1
0
mirror of https://github.com/apache/httpd.git synced 2025-08-05 16:55:50 +03:00

304 Commits

Author SHA1 Message Date
Yann Ylavic
cdc97c4368 Revert r1869222, wrong files committed.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1869223 13f79535-47bb-0310-9956-ffa450edef68
2019-10-31 16:10:08 +00:00
Yann Ylavic
e2d7af8692 mod_proxy_http: follow up to r1869216.
Let's call stream_reqbody() for all rb_methods, no RB_SPOOL_CL special case.

This both simplifies code and allows to keep EOS into the input_brigade until
it's sent, and thus detect whether we already fetched the whole body if/when
proxy_http_handler() re-enters for different balancer members.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1869222 13f79535-47bb-0310-9956-ffa450edef68
2019-10-31 16:08:33 +00:00
Yann Ylavic
7299090182 mod_proxy_http: fix load-balancer fallback for requests with a body.
Since r1656259 (or r1656259 in 2.4.41) and the move of prefetch before connect,
the balancer fallback case where proxy_http_handler() is re-entered with the
next balancer member broke.

We need to save the body (partially) prefetched the first time and reuse it on
successive calls, otherwise we might forward partial or empty body.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1869216 13f79535-47bb-0310-9956-ffa450edef68
2019-10-31 14:15:07 +00:00
Yann Ylavic
029deacf85 mod_proxy_http: follow up to r1868576.
Omit sending 100 continue if the body is (partly) prefetched, per
RFC 7231 (section 5.1.1).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1868653 13f79535-47bb-0310-9956-ffa450edef68
2019-10-20 13:06:29 +00:00
Yann Ylavic
cd9685dbfc mod_proxy_http: revert r1868625.
The HTTP_IN filter handles "100 Continue" the first time it's called only,
and in spool_reqbody_cl() we have already tried to prefetch the body, so
it's too late.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1868652 13f79535-47bb-0310-9956-ffa450edef68
2019-10-20 12:31:45 +00:00
Yann Ylavic
14037b617e mod_proxy_http: follow up to r1868576.
As suggested by Ruediger, let the HTTP_IN filter handle the 100 continue from
spool_reqbody_cl().

Also, according to rfc7231#section-5.1.1, we don't need the interim response
if we "already received some or all of the message body", which is now also
taken into account.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1868625 13f79535-47bb-0310-9956-ffa450edef68
2019-10-19 13:58:16 +00:00
Yann Ylavic
b936beed5c mod_proxy_http: Fix 100-continue deadlock for spooled request bodies. PR 63855.
Send "100 Continue", if needed, before fetching/blocking on the request body in
spool_reqbody_cl(), otherwise mod_proxy and the client can wait for each other,
leading to a request timeout (408).

While at it, make so that ap_send_interim_response() uses the default status
line if none is set in r->status_line.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1868576 13f79535-47bb-0310-9956-ffa450edef68
2019-10-18 07:50:59 +00:00
Rainer Jung
db74637563 mod_proxy/ssl: Proxy SSL client certificate
configuration and other proxy SSL configurations
broken inside <Proxy> context.
PR 63430
Triggered by r1855646+r1855748.
Patch from rpluem (proxy) and ylavic (ssl).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1859371 13f79535-47bb-0310-9956-ffa450edef68
2019-05-16 12:52:29 +00:00
Yann Ylavic
0848891b92 mod_proxy: follow up to r1836588: configurable Proxy100Continue.
Add Proxy100Continue directive to allow for 100-continue forwarding opt-out.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1856036 13f79535-47bb-0310-9956-ffa450edef68
2019-03-22 09:53:29 +00:00
Yann Ylavic
395e18056d mod_proxy_http: revert spurious comment from r1853953.
No, if we read more bytes than the C-L there is really something wrong in
our (or some) HTTP input filter.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853956 13f79535-47bb-0310-9956-ffa450edef68
2019-02-20 12:53:06 +00:00
Yann Ylavic
db66778090 mod_proxy_http: common function for stream_reqbody_{cl,chunked}()
Since stream_reqbody_cl() and stream_reqbody_chunked}() now have the same
structure, join them into a single stream_reqbody() function which is passed
the rb_method to handle only CL vs chunked cases differently.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853953 13f79535-47bb-0310-9956-ffa450edef68
2019-02-20 12:24:14 +00:00
Yann Ylavic
551dd2df80 mod_proxy_http: follow up to r1853561.
Handle "proxy-sendextracrlf" within the loop too.

