1
0
mirror of https://github.com/apache/httpd.git synced 2025-08-05 16:55:50 +03:00

258 Commits

Author SHA1 Message Date
Jean-Frederic Clere
de52fc46c8 Make sure the Additional error is displayed.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1922079 13f79535-47bb-0310-9956-ffa450edef68
2024-11-25 13:20:47 +00:00
Jean-Frederic Clere
f4847dbc43 rollback unrelated fix to my previous commit, sorry.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1921975 13f79535-47bb-0310-9956-ffa450edef68
2024-11-20 14:36:43 +00:00
Jean-Frederic Clere
d21b4c41f6 Merge PR#419: make sure the right method is displayed.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1921973 13f79535-47bb-0310-9956-ffa450edef68
2024-11-20 13:11:11 +00:00
Eric Covener
3c84b560b5 copy the trusted flag from the subrequest
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1919247 13f79535-47bb-0310-9956-ffa450edef68
2024-07-15 12:06:46 +00:00
Ruediger Pluem
fbe782e6c4 * Follow up to r1918814: Strings are from configuration and thus trusted
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1918823 13f79535-47bb-0310-9956-ffa450edef68
2024-07-02 11:19:45 +00:00
Eric Covener
cf3402e182 maintain trusted flag
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1918795 13f79535-47bb-0310-9956-ffa450edef68
2024-07-01 19:23:40 +00:00
Stefan Eissing
ed69ae3384 *) core: add final_resp_passed flag to request_rec to allow
ap_die() to judge if it can send out a response. Bump mmn.
     Enable test cases that check errors during response body to
     appear as error on client side.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910161 13f79535-47bb-0310-9956-ffa450edef68
2023-06-01 12:21:03 +00:00
Yann Ylavic
3ec0ffb9e1 http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
      hostname, per HTTP specifications.

The early checks avoid failing the request later on and thus save cycles
for those invalid cases.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1895921 13f79535-47bb-0310-9956-ffa450edef68
2021-12-13 18:55:18 +00:00
Yann Ylavic
1d45d5527f Revert spurious commit r1895340.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1895341 13f79535-47bb-0310-9956-ffa450edef68
2021-11-25 20:47:14 +00:00
Yann Ylavic
5da71e7634 Trigger ci.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1895340 13f79535-47bb-0310-9956-ffa450edef68
2021-11-25 20:45:54 +00:00
Yann Ylavic
b3110d36af core: handle morphing buckets setaside/reinstate and kill request core filter.
The purpose of ap_request_core_filter() is not clear, it seems to prevent
potential morphing buckets to go through AP_FTYPE_CONNECTION filters which
would fail to set them aside (ENOTIMPL), and read them (unbounded) in memory.

This patch allows ap_filter_setaside_brigade() to set morphing buckets aside
by simply moving them, assuming they have the correct lifetime (either until
some further EOR, or the connection lifetime, or whatever). IOW, the module is
responsible for sending morphing buckets whose lifetime needs not be changed
by the connection filters.

Now since morphing buckets consume no memory until (apr_bucket_)read, like FILE
buckets, we don't account for them in flush_max_threshold either. This changes
ap_filter_reinstate_brigade() to only account for in-memory and EOR buckets to
flush_upto.

Also, since the EOR bucket is sent only to c->output_filters once the request
is processed, when all the filters < AP_FTYPE_CONNECTION have done their job
and stopped retaining data (after the EOS bucket, if ever), we prevent misuse
of ap_filter_{setaside,reinstate}_brigade() outside connection filters by
returning ENOTIMPL. This is not the right API for request filters as of now.

Finally, ap_request_core_filter() and co can be removed.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1875947 13f79535-47bb-0310-9956-ffa450edef68
2020-03-31 16:22:53 +00:00
Joe Orton
2517583a44 Define ap_method_mask_t (typedef for apr_uint64_t) and use for method
bitmasks rather than apr_int64_t.  Fixes UBSan errors shifting to the
top bit of a signed integer.

* include/httpd.h: Add ap_method_mask_t, use it for AP_METHOD_BIT.
  (struct ap_method_mask_t): Likewise for method_mask field.
  (struct request_rec): Likewise for allowed field.

