1
0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00

230 Commits

Author SHA1 Message Date
Ruediger Pluem
3917af2aed * Fully backport r1913019 and leave it to r1913023 to include it conditionally.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913027 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 13:39:41 +00:00
Stefan Eissing
86fde0f8fd Merge of /httpd/httpd/trunk:r1913023
* modules/http2: Make WebSockets support conditional also
 on APR 1.7.x since apr_encode.h is required. Restore
 #include "apr_encode.h" removed in previous commit.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913024 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 13:21:37 +00:00
Stefan Eissing
c90c542986 * modules/http2/h2_session.c (h2_session_start):
Restrict WebSockets options handling to with-WS builds.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913020 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 12:43:44 +00:00
Joe Orton
3c6caeb2dc Merge r1913007 from trunk: [RTC exception for APLOGNO]
* modules/http2: Fill in APLOGNO.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913014 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 11:49:09 +00:00
Stefan Eissing
b763f5f4e8 Merge of /httpd/httpd/trunk:r1913005
*) mod_http2: enable WebSockets only when compiling against a
     recent enought nghttp2 version.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913006 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 11:11:45 +00:00
Stefan Eissing
decce82a70 Merge of /httpd/httpd/trunk:r1912999
* mod_http2: improved early cleanup of streams.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913000 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 09:05:00 +00:00
Stefan Eissing
582c533c17 Merge of 1912385 from trunk:
*) mod_http2: fixed a bug in handling of stream timeouts.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1912991 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 06:18:54 +00:00
Stefan Eissing
952cc27cad Merge of 1912415 from trunk:
mod_http2: fixed a compile time issue on Windows builds.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1912989 13f79535-47bb-0310-9956-ffa450edef68
2023-10-16 06:11:19 +00:00
Stefan Eissing
d7f0c6d189 Merge of /httpd/httpd/trunk:r1912180
*) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
     Fixes PR66752.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1912194 13f79535-47bb-0310-9956-ffa450edef68
2023-09-08 13:23:00 +00:00
Stefan Eissing
c18c18161b Merge of /httpd/httpd/trunk:r1911964
*) mod_proxy_http2: improved error handling on connection errors while
     response is already underway.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1912193 13f79535-47bb-0310-9956-ffa450edef68
2023-09-08 13:18:58 +00:00
Stefan Eissing
64c420f52a mod_http2: update version that has become v2.0.22 in github release
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1911981 13f79535-47bb-0310-9956-ffa450edef68
2023-08-29 07:46:03 +00:00
Stefan Eissing
0d1d79b020 Merge from trunk:
*) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
     described in RFC 8441. A new directive 'H2WebSockets on|off' has been
     added. The feature is by default not enabled.
     As also discussed in the manual, this feature should work for setups
     using "ProxyPass backend-url upgrade=websocket" without further changes.
     Special server modules for WebSockets will have to be adapted,
     most likely, as the handling if IO events is different with HTTP/2.
     HTTP/2 WebSockets are supported on platforms with native pipes. This
     excludes Windows.
     New directive `H2ProxyRequests on|off` to enable handling
     of HTTP/2 requests in a forward proxy configuration.
     General forward proxying is enabled via `ProxyRequests`. If the
     HTTP/2 protocol is also enabled for such a server/host, this new
     directive is needed in addition.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1911979 13f79535-47bb-0310-9956-ffa450edef68
2023-08-29 07:23:10 +00:00
Stefan Eissing
c973637478 Merge r1911291 from trunk:
*) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
     HTTP/2 requests twice. Fixes PR 66801.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1911858 13f79535-47bb-0310-9956-ffa450edef68
2023-08-23 07:52:33 +00:00
Joe Orton
ff558f52f5 Merge r1908502 from trunk:
mod_http2: Fix memory leak in calc_sha256_hash().
Submitted by: ylavic
Reviewed by: icing, jorton, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910854 13f79535-47bb-0310-9956-ffa450edef68
2023-07-07 12:04:17 +00:00
Stefan Eissing
06ceb22deb backport of https://github.com/apache/httpd/pull/364
Merge 1907696,1907697 from trunk:

  *) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
     amount of response body bytes put into a single HTTP/2 DATA frame.
     Setting this to 0 places no limit (but the max size allowed by the
     protocol is observed).
     The module, by default, tries to use the maximum size possible, which is
     somewhat around 16KB. This sets the maximum. When less response data is
     available, smaller frames will be sent.

Merge r1909769 from trunk (plus sync mod_http2.xml)

  *) mod_http2: v2.0.15 with the following fixes and improvements
     - New directive 'H2EarlyHint name value' to add headers to a response,
       picked up already when a "103 Early Hints" response is sent. 'name' and
       'value' must comply to the HTTP field restrictions.
       This directive can be repeated several times and header fields of the
       same names add. Sending a 'Link' header with 'preload' relation will
       also cause a HTTP/2 PUSH if enabled and supported by the client.
     - Fixed an issue where requests were not logged and accounted in a timely
       fashion when the connection returns to "keepalive" handling, e.g. when
       the request served was the last outstanding one.
       This led to late appearance in access logs with wrong duration times
       reported.
     - Accurately report the bytes sent for a request in the '%O' Log format.
       This addresses #203, a long outstanding issue where mod_h2 has reported
       numbers over-eagerly from internal buffering and not what has actually
       been placed on the connection.
       The numbers are now the same with and without H2CopyFiles enabled.

