*) http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications.
trunk patch: http://svn.apache.org/r1895914http://svn.apache.org/r1895921
2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/286.patch
backport PR: https://github.com/apache/httpd/pull/286
+1: ylavic, minfrin, gbechis
mod_proxy: Detect unix: scheme syntax errors at load time.
* modules/proxy/mod_proxy.c(add_pass, add_member, set_proxy_param,
proxysection):
Check return value of ap_proxy_de_socketfy().
* modules/proxy/proxy_util.c(ap_proxy_get_worker_ex):
Check return value of ap_proxy_de_socketfy().
http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications.
The early checks avoid failing the request later on and thus save cycles
for those invalid cases.
Submitted by: ylavic
Reviewed by: ylavic, minfrin, gbechis
Closes#286
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895955 13f79535-47bb-0310-9956-ffa450edef68
- mod_proxy_balancer: add missing spaces in HTML output
- mod_proxy_http: Avoid a double call to apr_table_get()
- mod_ssl: Fix some typo and doxygen issues
[Jean-Frederic Clere]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895943 13f79535-47bb-0310-9956-ffa450edef68
*) core/mod_proxy/mod_ssl:
Adding `outgoing` flag to conn_rec, indicating a connection is
initiated by the server to somewhere, in contrast to incoming
connections from clients.
Adding 'ap_ssl_bind_outgoing()` function that marks a connection
as outgoing and is used by mod_proxy instead of the previous
optional function `ssl_engine_set`. This enables other SSL
module to secure proxy connections.
The optional functions `ssl_engine_set`, `ssl_engine_disable` and
`ssl_proxy_enable` are now provided by the core to have backward
compatibility with non-httpd modules that might use them. mod_ssl
itself no longer registers these functions, but keeps them in its
header for backward compatibility.
The core provided optional function wrap any registered function
like it was done for `ssl_is_ssl`.
*core: clarify comments and use hook API better to check for presence of callbacks.
* optimizing hook check as suggested by Yann.
Submitted by: icing
Reviewed by:
Github: closes#203
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893182 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Don't canonicalize with both nocanon and ProxyPassInterpolateEnv On.
If nocanon is set, we should match the unparsed_uri against the interpolated
alias (not the ProxyPass'ed one) when verifying the resulting length. Otherwise
we falsely restore the canonicalized URL in case of mismatch. PR 65549.
Submitted by: Joel Self <joelself gmail.com>
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893111 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Follow up to r1892814.
* modules/proxy/proxy_util.c(fix_uds_filename):
Sanity checks on the configured UDS path, fail with 500 if invalid since
continuing through proxy processing wouldn't work as expected.
mod_proxy: Follow up to r1892986: APLOGNO()
Stefan get out of this body! :)
Submitted by: ylavic
Reviewed by: rpluem, ylavic, covener
Github: closes#265
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893101 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Fix potential tunneling infinite loop and spurious timeout.
PRs 65521 and 65519.
* modules/proxy/proxy_util.c(ap_proxy_tunnel_run):
Avoid an infinite loop by shutting down the connection for write when poll()
returns POLLHUP and read is already down. PR 65521.
* modules/proxy/proxy_util.c(ap_proxy_tunnel_run):
When write completion is finished don't check for ap_filter_input_pending()
before proxy_tunnel_forward() to flush input data, this is a nonblocking read
already which will do the same thing implicitely. ap_filter_input_pending()
is broken in 2.4.x without the whole pending data mechanism (not backported
yet), so let's align here. PR 65519.
mod_proxy: Follow up to r1892740.
Really remove the old ap_filter_input_pending() handling forgotten by r1892740.
Submitted by: ylavic
Reviewed by: ylavic, covener, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892971 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker.
When the generic "proxy:reverse" worker is selected for an uwsgi scheme, the
worker name is irrelevant so uwscgi_handler() should point to the PATH_INFO
directly from the given URL.
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892875 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Faster unix socket path parsing in the "proxy:" URL.
The actual r->filename format is "[proxy:]unix:path|url" for UDS, no need to
strstr(,"unix:") since it's at the start of the string.
mod_proxy: Follow up to r1892814.
Save some few cycles in ap_proxy_de_socketfy() too.
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892874 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match workers. PR 65419.