* include/http_config.h (struct cmd_parms): Likewise for limited field.

* include/ap_mmn.h: Bump MMN major.

* modules/*/*.c: Adjust all method masks to use ap_method_mask_t.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1874114 13f79535-47bb-0310-9956-ffa450edef68
2020-02-17 10:11:56 +00:00
Yann Ylavic
1b59b52292 Follow up to r1840265: really privatize ap_filter_{recycle,adopt_brigade}().
Move ap_filter_adopt_brigade()'s declaration to "server/core.h" (private).

For ap_filter_recycle(), make it static/internal to util_filter (renamed to
recycle_dead_filters() which better fits what it does). It's now also called
unconditionally from ap_filter_input_pending() which itself is always called
after the request processing and from MPM event (as input_pending hook).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840611 13f79535-47bb-0310-9956-ffa450edef68
2018-09-11 21:21:40 +00:00
Yann Ylavic
5ab81a73c1 Follow up to r1840149: core input filter pending data.
Since r1840149 ap_core_input_filter() can't use use f->[priv->]bb directly, so
ap_filter_input_pending() stopped accounting for its pending data.

But ap_core_input_filter() can't (and doesn't need to) setaside its socket
bucket, so ap_filter_setaside_brigade() is not an option. This commit adds
ap_filter_adopt_brigade() which simply moves the given buckets (brigade) into
f->priv->bb, and since this is not something to be done blindly (the buckets
need to have c->pool/bucket_alloc lifetime, which is the case in the core
filter) the function is not AP_DECLAREd/exported thus can be used in core only.

With ap_filter_adopt_brigade() and ap_filter_reinstate_brigade(), the core
input is now ap_filter_input_pending() friendly.

Also, ap_filter_recycle() is no more part of the API (AP_DECLARE removed too),
there really is no point to call it outside core code. MAJOR bumped once again
because of this.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840265 13f79535-47bb-0310-9956-ffa450edef68
2018-09-06 22:48:28 +00:00
Yann Ylavic
e70b8bfbcd util_filter: protect ap_filter_t private fields from external (ab)use.
Introduce opaque struct ap_filter_private to move ap_filter_t "pending", "bb"
and "deferred_pool" fields to the "priv" side of things.

This allows to trust values set internally (only!) in util_filter code, and
make useful assertions between the different functions calls, along with the
usual nice extensibility property.

Likewise, the private struct ap_filter_conn_ctx in conn_rec (from r1839997)
allows now to implement the new ap_acquire_brigade() and ap_release_brigade()
functions useful to get a brigade with c->pool's lifetime. They obsolete
ap_reuse_brigade_from_pool() which is replaced where previously used.

Some comments added in ap_request_core_filter() regarding the lifetime of the
data it plays with, up to EOR...

MAJOR bumped (once again).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840149 13f79535-47bb-0310-9956-ffa450edef68
2018-09-05 17:27:43 +00:00
Yann Ylavic
0093e3ad22 core: follow up to r1839997: some runtime optimizations.
We don't mind about cleaning up a connection filter when its pool is being
cleaned up already. For request filters, let pending_filter_cleanup() do
nothing if the given filter is not pending (anymore), which allows to save a
cleanup kill when the filter is removed.

Clear (zero) the reused filters (ap_filter_t) on reuse rather than cleanup,
then a single APR_RING_CONCAT() can be used to recycle dead_filters in a one
go.

Always call ap_filter_recycle() in ap_filter_output_pending(), even if no
filter is pending, and while at it fix s/ap_filter_recyle/ap_filter_recycle/
silly typo.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840028 13f79535-47bb-0310-9956-ffa450edef68
2018-09-04 10:32:10 +00:00
Yann Ylavic
5262e7e73a core: follow up to r1839997: recycle request filters to a delayed ring first.
We want not only ap_filter_output_pending() to be able to access each pending
filter's *f after the EOR is destroyed, but also each request filter to do
the same until it returns.

So request filters are now always cleaned up into a dead_filters ring which is
merged into spare_filters only when ap_filter_recycle() is called explicitely,
that is in ap_process_request_after_handler() and ap_filter_output_pending().