Btw, this extra CRLF heresy should go (at least in trunk)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853566 13f79535-47bb-0310-9956-ffa450edef68
2019-02-14 08:45:36 +00:00
Yann Ylavic
c3fe94ae37 Revert r1853564.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853565 13f79535-47bb-0310-9956-ffa450edef68
2019-02-14 08:40:38 +00:00
Yann Ylavic
4b53f9ec42 mod_proxy_http: follow up to r1853409: no need to double flush on EOS.
[Reverted by r1853565]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853564 13f79535-47bb-0310-9956-ffa450edef68
2019-02-14 08:34:05 +00:00
Yann Ylavic
a8633aa28d mod_proxy_http: follow up to r1853409: don't play with meta-buckets.
It's better/simpler to handle the final 0-size chunk within the loop (on EOS).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853561 13f79535-47bb-0310-9956-ffa450edef68
2019-02-14 08:22:49 +00:00
Yann Ylavic
a6d7dea215 mod_proxy_http: follow up to r1853409.
Don't send two final 0-size chunks when the last read brigade is a single EOS.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853518 13f79535-47bb-0310-9956-ffa450edef68
2019-02-13 16:53:50 +00:00
Yann Ylavic
01d8e196dc mod_proxy_http: rework the flushing strategy when forwarding the request body.
Since the forwarding of 100-continue (end to end) in r1836588, we depended on
reading all of the requested HUGE_STRING_LEN bytes to avoid the flushes, but
this is a bit fragile.

This commit introduces the new stream_reqbody_read() function which will try a
nonblocking read first and, if it fails with EAGAIN, will flush on the backend
side before blocking for the next client side read.

We can then use it in stream_reqbody_{chunked,cl}() to flush client forwarded
data only when necessary. This both allows "optimal" flushing and simplifies
code (note that spool_reqbody_cl() also makes use of the new function but not
its nonblocking/flush functionality, thus only for consistency with the two
others, simplification and common error handling).

Also, since proxy_http_req_t::flushall/subprocess_env::proxy-flushall are now
meaningless (and unused) on the backend side, they are renamed respectively to
prefetch_nonblocking/proxy-prefetch-nonblocking, and solely determine whether
to prefetch in nonblocking mode or not. These flags were trunk only and may
not be really useful if we decided to prefetch in nonblocking mode in any case,
but for 2.4.x the opt-in looks wise.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853407 13f79535-47bb-0310-9956-ffa450edef68
2019-02-11 21:55:43 +00:00
Yann Ylavic
f673148e9b http: Enforce consistently no response body with both 204 and 304 statuses.
Provide AP_STATUS_IS_HEADER_ONLY() helper/macro to check for 204 or 304 and
use it where some special treatment is needed when no body is expected.

Some of those places handled 204 only.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1837056 13f79535-47bb-0310-9956-ffa450edef68
2018-07-30 13:08:23 +00:00
Yann Ylavic
35019799d6 mod_proxy_http: follow up to r1836588: nonblocking read for 100-continue body.
Set nonblocking read (req->flushall) when handling 100-continue since no body
is expected to be there already.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1837040 13f79535-47bb-0310-9956-ffa450edef68
2018-07-30 10:14:42 +00:00
Yann Ylavic
f6fcec7974 mod_proxy_http: follow up to r1836588: fix drop of spurious 100 responses.
r1836588 broke t/security/CVE-2008-2364.t by forwarding more than one
"100 continue" response, fix it.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836750 13f79535-47bb-0310-9956-ffa450edef68
2018-07-26 17:51:09 +00:00
Yann Ylavic
12c264bec0 mod_proxy_http: follow up to r1836588/r1836648: handle unread 100-continue.
When the backend responds with a non-interim response to a 100-continue,
mod_proxy_http won't read the client's body, so make sure "Connection: close"
ends up being added to the response if nobody reads that body later.

The right thing to do at mod_proxy level, rather then forcing AP_CONN_CLOSE,
is to restore r->expecting_100 so that further processing (like error_override
or trying on the next balancer member) can still work.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836716 13f79535-47bb-0310-9956-ffa450edef68
2018-07-26 11:29:51 +00:00
Yann Ylavic
9559832595 mod_proxy_http: follow up to r1836588: avoid 100-continue responses from core.
When mod_proxy_http handles end-to-end "100 continue", it can't let
ap_http_filter() send its own interim response whenever the body is read.

So save/restore r->expecting_100 before/after handling the request, and use
req->expecting_100 internally (including to restore r->expecting appropriately).

While at it, add comments and debug logs about 100 continue handling, and
fill in missing APLOGNO()s from r1836588.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836648 13f79535-47bb-0310-9956-ffa450edef68
2018-07-25 16:33:44 +00:00
Yann Ylavic
3558bdf4b7 mod_proxy_http: forward 100-continue.
Handle end-to-end 100-continue, according to RFC 7231, such that the client
request body is not read/forwarded (according to its "Expect:" header) until
the backend wants to receive it (with interim 100 continue response), or never
forwarded if the backend provides a (non-interim) response and doesn't need
the client body at all.