We can't truncate ProxyMatch's worker name/url to the first '$' substitution
without possibly colliding with other workers. This also makes the matching
done at runtime by ap_proxy_strcmp_ematch() completely pointless.
To fix this and still address r1878467 (i.e. make http://host:port$1 a "valid"
URL), we need to remove '$' substitutions from the :port part of the URL only
since it's allowed anywhere else by apr_uri_parse().
So let's strip them before apr_uri_parse() and prepend them back in the path
before apr_uri_unparse() to restore the original URL. Non-matchable workers are
not concerned so ap_proxy_define_worker() is made a local helper (w/o the ap_
prefix) which takes "matchable" as argument and can then be called by both
ap_proxy_define_[match_]worker() functions.
mod_proxy: Follow up to r1891206: fix UDS scheme.
mod_proxy: Avoid confusion of prefix/regex matching workers at loading. PR 65429.
ap_proxy_get_worker() needs to know whether it should lookup for prefix or
match or both matching workers, depending on the context.
For instance <Proxy[Match]> or ProxyPass[Match] directives need to lookup for
an existing worker with the same type as the directive (*Match or not), because
they will define one with that matching type if none exists.
On the contrary, "ProxySet <url>" at load time or ap_proxy_pre_request() at run
time need to find a worker matching an url whether it's by prefix or by regex.
So this commit adds ap_proxy_get_worker_ex() which takes a bitmask for the
matching type and calls it appropriately where needed.
For consistency, ap_proxy_define_worker_ex() is also added, using the same
bitmask flags, deprecating ap_proxy_define_match_worker().
Follow up to r1891206.
Github: closes#261
Submitted by: ylavic
Reviewed by: ylavic, minfrin, icing
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892569 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_wstunnel: Add ProxyWebsocketFallbackToProxyHttp.
Allows to opt-out the fallback to mod_proxy_http to handle WebSocket upgrade,
and let mod_proxy_wstunnel handle the requests as in 2.4.46 and earlier.
Update docs.
Follow up to r1889792: CHANGES entry.
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889902 13f79535-47bb-0310-9956-ffa450edef68
r1887337, r1887340, r1887342, r1887343, r1887360, r1887364,
r1887923, r1887965, r1887993, r1888006, r1888083, r1888084,
r1888723, r1888724, r1888726, r1888729, r1889788] from trunk:
*) core/mod_ssl/mod_md:
- adding new ap_ssl_*() functions for a backward
compatible replacement of the major optional mod_ssl functions. This
allows other ssl modules to work without impersonating mod_ssl and
also allows different ssl modules being active on separate ports.
- latest mod_md with support for multiple certificates per domain
and ECDSA certificates. Removed ACMEv1 support.
- Interworking mod_md and ssl modules changed to exchange PEM strings
instead of file paths for ACME challenges.
- core/mod_ssl/mod_md: adding OCSP response provisioning as core feature.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889793 13f79535-47bb-0310-9956-ffa450edef68
* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response): Clear any
possible returned buckets in the brigade in the error case. As we want to
close the connection anyway there is no sensible content we could still
sent and hence doing the needed life time transformation of the buckets
would be a waste.
PR: 64234
Submitted by: rpluem
Reviewed by: ylavic, jorton, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1887378 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_hcheck: don't pile up health checks. PR 63010.
Prevent health checks from running for a worker until the last one is fully
finished, to avoid making things worse (memory growth, #connections, ..).
This is done by zeroing worker->s->updated before scheduling the worker in the
threadpool, and resetting the time when it's finished. The scheduler then does
nothing if worker->s->updated is zero.
Also, to save some apr_time_now() calls when !HC_USE_THREADS, *baton->now is
updated in the callback and reused by the scheduler.
Submitted by: ylavic
Reviewed by: ylavic, covener, icing
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1887119 13f79535-47bb-0310-9956-ffa450edef68
* We need to check for (!scheme && (u = strchr(url, ':')) && (u - url) > 14)
later as (!scheme || u[0] != '/' || u[1] != '/' || u[2] == '\0') is true
for requests with the CONNECT method which we need to decline. But in many
cases requests with the CONNECT method have (u - url) > 14 as in this
case (u - url) is the length of the FQDN the forward proxy should connect
to.
mod_proxy_http: follow up to r1886141, axe overlong scheme check.