Merge r1910157 from trunk

 * mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
   connection when sending data on the frontend one. This caused crashes
   or infinite loops in rare situations.
 * mod_proxy_http2: fixed a bug in retry/response handling that could lead
   to wrong status codes or HTTP messages send at the end of response bodies
   exceeding the announced content-length.
 * mod_proxy_http2: fix retry handling to not leak temporary errors.
   On detecting that that an existing connection was shutdown by the other
   side, a 503 response leaked even though the request was retried on a
   fresh connection.
 * mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
   the wrong order when a bucket_beam was destroyed.

Merge of 1910331,1910386,1910441 from trunk

  *) mod_http2: fixed a bug in flushing pending data on an already closed
     connection that could lead to a busy loop, preventing the HTTP/2 session
     to close down successfully. Fixed PR 66624.
     Fixed a bug that could lead to a crash in main connection
     output handling. This occured only when the last request on a HTTP/2
     connection had been processed and the session decided to shut down.
     This could lead to an attempt to send a final GOAWAY while the previous
     write was still in progress. See PR 66646.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910699 13f79535-47bb-0310-9956-ffa450edef68
2023-06-30 07:22:40 +00:00
Stefan Eissing
7dd0de2c6d Merge of 1909932,1909982 from trunk
*) mod_http2: avoid double chunked-encoding on internal redirects.
     PR 66597 [Yann Ylavic, Stefan Eissing]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910501 13f79535-47bb-0310-9956-ffa450edef68
2023-06-20 10:47:27 +00:00
Stefan Eissing
bf1556ed1b Merge r1909989 from trunk:
*) mod_proxy_http2: fix retry handling to not leak temporary errors.
     On detecting that that an existing connection was shutdown by the other
     side, a 503 response leaked even though the request was retried on a
     fresh connection.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1909992 13f79535-47bb-0310-9956-ffa450edef68
2023-05-22 14:18:14 +00:00
Ruediger Pluem
fd92481223 Merge r1908827, r1908838 from trunk:
mod_proxy: Check for space/ctrls in nocanon path/urls before forwarding.



Follow up to r1908827: CHANGES entry.
Submitted by: ylavic
Reviewed by: ylavic, rpluem, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908865 13f79535-47bb-0310-9956-ffa450edef68
2023-03-31 14:37:07 +00:00
Ruediger Pluem
9b8cf1746b Merge r1908341, r1908628, r1908629 from trunk:
Do not double encode encoded slashes

In case that AllowEncodedSlashes is set to NoDecode do not double encode
encoded slashes in the URL sent by the reverse proxy to the backend.

* include/ap_mmn.h: Document the addition of ap_proxy_canonenc_ex to the API.

* modules/proxy/mod_proxy.h: Declare ap_proxy_canonenc_ex and define flag
      values.

* modules/proxy/proxy_util.c: Implement ap_proxy_canonenc_ex by modifying
      ap_proxy_canonenc accordingly and reimplement ap_proxy_canonenc to
      use ap_proxy_canonenc_ex with the appropriate flag.

* modules/http2/mod_proxy_http2.c, modules/proxy/mod_proxy_*.c: Set the
      correct flag based on the AllowEncodedSlashes configuration and use
      ap_proxy_canonenc_ex instead of ap_proxy_canonenc.


* Whitespace fixes. No functional change.

* Fix typo

Reviewed by: rpluem, ylavic, covener

Github: closes #351


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908864 13f79535-47bb-0310-9956-ffa450edef68
2023-03-31 14:33:00 +00:00
Stefan Eissing
cd2312bdb6 Merge r1908691 from trunk:
*) mod_http2: fixed a crash during connection termination. See PR 66539.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908852 13f79535-47bb-0310-9956-ffa450edef68
2023-03-31 12:04:33 +00:00
Eric Covener
a356fdbfb9 Merge r1908302 from trunk:
move B=xx example to the bottom

show example with quoted flags and a space


Reviewed By: ylavic, rpluem, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908536 13f79535-47bb-0310-9956-ffa450edef68
2023-03-19 21:29:58 +00:00
Ruediger Pluem
8b93a6512f Merge r1908116 from trunk:
* modules/http2/mod_proxy_http2.c: Fix missing APLOGNO.

