A child asked to stop gracefully (AP_SIG_GRACEFUL, the pipe-of-death, a
generation change or MaxConnectionsPerChild) used to set die_now, which
stopped the pollers and cancelled everything still queued in the worker
pool. Connections writing a response, parked keep-alive connections and
accepted connections not yet started were dropped, so a slow download
was truncated by any graceful restart.
The child now drains. The supervisor starts it, the listener-owning
poller closes the listening sockets from its own thread, idle keep-alive
connections are expired at once, and the child exits when the count of
open connections reaches zero. The parent no longer counts a draining
child, so its replacement starts in a free slot while the old one
finishes. Run child_stopping and child_stopped from the child exit path
as the other MPMs do.
The scoreboard is sized from the daemon limit when first created and is
kept across graceful restarts, but motorz reported StartServers as that
limit, so raising StartServers on a graceful restart indexed past the
end of shared memory and crashed the parent. Add ServerLimit, defaulting
to twice StartServers, and fix it and ThreadLimit across restarts as
mpm_event does.
perform_idle_server_maintenance() could fork into slot 0 when no slot
was free, and did not count a child that was still starting. Count
children by recorded pid, generation and quiescing state instead, and
start one only in a free slot.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939361 13f79535-47bb-0310-9956-ffa450edef68
ap_duplicate_listeners() ignored the return value of make_sock() for a
duplicated listener. On failure make_sock() logs the error and closes
the socket, but the loop carried on with the closed listener: with one
Listen the server started or restarted with fewer listeners, and with
several it failed on the closed descriptor with a misleading "Bad file
descriptor". Return the error so that the MPM reports "could not
duplicate listeners" with the original status.
PR: 70106
Submitted by: Xuqing Yang
GitHub: closes#861
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939304 13f79535-47bb-0310-9956-ffa450edef68
* modules/md/md_crypt.c (md_asn1_time_get): For OpenSSL >= 1.1.1,
convert the certificate's ASN1_TIME directly via ASN1_TIME_to_tm()
instead of reconstructing it as apr_time_now() + ASN1_TIME_diff().
The latter samples the current time twice (once explicitly, once
inside ASN1_TIME_diff()); if the wall clock ticks over a second
between the two reads, the result is off by one second. This is a
real, reproducible race, not a theoretical one: forcing the two
reads to straddle a second boundary reproduces it in 29-39 out of
40 trials. It intermittently broke the exact-timestamp assertions
in test/modules/md/test_920_status.py::test_md_920_002.
* changes-entries/md-asn1-time-race.txt: Add entry.
GitHub: closes#838
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939271 13f79535-47bb-0310-9956-ffa450edef68
A MultiViews response took the media type of the selected file as it
was, so the qs source quality set with AddType was sent to the client.
Drop it after the variant has been selected. Other parameters are kept.
PR: 53595
GitHub: closes#824
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939268 13f79535-47bb-0310-9956-ffa450edef68
Stop reading (and writing) one byte past the end of a file
description when it ends inside an unterminated "&" entity or "<"
tag, as a ScanHTMLTitles title can.
* modules/generators/mod_autoindex.c (terminate_description): Check
for the terminating NUL before advancing past it when scanning an
unterminated "<" tag or "&" entity, and break out of the loop at
end of string rather than continuing past it.
* test/modules/generators/env.py (GeneratorsTestSetup.__init__): Load
mod_autoindex for the generators test suite.
* test/modules/generators/htdocs/autoindex/: New test content.
* test/modules/generators/test_002_autoindex.py (TestAutoindex): New
test that a ScanHTMLTitles description ending in a bare "&" is
rendered without reading past the end of the description.
Submitted by: arshiya tabasum <arshi bugqore.com>
GitHub: closes#812
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939181 13f79535-47bb-0310-9956-ffa450edef68
to a script from 256 to APACHE_ARG_MAX, and bound URI/query/env-value
lengths against the configured request limits rather than APR_PATH_MAX.
PR 70270.
* changes-entries/cgid-env-limit.txt: Add changelog entry.
