mod_proxy: Consistently close the socket on failure to reuse the connection.
proxy_connection_create() and ap_proxy_connect_backend() sometimes close the
connection on failure, sometimes not. Always close it.
mod_proxy: restore reuse of ProxyRemote connections when possible.
Fixes a regression from 2.4.59 (r1913907).
For a reverse proxy setup with a worker (enablereuse=on) and a
forward/CONNECT ProxyRemote to reach it, an open connection/tunnel
to/through the remote proxy for the same origin server (and using the
same proxy auth) should be reusable. Avoid closing them like r1913534
did.
* modules/proxy/proxy_util.c:
Rename the struct to remote_connect_info since it's only used for
connecting through remote CONNECT proxies. Axe the use_http_connect
field, always true.
* modules/proxy/proxy_util.c(ap_proxy_connection_reusable):
Remote CONNECT (forward) proxy connections can be reused if the auth
and origin server infos are the same, so conn->forward != NULL is not
a condition to prevent reusability.
* modules/proxy/proxy_util.c(ap_proxy_determine_connection):
Fix the checks around conn->forward reuse and connection cleanup if
that's not possible.
Submitted by: jfclere, ylavic
Reviewed by: ylavic, jfclere, rpluem
Github: closes#532
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1926317 13f79535-47bb-0310-9956-ffa450edef68
* Temporarily add back the query string to the URL as it might contain the
routing information for sticky sessions.
PR: 69443
Reviewed by: rpluem, covener, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1926107 13f79535-47bb-0310-9956-ffa450edef68
- server: Use apr_size_t instead of int to harden against overflows
- mod_http2: DOXYGEN has nothing to do here, just remove this
strange "#if defined(DOXYGEN)"
- test: make the compiler happy when using --enable-maintainer-mode
- mod_proxy: Fix format string type check
- mod_http2: Fix comment, no functional change
- <various>: Remove unnecessary APLOGNO() use in TRACE-level logging
- mod_cache_socache: Update comment only, to remove reference to
session cache
- mod_dav: Fix error message formatting if an unauthenticated user
tries to use an authenticated user's lock token
- <none>: trigger ci
- server: Fix typo in comment
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1922956 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME. PR 69203
Before r1918550 (r1918559 in 2.4.60), "SetHandler proxy:..." configurations
did not pass through proxy_fixup() hence the proxy_canon_handler hooks, leaving
fcgi's SCRIPT_FILENAME environment variable (from r->filename) decoded, or more
exactly not re-encoded.
We still want to call ap_proxy_canon_url() for "fcgi:" to handle/strip the UDS
"unix:" case and check that r->filename is valid and contains no controls, but
proxy_fcgi_canon() will not ap_proxy_canonenc_ex() thus re-encode anymore.
Note that this will do the same for "ProxyPass fcgi:...", there is no reason
that using SetHandler or ProxyPass don't result in the same thing. If an opt
in/out makes sense we should probably look at ProxyFCGIBackendType.
Follow up to r1919620: CHANGES entry indent.
Follow up to r1919620: init path after "proxy:" is skipped.
Follow up to r1919620: Restore r->filename re-encoding for ProxyPass URLs.
mod_proxy_fgci: Follow up to r1919628: Simplify.
Variable from_handler is used once so axe it.
Submitted by: ylavic
Reviewed by: ylavic, covener, jorton
Github: closes#470
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1922080 13f79535-47bb-0310-9956-ffa450edef68
When a rewrite to proxy is configured in the server config, a check is made to make sure mod_proxy is active. But the same is not done if a rewrite to proxy is configured in an .htaccess file.
Basically this patch is the block of code from hook_uri2file that does the proxy check, copied to hook_fixup.
Patch provided by Michael Streeter [mstreeter1 gmail.com], slightly modified to use a new APLOGNO
PR 56264
mod_rewrite, mod_proxy: mod_proxy to cononicalize rewritten [P] URLs. PR 69235.
When mod_rewrite sets a "proxy:" URL with [P], it should be canonicalized by
mod_proxy still, notably to handle any "unix:" local socket part.
To avoid double encoding in perdir context, a follow up commit should remove the
ap_escape_uri() done in mod_rewrite since it's now on mod_proxy to canonicalize,
per PR 69260.
* Leave the proper escaping of the URL and the adding of r->args to the
proxy module which runs after us after r1920570.
Just take care to add r->args in case the proxy rule has the
[NE] flag set and tell the proxy module to not escape in this case.