Submitted by: jorton
Reviewed by: rpluem

Note: mod_proxy_http2 is CTR on 2.4.x.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908118 13f79535-47bb-0310-9956-ffa450edef68
2023-03-06 10:00:09 +00:00
Eric Covener
8789f6bb92 Merge r1908095 from trunk:
don't forward invalid query strings

    Submitted by: rpluem

Reviewed By:  covener, fielding, rpluem, gbechis



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908096 13f79535-47bb-0310-9956-ffa450edef68
2023-03-05 20:28:43 +00:00
Stefan Eissing
3562db01e3 Merge of r1906775 from trunk:
*) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
     reported in access logs and error documents. The processing of the
     reset was correct, only unneccesary reporting was caused.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906806 13f79535-47bb-0310-9956-ffa450edef68
2023-01-19 16:01:46 +00:00
Stefan Eissing
51484e5d8f Merge of httpd/httpd/trunk:r1906051
*) mod_proxy_http2: apply the standard httpd content type handling
     to responses from the backend, as other proxy modules do. Fixes PR 66391.
     Thanks to Jérôme Billiras for providing the patch.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906476 13f79535-47bb-0310-9956-ffa450edef68
2023-01-09 07:47:29 +00:00
Stefan Eissing
9767274b88 *) mod_http2: version 2.0.10 of the module, synchronizing changes
with the gitgub version. This is a partial rewrite of how connections
     and streams are handled.
     - an APR pollset and pipes (where supported) are used to monitor
       the main connection and react to IO for request/response handling.
       This replaces the stuttered timed waits of earlier versions.
     - H2SerializeHeaders directive still exists, but has no longer an effect.
     - Clients that seemingly misbehave still get less resources allocated,
       but ongoing requests are no longer disrupted.
     - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
       were overwritten instead of preserved. [PR by @daum3ns]
     - A regression in v1.15.24 was fixed that could lead to httpd child
       processes not being terminated on a graceful reload or when reaching
       MaxConnectionsPerChild. When unprocessed h2 requests were queued at
       the time, these could stall. See #212.
     - Improved information displayed in 'server-status' for H2 connections when
       Extended Status is enabled. Now one can see the last request that IO
       operations happened on and transferred IO stats are updated as well.
     - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
       send a GOAWAY frame much too early on new connections, leading to invalid
       protocol state and a client failing the request. See PR65731 at
       <https://bz.apache.org/bugzilla/show_bug.cgi?id=65731>.
       The module now initializes the HTTP/2 protocol correctly and allows the
       client to submit one request before the shutdown via a GOAWAY frame
       is being announced.
     - :scheme pseudo-header values, not matching the
       connection scheme, are forwarded via absolute uris to the
       http protocol processing to preserve semantics of the request.
       Checks on combinations of pseudo-headers values/absence
       have been added as described in RFC 7540. Fixes #230.
     - A bug that prevented trailers (e.g. HEADER frame at the end) to be
       generated in certain cases was fixed. See #233 where it prevented
       gRPC responses to be properly generated.
     - Request and response header values are automatically stripped of leading
       and trialing space/tab characters. This is equivalent behaviour to what
       Apache httpd's http/1.1 parser does.
       The checks for this in nghttp2 v1.50.0+ are disabled.
     - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
       on the v2.0.x versions for stability. Many thanks!

  *) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
     request ':authority' is known. Improved test case that did not catch that
     the previous 'fix' was incorrect.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906475 13f79535-47bb-0310-9956-ffa450edef68
2023-01-09 07:35:18 +00:00
Jim Jagielski
a7b9ab822f Merge r1900356 from trunk:
*) mod_http2: remove unused and insecure code. Fixes PR66037.
     Thanks to Ronald Crane (Zippenhop LLC) for reporting this.


Submitted by: icing
Reviewed by: jailletc36, icing, rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1901010 13f79535-47bb-0310-9956-ffa450edef68
2022-05-17 18:19:36 +00:00
Jim Jagielski
93e3223464 Merge r from trunk:
Submitted by: icing, rpluem, ylavic
Reviewed by: jim

Github: closes #317


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1901009 13f79535-47bb-0310-9956-ffa450edef68
2022-05-17 18:17:44 +00:00
Stefan Eissing
55b993c475 merge of 1898146,1898173 from trunk:
*) mod_http2: preserve the port number given in a HTTP/1.1
     request that was Upgraded to HTTP/2. Fixes PR65881.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898586 13f79535-47bb-0310-9956-ffa450edef68
2022-03-04 08:51:47 +00:00
Yann Ylavic
285b6285e7 ap_regex: Use Thread Local Storage (if efficient) to avoid allocations.
PCRE2 wants an opaque context by providing the API to allocate and free it, so
to minimize these calls we maintain one opaque context per thread (in Thread
Local Storage, TLS) grown as needed, and while at it we do the same for PCRE1
ints vectors. Note that this requires a fast TLS mechanism to be worth it,
which is the case of apr_thread_data_get/set() from/to apr_thread_current()
when APR_HAS_THREAD_LOCAL; otherwise we'll do the allocation and freeing for
each ap_regexec().

The small stack vector is used for PCRE1 && !APR_HAS_THREAD_LOCAL only now.


Follow up to r1897240: APR_HAS_THREAD_LOCAL wants #ifdef instead of #if.


Follow up to r1897240: CHANGES entry.


ap_regex: PCRE needs buffers sized against the number of captures only.

No more (useless), no less (or PCRE will allocate a new buffer by itself to
satisfy the needs), so we should base our buffer size solely on the number
of captures in the regex (determined at compile time from the pattern).