* modules/generators/mod_cgid.c: Replace ENV_COUNT_MAX with ENV_VAL_MAX,
a sanity bound on the length of a single environment variable value.
(get_req): Take the main server_rec as an argument. Allow up to
APACHE_ARG_MAX environment variables; check uri_len and args_len
against the configured LimitRequestLine rather than APR_PATH_MAX;
check each environment variable value against ENV_VAL_MAX.
(send_req): Fail with APR_ENOSPC if more than APACHE_ARG_MAX
environment variables are present.
(cgid_server): Pass main_server to get_req.
* test/modules/generators/htdocs/cgi/: New tests scripts.
* test/modules/generators/test_001_cgid.py: New tests.
Submitted by: Emmanuel Dreyfus <manu netbsd.org>, jorton
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub: closes#850
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939165 13f79535-47bb-0310-9956-ffa450edef68
h2_session_shutdown() passed its reason, an APR or nghttp2 status, as the
error code of the GOAWAY frame. A connection timeout was sent as 70007
(APR_TIMEUP), an inadequate TLS connection as 22 (APR_EINVAL).
Give h2_session_shutdown() the HTTP/2 error code as a separate argument.
Timeouts and graceful shutdowns send NO_ERROR, failures INTERNAL_ERROR
and inadequate TLS parameters INADEQUATE_SECURITY.
PR: 70212
GitHub: closes#799
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939156 13f79535-47bb-0310-9956-ffa450edef68
dav_method_options() builds its own Allow field and unconditionally
advertised TRACE for existing DAV resources, even when TraceEnable was
off.
Respect TraceEnable when constructing the DAV Allow field.
PR: 70264
GitHub: closes#827
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939146 13f79535-47bb-0310-9956-ffa450edef68
Add ap_size_parameter_parse(), a helper to parse a configuration value
as an apr_off_t, which fails on trailing characters and on overflow.
The range of the value remains up to the directive.
Use it for configuration directives which parsed such values in
different ways, some of them accepting trailing characters or doing no
checks at all: LimitRequestBody (unchanged behavior), ScriptLogLength,
ScriptLogBuffer, DavQuota, BufferSize, AuthFormSize, and the
mod_cache_disk and mod_cache_socache size and time directives.
GitHub: closes#829
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939129 13f79535-47bb-0310-9956-ffa450edef68
* changes-entries/deflate-xlen-unsigned.txt: Add changes entry.
* modules/filters/mod_deflate.c (consume_zlib_flags): Cast the
FEXTRA length bytes through unsigned char before widening so a
byte with the high bit set is not sign-extended, fixing inflation
of gzip streams carrying an extra field.
Submitted by: arshiya tabasum <arshi bugqore.com>
GitHub: closes#839
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939124 13f79535-47bb-0310-9956-ffa450edef68
set_limit_xml_req_body() used atol(), so "abc123" and "123abc" were
accepted as 0 and 123, and a value out of range of a long gave an
undefined result. Parse the whole argument with apr_strtoff() like
LimitRequestBody, and reject values that do not fit in limit_xml_body
or exceed AP_MAX_LIMIT_XML_BODY.
PR: 69975
GitHub: closes#825
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939121 13f79535-47bb-0310-9956-ffa450edef68
consistency and we could use a dummy file in 2.4.x
so changes-entries/ is not dropped by git every
time `make update-changes` empties it.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939103 13f79535-47bb-0310-9956-ffa450edef68
failing configuration with httpd -t, and return its stderr;
apachectl_stderr is not set on Windows.
(test_filters_003_32, test_filters_003_35, test_filters_003_38,
test_filters_003_39, test_filters_003_40, test_filters_003_42,
test_filters_003_44, test_filters_003_45, test_filters_003_46): Use it.
* changes-entries/sed-fixes.txt: Add entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub: closes#791
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938966 13f79535-47bb-0310-9956-ffa450edef68
and test the LOCAL command.
* modules/metadata/mod_remoteip.c (remoteip_input_filter): Log EOF while
reading the PROXY protocol header at info level, as the peer going away;
other read errors are still logged as errors. Skip metadata buckets
rather than copying from them: the EOS bucket arriving before the EOF
was passed to memcpy() as a NULL source.