* Mention the additional bug
Submitted by: jailletc36, ylavic, rpluem
Reviewed by: rpluem, ylavic, covener
Github: closes#484
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1921299 13f79535-47bb-0310-9956-ffa450edef68
Remove support for Request-Range header sent by Navigator 2-3 and
MSIE 3
* Follow up to r1918814: Strings are from configuration and thus trusted
Submitted by: sf, rpluem
Reviewed by: rpluem, covener, jorton
Github: closes#475
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920981 13f79535-47bb-0310-9956-ffa450edef68
*) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs
in <Location> (incomplete fix in 2.4.62). PR 69160.
When SetHandler "unix:..." is used in a <Location "/path"> block, the path
gets appended (including $DOCUMENT_ROOT somehow) to r->filename hence the
current checks in fixup_uds_filename() to add "localhost" when missing don't
work. Fix them.
mod_proxy: Allow for empty UDS URL hostname in ProxyPass workers too.
Using "unix:/udspath|scheme:" or "unix:/udspath|scheme://" for a ProxyPass URL
does not work currently, while it works for SetHandler "proxy:unix:...".
Submitted by: ylavic
Reviewed by: ylavic, covener, rpluem
Github: closes#467
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1920977 13f79535-47bb-0310-9956-ffa450edef68
The hostname part of the URL is not mandated for UDS though the canon_handler
hooks will require it, so add "localhost" if it's missing (won't be used anyway
for an AF_UNIX socket).
This can trigger with SetHandler "unix:" URLs which are now also fixed up.
Follow up to r1919015: fix compilation.
mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
"balancer:" URLs set via SetHandler, also allowing for "unix:"
sockets with BalancerMember(s). PR 69168.
* modules/proxy/proxy_util.h, modules/proxy/proxy_util.c:
Move proxy_interpolate() from mod_proxy.c to ap_proxy_interpolate(),
exported locally only (non public).
Move proxy_fixup() from mod_proxy.c to ap_proxy_canon_url(), exported
locally only too (non public).
Rollback ap_proxy_fixup_uds_filename() to a local fixup_uds_filename()
usable from proxy_util.c only. The public function will be removed in
a following commit.
* modules/proxy/mod_proxy.h:
Note that ap_proxy_fixup_uds_filename() is deprecated.
* modules/proxy/mod_proxy.c:
Just use ap_proxy_canon_url() from proxy_fixup() and proxy_handler()
for SetHandler URLs.
* modules/proxy/mod_proxy_balancer.c:
Do not canonicalize the path from proxy_balancer_canon() anymore but
rather from balancer_fixup() where the balancer URL is rewritten to
the BalancerMember URL.
mod_proxy: Don't mangle r->filename when ap_proxy_canon_netloc() fails.
ap_proxy_canon_netloc() called from the canon_handler hooks modifies its
given url in place, hence &r->filename[6] passed from ap_proxy_canon_url().
This is not an issue if the canon_handler hook succeeds (or declines) since
r->filename is usually completely rewritten finally, but on failure it gets
truncated.
Avoid this by passing a copy of r->filename from the start, the proxy *url
and r->filename don't need to point to the same data.
* proxy/proxy_util.c(ap_proxy_canon_url):
Pass a copy of r->filename to the canon_handler hooks.
Follow up to r1919023: fix compilation.
Merges r1919015, r1919019, r1919022, r1919023, r1919024 from trunk
Reviewed by: rpluem, covener, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1919138 13f79535-47bb-0310-9956-ffa450edef68
* modules/proxy/proxy_util.c:
Export ap_proxy_fixup_uds_filename() from fix_uds_filename.
Call it from ap_proxy_pre_request() even for rewritten balancer workers.
* modules/proxy/mod_proxy.h:
Declare ap_proxy_fixup_uds_filename()
* modules/proxy/mod_proxy.c:
Fixup UDS filename from r->handler in proxy_handler().
* include/ap_mmn.h:
Bump MMN minor for ap_proxy_fixup_uds_filename()
mod_proxy: follow up to r1918626: Simplify ap_proxy_fixup_uds_filename() and callers.
Merges r1918626, r1918647 from trunk
GH: closes#457
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918666 13f79535-47bb-0310-9956-ffa450edef68
*) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
described in RFC 8441. A new directive 'H2WebSockets on|off' has been
added. The feature is by default not enabled.
As also discussed in the manual, this feature should work for setups
using "ProxyPass backend-url upgrade=websocket" without further changes.
