PCRE2 wants an opaque context by providing the API to allocate and free it, so
to minimize these calls we maintain one opaque context per thread (in Thread
Local Storage, TLS) grown as needed, and while at it we do the same for PCRE1
ints vectors. Note that this requires a fast TLS mechanism to be worth it,
which is the case of apr_thread_data_get/set() from/to apr_thread_current()
when APR_HAS_THREAD_LOCAL; otherwise we'll do the allocation and freeing for
each ap_regexec().
The small stack vector is used for PCRE1 && !APR_HAS_THREAD_LOCAL only now.
Follow up to r1897240: APR_HAS_THREAD_LOCAL wants #ifdef instead of #if.
Follow up to r1897240: CHANGES entry.
ap_regex: PCRE needs buffers sized against the number of captures only.
No more (useless), no less (or PCRE will allocate a new buffer by itself to
satisfy the needs), so we should base our buffer size solely on the number
of captures in the regex (determined at compile time from the pattern).
The nmatch provided by the user is used to fill in pmatch only (up to that),
but "our" buffers are sized exactly as needed to avoid oversized allocations
or PCRE allocating by itself.
ap_regex: Follow up to r1897244: Fix pmatch overflow and returned value at limits.
Don't write to pmatch[nlimit:] when ncaps > nmatch, rc should not exceed nmatch
either as before r1897244.
ap_regex: Follow up to r1897240: Fix issues spotted by Rüdiger (thanks!).
#include "apr_thread_proc.h" is enough/needed by util_pcre.c and main.c.
Fix compilation (vector => ovector) for !HAVE_PCRE2 && APR_HAS_THREAD_LOCAL.
Check pcre2_match_data_create() return value for HAVE_PCRE2 && !APR_HAS_THREAD_LOCAL.
ap_regex: Follow up to r1897240: runtime fallback to alloc/free.
Even though APR_HAS_THREAD_LOCAL is compiled in, ap_regexec() might still be
called by non a apr_thread_t thread, let's fall back to alloc/free in this
case too.
ap_regex: Follow up to r1897240: no ap_thread_current() yet.
ap_regex: Follow up to r1897240: cleanups.
ap_regex: Follow up to r1897240: cleanup PCRE2 match data on exit.
ap_regex: Follow up to r1897240: #if APR_HAS_THREAD_LOCAL, not #ifdef.
core: Efficient ap_thread_current() with APR < 1.8.
#define ap_thread_create, ap_thread_current_create and ap_thread_current to
their apr-1.8+ equivalent if available, or implement them using the compiler's
thread_local mechanism if available, or finally provide stubs otherwise.
#define AP_HAS_THREAD_LOCAL to 1 in the two former case or 0 otherwise, while
AP_THREAD_LOCAL is defined to the compiler's keyword iff AP_HAS_THREAD_LOCAL.
Replace all apr_thread_create() calls with ap_thread_create() so that httpd
threads can use ap_thread_current()'s pool data as Thread Local Storage.
Bump MMN minor.
* include/httpd.h():
Define AP_HAS_THREAD_LOCAL, AP_THREAD_LOCAL (eventually), ap_thread_create(),
ap_thread_current_create() and ap_thread_current().
* server/util.c:
Implement ap_thread_create(), ap_thread_current_create() and
ap_thread_current() when APR < 1.8.
* modules/core/mod_watchdog.c, modules/http2/h2_workers.c,
modules/ssl/mod_ssl_ct.c:
Use ap_thread_create() instead of apr_thread_create.
* server/main.c:
Use AP_HAS_THREAD_LOCAL and ap_thread_current_create instead of APR's.
* server/util_pcre.c:
Use AP_HAS_THREAD_LOCAL and ap_thread_current instead of APR's.
* server/mpm/event/event.c, server/mpm/worker/worker.c,
server/mpm/prefork/prefork.c:
Use ap_thread_create() instead of apr_thread_create.
Create an apr_thread_t/ap_thread_current() for the main chaild thread usable
at child_init().
