1
0
mirror of https://github.com/apache/httpd.git synced 2026-01-13 21:42:17 +03:00
Commit Graph

1740 Commits

Author SHA1 Message Date
Yann Ylavic
e472402601 mod_proxy_fcgi: follow up to r1638818.
Let ap_scan_script_header*() validate the headers.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1639812 13f79535-47bb-0310-9956-ffa450edef68
2014-11-15 00:35:37 +00:00
Yann Ylavic
02e736ae5a mod_proxy_fcgi: CVE-2014-3583: Fix a potential crash with response headers'
size above 8K.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1638818 13f79535-47bb-0310-9956-ffa450edef68
2014-11-12 15:41:07 +00:00
Yann Ylavic
a7becdbf75 mod_proxy_connect: Don't issue AH02447 on sockets hangups, let the read
determine whether it is a normal close or a real error. PR 57168.

Abort the client or backend connection on polling errors, but don't forcibly
abort the client side at the end (the core filters will do that otherwise
when necessary), so that lingering close and SSL shutdown can occur on normal
close.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1635645 13f79535-47bb-0310-9956-ffa450edef68
2014-10-31 00:07:06 +00:00
Yann Ylavic
6d40a34636 mod_proxy_wstunnel: abort backend connection on polling error to avoid
further processing (lingering close, SSL shutdown).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1635644 13f79535-47bb-0310-9956-ffa450edef68
2014-10-30 23:56:27 +00:00
Eric Covener
3eddd534ce When using EBCDIC encoding, HTTPS through ProxyPass and ProxyRemote doesn't
work correctly. PR 57092

Submitted By: Edward Lu 
Committed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1634425 13f79535-47bb-0310-9956-ffa450edef68
2014-10-27 00:55:20 +00:00
Ruediger Pluem
26848f7a23 * Use the correct server name for SNI in case the backend SSL connection itself
is established via a proxy server.

PR: 57139
Submitted by: Szabolcs Gyurko <szabolcs gyurko.org>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1634120 13f79535-47bb-0310-9956-ffa450edef68
2014-10-24 19:00:10 +00:00
Christophe Jaillet
46b8fcedc9 Fix indent.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1633522 13f79535-47bb-0310-9956-ffa450edef68
2014-10-22 04:54:52 +00:00
Christophe Jaillet
a9c4c3a37d Concat string at compile time when possible.
Doing so, sometimes also give the opportunity to turn a 'ap_fputstrs' into a 'ap_fputs'.
PR 53741

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1626050 13f79535-47bb-0310-9956-ffa450edef68
2014-09-18 19:06:52 +00:00
Jim Jagielski
e5cf7761a4 oops... prepend 0
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1625952 13f79535-47bb-0310-9956-ffa450edef68
2014-09-18 12:10:54 +00:00
Christophe Jaillet
2785b009e9 Silent some cppcheck warnings.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1621806 13f79535-47bb-0310-9956-ffa450edef68
2014-09-01 14:40:01 +00:00
Christophe Jaillet
f1176161be Fix sscanf format spotted by cppcheck.
Improve alignment.
Untested.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1621419 13f79535-47bb-0310-9956-ffa450edef68
2014-08-30 06:51:11 +00:00
Jim Jagielski
074c9cce56 Might as well make it 256 and be done w/ it. The extra bytes are
moot nowaways.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1621382 13f79535-47bb-0310-9956-ffa450edef68
2014-08-29 20:39:22 +00:00
Jim Jagielski
527acb80ce Correct loglevel.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1621372 13f79535-47bb-0310-9956-ffa450edef68
2014-08-29 19:42:34 +00:00
Jim Jagielski
6be32ac353 PR53218
Allow for longer worker names and make truncation a non-fatal
error... 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1621367 13f79535-47bb-0310-9956-ffa450edef68
2014-08-29 19:17:45 +00:00
Rainer Jung
5002fd13e7 Switch preference for headers, Transfer-Encoding
first, Content-Length second.

Addition to r1615289.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1620324 13f79535-47bb-0310-9956-ffa450edef68
2014-08-25 13:44:03 +00:00
Yann Ylavic
6d3f422f8c mod_proxy: add missing APLOGNOs.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1619455 13f79535-47bb-0310-9956-ffa450edef68
2014-08-21 15:49:54 +00:00
Jeff Trawick
7e9b8a0b06 mod_proxy_fcgi: Fix faulty logging of large amounts of stderr from the
application.

PR: 56858
Submitted by: Manuel Mausz <manuel-asf mausz.at>
Reviewed by: trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1618401 13f79535-47bb-0310-9956-ffa450edef68
2014-08-16 19:15:02 +00:00
Rainer Jung
3535416fc0 PR53420: Proxy responses with error status and
"ProxyErrorOverride On" hang until proxy timeout.

