Password hash functions must be expensive in order to be secure. But
if they have to be re-evaluated for every request, performance
suffers.
As a minimal remedy, cache the most recent result for every
connection. This gives a great performance boost if a web browser
does many requests on the same connection with the same
user+password. In principle, this may keep the plain text password
around longer than before. But in practice, there won't be much
difference since user+password can already remain in some unused
data bucket for longer than the request duration.
A proper solution still needs to be found for connections from
proxies which may carry requests for many different users.
While it currently only requires the conn_rec, the new
ap_password_validate() function takes username and request_rec to
allow future extensions, like detection of brute-force attempts.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1427548 13f79535-47bb-0310-9956-ffa450edef68
This is a first stab, the checks will likely have to be revised.
For now, we check
* if the request line contains control characters
* if the request uri has fragment or username/password
* that the request method is standard or registered with RegisterHttpMethod
* that the request protocol is of the form HTTP/[1-9]+.[0-9]+,
or missing for 0.9
* if there is garbage in the request line after the protocol
* if any request header contains control characters
* if any request header has an empty name
* for the host name in the URL or Host header:
- if an IPv4 dotted decimal address: Reject octal or hex values, require
exactly four parts
- if a DNS host name: Reject non-alphanumeric characters besides '.' and
'-'. As a side effect, this rejects multiple Host headers.
* if any response header contains control characters
* if any response header has an empty name
* that the Location response header (if present) has a valid scheme and is
absolute
If we have a host name both from the URL and the Host header, we replace the
Host header with the value from the URL to enforce RFC conformance.
There is a log-only mode, but the loglevels of the logged messages need some
thought/work. Currently, the checks for incoming data log for 'core' and the
checks for outgoing data log for 'http'. Maybe we need a way to configure the
loglevels separately from the core/http loglevels.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1426877 13f79535-47bb-0310-9956-ffa450edef68
This reverts r1407643, but changes the syntax of HttpProtocol to
min=0.9|1.0, which is less ambiguous than the previous +0.9|-0.9.
Allowing to configure an arbitrary version range was a bad idea,
because it only checked the version in the request line, without
affecting the semantics of the headers, etc.
A tighter restriction off the version in the request line is still
possible with <If "%{SERVER_PROTOCOL_NUM} ..."> .
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1425366 13f79535-47bb-0310-9956-ffa450edef68
This is necessary to properly disallow directives that don't work in
<If>.
A separate NOT_IN_IF flag may be nicer, but would create much more
hassle when being backported to 2.4.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1406495 13f79535-47bb-0310-9956-ffa450edef68
of server loading for Apache. So create a struct that
holds some useful data. The hope is that for those
platforms that lack getloadavg(), people will write
replacements.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1389481 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_connect to avoid an inappropriate DNS lookup:
* modules/proxy/proxy_util.c (ap_proxy_checkproxyblock): Take hostname
argument, make address argument optional. Check names against
hostname arg, omit if addr not given.
(ap_proxy_determine_connection): Adjust for the above; pass hostname
from URI not the next hop.
* modules/proxy/mod_proxy_ftp.c (proxy_ftp_handler): Adjust for
ap_proxy_checkproxyblock change.
* modules/proxy/mod_proxy_connect.c (proxy_connect_handler): Adjust
similarly, and avoid the DNS lookup on the request-URI hostname if a
proxy is used.
* include/ap_mmn.h: Bump MMN.
PR: 43697
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1365001 13f79535-47bb-0310-9956-ffa450edef68