* server/mpm/winnt/child.c:
Use ap_thread_create() instead of CreateThread().
Create an apr_thread_t/ap_thread_current() for the main chaild thread usable
Follow up to r1897460: APLOGNOs.
Follow up to r1897460: !APR_HAS_THREAD implies no ap_thread_* either.
core: Follow up to r1897460: Implement and use ap_thread_current_after_fork().
thread_local variables are not (always?) reset on fork(), so we need a way
to set the current_thread to NULL in the child process.
Implement and use ap_thread_current_after_fork() for that.
* include/httpd.h:
Define ap_thread_current_after_fork().
* server/util.c:
Implement ap_thread_current_after_fork().
* server/mpm/event/event.c, server/mpm/prefork/prefork.c,
server/mpm/worker/worker.c:
Use ap_thread_current_after_fork().
* server/mpm/winnt/child.c:
Windows processes are not fork()ed and each child runs the main(), so
ap_thread_current_create() was already called there.
core: Follow up to r1897460: Provide ap_thread_main_create().
Replace ap_thread_current_create() by ap_thread_main_create() which is how
it's used by httpd. The former is now a local helper only to implement the
latter.
This allows to consolidate/factorize common code in the main() of httpd and
the unix MPMs.
ap_regex: Follow up to r1897240: Fetch the ovector _after_ the match.
Possibly(?) pcre2_match() can modifiy the given pcre2_match_data and invalidate
the old ovector, be safe and fetch it after.
main: Follow up to r1897240: Fix bad log copypasta.
Don't stderr printf the "stat" and "failed" results from the previous
apr_app_initialize() call for an error in ap_thread_main_create().
core: Follow up to r1897240: Opt-out for AP_HAS_THREAD_LOCAL and/or pcre's usage.
If the compiler's thread_local is not efficient enough on some platforms, or
not desired, have a way to disable its usage in httpd (at compile time).
Handle -DAP_NO_THREAD_LOCAL and/or -DAPREG_NO_THREAD_LOCAL as build opt-out for
thread_local usage in httpd gobally and/or in ap_regex only (respectively).
core: Follow up to r1897240: Provide/export ap_thread_current_create()
For completness, and possibly to ease backport to 2.4.x for MPM winnt.
core: Follow up to r1897240 & r1897691: Syntax.
Add compiled and loaded PCRE version numbers
to "httpd -V" output and to mod_info page.
Forgotten file needed for r1612934.
Minor mmn bump due to r1612940.
Backports: r1897240, r1897241, r1897242, r1897244, r1897248, r1897250,
r1897260, r1897261, r1897263, r1897386, r1897459, r1897460,
r1897461, r1897462, r1897472, r1897543, r1897651, r1897680,
r1897689, r1897691, r1897692, r1612934, r1612940, r1613189
Submitted by: ylavic, rjung, rjung, rjung
Reviewed by: ylavic, rpluem, covener, steffenal, wrowe
GH: closes#289 (https://github.com/apache/httpd/pull/289)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898467 13f79535-47bb-0310-9956-ffa450edef68
*) http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications.
trunk patch: http://svn.apache.org/r1895914http://svn.apache.org/r1895921
2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/286.patch
backport PR: https://github.com/apache/httpd/pull/286
+1: ylavic, minfrin, gbechis
mod_proxy: Detect unix: scheme syntax errors at load time.
* modules/proxy/mod_proxy.c(add_pass, add_member, set_proxy_param,
proxysection):
Check return value of ap_proxy_de_socketfy().
* modules/proxy/proxy_util.c(ap_proxy_get_worker_ex):
Check return value of ap_proxy_de_socketfy().
http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications.
The early checks avoid failing the request later on and thus save cycles
for those invalid cases.