The former takes care of recycling at the end of the request, with any MPM,
while the latter keeps recycling during MPM event's write completion.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840002 13f79535-47bb-0310-9956-ffa450edef68
2018-09-04 02:40:49 +00:00
Yann Ylavic
3fdba065dd core: axe data_in_in/output_filter from conn_rec.
They were superseded by ap_filter_should_yield() and ap_run_in/output_pending()
in r1706669 and had poor semantics since then (we can't maintain pending
semantics both by filter and for the whole connection).

Register ap_filter_input_pending() as the default input_pending hook (which
seems to have been forgotten in the first place).

On the MPM event side, we don't need to flush pending output data when the
connection has just been processed, ap_filter_should_yield() is lightweight and
enough to determine whether we should really enter write completion state or go
straight to reading. ap_run_output_pending() is used only when write completion
is in place and needs to be completed before more processing.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836364 13f79535-47bb-0310-9956-ffa450edef68
2018-07-20 15:47:16 +00:00
Yann Ylavic
8d0a14e3e8 core: integrate data_in_{in,out}put_filter to ap_filter_{in,out}put_pending().
Straightforward for ap_filter_input_pending() since c->data_in_input_filter is
always checked wherever ap_run_input_pending(c) is.

For ap_filter_output_pending(), this allows to set c->data_in_output_filter in
ap_process_request_after_handler() and avoid an useless flush from mpm_event.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836239 13f79535-47bb-0310-9956-ffa450edef68
2018-07-18 22:36:19 +00:00
Yann Ylavic
eb5e821bea core: Add ap_reuse_brigade_from_pool().
Current RETRIEVE_BRIGADE_FROM_POOL macro from "http_request.c" is turned into
a helper and used in ap_request_core_filter().

We will need it in a subsequent commit in "util_filter.c" too.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836018 13f79535-47bb-0310-9956-ffa450edef68
2018-07-16 11:06:57 +00:00
Joe Orton
07ab2af39d * modules/http/http_request.c (ap_process_request_after_handler,
ap_process_request): Cache and retrieve the brigade structure used
  to send EOR and FLUSH between requests in c->pool userdata, to avoid
  allocating a brigade structure per-request out of c->pool.

Submitted by: rpluem, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1833014 13f79535-47bb-0310-9956-ffa450edef68
2018-06-06 11:39:33 +00:00
Eric Covener
5d755688b1 PR62186: preserve %<m for ErrorDocument internal redirects
*) core: Preserve the original HTTP request method in the '%<m' LogFormat
     when an path-based ErrorDocument is used.  PR 62186.
     [Micha Lenk <micha lenk.info>]

Submitted By: Micha Lenk
Committed By: covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1828920 13f79535-47bb-0310-9956-ffa450edef68
2018-04-11 18:49:05 +00:00
Christophe Jaillet
3e56c5b221 Fix some typos reported in PR 59998
Most add already been fixed when PR 59990 had been applied on trunk. 

Thx klemens

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1827669 13f79535-47bb-0310-9956-ffa450edef68
2018-03-24 20:05:19 +00:00
Yann Ylavic
b959689cb5 Fix timeout logging in ap_process_request().
We can't use 'r' after ap_process_request_after_handler(), the core output
filter might have cleaned up its deferred bucket brigade on error, including
the EOR bucket.

Reported by: steffenal
Fixes SpiderLabs/ModSecurity#1542


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1826556 13f79535-47bb-0310-9956-ffa450edef68
2018-03-12 15:24:13 +00:00
Yann Ylavic
c73d594ccc core: don't send EOR bucket through request filters.
The core request filter is the only one which should take care of it.
In theory the other request filters should have bailed out on EOS already,
but that's not always the case (and even less the case on error).
So be safe by not sending them a bucket which may destroy the request (and
their brigade) underneath them.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1822600 13f79535-47bb-0310-9956-ffa450edef68
2018-01-30 02:00:33 +00:00
Luca Toscano
aeaabea3c2 core, mod_rewrite: introduce the 'redirect-keeps-vary' note
to allow proper Vary header insertion when
                   dealing with a RewriteRule in a directory
                   context.

