The existing note about implicit disabling of Options was difficult
to parse. Rewrite as a type="warning" note with:
- Clear statement that the restriction controls enabling, not disabling
- Explanation of absolute vs relative (+/-) Options syntax
- Concrete example showing how inherited options get implicitly disabled
BZ#70099
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934980 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_html: Simplify to use the ap_varbuf API.
* modules/filters/mod_proxy_html.c: Include util_varbuf.h.
(saxctxt): Replace buf/offset/avail members with struct ap_varbuf vb.
(DEFAULT_BUFSZ): New macro.
(normalise): Take struct ap_varbuf * parameter instead of char *.
(preserve, pappend): Remove functions, replaced by ap_varbuf_grow
and ap_varbuf_strmemcat respectively.
(dump_content): Use ap_varbuf for regex substitutions via
ap_varbuf_regsub, avoiding manual buffer resizing with
preserve/memmove/memcpy. Use a temporary ap_varbuf for building
regex replacement results.
(pcharacters, pcomment): Use ap_varbuf_strmemcat and ap_varbuf_strcat
in place of pappend.
(pendElement): Check vb.strlen instead of offset.
(pstartElement): Use ap_varbuf for attribute URL rewriting with the
same ap_varbuf_regsub approach. Use a temporary ap_varbuf for
regex replacements.
(proxy_html_filter): Initialize the ap_varbuf with a clamped bufsz.
(proxy_html_merge): Use DEFAULT_BUFSZ macro.
Assisted-by: Claude Opus 4.6 (claude-opus-4-6)
Reviewed by: covener, jfclere, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934977 13f79535-47bb-0310-9956-ffa450edef68
Fix OpenSSL 4.0 compatibility and test that in CI.
CI: Update to test OpenSSL 4.0.0 explicitly.
CI: No longer disable deprecated-declaration warnings for OpenSSL 3.4 -Werror build.
* modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Change name to
const X509_NAME *.
(ssl_callback_proxy_cert): Change ca_name, issuer, and ca_issuer to
const X509_NAME *.
* modules/ssl/ssl_engine_log.c (ssl_log_cert_error): Change cert
parameter to const X509 *. Use X509_get0_serialNumber,
X509_get0_notBefore, and X509_get0_notAfter instead of non-const
variants.
(ssl_log_xerror, ssl_log_cxerror, ssl_log_rxerror): Change cert
parameter to const X509 *.
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn): Change
xsname parameter to const X509_NAME *.
(ssl_var_lookup_ssl_cert_dn_oneline): Change xsname parameter to
const X509_NAME *.
(ssl_var_lookup_ssl_cert): Change xsname to const X509_NAME *.
(ssl_var_lookup_ssl_cert_rfc4523_cea): Change issuer to const
X509_NAME *.
* modules/ssl/ssl_private.h (ssl_log_xerror, ssl_log_cxerror,
ssl_log_rxerror): Update declarations to use const X509 *.
* modules/ssl/ssl_util_ssl.c (modssl_X509_NAME_to_string): Change dn
parameter to const X509_NAME *.
(getIDs): Change subj to const X509_NAME *.
* modules/ssl/ssl_util_ssl.h (modssl_X509_NAME_to_string): Update
declaration to use const X509_NAME *.
* support/ab.c (ssl_print_cert_info): Change dn to const X509_NAME *.
mod_ssl: use ASN1_STRING accessor API in dump_extn_value:
* modules/ssl/ssl_engine_vars.c (dump_extn_value): Use
ASN1_STRING_get0_data() and ASN1_STRING_length() rather than
directly dereferencing the ASN1_OCTET_STRING structure, which is
opaque in OpenSSL 4.0.
* modules/ssl/ssl_private.h: Add compat macros for
ASN1_STRING_get0_data and ASN1_STRING_length for pre-1.1 API.
mod_ssl: constify ASN1_TIME pointers, use X509_get0_not{Before,After}:
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_valid,
ssl_var_lookup_ssl_cert_remain): Constify ASN1_TIME * parameter.
(ssl_var_lookup_ssl_cert): Use X509_get0_notBefore() and
X509_get0_notAfter() which return const pointers.
(ssl_var_lookup_ssl_cert_remain): Use ASN1_TIME_check() directly
rather than INVALID_ASN1_TIME macro which dereferences the
ASN1_TIME structure.
(dump_extn_value): Constify ASN1_OCTET_STRING * parameter.
* modules/ssl/ssl_private.h: Add compat macros for
X509_get0_before and X509_get0_after for pre-1.1 API.
mod_ssl: constify X509_NAME_ENTRY and X509_EXTENSION pointers:
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn,
extract_dn): Constify X509_NAME_ENTRY * variables, constify
X509_NAME * parameter of extract_dn, drop unnecessary casts
on X509_NAME_ENTRY_get_object() calls.