Submitted by: ylavic
Reviewed by: ylavic, minfrin, gbechis
Closes#286
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895955 13f79535-47bb-0310-9956-ffa450edef68
- mod_proxy_balancer: add missing spaces in HTML output
- mod_proxy_http: Avoid a double call to apr_table_get()
- mod_ssl: Fix some typo and doxygen issues
[Jean-Frederic Clere]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895943 13f79535-47bb-0310-9956-ffa450edef68
*) mod_dav: Some DAV extensions, like CalDAV, specify both document
elements and property elements that need to be taken into account
when generating a property. The document element and property element
are made available in the dav_liveprop_elem structure by calling
dav_get_liveprop_element(). [Graham Leggett]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895893 13f79535-47bb-0310-9956-ffa450edef68
*) mod_dav: Add utility functions dav_validate_root_ns(),
dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() and
dav_find_attr() so that other modules get to play too.
[Graham Leggett]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895887 13f79535-47bb-0310-9956-ffa450edef68
*) core/mod_proxy/mod_ssl:
Adding `outgoing` flag to conn_rec, indicating a connection is
initiated by the server to somewhere, in contrast to incoming
connections from clients.
Adding 'ap_ssl_bind_outgoing()` function that marks a connection
as outgoing and is used by mod_proxy instead of the previous
optional function `ssl_engine_set`. This enables other SSL
module to secure proxy connections.
The optional functions `ssl_engine_set`, `ssl_engine_disable` and
`ssl_proxy_enable` are now provided by the core to have backward
compatibility with non-httpd modules that might use them. mod_ssl
itself no longer registers these functions, but keeps them in its
header for backward compatibility.
The core provided optional function wrap any registered function
like it was done for `ssl_is_ssl`.
*core: clarify comments and use hook API better to check for presence of callbacks.
* optimizing hook check as suggested by Yann.
Submitted by: icing
Reviewed by:
Github: closes#203
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893182 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match workers. PR 65419.
We can't truncate ProxyMatch's worker name/url to the first '$' substitution
without possibly colliding with other workers. This also makes the matching
done at runtime by ap_proxy_strcmp_ematch() completely pointless.
To fix this and still address r1878467 (i.e. make http://host:port$1 a "valid"
URL), we need to remove '$' substitutions from the :port part of the URL only
since it's allowed anywhere else by apr_uri_parse().
So let's strip them before apr_uri_parse() and prepend them back in the path
before apr_uri_unparse() to restore the original URL. Non-matchable workers are
not concerned so ap_proxy_define_worker() is made a local helper (w/o the ap_
prefix) which takes "matchable" as argument and can then be called by both
ap_proxy_define_[match_]worker() functions.
mod_proxy: Follow up to r1891206: fix UDS scheme.
mod_proxy: Avoid confusion of prefix/regex matching workers at loading. PR 65429.
ap_proxy_get_worker() needs to know whether it should lookup for prefix or
match or both matching workers, depending on the context.
For instance <Proxy[Match]> or ProxyPass[Match] directives need to lookup for
an existing worker with the same type as the directive (*Match or not), because
they will define one with that matching type if none exists.
On the contrary, "ProxySet <url>" at load time or ap_proxy_pre_request() at run
time need to find a worker matching an url whether it's by prefix or by regex.
So this commit adds ap_proxy_get_worker_ex() which takes a bitmask for the
matching type and calls it appropriately where needed.
For consistency, ap_proxy_define_worker_ex() is also added, using the same
bitmask flags, deprecating ap_proxy_define_match_worker().
Follow up to r1891206.
Github: closes#261
Submitted by: ylavic
Reviewed by: ylavic, minfrin, icing
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892569 13f79535-47bb-0310-9956-ffa450edef68
*) core: add hook child_stopping hook that gets called when the MPM is stopping a
child process. The additional graceful parameter allows registered hooks
to free resources early during a graceful shutdown.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892167 13f79535-47bb-0310-9956-ffa450edef68
r1887337, r1887340, r1887342, r1887343, r1887360, r1887364,
r1887923, r1887965, r1887993, r1888006, r1888083, r1888084,
r1888723, r1888724, r1888726, r1888729, r1889788] from trunk:
*) core/mod_ssl/mod_md:
- adding new ap_ssl_*() functions for a backward
compatible replacement of the major optional mod_ssl functions. This
allows other ssl modules to work without impersonating mod_ssl and
also allows different ssl modules being active on separate ports.