* test/modules/metadata/test_004_remoteip.py (test_metadata_004_03,
test_metadata_004_04, test_metadata_004_05, test_metadata_004_06): Test
PROXY protocol v2 with the PROXY and LOCAL commands, with and without an
address block, and a peer disconnecting after a partial header.
PR: 63893
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
GitHub: closes#805
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938927 13f79535-47bb-0310-9956-ffa450edef68
they are configured in, and fix merging.
* modules/metadata/mod_remoteip.c
(merge_remoteip_server_config): When both the main server and the virtual
host have proxymatch_ip entries, merge the two arrays.
(remoteip_hook_post_config): Log a warning (APLOGNO 10633) for each
virtual host whose proxy entries were merged with the main server's.
(remoteip_cmds): Drop EXEC_ON_READ from RemoteIPTrustedProxyList and
RemoteIPInternalProxyList so the directives apply in the server/vhost
scope they are configured in, rather than globally at config read time.
* test/modules/metadata/test_004_remoteip.py: New test.
* test/modules/metadata/env.py
(MetadataTestSetup.__init__): Add remoteip to the optional modules.
PR: 70207
Submitted by: Arturo Bernal <abernal apache.org>
GitHub: closes#793
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938908 13f79535-47bb-0310-9956-ffa450edef68
client.
* modules/cache/mod_socache_redis.c
(RD_DEFAULT_SERVER_RWTO): Define in seconds rather than microseconds.
(socache_rd_set_timeout): Convert the timeout from apr_time_t to whole
seconds, rounding up so a positive value does not become 0.
* test/modules/ssl/env.py
(SSLTestSetup.__init__): Add socache_redis as an optional module.
* test/modules/ssl/test_004_socache_redis.py: New test using a silent
Redis server to verify that RedisTimeout values are applied with the
expected whole-second rounding.
Submitted by: Christophe JAILLET, Arturo Bernal <abernal apache.org>
GitHub: closes#790
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938833 13f79535-47bb-0310-9956-ffa450edef68
* modules/http2/h2_stream.c (h2_stream_create_input): do not reject a
':path' of '*' with a ':scheme' present when the method is OPTIONS
over http/https; pass the asterisk-form through as is.
* test/modules/http2/test_203_rfc9113.py (test_h2_203_03_options_asterisk,
test_h2_203_04_invalid_path): Add tests.
Submitted by: Arturo Bernal <abernal apache.org>
PR: 70195
GitHub: closes#788
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938821 13f79535-47bb-0310-9956-ffa450edef68
SSL_VERIFY_CLIENT_ONCE to the verify mode used for Post-Handshake
Authentication. OpenSSL refuses the request with SSL_R_INVALID_CONFIG
when that flag is set and a certificate has already been received, so
a per-directory SSLVerifyClient failed with 403 on a TLSv1.3 connection
to a virtual host which had itself asked for a certificate.
Submitted by: Michael Kaufmann <mail michael-kaufmann.ch>
PR: 63096
GitHub: PR #770
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938504 13f79535-47bb-0310-9956-ffa450edef68
* modules/filters/mod_sed.c (sed_filter_ctxt): Add passed, evalerr.
(keep_metadata): New.
(append_bucket, sed_response_filter): Track whether anything has
reached the next filter.
(sed_response_filter): On a failed evaluation, pass the metadata on
and go on doing so for the rest of the response, unless nothing has
been written yet; carry metadata buckets other than EOS and FLUSH
through rather than deleting them; don't take the first bucket of an
empty brigade.
* changes-entries/sed-eos-on-error.txt: Add.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #769
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938485 13f79535-47bb-0310-9956-ffa450edef68
* modules/filters/sed0.c (ycomp): Stop parsing after reporting
SEDERR_TSNTSS when the destination string is shorter than the
source string. Previously the loop kept advancing tsp past the
closing delimiter and past the NUL terminator of the command
line, reading beyond the end of linebuf and eventually reporting
a bogus "ending delimiter missing" error.