Regression from 2.2. It was introduced by r912063
in order to fix PR41646.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1615289 13f79535-47bb-0310-9956-ffa450edef68
2014-08-02 08:24:35 +00:00
Christophe Jaillet
fb0ad3fd89 Turn some APR_BUCKET_REMOVE(e)+apr_bucket_destroy(e) into the equivalent apr_bucket_delete(e) to reduce code verbosity
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1615026 13f79535-47bb-0310-9956-ffa450edef68
2014-08-01 04:23:50 +00:00
Christophe Jaillet
56d0c25725 Add missing APLOGNO.
Refactor some lines to keep APLOGNO on the same line as ap_log_error, when applicable.
Split lines longer than 80.
Improve alignment.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1612068 13f79535-47bb-0310-9956-ffa450edef68
2014-07-20 09:32:58 +00:00
Guenter Knauf
53e360cf37 Added missing export for proxy module.
Submitted by normw at gknw net.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610997 13f79535-47bb-0310-9956-ffa450edef68
2014-07-16 13:21:30 +00:00
Eric Covener
8cc5e00f9e *) SECURITY: CVE-2013-5704 (cve.mitre.org)
core: HTTP trailers could be used to replace HTTP headers
     late during request processing, potentially undoing or
     otherwise confusing modules that examined or modified
     request headers earlier.  Adds "MergeTrailers" directive to restore
     legacy behavior.  

Submitted By: Edward Lu, Yann Ylavic, Joe Orton, Eric Covener
Committed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610814 13f79535-47bb-0310-9956-ffa450edef68
2014-07-15 19:11:02 +00:00
Joe Orton
bb2749fd6e SECURITY (CVE-2014-0117): Fix a crash in mod_proxy. In a reverse
proxy configuration, a remote attacker could send a carefully crafted
request which could crash a server process, resulting in denial of
service.

Thanks to Marek Kroemeke working with HP's Zero Day Initiative for
reporting this issue.

* server/util.c (ap_parse_token_list_strict): New function.

* modules/proxy/proxy_util.c (find_conn_headers): Use it here.

* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response):
  Send a 400 for a malformed Connection header.

Submitted by: Edward Lu, breser, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610674 13f79535-47bb-0310-9956-ffa450edef68
2014-07-15 12:27:00 +00:00
Christophe Jaillet
b854d7e818 Remove some 'register' in variable declaration.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610366 13f79535-47bb-0310-9956-ffa450edef68
2014-07-14 09:05:27 +00:00
Rainer Jung
3e3b46844f Forward local IP address as a custom request attribute
like we already do for the remote port.

Both were forgotten in the original AJP 13 spec
but are needed by the Servlet spec. Until now,
Tomcat simply returns for getLocalAddr() the same as
for getLocalName().

The next round of Tomcat releases will look for the
optional new request attribute.

See also Tomcat BZ 56661.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610207 13f79535-47bb-0310-9956-ffa450edef68
2014-07-13 14:20:04 +00:00
Jan Kaluža
058348d405 mod_proxy: better check for worker->s->is_name_matchable
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1609688 13f79535-47bb-0310-9956-ffa450edef68
2014-07-11 11:09:34 +00:00
Jan Kaluža
c0a52f109d mod_proxy: add ap_proxy_define_match_worker() and use it for ProxyPassMatch
and ProxyMatch section to distinguish between normal workers and workers
with regex substitutions in the name. Implement handling of such workers
in ap_proxy_get_worker(). PR 43513


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1609680 13f79535-47bb-0310-9956-ffa450edef68
2014-07-11 10:36:15 +00:00
Yann Ylavic
4f08f4008a Fix C99 (or later only) comment.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1609101 13f79535-47bb-0310-9956-ffa450edef68
2014-07-09 11:11:23 +00:00
Christophe Jaillet
55c2568e4e s/apr_pstrndup/apr_pstrmemdup/ to save a few cycles
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1608999 13f79535-47bb-0310-9956-ffa450edef68
2014-07-09 03:47:31 +00:00
Takashi Sato
3d83bde5ef Revert r1601943, r1602058, r1605307 (socket callback returning pollfds)
Revert r1605369 (wstunnel refactoring)