Special server modules for WebSockets will have to be adapted,
most likely, as the handling if IO events is different with HTTP/2.
HTTP/2 WebSockets are supported on platforms with native pipes. This
excludes Windows.
New directive `H2ProxyRequests on|off` to enable handling
of HTTP/2 requests in a forward proxy configuration.
General forward proxying is enabled via `ProxyRequests`. If the
HTTP/2 protocol is also enabled for such a server/host, this new
directive is needed in addition.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1911979 13f79535-47bb-0310-9956-ffa450edef68
Do not double encode encoded slashes
In case that AllowEncodedSlashes is set to NoDecode do not double encode
encoded slashes in the URL sent by the reverse proxy to the backend.
* include/ap_mmn.h: Document the addition of ap_proxy_canonenc_ex to the API.
* modules/proxy/mod_proxy.h: Declare ap_proxy_canonenc_ex and define flag
values.
* modules/proxy/proxy_util.c: Implement ap_proxy_canonenc_ex by modifying
ap_proxy_canonenc accordingly and reimplement ap_proxy_canonenc to
use ap_proxy_canonenc_ex with the appropriate flag.
* modules/http2/mod_proxy_http2.c, modules/proxy/mod_proxy_*.c: Set the
correct flag based on the AllowEncodedSlashes configuration and use
ap_proxy_canonenc_ex instead of ap_proxy_canonenc.
* Whitespace fixes. No functional change.
* Fix typo
Reviewed by: rpluem, ylavic, covener
Github: closes#351
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908864 13f79535-47bb-0310-9956-ffa450edef68
* In the reverse proxy case r->filename might contain a query string if
the nocanon option was used with ProxyPass.
If this is the case cut off the query string as the last parameter in
this query string might end up on an extension we take care about, but
we only want to match against path components not against query
parameters.
* Add CHANGES entry for r1907505 [skip ci]
Reviewed By: rpluem, ylavic, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1908538 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_hcheck: Honor worker timeout settings.
Daniel reported on user@ that hc connections do not timeout according to
the worker's tumeout= configuration, this fixes it.
While at it, copy the other timeout settings too.
Reported by: dferradal
Submitted By: rpluem
Reviewed By: rpluem, jorton, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906499 13f79535-47bb-0310-9956-ffa450edef68
Allow for HTTP/1.1 or HTTP/1.0 protocol health checks
Document hcmethod enhancement to allow HTTP/1.1 comms
catch by CJ
Bump mmn
bump again
+ suppress MMN changes, applied manually in 1906496
Submitted By: jim
Reviewed By: jim, covener, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906498 13f79535-47bb-0310-9956-ffa450edef68
* Close the connection in case an EOC bucket was seen
* In case we see an EOC bucket and there was an error bucket before, use its
status as status for the request. This should ensure proper status logging
in the access log.
* We need to set r->status on each call after we noticed an EOC as
data bucket generators like ap_die might have changed the status
code. But we know better in this case and insist on the status
code that we have seen in the error bucket.
* Keep track of the number of keepalives we processed on this connection.
* Report a broken backend in case reading the response line failed on the
first request on this connection otherwise we assume we have just run
into a keepalive race and the backend is still healthy.
* Add Changelog for r1899451, r1899454, r1899562, r1899564, r1899584
Submitted by: rpluem
Reviewed by: jim
Github: closes#314
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1900755 13f79535-47bb-0310-9956-ffa450edef68
*) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
an attempt to load a dbm driver fails, log clearly which driver triggered
the error (not "default"), and what the error was.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898590 13f79535-47bb-0310-9956-ffa450edef68
*) mod_proxy: Use the maxium of front end and backend timeouts instead of the
minimum when tunneling requests (websockets, CONNECT requests).
Backend timeouts can be configured more selectively (per worker if needed)
as front end timeouts and typically the backend timeouts reflect the
application requirements better. PR 65886
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898559 13f79535-47bb-0310-9956-ffa450edef68
APR and APU must be at least 1.3 to be able to configure and build httpd 2.4.x.
So remove some osbolete #if in the source code.
- mod_socache_memcache
- mod_authn_dbd
- mod_log_config
- mod_proxy_ftp and proxy-util
Submitted by: jailletc36, jailletc36, jailletc36, jailletc36
Reviewed by: jailletc36, icing, rpluem
Backported by: jailletc36
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1898393 13f79535-47bb-0310-9956-ffa450edef68