The nmatch provided by the user is used to fill in pmatch only (up to that),
but "our" buffers are sized exactly as needed to avoid oversized allocations
or PCRE allocating by itself.


ap_regex: Follow up to r1897244: Fix pmatch overflow and returned value at limits.

Don't write to pmatch[nlimit:] when ncaps > nmatch, rc should not exceed nmatch
either as before r1897244.


ap_regex: Follow up to r1897240: Fix issues spotted by Rüdiger (thanks!).

#include "apr_thread_proc.h" is enough/needed by util_pcre.c and main.c.
Fix compilation (vector => ovector) for !HAVE_PCRE2 && APR_HAS_THREAD_LOCAL.
Check pcre2_match_data_create() return value for HAVE_PCRE2 && !APR_HAS_THREAD_LOCAL.


ap_regex: Follow up to r1897240: runtime fallback to alloc/free.

Even though APR_HAS_THREAD_LOCAL is compiled in, ap_regexec() might still be
called by non a apr_thread_t thread, let's fall back to alloc/free in this
case too.


ap_regex: Follow up to r1897240: no ap_thread_current() yet.


ap_regex: Follow up to r1897240: cleanups.


ap_regex: Follow up to r1897240: cleanup PCRE2 match data on exit.


ap_regex: Follow up to r1897240: #if APR_HAS_THREAD_LOCAL, not #ifdef.


core: Efficient ap_thread_current() with APR < 1.8.

#define ap_thread_create, ap_thread_current_create and ap_thread_current to
their apr-1.8+ equivalent if available, or implement them using the compiler's
thread_local mechanism if available, or finally provide stubs otherwise.

#define AP_HAS_THREAD_LOCAL to 1 in the two former case or 0 otherwise, while
AP_THREAD_LOCAL is defined to the compiler's keyword iff AP_HAS_THREAD_LOCAL.

Replace all apr_thread_create() calls with ap_thread_create() so that httpd
threads can use ap_thread_current()'s pool data as Thread Local Storage.

Bump MMN minor.

* include/httpd.h():
  Define AP_HAS_THREAD_LOCAL, AP_THREAD_LOCAL (eventually), ap_thread_create(),
  ap_thread_current_create() and ap_thread_current().
  
* server/util.c:
  Implement ap_thread_create(), ap_thread_current_create() and
  ap_thread_current() when APR < 1.8.

* modules/core/mod_watchdog.c, modules/http2/h2_workers.c,
    modules/ssl/mod_ssl_ct.c:
  Use ap_thread_create() instead of apr_thread_create.

* server/main.c:
  Use AP_HAS_THREAD_LOCAL and ap_thread_current_create instead of APR's.

* server/util_pcre.c:
  Use AP_HAS_THREAD_LOCAL and ap_thread_current instead of APR's.

* server/mpm/event/event.c, server/mpm/worker/worker.c,
    server/mpm/prefork/prefork.c:
  Use ap_thread_create() instead of apr_thread_create.
  Create an apr_thread_t/ap_thread_current() for the main chaild thread usable
  at child_init().
  
* server/mpm/winnt/child.c:
  Use ap_thread_create() instead of CreateThread().
  Create an apr_thread_t/ap_thread_current() for the main chaild thread usable


Follow up to r1897460: APLOGNOs.


Follow up to r1897460: !APR_HAS_THREAD implies no ap_thread_* either.


core: Follow up to r1897460: Implement and use ap_thread_current_after_fork().

thread_local variables are not (always?) reset on fork(), so we need a way
to set the current_thread to NULL in the child process.

Implement and use ap_thread_current_after_fork() for that.

* include/httpd.h:
  Define ap_thread_current_after_fork().

* server/util.c:
  Implement ap_thread_current_after_fork().

* server/mpm/event/event.c, server/mpm/prefork/prefork.c,
    server/mpm/worker/worker.c:
  Use ap_thread_current_after_fork().

* server/mpm/winnt/child.c:
  Windows processes are not fork()ed and each child runs the main(), so
  ap_thread_current_create() was already called there.


core: Follow up to r1897460: Provide ap_thread_main_create().

Replace ap_thread_current_create() by ap_thread_main_create() which is how
it's used by httpd. The former is now a local helper only to implement the
latter.

This allows to consolidate/factorize common code in the main() of httpd and
the unix MPMs.


ap_regex: Follow up to r1897240: Fetch the ovector _after_ the match.

Possibly(?) pcre2_match() can modifiy the given pcre2_match_data and invalidate
the old ovector, be safe and fetch it after.


main: Follow up to r1897240: Fix bad log copypasta.

Don't stderr printf the "stat" and "failed" results from the previous
apr_app_initialize() call for an error in ap_thread_main_create().


core: Follow up to r1897240: Opt-out for AP_HAS_THREAD_LOCAL and/or pcre's usage.

If the compiler's thread_local is not efficient enough on some platforms, or
not desired, have a way to disable its usage in httpd (at compile time).

Handle -DAP_NO_THREAD_LOCAL and/or -DAPREG_NO_THREAD_LOCAL as build opt-out for
thread_local usage in httpd gobally and/or in ap_regex only (respectively).


core: Follow up to r1897240: Provide/export ap_thread_current_create()

For completness, and possibly to ease backport to 2.4.x for MPM winnt.


core: Follow up to r1897240 & r1897691: Syntax.


