Do not double encode encoded slashes
In case that AllowEncodedSlashes is set to NoDecode do not double encode
encoded slashes in the URL sent by the reverse proxy to the backend.
* include/ap_mmn.h: Document the addition of ap_proxy_canonenc_ex to the API.
* modules/proxy/mod_proxy.h: Declare ap_proxy_canonenc_ex and define flag
values.
* modules/proxy/proxy_util.c: Implement ap_proxy_canonenc_ex by modifying
ap_proxy_canonenc accordingly and reimplement ap_proxy_canonenc to
use ap_proxy_canonenc_ex with the appropriate flag.
* modules/http2/mod_proxy_http2.c, modules/proxy/mod_proxy_*.c: Set the
correct flag based on the AllowEncodedSlashes configuration and use
ap_proxy_canonenc_ex instead of ap_proxy_canonenc.
* Whitespace fixes. No functional change.
* Fix typo
Reviewed by: rpluem, ylavic, covener
Github: closes#351
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908864 13f79535-47bb-0310-9956-ffa450edef68
* In the reverse proxy case r->filename might contain a query string if
the nocanon option was used with ProxyPass.
If this is the case cut off the query string as the last parameter in
this query string might end up on an extension we take care about, but
we only want to match against path components not against query
parameters.
* Add CHANGES entry for r1907505 [skip ci]
Reviewed By: rpluem, ylavic, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908538 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_hcheck: Honor worker timeout settings.
Daniel reported on user@ that hc connections do not timeout according to
the worker's tumeout= configuration, this fixes it.
While at it, copy the other timeout settings too.
Reported by: dferradal
Submitted By: rpluem
Reviewed By: rpluem, jorton, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906499 13f79535-47bb-0310-9956-ffa450edef68
Allow for HTTP/1.1 or HTTP/1.0 protocol health checks
Document hcmethod enhancement to allow HTTP/1.1 comms
catch by CJ
Bump mmn
bump again
+ suppress MMN changes, applied manually in 1906496
Submitted By: jim
Reviewed By: jim, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906498 13f79535-47bb-0310-9956-ffa450edef68
* Close the connection in case an EOC bucket was seen
* In case we see an EOC bucket and there was an error bucket before, use its
status as status for the request. This should ensure proper status logging
in the access log.
* We need to set r->status on each call after we noticed an EOC as
data bucket generators like ap_die might have changed the status
code. But we know better in this case and insist on the status
code that we have seen in the error bucket.
* Keep track of the number of keepalives we processed on this connection.
* Report a broken backend in case reading the response line failed on the
first request on this connection otherwise we assume we have just run
into a keepalive race and the backend is still healthy.
* Add Changelog for r1899451, r1899454, r1899562, r1899564, r1899584
Submitted by: rpluem
Reviewed by: jim
Github: closes#314
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1900755 13f79535-47bb-0310-9956-ffa450edef68
*) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
an attempt to load a dbm driver fails, log clearly which driver triggered
the error (not "default"), and what the error was.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898590 13f79535-47bb-0310-9956-ffa450edef68
*) mod_proxy: Use the maxium of front end and backend timeouts instead of the
minimum when tunneling requests (websockets, CONNECT requests).
Backend timeouts can be configured more selectively (per worker if needed)
as front end timeouts and typically the backend timeouts reflect the
application requirements better. PR 65886
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898559 13f79535-47bb-0310-9956-ffa450edef68
APR and APU must be at least 1.3 to be able to configure and build httpd 2.4.x.
So remove some osbolete #if in the source code.
- mod_socache_memcache
- mod_authn_dbd
- mod_log_config
- mod_proxy_ftp and proxy-util
Submitted by: jailletc36, jailletc36, jailletc36, jailletc36
Reviewed by: jailletc36, icing, rpluem
Backported by: jailletc36
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898393 13f79535-47bb-0310-9956-ffa450edef68
*) http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications.
trunk patch: http://svn.apache.org/r1895914http://svn.apache.org/r1895921
2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/286.patch
backport PR: https://github.com/apache/httpd/pull/286
+1: ylavic, minfrin, gbechis
mod_proxy: Detect unix: scheme syntax errors at load time.
* modules/proxy/mod_proxy.c(add_pass, add_member, set_proxy_param,
proxysection):
Check return value of ap_proxy_de_socketfy().
* modules/proxy/proxy_util.c(ap_proxy_get_worker_ex):
Check return value of ap_proxy_de_socketfy().
http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications.
The early checks avoid failing the request later on and thus save cycles
for those invalid cases.
Submitted by: ylavic
Reviewed by: ylavic, minfrin, gbechis
Closes#286
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895955 13f79535-47bb-0310-9956-ffa450edef68
- mod_proxy_balancer: add missing spaces in HTML output
- mod_proxy_http: Avoid a double call to apr_table_get()
- mod_ssl: Fix some typo and doxygen issues
[Jean-Frederic Clere]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895943 13f79535-47bb-0310-9956-ffa450edef68
*) core/mod_proxy/mod_ssl:
Adding `outgoing` flag to conn_rec, indicating a connection is
initiated by the server to somewhere, in contrast to incoming
connections from clients.
Adding 'ap_ssl_bind_outgoing()` function that marks a connection
as outgoing and is used by mod_proxy instead of the previous
optional function `ssl_engine_set`. This enables other SSL
module to secure proxy connections.
The optional functions `ssl_engine_set`, `ssl_engine_disable` and
`ssl_proxy_enable` are now provided by the core to have backward
compatibility with non-httpd modules that might use them. mod_ssl
itself no longer registers these functions, but keeps them in its
header for backward compatibility.