- latest mod_md with support for multiple certificates per domain
and ECDSA certificates. Removed ACMEv1 support.
- Interworking mod_md and ssl modules changed to exchange PEM strings
instead of file paths for ACME challenges.
- core/mod_ssl/mod_md: adding OCSP response provisioning as core feature.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889793 13f79535-47bb-0310-9956-ffa450edef68
"[mod_dav_fs etag handling] should really honor the FileETag setting".
- It now does.
- Add "Digest" to FileETag directive, allowing a strong ETag to be
generated using a file digest.
- Add ap_make_etag_ex() and ap_set_etag_fd() to allow full control over
ETag generation.
- Add concept of "binary notes" to request_rec, allowing packed bit flags
to be added to a request.
- First binary note - AP_REQUEST_STRONG_ETAG - allows modules to force
the ETag to a strong ETag to comply with RFC requirements, such as those
mandated by various WebDAV extensions.
Be defensive when the request is missing.
Remove tabs.
Use a dedicated constant for the base64 sha1 length.
Be defensive when calculating the digest. Make sure the offset is initialised
to zero before reading the current offset.
Seek to the start of the file when calculating the ETag.
Add log numbers to util_etag.c.
Add MMAP support to ETag generation.
Use a brigade instead of direct reads, allow APR to handle MMAP.
Bump the logno.
Submitted by: minfrin
Reviewed by: minfrin, jim, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1887384 13f79535-47bb-0310-9956-ffa450edef68
let wstunnel run first
Since wstunnel can step aside based on the Upgrade: header.
mod_proxy: Add proxy check_trans hook.
This allows proxy modules to decline request handling at early stage.
Then mod_proxy_wstunnel can implement that hook to verify that an Upgrade
is requested, and otherwise hand over to mod_proxy_http.
Submitted by: covener, ylavic
Reviewed by: jim, rpluem, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1883534 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: add ap_proxy_define_match_worker() and use it for ProxyPassMatch
and ProxyMatch section to distinguish between normal workers and workers
with regex substitutions in the name. Implement handling of such workers
in ap_proxy_get_worker(). PR 43513
mod_proxy: better check for worker->s->is_name_matchable
Return a match whenever we get to the end of the worker name, regardless
of whether there is URL left.
ProxyPassMatch had been using the default worker in trunk.
Follow up to r1609680: simpler/faster ap_proxy_strcmp_ematch().
No functional change.
Follow up to r1609680: further simplify/optimize ap_proxy_strcmp_ematch().
While at it, same treatment for its mother ap_strcmp_match().
make sure the $n of the regular expressions is not included the name of the worker.
for example, the example:
ProxyPassMatch "^(/.*\.gif)$" "http://backend.example.com:8000$1"
was giving:
AH00526: Syntax error on line nnn of bla/conf/httpd.conf:
ProxyPass Unable to parse URL: http://backend.example.com:8000$1
ap_proxy_define_match_worker: don't copy the url unnecessarily.
And save a few cycles, when the duplication is needed, by not copying
the ignored part.
ap_proxy_define_match_worker: disable connection reuse by default.
To avoid compat issues with dns/connection reuse now that a worker with
dollar substitution can be elected.
CHANGES entry for ap_proxy_define_match_worker().
Oups, axe spurious copypasta.
mod_proxy: unfail mixed ProxyPass/<Proxy> and ProxyPassMatch/<ProxyMatch>.
It is not a failure in current 2.4.x, so to ease backport and to avoid compat
breakage simply warn about the second directive being ignored.
This commit can be reverted in trunk if we want next versions to fail in this
case.
[Reverted by r1879363]
Submitted by: jkaluza, covener, ylavic, ylavic, jfclere, ylavic, ylavic, ylavic, ylavic, ylavic
Reviewed by: ylavic, minfrin (with an MMN bump), jim (agree w/ minfrin)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1880772 13f79535-47bb-0310-9956-ffa450edef68