Submitted by: Ankit Prateek <ankit offbyquant.com>
* test/modules/filters/test_002_sed_ycomp.py: New test. Check that
y/// commands with unequal string lengths are rejected with the
size-mismatch error rather than the delimiter error, in both
directions, and that a well-formed y/// still compiles and the
server starts. Skipped on Windows, where "httpd -k start" is
service control and fails before the configuration is read.
* test/modules/filters/env.py (FiltersTestSetup.__init__): Load
mod_sed.
(FiltersTestEnv.__init__): Add sed to the logged modules.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: closes#766, closes#678
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938337 13f79535-47bb-0310-9956-ffa450edef68
* modules/http2/h2_stream.c (h2_stream_add_header): Guard the AH10178,
AH10180 and AH10181 log messages on stream->request_headers_failed
rather than h2_stream_is_ready().
(h2_stream_end_headers): Likewise for AH10230.
Submitted by: Michael Kaufmann <mail michael-kaufmann.ch>
* test/modules/http2/test_111_header_limit_log.py: New test, checking
that AH10181 is logged exactly once for a request with many headers
over LimitRequestFields.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: closes#765, closes#666
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938328 13f79535-47bb-0310-9956-ffa450edef68
length on unmatched tail. Account for the unmatched tail after a
successful substitution before emitting the result. This keeps
SubstituteMaxLineLength effective for flattened literal substitutions
and for both regular-expression paths.
Submitted by: Robert McConnell <robert mcc0nnell.org>
GitHub: closes#755
Add test coverage:
* test/modules/filters/__init__.py,
test/modules/filters/conftest.py,
test/modules/filters/env.py,
test/modules/filters/test_001_substitute_maxlen.py: New test suite.
GitHub: closes#762
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938306 13f79535-47bb-0310-9956-ffa450edef68
NUL-terminated string in place, returning a pointer to the new
terminating NUL.
* include/httpd.h: Declare ap_cstr_stripws().
* server/util.c (ap_cstr_stripws): Implement it, handling the
empty-string case safely.
(ap_getline): Use it; adjust the returned length and memmove size
accordingly.
* modules/http/byterange_filter.c, modules/mappers/mod_negotiation.c,
modules/metadata/mod_cern_meta.c, modules/proxy/mod_proxy_hcheck.c,
modules/proxy/mod_proxy_http.c, modules/proxy/mod_proxy_uwsgi.c,
server/util_script.c: Replace open-coded trailing-whitespace
stripping loops with ap_cstr_stripws(). This avoids the undefined
behaviour of forming &value[strlen(value)-1], which points before
the start of the string when the value is empty.
* modules/metadata/mod_cern_meta.c, server/util_script.c: Use
apr_pstrmemdup() with the returned end pointer rather than
apr_pstrdup().
* include/ap_mmn.h: Bump MMN minor.
* test/unit/util.c: Add ap_cstr_stripws() unit tests.
* test/modules/proxy/test_03_response.py,
test/modules/proxy/test_05_uwsgi.py: Add tests for empty backend
response header values.
Submitted by: Robert McConnell <robert mcc0nnell.org>, jorton
GitHub: closes#749
Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938194 13f79535-47bb-0310-9956-ffa450edef68
included a trailing whitespace character in the copied string; simplify
loop termination.
(magic_rsl_to_request): Decline if the type is not of the form
token/token; ignore an encoding which is not a valid token.
(ascmagic): Don't append a note for content with escape sequences.
* test/modules/metadata/: New test suite.
* docs/log-message-tags/next-number: Bump.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
GitHub: closes#751
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938070 13f79535-47bb-0310-9956-ffa450edef68
* modules/aaa/mod_auth_digest.c (add_auth_info): Add the
(Proxy-)Authentication-Info header to err_headers_out, so a one-time
nonce client gets its nextnonce after an error response rather than a
stale re-challenge.
(note_digest_auth_failure): Drop any (Proxy-)Authentication-Info when
issuing a challenge, so a post-authentication 401 carries only the
fresh nonce.