Add compiled and loaded PCRE version numbers
to "httpd -V" output and to mod_info page.


Forgotten file needed for r1612934.


Minor mmn bump due to r1612940.


Backports: r1897240, r1897241, r1897242, r1897244, r1897248, r1897250,
           r1897260, r1897261, r1897263, r1897386, r1897459, r1897460,
           r1897461, r1897462, r1897472, r1897543, r1897651, r1897680,
           r1897689, r1897691, r1897692, r1612934, r1612940, r1613189
Submitted by: ylavic, rjung, rjung, rjung
Reviewed by: ylavic, rpluem, covener, steffenal, wrowe
GH: closes #289 (https://github.com/apache/httpd/pull/289)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898467 13f79535-47bb-0310-9956-ffa450edef68
2022-02-28 11:56:43 +00:00
Yann Ylavic
a962ba7304 Merge r1895914, r1895921 from trunk:
*) http: Enforce that fully qualified uri-paths not to be forward-proxied
     have an http(s) scheme, and that the ones to be forward proxied have a
     hostname, per HTTP specifications.
     trunk patch: http://svn.apache.org/r1895914
                  http://svn.apache.org/r1895921
     2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/286.patch
     backport PR: https://github.com/apache/httpd/pull/286
     +1: ylavic, minfrin, gbechis


mod_proxy: Detect unix: scheme syntax errors at load time.

* modules/proxy/mod_proxy.c(add_pass, add_member, set_proxy_param,
                            proxysection):
  Check return value of ap_proxy_de_socketfy().

* modules/proxy/proxy_util.c(ap_proxy_get_worker_ex):
  Check return value of ap_proxy_de_socketfy().



http: Enforce that fully qualified uri-paths not to be forward-proxied
      have an http(s) scheme, and that the ones to be forward proxied have a
      hostname, per HTTP specifications.

The early checks avoid failing the request later on and thus save cycles
for those invalid cases.


Submitted by: ylavic
Reviewed by: ylavic, minfrin, gbechis
Closes #286


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895955 13f79535-47bb-0310-9956-ffa450edef68
2021-12-14 15:35:56 +00:00
Graham Leggett
c1e16a6671 Backport:
*) mod_http2: fixes PR65731 and https://github.com/icing/mod_h2/issues/212
     trunk patch: na, fixed on 2.4.x source base
     backport PR: https://github.com/apache/httpd/pull/281
     +1: icing, minfrin, ylavic



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895869 13f79535-47bb-0310-9956-ffa450edef68
2021-12-13 10:33:48 +00:00
Yann Ylavic
9ecde98131 Revert r1895807 [skip ci].
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895808 13f79535-47bb-0310-9956-ffa450edef68
2021-12-11 12:57:53 +00:00
Yann Ylavic
4e5ec8ef75 Vote, promote [skip ci].
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1895807 13f79535-47bb-0310-9956-ffa450edef68
2021-12-11 12:56:14 +00:00
Graham Leggett
6e998eb486 Backport:
*) mod_http2: when a server is restarted gracefully, any idle h2 worker
   threads are shut down immediately.
   Also, change OpenSSL API use for deprecations in OpenSSL 3.0.
   Adds all other, never proposed code changes to make a clean
   sync of http2 sources.
   trunk patch: http://svn.apache.org/r1893214
                http://svn.apache.org/r1893215
                http://svn.apache.org/r1893220
                and other never proposed code changes
   PR: https://github.com/apache/httpd/pull/270
   +1: icing, rpluem, minfrin



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1893658 13f79535-47bb-0310-9956-ffa450edef68
2021-09-26 14:30:51 +00:00
Yann Ylavic
2fa30bf37c Merge r1892599 from trunk:
mod_http2: fixes a use-after-read of an integer value when
   passing a stream identifier for further IO checking. A
   non-issue since an int value matching no active stream
   will lead to no action.


Submitted by: icing
Reviewed by: icing, jorton, ylavic


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892876 13f79535-47bb-0310-9956-ffa450edef68
2021-09-03 17:01:29 +00:00
Stefan Eissing
ecebcc035c Merged r1734009,r1734231,r1734281,r1838055,r1838079,r1840229,r1876664,r1876674,r1876784,r1879078,r1881620,r1887311,r1888871 from trunk:
*) core: Split ap_create_request() from ap_read_request(). [Graham Leggett]

  *) core, h2: common ap_parse_request_line() and ap_check_request_header()
     code. [Yann Ylavic]

  *) core: Add StrictHostCheck to allow unconfigured hostnames to be
     rejected. [Eric Covener]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1890245 13f79535-47bb-0310-9956-ffa450edef68
2021-05-27 13:08:21 +00:00
Stefan Eissing
c0cff48bcc Merge of [r1886840, r1887085, r1887087, r1887134, r1887151, r1887152,
r1887337, r1887340, r1887342, r1887343, r1887360, r1887364, 
       r1887923, r1887965, r1887993, r1888006, r1888083, r1888084,
       r1888723, r1888724, r1888726, r1888729, r1889788] from trunk:

   *) core/mod_ssl/mod_md:
     - adding new ap_ssl_*() functions for a backward
       compatible replacement of the major optional mod_ssl functions. This
       allows other ssl modules to work without impersonating mod_ssl and
       also allows different ssl modules being active on separate ports.
     - latest mod_md with support for multiple certificates per domain
       and ECDSA certificates. Removed ACMEv1 support.
     - Interworking mod_md and ssl modules changed to exchange PEM strings
       instead of file paths for ACME challenges.
     - core/mod_ssl/mod_md: adding OCSP response provisioning as core feature.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889793 13f79535-47bb-0310-9956-ffa450edef68
2021-05-12 10:14:42 +00:00
Stefan Eissing
5bc61a05cf Merge r1889119 from trunk:
mod_http2: fix incomplete sync with github and its version number.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1889759 13f79535-47bb-0310-9956-ffa450edef68
2021-05-11 13:36:45 +00:00
Christophe Jaillet
3da35a145c Merge r1888087 from trunk
* mod_http2: Fixed a race condition that could lead to streams being
     aborted (RST to the client), although a response had been produced

Submitted by: icing
Reviewed by: icing, rpluem, covener
Backported by: jailletc36

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1888922 13f79535-47bb-0310-9956-ffa450edef68
2021-04-18 18:55:43 +00:00
Stefan Eissing
c0c8c96a8c *) mod_http2: sync with github standalone version 1.15.17
- Log requests and sent the configured error response in case of early detected
       errors like too many or too long headers. [Ruediger Pluem]
     - new option 'H2OutputBuffering on/off' which controls the buffering of stream output.
       The default is on, which is the behaviour of older mod-h2 versions. When off, all
       bytes are made available immediately to the main connection for sending them
       out to the client. This fixes interop issues with certain flavours of gRPC, see
       also <https://github.com/icing/mod_h2/issues/207>.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1888011 13f79535-47bb-0310-9956-ffa450edef68
2021-03-24 14:28:49 +00:00
Yann Ylavic
928b83ac66 Merge r1883668, r1886255 from trunk:
mod_http2: explicitely apr_thread_exit() at the end of slot_run().

Calling apr_thread_exit() before returning from the thread function avoids
leaking the thread's pool (until/unless APR-2.0 is used).


mod_http2: Fix workers synchronization on pchild cleanup.

When the MPM child exits and pre-workers_pool_cleanup() is called, all the
workers are not necessarily in their idle critical section, thus aborting slots
in the ->idle list only may leave worker threads alive, later blocked in the
idle critical section with no one to wake them.

Instead of the per-slot ->aborted flag, workers_pool_cleanup() will now set
workers->aborted "globally" such that slot_run() does not wait to be woken up
from idle in this case, and all workers really exit.

Also, for workers_pool_cleanup() to wait for all the workers to reach the
->zombies list before returning, a new ->all_done condition variable is armed
when the last thread exits. Since this depends on the atomic ->worker_count to
reach zero, for accuracy the increment in activate_slot() is moved before the
thread startup.


* modules/http2/h2_workers.h (struct h2_workers): volatilize ->aborted and
  add the ->all_done condition variable.

* modules/http2/h2_workers.c (push_slot, pop_slot): volatilize the h2_slot*
  being cas-ed.

* modules/http2/h2_workers.c (cleanup_zombies): rename to join_zombies(), and
  move ->worker_count atomic inc to slot_done().

* modules/http2/h2_workers.c (get_next): when workers->aborted, leave and don't
  wait for ->not_idle. Return an int/bool since it's gotten / not gotten.

* modules/http2/h2_workers.c (slot_done): signal ->all_done when the last
  worker and the MPM child are exiting.

* modules/http2/h2_workers.c (slot_run): rework the loops now that get_next()
  is the stop signal.

* modules/http2/h2_workers.c (workers_pool_cleanup): wait for ->all_done when
  needed, and remove the !workers->aborted condition since the cleanup will
  only be called once.

* modules/http2/h2_workers.c (activate_slot): move ->worker_count atomic inc
  before the thread creation and handle failure rollback.


github: closes #169

Submitted by: ylavic
Reviewed by: ylavic, icing, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1887374 13f79535-47bb-0310-9956-ffa450edef68
2021-03-09 15:44:30 +00:00
Graham Leggett
64143c9eb8 Backport to 2.4:
*) Easy patches: synch 2.4.x and trunk
        - mod_http2: Fix ascii art
        - mod_http2: fix some dox comments
        - mod_dav: Don't call memcpy(,NULL,0)
        - mod_ssl: Pass base_server in OpenSSL init log message
        - .gdbinit: tab to space
        - mod_so: don't try to load modules from a NULL path
        - mod_cache_file/mod_lua: Add missing "const" or "static const" qualifiers
                                  in some command_rec definitions
        - mod_lua: Fix compilation error if APR_HAS_THREADS is not defined
        - core/log: fix an harmless warning spoted by gcc 10
        - mod_ssl: update comment
     trunk patch:
          http://svn.apache.org/r1810233
          http://svn.apache.org/r1827530
          http://svn.apache.org/r1874144
          http://svn.apache.org/r1877262
          http://svn.apache.org/r1878263
          http://svn.apache.org/r1880461
          http://svn.apache.org/r1882053
          http://svn.apache.org/r1882060
          http://svn.apache.org/r1883452
          http://svn.apache.org/r1884551
     2.4.x patch: svn merge -c 1810233,1827530,1874144,1877262,1878263,1880461,1882053,1882060,1883452,1884551 ^/httpd/httpd/trunk .
     +1: jailletc36, jorton, minfrin