This change is an attempt to fix a long standing problem,
brought up while working on PR 58231. Our documentation clearly
states the following:

"If a HTTP header is used in a condition this header is added
to the Vary header of the response in case the condition
evaluates to true for the request."

This is currently not true for RewriteCond/Rules working in
a directory context, since when an internal redirect happens
all the outstanding response headers get dropped.

There might be a better solution so I am looking forward to
hear more opinions and comments. My goal for a delicate change
like this one would be to affect the least amount of configurations
possible, without triggering unwanted side effects.

If the solution is good for everybody tests will be written
in the suite asap.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1811744 13f79535-47bb-0310-9956-ffa450edef68
2017-10-10 17:41:37 +00:00
Yann Ylavic
81cdebf482 ap_check_pipeline: clarify/simplify !max_blank_lines logic, no functional change.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1765061 13f79535-47bb-0310-9956-ffa450edef68
2016-10-15 13:31:31 +00:00
Yann Ylavic
1bda0469cf [mod_proxy_]http: follow up to r1750392.
Export [ap_]check_pipeline() and use it also for ap_proxy_check_connection(),
so that all the necessary checks on the connection are done before reusing it.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756186 13f79535-47bb-0310-9956-ffa450edef68
2016-08-12 13:58:10 +00:00
Yann Ylavic
104ef73c95 Revert r1756064 and r1756060 until fixed (tests framework passes).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756065 13f79535-47bb-0310-9956-ffa450edef68
2016-08-11 23:37:45 +00:00
Yann Ylavic
25b8c2b589 http: follow up to r1750392.
Restore AP_MODE_READBYTES cleared inadvertently in r1756060.

[Reverted by r1756065]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756064 13f79535-47bb-0310-9956-ffa450edef68
2016-08-11 23:24:47 +00:00
Yann Ylavic
2023d56eea [mod_proxy_]http: follow up to r1750392.
Export [ap_]check_pipeline() and use it also for ap_proxy_check_connection().

[Reverted by r1756065]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756060 13f79535-47bb-0310-9956-ffa450edef68
2016-08-11 22:32:42 +00:00
Yann Ylavic
239ac0c076 Follow up to r1734656: restore c->data_in_input_filters usage to
see if it helps unblocking test framework.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1736216 13f79535-47bb-0310-9956-ffa450edef68
2016-03-22 17:08:29 +00:00
Graham Leggett
64eaf888e9 core: Extend support for setting aside data from the network input filter
to any connection or request input filter.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1734656 13f79535-47bb-0310-9956-ffa450edef68
2016-03-12 00:43:58 +00:00
Yann Ylavic
1612dc929b core: follow up to r1710095, r1710105.
We can do this in a single (no inner) loop, and simplify again the logic.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1711902 13f79535-47bb-0310-9956-ffa450edef68
2015-11-02 08:08:25 +00:00
Yann Ylavic
2590be0587 core: follow up to r1710095.
Simplify logic in check_pipeline(), and log unexpected errors.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1710105 13f79535-47bb-0310-9956-ffa450edef68
2015-10-22 21:19:52 +00:00
Yann Ylavic
f9b56afc0e core: Limit to ten the number of tolerated empty lines between request,
and consume them before the pipelining check to avoid possible response
delay when reading the next request without flushing.

Before this commit, the maximum number of empty lines was the same as
configured LimitRequestFields, defaulting to 100, which was way too much.
We now use a fixed/hard limit of 10 (DEFAULT_LIMIT_BLANK_LINES).

check_pipeline() is changed to check for (up to the limit) and comsume the
trailing [CR]LFs so that they won't be interpreted as pipelined requests,
otherwise we would block on the next read without flushing data, and hence
possibly delay pending response(s) until the next/real request comes in or
the keepalive timeout expires.
 