The core provided optional function wrap any registered function
like it was done for `ssl_is_ssl`.
*core: clarify comments and use hook API better to check for presence of callbacks.
* optimizing hook check as suggested by Yann.
Submitted by: icing
Reviewed by:
Github: closes#203
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893182 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Don't canonicalize with both nocanon and ProxyPassInterpolateEnv On.
If nocanon is set, we should match the unparsed_uri against the interpolated
alias (not the ProxyPass'ed one) when verifying the resulting length. Otherwise
we falsely restore the canonicalized URL in case of mismatch. PR 65549.
Submitted by: Joel Self <joelself gmail.com>
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893111 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Follow up to r1892814.
* modules/proxy/proxy_util.c(fix_uds_filename):
Sanity checks on the configured UDS path, fail with 500 if invalid since
continuing through proxy processing wouldn't work as expected.
mod_proxy: Follow up to r1892986: APLOGNO()
Stefan get out of this body! :)
Submitted by: ylavic
Reviewed by: rpluem, ylavic, covener
Github: closes#265
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893101 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Fix potential tunneling infinite loop and spurious timeout.
PRs 65521 and 65519.
* modules/proxy/proxy_util.c(ap_proxy_tunnel_run):
Avoid an infinite loop by shutting down the connection for write when poll()
returns POLLHUP and read is already down. PR 65521.
* modules/proxy/proxy_util.c(ap_proxy_tunnel_run):
When write completion is finished don't check for ap_filter_input_pending()
before proxy_tunnel_forward() to flush input data, this is a nonblocking read
already which will do the same thing implicitely. ap_filter_input_pending()
is broken in 2.4.x without the whole pending data mechanism (not backported
yet), so let's align here. PR 65519.
mod_proxy: Follow up to r1892740.
Really remove the old ap_filter_input_pending() handling forgotten by r1892740.
Submitted by: ylavic
Reviewed by: ylavic, covener, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892971 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker.
When the generic "proxy:reverse" worker is selected for an uwsgi scheme, the
worker name is irrelevant so uwscgi_handler() should point to the PATH_INFO
directly from the given URL.
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892875 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Faster unix socket path parsing in the "proxy:" URL.
The actual r->filename format is "[proxy:]unix:path|url" for UDS, no need to
strstr(,"unix:") since it's at the start of the string.
mod_proxy: Follow up to r1892814.
Save some few cycles in ap_proxy_de_socketfy() too.
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892874 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match workers. PR 65419.
We can't truncate ProxyMatch's worker name/url to the first '$' substitution
without possibly colliding with other workers. This also makes the matching
done at runtime by ap_proxy_strcmp_ematch() completely pointless.
To fix this and still address r1878467 (i.e. make http://host:port$1 a "valid"
URL), we need to remove '$' substitutions from the :port part of the URL only
since it's allowed anywhere else by apr_uri_parse().
So let's strip them before apr_uri_parse() and prepend them back in the path
before apr_uri_unparse() to restore the original URL. Non-matchable workers are
not concerned so ap_proxy_define_worker() is made a local helper (w/o the ap_
prefix) which takes "matchable" as argument and can then be called by both
ap_proxy_define_[match_]worker() functions.
mod_proxy: Follow up to r1891206: fix UDS scheme.
mod_proxy: Avoid confusion of prefix/regex matching workers at loading. PR 65429.
ap_proxy_get_worker() needs to know whether it should lookup for prefix or
match or both matching workers, depending on the context.
For instance <Proxy[Match]> or ProxyPass[Match] directives need to lookup for
an existing worker with the same type as the directive (*Match or not), because
they will define one with that matching type if none exists.
On the contrary, "ProxySet <url>" at load time or ap_proxy_pre_request() at run
time need to find a worker matching an url whether it's by prefix or by regex.
So this commit adds ap_proxy_get_worker_ex() which takes a bitmask for the
matching type and calls it appropriately where needed.
For consistency, ap_proxy_define_worker_ex() is also added, using the same
bitmask flags, deprecating ap_proxy_define_match_worker().
Follow up to r1891206.
Github: closes#261
Submitted by: ylavic
Reviewed by: ylavic, minfrin, icing
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892569 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_wstunnel: Add ProxyWebsocketFallbackToProxyHttp.
Allows to opt-out the fallback to mod_proxy_http to handle WebSocket upgrade,
and let mod_proxy_wstunnel handle the requests as in 2.4.46 and earlier.
Update docs.
Follow up to r1889792: CHANGES entry.
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889902 13f79535-47bb-0310-9956-ffa450edef68
r1887337, r1887340, r1887342, r1887343, r1887360, r1887364,
r1887923, r1887965, r1887993, r1888006, r1888083, r1888084,
r1888723, r1888724, r1888726, r1888729, r1889788] from trunk:
*) core/mod_ssl/mod_md:
- adding new ap_ssl_*() functions for a backward
compatible replacement of the major optional mod_ssl functions. This
allows other ssl modules to work without impersonating mod_ssl and
also allows different ssl modules being active on separate ports.
- latest mod_md with support for multiple certificates per domain
and ECDSA certificates. Removed ACMEv1 support.
- Interworking mod_md and ssl modules changed to exchange PEM strings
instead of file paths for ACME challenges.
- core/mod_ssl/mod_md: adding OCSP response provisioning as core feature.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889793 13f79535-47bb-0310-9956-ffa450edef68