This is achieved by filling the header_brigade in ap_proxy_http_prefetch()
and letting ap_proxy_http_request() determine whether it should forward that
brigade only (with the "Expect: 100-continue" specified by the client or added
according to "ping=" configuration), or forward the whole body for the usual
case (as before).

When 100-continue expectation is in place, the body is actually forwarded by
ap_proxy_http_process_response() when/if a "100 continue" response is sent by
the backend, otherwise the body is discarded; a future enhancement could make
so that in a balancer configuration, the body could be forwarded to another
balancer member depending on the status/error from the backend.

So stream_reqbody_cl() and stream_reqbody_chunked() functions are adapted to be
called by either ap_proxy_http_request() or ap_proxy_http_process_response(),
while spool_reqbody_cl() still spools the body in ap_proxy_http_prefetch() thus
before the backend is connected/reused to avoid inactivity on the connection
for the prefetch time (the prefetched body is also forwarded according to the
100-continue expectation, though).

Also, since the brigades and other runtime objects now need to be shared by the
ap_proxy_http_*() functions chain, a proxy_http_req_t struct/context is created
from the start and passed to them as (the single) argument. This is also a good
candidate for a future async baton, if we wanted to let the MPM event wait for
connection data for us at any stage and be called back ;)

Finally, ap_send_interim_response() is modified to correcly handle 100 continue
responses once, and take care of clearing r->expecting_100 only for them.

PR 60330.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836588 13f79535-47bb-0310-9956-ffa450edef68
2018-07-24 21:55:29 +00:00
Ruediger Pluem
2acd655200 * Always retrieve conditional function. static variable might contain garbage if module was reloaded in a static build.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1836383 13f79535-47bb-0310-9956-ffa450edef68
2018-07-20 19:36:01 +00:00
Yann Ylavic
fab86dcf0e Axe ap_rgetline_core(), not used anymore.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1829790 13f79535-47bb-0310-9956-ffa450edef68
2018-04-22 15:58:18 +00:00
Yann Ylavic
15facfd9c9 mod_proxy_http: follow up to r1829573: remain EBCDIC friendly.
Keep using ap_rgetline() as before r1829573, since ap_rgetline_core() is
EBCDIC agnostic.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1829657 13f79535-47bb-0310-9956-ffa450edef68
2018-04-20 13:55:43 +00:00
Yann Ylavic
a9801cc4ef mod_proxy_http: make use of AP_GETLINE_NOSPC_EOL in ap_proxygetline().
Fixes response header thrown away after the previous one was considered too
large and truncated.

PR 62196.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1829573 13f79535-47bb-0310-9956-ffa450edef68
2018-04-19 16:06:57 +00:00
Eric Covener
a200c75a3d add log id for r1828926
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1828927 13f79535-47bb-0310-9956-ffa450edef68
2018-04-11 19:18:03 +00:00
Eric Covener
bd1ccf5f0a PR62199: add worker parameter ResponseFieldSize to mod_proxy
Submitted By: Hank Ibell
Committed By: covener




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1828926 13f79535-47bb-0310-9956-ffa450edef68
2018-04-11 19:11:52 +00:00
Graham Leggett
fac7f995b0 mod_proxy: Provide an RFC1035 compliant version of the hostname in the
proxy_worker_shared structure. PR62085


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1824176 13f79535-47bb-0310-9956-ffa450edef68
2018-02-13 21:22:05 +00:00
Yann Ylavic
56111a692a mod_proxy: allow SSLProxyCheckPeer* usage for all proxy modules.
PR 61857.

Proposed by: Markus Gausling <markusgausling googlemail.com>
Reviewed by: ylavic



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1818726 13f79535-47bb-0310-9956-ffa450edef68
2017-12-19 22:46:27 +00:00
Jean-Frederic Clere
92f22d68c0 Fix for JBCS-390.
Note it is related to PR  59007



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1807318 13f79535-47bb-0310-9956-ffa450edef68
2017-09-05 07:27:33 +00:00
Christophe Jaillet
e0f539c438 Move definition of ASCII_ZERO to httpd.h and rename it ZERO_ASCII for consistancy reason.
Remove definition of ASCII_CRLF which is the same as CRLF_ASCII.

Use ZERO_ASCII and CRLF_ASCII in mod_proxy_http

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1777611 13f79535-47bb-0310-9956-ffa450edef68
2017-01-06 13:58:03 +00:00
Yann Ylavic
1bda0469cf [mod_proxy_]http: follow up to r1750392.
Export [ap_]check_pipeline() and use it also for ap_proxy_check_connection(),
so that all the necessary checks on the connection are done before reusing it.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756186 13f79535-47bb-0310-9956-ffa450edef68
2016-08-12 13:58:10 +00:00
Yann Ylavic
104ef73c95 Revert r1756064 and r1756060 until fixed (tests framework passes).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756065 13f79535-47bb-0310-9956-ffa450edef68
2016-08-11 23:37:45 +00:00
Yann Ylavic
2023d56eea [mod_proxy_]http: follow up to r1750392.
Export [ap_]check_pipeline() and use it also for ap_proxy_check_connection().