Finally, when the maximum number of empty line is reached in
read_request_line(), or that request line does not contains at least a method
and an (valid) URI, we can fail early and avoid some failure detected in
further processing.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1710095 13f79535-47bb-0310-9956-ffa450edef68
2015-10-22 20:26:12 +00:00
Graham Leggett
91b4321bfa Make sure we free the main request rather than the final internal
redirect.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1707155 13f79535-47bb-0310-9956-ffa450edef68
2015-10-06 22:04:24 +00:00
Graham Leggett
615f97f933 core: Extend support for asynchronous write completion from the
network filter to any connection or request filter.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1706669 13f79535-47bb-0310-9956-ffa450edef68
2015-10-04 10:10:51 +00:00
Yann Ylavic
6cb5958ce8 mod_ssl: follow up to r1705194, r1705823, r1705826 and r1705828.
Add CHANGES entry, and restore ap_process_request_after_handler()'s comment
as prior to r1705194 (the change makes no sense now).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1705833 13f79535-47bb-0310-9956-ffa450edef68
2015-09-29 10:31:58 +00:00
Yann Ylavic
9aba39ee0c mod_ssl: forward EOR (only) brigades to the core_output_filter().
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1705194 13f79535-47bb-0310-9956-ffa450edef68
2015-09-24 23:13:03 +00:00
Eric Covener
240d6e09d1 Avoid adding duplicate subequest filters, as they would not be stripped
properly during an ap_internal_fast_redirect.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1698334 13f79535-47bb-0310-9956-ffa450edef68
2015-08-28 13:13:14 +00:00
Stefan Eissing
9d99941373 reversal of 1698239 due to nedless loop in t/apache/pr17629.t
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1698328 13f79535-47bb-0310-9956-ffa450edef68
2015-08-28 12:55:55 +00:00
Eric Covener
f7a34707da avoid adding multiple subrequest filters when there are nested subrequests.
Multiple copies of the filter were not stripped properly 
during ap_fast_internal_redirect() which left the EOS buckets
stripped out of the brigade. This results in the end-chunk never
going out on the wire for a chunked response.

observed with mainreq -> directoryindex -> FallbackResource

PR58292



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1698239 13f79535-47bb-0310-9956-ffa450edef68
2015-08-27 22:55:52 +00:00
Gregg Lewis Smith
dc8a79e563 ap_process_request needs exportation for use in mod_h2 on Windows
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1694950 13f79535-47bb-0310-9956-ffa450edef68
2015-08-10 03:30:25 +00:00
Yann Ylavic
f6090114a8 core: Cleanup the request soon/even if some output filter fails to
handle the EOR bucket.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1666998 13f79535-47bb-0310-9956-ffa450edef68
2015-03-16 13:52:39 +00:00
Yann Ylavic
bce39a4336 ap_die(): follow up to r1657881.
Use log level DEBUG for AP_FILTER_ERROR => HTTP_INTERNAL_SERVER_ERROR.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1665643 13f79535-47bb-0310-9956-ffa450edef68
2015-03-10 17:58:01 +00:00
Yann Ylavic
be12754eed http: Make ap_die() robust against any HTTP error code and not modify
response status (finally logged) when nothing is to be done.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1657881 13f79535-47bb-0310-9956-ffa450edef68
2015-02-06 16:16:52 +00:00
Eric Covener
8cc5e00f9e *) SECURITY: CVE-2013-5704 (cve.mitre.org)
core: HTTP trailers could be used to replace HTTP headers
     late during request processing, potentially undoing or
     otherwise confusing modules that examined or modified
     request headers earlier.  Adds "MergeTrailers" directive to restore
     legacy behavior.  

Submitted By: Edward Lu, Yann Ylavic, Joe Orton, Eric Covener
Committed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610814 13f79535-47bb-0310-9956-ffa450edef68
2014-07-15 19:11:02 +00:00
Eric Covener
7eb8fbe0ba also copy r->invoke_mtx when creating a subrequest
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1402924 13f79535-47bb-0310-9956-ffa450edef68
2012-10-28 02:37:41 +00:00
Stefan Fritsch
8ec0c56b02 Code clean up (remove useless memory allocation)
Submitted by: Christophe JAILLET <christophe jaillet wanadoo fr>
PR: 52648


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1361803 13f79535-47bb-0310-9956-ffa450edef68
2012-07-15 21:19:54 +00:00