* test/modules/aaa/test_011_authinfo_errors.py: New tests.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
GitHub: closes PR #739
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937888 13f79535-47bb-0310-9956-ffa450edef68
8192 bytes, holding around 140 clients.
* docs/manual/mod/mod_auth_digest.xml: Document the new default.
* test/modules/aaa/conftest.py, test/modules/aaa/test_008_onetime_nccheck.py:
Pin AuthDigestShmemSize to the old size.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub: PR #730
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937712 13f79535-47bb-0310-9956-ffa450edef68
* modules/arch/unix/mod_systemd.c (watchdog_ping): New.
(systemd_pre_config, systemd_post_config, systemd_monitor): Send the
watchdog keep-alive, and warn (AH10621) if WatchdogSec is too short
to be met.
* docs/manual/mod/mod_systemd.xml: Document watchdog support.
* test/modules/arch/linux/test_006_watchdog.py: New test suite.
* test/modules/arch/linux/env.py (ForegroundServer): New, running httpd
in the foreground so $WATCHDOG_PID can name it.
(TransientService): Take extra unit properties.
* test/modules/arch/linux/test_001_notify.py
(test_systemd_001_09_watchdog): No longer xfail; use a WatchdogSec
which does not draw AH10621.
* test/modules/arch/linux/README: Describe the watchdog tests.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: closes#728
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937644 13f79535-47bb-0310-9956-ffa450edef68
The "none" arg is documented somehow in r1932337, but not implemented.
* modules/proxy/mod_proxy_connect.c (connect_conf): Add "None".
(set_allowed_ports): Accept "None"; reject combining it with ports in
the same context.
(merge_config): Special-case "None": it disallows all ports and
overrides an inherited list, and an inherited "None" is overridden by
a port list in a vhost; two port lists still merge as a union.
(allowed_port): Disallow all ports when "none" is set.
* docs/manual/mod/mod_proxy_connect.xml: Clarify the merge behaviour and
the "None" restriction.
* test/modules/proxy/test_07_connect.py: Added.
* test/modules/proxy/env.py: Load mod_proxy_connect for the suite.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Github: closes#719
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937537 13f79535-47bb-0310-9956-ffa450edef68
* modules/filters/mod_substitute.c (set_pattern): Guard the
pre-incrementing delimiter scan loops with a NUL check, preventing
a read past the end of the allocation when the from or to field has
no closing delimiter.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: closes#685
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936264 13f79535-47bb-0310-9956-ffa450edef68
* modules/filters/mod_substitute.c (set_max_line_length): Check that
the parsed value does not exceed APR_INT64_MAX / multiplier before
applying the K/M/G suffix, to avoid signed integer overflow UB.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936263 13f79535-47bb-0310-9956-ffa450edef68
* modules/ldap/util_ldap.c: Hold the LDAP cache lock continuously
from URL node fetch through child cache access, closing the window
where a concurrent request could free the node between unlock and
re-lock. Re-fetch the URL node under the lock for write-back paths.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936261 13f79535-47bb-0310-9956-ffa450edef68
* modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500
error if a framing header is found in a .meta file rather than
merging it into the response headers.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936260 13f79535-47bb-0310-9956-ffa450edef68
* modules/metadata/mod_remoteip.c (remoteip_process_v2_header): Set
conn_conf->client_addr and client_ip for the LOCAL case, matching
the v1 UNKNOWN path.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936258 13f79535-47bb-0310-9956-ffa450edef68
The compat macros added in 83d565f for pre-1.1.0 OpenSSL used incorrect
names (X509_get0_before/X509_get0_after) which don't match the actual
API names used in the code (X509_get0_notBefore/X509_get0_notAfter).
This caused link failures when building against OpenSSL 1.0.2.
Also add missing X509_get0_serialNumber compat macro which was used in
ssl_engine_log.c but never shimmed for pre-1.1.0.
Submitted by: Craig Lorentzen <crlorent amazon.com>
Github: closes#673
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1935577 13f79535-47bb-0310-9956-ffa450edef68