Since mod_proxy can see CONNECT URIs, "hostname:port" versus "scheme:"
is hardly distinguishable (we don't want to limit the length of hostnames),
and we don't allocate the scheme anymore while parsing, let's simply decline
unrecognized schemes (overlong or not) and be caught by the no-handler case
if there really is no proxy handler interested.
Submitted by: rpluem, ylavic
Reviewed by: ylavic, covener, icing
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1887118 13f79535-47bb-0310-9956-ffa450edef68
* If we face a timeout during receiving the response from the backend and if
we pinged it successfully before don't assume the whole backend has failed.
Assume that only the request has failed and return a gateway timeout then.
Add failontimeout to allow server admin to mark balancer member in err if IO timeout occurs.
ping tuning via Yann Ylavic <ylavic.dev@gmail.com>
Use 'apr_table_setn' instead of 'apr_table_set' when possible in order to save memory.
mod_proxy: axe negative "ping" parameter setting and handling.
This used to check for the backend connection readability only (instead of
the full ping/100-continue round-trip), but the case is already handled by
ap_proxy_connect_backend() which is always called.
Submitted by: rpluem, druggeri, jim, jailletc36, ylavic
Reviewed by: rpluem, ylavic, icing
Github: closes#170
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1887116 13f79535-47bb-0310-9956-ffa450edef68
* When ap_cstr_casecmp[n] have been introduced, in r1747469, it has
introduced many differences between 2.4.x and trunk.
Direct backporting was not that easy because:
- it was initialy introduced as ap_casecmpstr[n] with several patches
- it touched some files that were not in 2.4.x branch
Later, parts of it have already been backported.
This patch tries to clean all this.
Submitted by: many people
Reviewed by: jailletc36, minfrin, ylavic
Backported by: jailletc36
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1885697 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: pconf vs pchild consistency, and correctness in ONE_PROCESS mode.
Consistently use pconf for ap_proxy_define_{worker,balancer}() and pchild for
ap_proxu_initialize_{worker,balancer}() in mod_proxy [child_]init code.
pchild is needed in _initialize() for mutexes/shms' child_init and cleanup,
and to avoid a crash on shutdown (i.e. ap_terminate) in ONE_PROCESS mode,
where worker->cp->pool is destroyed twice, let's register conn_pool_cleanup()
as a pre_cleanup of pchild.
Submitted by: ylavic
Reviewed by: ylavic, jorton, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1885141 13f79535-47bb-0310-9956-ffa450edef68
let wstunnel run first
Since wstunnel can step aside based on the Upgrade: header.
mod_proxy: Add proxy check_trans hook.
This allows proxy modules to decline request handling at early stage.
Then mod_proxy_wstunnel can implement that hook to verify that an Upgrade
is requested, and otherwise hand over to mod_proxy_http.
Submitted by: covener, ylavic
Reviewed by: jim, rpluem, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1883534 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: add ap_proxy_define_match_worker() and use it for ProxyPassMatch
and ProxyMatch section to distinguish between normal workers and workers
with regex substitutions in the name. Implement handling of such workers
in ap_proxy_get_worker(). PR 43513
mod_proxy: better check for worker->s->is_name_matchable
Return a match whenever we get to the end of the worker name, regardless
of whether there is URL left.
ProxyPassMatch had been using the default worker in trunk.
Follow up to r1609680: simpler/faster ap_proxy_strcmp_ematch().
No functional change.
Follow up to r1609680: further simplify/optimize ap_proxy_strcmp_ematch().
While at it, same treatment for its mother ap_strcmp_match().
make sure the $n of the regular expressions is not included the name of the worker.
for example, the example:
ProxyPassMatch "^(/.*\.gif)$" "http://backend.example.com:8000$1"
was giving:
AH00526: Syntax error on line nnn of bla/conf/httpd.conf:
ProxyPass Unable to parse URL: http://backend.example.com:8000$1
ap_proxy_define_match_worker: don't copy the url unnecessarily.
And save a few cycles, when the duplication is needed, by not copying
the ignored part.
ap_proxy_define_match_worker: disable connection reuse by default.
To avoid compat issues with dns/connection reuse now that a worker with
dollar substitution can be elected.
CHANGES entry for ap_proxy_define_match_worker().
Oups, axe spurious copypasta.
mod_proxy: unfail mixed ProxyPass/<Proxy> and ProxyPassMatch/<ProxyMatch>.