[Reverted by r1756065]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756060 13f79535-47bb-0310-9956-ffa450edef68
2016-08-11 22:32:42 +00:00
Yann Ylavic
9d46ecdbe4 mod_proxy_http: 204 or 304 cannot happen here since ap_is_HTTP_ERROR() above
is true.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1754979 13f79535-47bb-0310-9956-ffa450edef68
2016-08-02 16:42:39 +00:00
Yann Ylavic
d47374519b mod_proxy_http: handle 401 error override in the same block as other errors
to simplify logic, no functional change.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1754975 13f79535-47bb-0310-9956-ffa450edef68
2016-08-02 16:34:56 +00:00
Yann Ylavic
a5e672195b mod_proxy_http: don't pretend we are sending a body before ProxyErrorOverride
takes place, the response it to be handled by ErrorDocument is this case.
Also it useless to take care of pre-read data since the body is discarded in
this case.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1754974 13f79535-47bb-0310-9956-ffa450edef68
2016-08-02 16:27:26 +00:00
Yann Ylavic
73c941d869 mod_proxy_http: ping retry only if full 100-continue conditions are met.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1754159 13f79535-47bb-0310-9956-ffa450edef68
2016-07-26 17:16:18 +00:00
Yann Ylavic
26faec4940 mod_proxy: follow up to r1750392.
Avoid double checking the connection in ap_proxy_connect_backend() when
ap_proxy_check_backend() says it is up and good to go.

This can be done by moving the PROXY_WORKER_IS_USABLE() check in
ap_proxy_check_backend(), since it is called by ap_proxy_connect_backend(),
and not calling the latter if the former succeeded (for the modules using it).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750474 13f79535-47bb-0310-9956-ffa450edef68
2016-06-28 11:19:36 +00:00
Yann Ylavic
b031a1ffed mod_proxy: we don't need ap_proxy_ssl_connection_cleanup() anymore with
ap_proxy_check_backend() used at connection reuse time, so remove its last call and deprecate it.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750416 13f79535-47bb-0310-9956-ffa450edef68
2016-06-27 21:49:15 +00:00
Yann Ylavic
bc73d63b45 mod_proxy: use proxy_conn_rec->tmp_bb where appopriate to avoid temporary
brigade create/destroy.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750412 13f79535-47bb-0310-9956-ffa450edef68
2016-06-27 21:39:53 +00:00
Yann Ylavic
d4aa6476b2 mod_proxy_{http,ajp,fcgi}}: don't reuse backend connections with data available
before the request is sent.  PR 57832.

ap_proxy_check_backend() can be used before ap_proxy_connect_backend() to try
to read available data (including from the filters), and is called by
ap_proxy_connect_backend() to check the socket state only (as before, still
relevant after ap_proxy_check_backend() due to filter data which may not have
triggered a real socket operation).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750392 13f79535-47bb-0310-9956-ffa450edef68
2016-06-27 17:26:12 +00:00
William A. Rowe Jr
f4cc76ee71 Rename ap_casecmpstr[n]() to ap_cstr_casecmp[n](), update with APR doxygen
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747469 13f79535-47bb-0310-9956-ffa450edef68
2016-06-09 00:06:42 +00:00
Christophe Jaillet
28ebc75b2b Avoid memory allocation before making sure that this handler can handle the URL
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1744460 13f79535-47bb-0310-9956-ffa450edef68
2016-05-18 21:54:09 +00:00
Yann Ylavic
f9ad2754f7 mod_proxy, mod_ssl: Handle SSLProxy* directives in <Proxy> sections,
allowing per backend TLS configuration.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1740928 13f79535-47bb-0310-9956-ffa450edef68
2016-04-26 00:04:57 +00:00
Jeff Trawick
7055ceebe7 Add missing proxy_run_detach_backend() on error path
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1735649 13f79535-47bb-0310-9956-ffa450edef68
2016-03-18 17:33:40 +00:00
Yann Ylavic
447582e5f4 mod_proxy: axe negative "ping" parameter setting and handling.
This used to check for the backend connection readability only (instead of
the full ping/100-continue round-trip), but the case is already handled by
ap_proxy_connect_backend() which is always called.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1729507 13f79535-47bb-0310-9956-ffa450edef68
2016-02-09 23:38:59 +00:00
Ruediger Pluem
c49ff0035c * Use new ap_proxy_buckets_lifetime_transform
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1726782 13f79535-47bb-0310-9956-ffa450edef68
2016-01-26 12:20:33 +00:00