same key again as
  the ingredients used to compose the key might have changed and we constantly
  must use a key that could be generated during the quick handler phase.

PR: 41475


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@506621 13f79535-47bb-0310-9956-ffa450edef68
2007-02-12 20:29:04 +00:00
Jim Jagielski
c9d888295d Change common but incorrect usage of 'depreciated'
for 'deprecated'


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@504892 13f79535-47bb-0310-9956-ffa450edef68
2007-02-08 13:46:14 +00:00
Jim Jagielski
3b048c1aeb Further refinement for PR41056 / PR 19954 (mostly-fixed in r480135.)
We assume that a successful read but an empty brigade
is NOT cause for EAGAIN. Testing may or may not
confirm this assumption, in which case that test
may be required as well.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@504559 13f79535-47bb-0310-9956-ffa450edef68
2007-02-07 14:26:37 +00:00
Ruediger Pluem
8a7fb4574c * Add CacheIgnoreQueryString directive to cache requests with a query string
even if no expiration time is specified. Futhermore the query string will not
  be used for key generation such that requests to the same URI path, but with
  different query strings are mapped to the same cache entity. Turning this
  setting to ON violates RFC 2616/13.9 and thus it is turned off by default.

PR: 41484
Submitted by: Fredrik Widlund <fredrik.widlund qbrick.com>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@504183 13f79535-47bb-0310-9956-ffa450edef68
2007-02-06 15:55:50 +00:00