It is not a failure in current 2.4.x, so to ease backport and to avoid compat
breakage simply warn about the second directive being ignored.
This commit can be reverted in trunk if we want next versions to fail in this
case.
[Reverted by r1879363]
Submitted by: jkaluza, covener, ylavic, ylavic, jfclere, ylavic, ylavic, ylavic, ylavic, ylavic
Reviewed by: ylavic, minfrin (with an MMN bump), jim (agree w/ minfrin)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1880772 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_uwsgi: Error out on HTTP header larger than 16K
The uwsgi protocol does not let us serialize more than 16K of HTTP header,
so fail early with 500 if it happens.
Follow up to r1880205, APLOGNO().
Submitted by: ylavic
Reviewed by: ylavic, covener, icing
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1880251 13f79535-47bb-0310-9956-ffa450edef68
Easy patches: synch 2.4.x and trunk
- core: Re-introduce check for sufficient PCRE version.
- core: Fix doc string for QualifyRedirectURL
- mod_proxy: really return an error message on invalid "flusher" value.
- mod_http2: Remove extra and un-needed ""
- mod_ldap: fix a (unlikely) memory leak
- ab: fix a typo
- suexec: Report error string after failure from setgid/initgroups or setuid
- mod_session_crypto: be less specific and don't echo passphrase
- mod_proxy_html: Fix proxy_html_conf.bufsz to have correct type, as
it is used with ap_set_int_slot.
- mod_md: update duplicated APLOGNOs.
Submitted by: fuankg, trawick, ylavic, jailletc36, jorton, jailletc36, jorton, covener, jorton, ylavic
Reviewed by: jailletc36, jim, ylavic
Backported by: jailletc36
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1879490 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_http: don't strip EOS when spooling request body to file.
To prevent stream_reqbody() from sending the FILE and FLUSH bucket in separate
brigades, and thus apr_file_setaside() to trigger if network congestion occurs
with the backend, restore the EOS in spool_reqbody_cl() which was stripped
when spooling the request body to a file.
Until APR r1878279 is released (and installed by users), apr_file_setaside()
on a temporary file (mktemp) will simply drop the file cleanup, leaking the
fd and inode..
This fixes BZ 64452.
Submitted by: ylavic
Reviewed by: ylavic, jorton, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1879226 13f79535-47bb-0310-9956-ffa450edef68
don't ignore some apr_procattr failures (clang scan-build)
doxygen improvements
Standardize order of "extern" and XXX_DECLARE_YYY.
Fix some compilation warning when MIME_MAGIC_DEBUG is defined.
warning: format ‘%x’ expects argument of type ‘unsigned int’, but argument <n> has type ‘<something> *’ [-Wformat=]
style: cmd_rec at the bottom
no functional change
Fix a typo in a message.
Reported and fixed by Christian Bartolomäus (bartolin gmx.de)
PR 63806
malloc -> ap_malloc
bz #63967
Slighly simplify code.
No need to set to NULL or 0 fields that are apr_pcalloc'ed.
Axe 'set_cookie_enable' and use 'ap_set_flag_slot' instead.
(based on ideas taken from r1874389)
Parentheses around AP_BUCKET_IS_EOR argument.
Fix a typo
Submitted by: trawick, rjung, jailletc36, covener, jailletc36, gbechis, jailletc36, ylavic, jailletc36
Reviewed by: jailletc36, gbechis, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1876885 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_http: fix load-balancer fallback for requests with a body.
Since r1656259 (or r1656259 in 2.4.41) and the move of prefetch before connect,
the balancer fallback case where proxy_http_handler() is re-entered with the
next balancer member broke.
We need to save the body (partially) prefetched the first time and reuse it on
successive calls, otherwise we might forward partial or empty body.
mod_proxy_http: follow up to r1869216.
Let's call stream_reqbody() for all rb_methods, no RB_SPOOL_CL special case.
This both simplifies code and allows to keep EOS into the input_brigade until
it's sent, and thus detect whether we already fetched the whole body if/when
proxy_http_handler() re-enters for different balancer members.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1875111 13f79535-47bb-0310-9956-ffa450edef68
to implement legacy AJP13 authentication. PR 53098.
The attribute is now suggested/required by tomcat.
Backport of r1738878 from trunk.
Backported by: covener
Reviewed by: covener, jorton, rjung
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1874456 13f79535-47bb-0310-9956-ffa450edef68