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1885612 13f79535-47bb-0310-9956-ffa450edef68
2021-01-17 17:23:37 +00:00
Yann Ylavic
fb3f3ea09d Merge r1883704, r1883707 from trunk:
mod_proxy_http2: thread safety with MPM prefork, still..

The allocator of pchild has no mutex with MPM prefork, but we need one
for h2 workers threads synchronization.

Even though mod_http2 shouldn't be used with prefork, better be safe than
sorry, so forcibly set the mutex in h2_child_init() if it doesn't exist.

This prevents the below situation:

AddressSanitizer: heap-use-after-free on address 0x6250003ea938 at pc 0x7fe229f40f3c bp 0x7fe22146dd30 sp 0x7fe22146dd28

WRITE of size 8 at 0x6250003ea938 thread T4
    #0 0x7fe229f40f3b in apr_pool_destroy memory/unix/apr_pools.c:1015
                         `-> if ((*pool->ref = pool->sibling) != NULL)
    #1 0x7fe229f6ef1a in apr_thread_exit threadproc/unix/thread.c:206
    #2 0x7fe223a26671 in slot_run /home/yle/src/apache/httpd/trunk.ro/modules/http2/h2_workers.c:248
    #3 0x7fe229f6ebcc in dummy_worker threadproc/unix/thread.c:142
    #4 0x7fe229ecbea6 in start_thread nptl/pthread_create.c:477
    #5 0x7fe229df9d4e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfdd4e)

0x6250003ea938 is located 56 bytes inside of 8192-byte region [0x6250003ea900,0x6250003ec900)
freed by thread T6 here:
    #0 0x7fe22a1ecb6f in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f)
    #1 0x7fe229f3fe38 in allocator_free memory/unix/apr_pools.c:507
    #2 0x7fe229f4107b in apr_pool_destroy memory/unix/apr_pools.c:1043
    #3 0x7fe229f6ef1a in apr_thread_exit threadproc/unix/thread.c:206
    #4 0x7fe223a26671 in slot_run /home/yle/src/apache/httpd/trunk.ro/modules/http2/h2_workers.c:248
    #5 0x7fe229f6ebcc in dummy_worker threadproc/unix/thread.c:142
    #6 0x7fe229ecbea6 in start_thread nptl/pthread_create.c:477



mod_proxy_http2: follow up to r1883704.

For event/worker MPMs, pchild uses pconf's allocator, so its is NULL.


Submitted by: ylavic
Reviewed by: ylavic, jorton, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1885138 13f79535-47bb-0310-9956-ffa450edef68
2021-01-05 10:20:45 +00:00
Yann Ylavic
fd70b17ea5 Merge r1884169, r1884170 from trunk:
mod_http2: Rename server_pool as pchild in h2_workers_create()

To clarify which parent pool the workers threads have.
And add a comment about workers_pool_cleanup()'s role and when it runs.

No functional change.


mod_http2: stop/wait the workers threads before their pool is killed.

There shouldn't be any worker thread active when pchild is destroyed (thus each
thread's pool), so register workers_pool_cleanup as a pre_cleanup of pchild.

This is to avoid races like the below stacktrace, where slot_run() threads
are still running when clean_child_exit() is called.

Thread 23 (Thread 0x7f4865b79800 (LWP 3740)):
#0  0x00007f4864dec449 in pthread_cond_destroy@@GLIBC_2.3.2 () from /lib/x86_64-linux-gnu/libpthread.so.0
#1  0x00007f4865020117 in run_cleanups (cref=<optimized out>) at memory/unix/apr_pools.c:2629
#2  pool_clear_debug (pool=pool@entry=0x558a5297e4a0, file_line=0x558a5237456b "event.c:757") at memory/unix/apr_pools.c:1830
#3  0x00007f486501ffee in pool_destroy_debug (pool=0x558a5297e4a0, file_line=<optimized out>) at memory/unix/apr_pools.c:1915
#4  0x00007f48650200f0 in pool_clear_debug (pool=pool@entry=0x558a52a41070, file_line=0x558a5237456b "event.c:757") at memory/unix/apr_pools.c:1827
#5  0x00007f486501ffee in pool_destroy_debug (pool=0x558a52a41070, file_line=<optimized out>) at memory/unix/apr_pools.c:1915
#6  0x00007f486502085c in apr_pool_destroy_debug (pool=<optimized out>, file_line=<optimized out>) at memory/unix/apr_pools.c:1957
#7  0x0000558a52326cfc in clean_child_exit (code=0) at event.c:757
#8  0x0000558a52327969 in child_main (child_num_arg=child_num_arg@entry=1, child_bucket=child_bucket@entry=0) at event.c:2926
#9  0x0000558a52327ce5 in make_child (s=0x558a52c9f840, slot=slot@entry=1, bucket=0) at event.c:2992
#10 0x0000558a52327d4c in startup_children (number_to_start=2, number_to_start@entry=3) at event.c:3015
#11 0x0000558a523289ac in event_run (_pconf=<optimized out>, plog=0x558a5273ce00, s=0x558a52c9f840) at event.c:3374
#12 0x0000558a5233e91e in ap_run_mpm (pconf=0x558a5270cbe0, plog=0x558a5273ce00, s=0x558a52c9f840) at mpm_common.c:100
#13 0x0000558a5231b763 in main (argc=<optimized out>, argv=<optimized out>) at main.c:844