per discassion on dev@httpd.a.o thread Message-ID:
<CALK=YjN9HfThP_k_rF9iJPcUhcQk9sNOaDPxZNG+HcJNWS4ZAQ@mail.gmail.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1605946 13f79535-47bb-0310-9956-ffa450edef68
2014-06-27 04:17:30 +00:00
Takashi Sato
83aea4aac7 Async mod_proxy_wstunnel:
Resume a client connection from SUSPENDED state to avoid the 
connection remain suspended.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1605376 13f79535-47bb-0310-9956-ffa450edef68
2014-06-25 12:52:09 +00:00
Takashi Sato
ffc5802356 Refactor asynchronous mod_proxy_wstunnel using pollfd returned by MPM.
r1601943 and r1605307 made Event MPM return woken pollfd, so async 
wstunnel doesn't need its own apr_pollset_poll.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1605369 13f79535-47bb-0310-9956-ffa450edef68
2014-06-25 12:24:03 +00:00
Christophe Jaillet
0c2094251f Use ap_remove_input_filter_byhandle instead of duplicating the code.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1605207 13f79535-47bb-0310-9956-ffa450edef68
2014-06-24 21:47:21 +00:00
Yann Ylavic
aa5ca9770e mod_proxy_fcgi: follow up to r1592032.
Also break the outer loop when "sending stdin" fails.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1603122 13f79535-47bb-0310-9956-ffa450edef68
2014-06-17 10:37:15 +00:00
Jeff Trawick
e22212a41b Reindent after small fix in r1603027
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1603029 13f79535-47bb-0310-9956-ffa450edef68
2014-06-16 23:57:19 +00:00
Jeff Trawick
d6d845cfcd Fix bug introduced in r1591508 which resulted in the final empty
FCGI_STDIN not being sent.  Interaction with latest uWSGI (and
probably other protocol implementations) breaks without this.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1603027 13f79535-47bb-0310-9956-ffa450edef68
2014-06-16 23:56:06 +00:00
Yann Ylavic
ec95d72c5a mod_proxy: Don't limit the size of the connectable Unix Domain Socket paths.
Since connect() to UDS path is used at several places, introduce
ap_proxy_connect_uds() in proxy_util.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1602989 13f79535-47bb-0310-9956-ffa450edef68
2014-06-16 20:26:24 +00:00
Jim Jagielski
637f263141 revert 1602523, until there is understanding
about what the actual issue and "requirement" are.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1602697 13f79535-47bb-0310-9956-ffa450edef68
2014-06-15 13:54:55 +00:00
Jim Jagielski
74820dfc57 Allow for "magic" scheme "auto" which makes the scheme of
the backend worker match whatever the scheme of the
incoming request was...

For example:

   ProxyPass / auto://foo.example.com/

If the incoming request is http:.../lala then
the resultant will be http://foo.example.com/lala

If it's wws:.../lolo then we'd send
wws://foo.example.com/lolo

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1602523 13f79535-47bb-0310-9956-ffa450edef68
2014-06-13 21:10:51 +00:00
Takashi Sato
0e4cf76a64 Socket event callback now takes pollfd.
User (e.g. mod_proxy_wstunnel) can know
which socket is ready.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601943 13f79535-47bb-0310-9956-ffa450edef68
2014-06-11 16:39:34 +00:00
Yann Ylavic
3dd42c024f mod_proxy: follow up to r1601291.
Since deferred_write_pool is needed by the core_output_filter and is a subpool
of the connection, shutdown in a pre_cleanup of the connection's pool to avoid
a freed memory access (SEGV).

Reported By: takashi


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601630 13f79535-47bb-0310-9956-ffa450edef68
2014-06-10 13:23:20 +00:00
Yann Ylavic
9614c0b8e6 Strip useless apr_brigade_cleanup() calls.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601624 13f79535-47bb-0310-9956-ffa450edef68
2014-06-10 12:44:15 +00:00
Takashi Sato
854c7a5611 * apr_status_t vs HTTP status code fix
* use APR_STATUS_IS_ENOTIMPL rather than direct comparison


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601604 13f79535-47bb-0310-9956-ffa450edef68
2014-06-10 11:21:22 +00:00
Takashi Sato
a310a093ba Private function doesn't need ap_ prefix.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601603 13f79535-47bb-0310-9956-ffa450edef68
2014-06-10 11:08:43 +00:00
Yann Ylavic
5cc5869ea4 mod_proxy: Shutdown (eg. SSL close notify) the backend connection
before closing.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601291 13f79535-47bb-0310-9956-ffa450edef68
2014-06-09 01:03:39 +00:00
Yann Ylavic
bac2d32f4c Revert r1601285 and r1601283.
Shouldn't have commited the latter without disussing it on dev@.
Since the former creates upper APLOGNOs, revert and then recommit with the reverted next tag number.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601290 13f79535-47bb-0310-9956-ffa450edef68
2014-06-09 00:59:04 +00:00
Yann Ylavic
9f43505e4d mod_proxy: Shutdown (eg. close notify) the backend connection before closing.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1601285 13f79535-47bb-0310-9956-ffa450edef68
2014-06-09 00:23:16 +00:00
Yann Ylavic
f1a9de3123 mod_proxy_http: avoid (unlikely) access to freed memory.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1599486 13f79535-47bb-0310-9956-ffa450edef68
2014-06-03 11:47:11 +00:00
Christophe Jaillet
68b56009d5 Fix computation of the size of 'struct sockaddr_un' when passed to 'connect()'.
Use the same logic as the one in ' in 'proxy_util.c'.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1598946 13f79535-47bb-0310-9956-ffa450edef68
2014-06-01 06:54:15 +00:00
Ruediger Pluem
a902bda003 * Give ap_proxy_post_request as chance to act correctly on the status code
by setting r->status temporarily to access_status. r->status might be
  different than access_status e.g. r->status could be HTTP_OK if e.g. we
  override the error page on the proxy or if the error was not generated
  by the backend itself but by the proxy e.g. a bad gateway.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1597352 13f79535-47bb-0310-9956-ffa450edef68
2014-05-24 20:55:52 +00:00