Thread 2 (Thread 0x7f4840b70700 (LWP 3836)):
#0  0x00007f4864dec9f3 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/x86_64-linux-gnu/libpthread.so.0
#1  0x00007f486501f65d in apr_thread_cond_wait (cond=<optimized out>, mutex=<optimized out>) at locks/unix/thread_cond.c:68
#2  0x00007f484e14ae4a in get_next (slot=0x558a528d5fe0) at h2_workers.c:209
#3  slot_run (thread=0x558a52828b30, wctx=0x558a528d5fe0) at h2_workers.c:228
#4  0x00007f4864de66db in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#5  0x00007f4864b0f88f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Thread 1 (Thread 0x7f4841b72700 (LWP 3834)):
#0  0x00007f4864a2ce97 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007f4864a2e801 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007f4865020865 in apr_pool_destroy_debug (pool=<optimized out>, file_line=<optimized out>) at memory/unix/apr_pools.c:1955
#3  0x00007f486502b536 in apr_thread_exit (thd=thd@entry=0x558a52ba8980, retval=retval@entry=0) at threadproc/unix/thread.c:206
#4  0x00007f484e14aec6 in slot_run (thread=0x558a52ba8980, wctx=0x558a528d6060) at h2_workers.c:248
#5  0x00007f4864de66db in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#6  0x00007f4864b0f88f in clone () from /lib/x86_64-linux-gnu/libc.so.6


Submitted by: ylavic
Reviewed by: ylavic, jorton, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1884318 13f79535-47bb-0310-9956-ffa450edef68
2020-12-11 14:49:12 +00:00
Jim Jagielski
7f380f8f5e mod_http2: Remove .gitignore. It is not present in trunk and
contains problematic entries for our tree (especially Makefile.in).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1883533 13f79535-47bb-0310-9956-ffa450edef68
2020-11-17 14:55:29 +00:00
Ruediger Pluem
f7173e9109 Merge r1881620, r1881635 from trunk:
Process early errors via a dummy HTTP/1.1 request as well

Process early errors via a dummy HTTP/1.1 request as well to ensure
that the request gets logged correctly and possible custom error
pages are considered. The previous way of directly sending a HTTP/2
answer with the HTTP status code appropriate for the error is more
efficient, but does not log the request nor sents a possible custom
error page.

* modules/http2/h2.h: Add http_status to h2_request struct and define
  H2_HTTP_STATUS_UNSET.

* modules/http2/h2_request.c(h2_request_create_rec): Check if
  http_status is set for the request and die with the
  status code it contains if set.

* modules/http2/h2_session.c(on_header_cb): Adjust the error condition
  now that we mark early errors via http_status: Only return an error
  if the status is not success and http_status is not H2_HTTP_STATUS_UNSET.

* modules/http2/h2_stream.c(set_error_response): Set http_status
  on the request instead of creating headers for a response and a
  respective brigade.

Github: closes #137


* Changelog for r1881620

Submitted by: rpluem
Reviewed by: rpluem, giovanni, ylavic

Github: closes #142


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1883475 13f79535-47bb-0310-9956-ffa450edef68
2020-11-16 12:24:12 +00:00
Ruediger Pluem
060dd8c1f9 Merge r1859213 from trunk:
* Only do one retry to be more in line with the other modules.

Note: mod_proxy_http2 is still experimental and thus CTR even for backports.

Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1881147 13f79535-47bb-0310-9956-ffa450edef68
2020-08-24 15:39:56 +00:00
Stefan Eissing
a61223e9cb Merge of r1880395 from trunk:
*) mod_http2: remote support for abandoned http-wg draft
     <https://datatracker.ietf.org/doc/draft-kazuho-h2-cache-digest/>.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1880396 13f79535-47bb-0310-9956-ffa450edef68
2020-07-29 12:33:53 +00:00
Graham Leggett
aa603590d6 *) mod_http2: Fixes LimitRequestFields configuration handling to compensate for
browsers that send request headers as multiple ones to make best use of HTTP/2
    compression.
    Trunk version of patch:
      http://svn.apache.org/r1879832
    2.4.x:
      svn merge -c 1879832 ^/httpd/httpd/trunk .
    +1: icing, rpluem, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1879895 13f79535-47bb-0310-9956-ffa450edef68
2020-07-15 14:59:43 +00:00