(ssl_ext_list): Use MODSSL_X509_EXT_CONST for X509_EXTENSION *
since X509_EXTENSION accessors are only constified in OpenSSL 4.
* modules/ssl/ssl_util_ssl.c, modules/ssl/ssl_util_ssl.h
(modssl_X509_NAME_ENTRY_to_string): Constify X509_NAME_ENTRY *
parameter.
* modules/ssl/ssl_private.h: Add MODSSL_X509_EXT_CONST, defined
as const for OpenSSL 4+ and empty otherwise.
* modules/ssl/ssl_util_ssl.c (asn1_string_convert): Constify
ASN1_STRING * argument.
* modules/ssl/ssl_engine_ocsp.c (extract_responder_uri): Use
modssl_ASN1_STRING_convert instead of directly accessing ASN1_STRING
data pointer.
* modules/ssl/ssl_util_ssl.c (modssl_ASN1_STRING_convert): Rename from
asn1_string_convert and export function.
(asn1_string_to_utf8): Update to use modssl_ASN1_STRING_convert.
(modssl_X509_NAME_ENTRY_to_string): Update to use
modssl_ASN1_STRING_convert.
* modules/ssl/ssl_util_ssl.h (modssl_ASN1_STRING_convert): Declare new
function.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CI: Add OpenSSL 3.1 builds, including a no-engine build.
(attempt to use 3.2 failed, unsure why)
- add OpenSSL build binaries to $PATH
CI: add OpenSSL 3.2, test OpenSSL 3.x using Apache::Test
trunk to pick up r1916067.
CI: The OpenSSL no-engine config option is redundant as of 4.0, remove.
CI: Try to fix ab failures during OpenSSL ech job, set RPATH via LDFLAGS
CI: For OpenSSL branch builds, always build a fresh version of the
OpenSSL branch and cache the commit hash to allow checking for freshness.
Also clone with --depth=1 to save time+bandwidth.
Reviewed by: jorton, covener (skimmed+CI results), rpluem
Github: closes#642
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934973 13f79535-47bb-0310-9956-ffa450edef68
CMake: update min version required
GitHub: closes#640
Submitted by: Jeff McKenna <jmckenna gatewaygeomatics.com>
Fix Windows GHA build.
* .github/workflows/windows.yml
(): Use Enter-VsDevShell to find VS installation and save
environment variables to GITHUB_ENV.
CI: Update used actions to use newer Node.js than 20
CI: Update upload-artifact action, drop unnecessary Ubuntu 22.04 fix
CI: Drop 'shell: cmd', use PowerShell for the Windows workflow
CI: Print used CMake version for Windows workflow
Submitted by: Vladimír Chlup <vchlup ibm.com>
Github: closes#660
* .github/workflows/windows.yml: Use checkout@v6.
Submitted by: ivan
Github: closes#663
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934934 13f79535-47bb-0310-9956-ffa450edef68
mod_ssl: Set auth type to \"ClientCert\" after authentication
When client certificate authentication has been performed r->ap_auth_type was
never populated and env AUTH_TYPE was empty.
We now set auth type to \"ClientCert\".
PR: 45058
Submitted by: Michael Osipov <michaelo@apache.org>
Reviewed by: michaelo, jorton, rpluem
Github: closes#645
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934901 13f79535-47bb-0310-9956-ffa450edef68
mod_ssl: Expose serialNumber (2.5.4.5) as standard env var from certificate DN
serialNumber (2.5.4.5) is a standard LDAP attribute embedded in the subject's
and/or issuer's DN, extract it by standard means from the DN and expose
via StdEnvVars.
PR: 35154
Co-authored-by: Michael Osipov <michaelo@apache.org>
Submitted by: Benjamin Demarteau <benjamin.demarteau@liege.be>
Reviewed By: michaelo, jorton, rpluem
Github: closes#644
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934900 13f79535-47bb-0310-9956-ffa450edef68
expr parse fail should hide conditional content
these are neither true or false, the enclosing content should not
be printed
Submitted by: covener
Reviewed by: covener, jorton, rpluem
Github: closes#658
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934899 13f79535-47bb-0310-9956-ffa450edef68
memchr() takes a char * as a first parameter, and 'buf' is a const char *.
This breaks build process at least with gcc 16.1.1 and maintainer-mode enabled.
Without maintainer-mode, only a warning is generated.
strchr() takes a char * as a first parameter, and in the cases a const char * is passed.
This breaks build process at least with gcc 16.1.1 and maintainer-mode enabled.
Without maintainer-mode, only a warning is generated.
Submitted by: jailletc36
Reviewed by: jailletc36, jim, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934885 13f79535-47bb-0310-9956-ffa450edef68
core: Add millisecond support to ErrorLogFormat time specifiers
%{m} prints the timestamp in millisecond-resolution.
* include/util_time.h:
Define new AP_CTIME_OPTION_MSEC option for printing time in milliseconds
format.
* server/util_time.c (ap_recent_ctime_ex):
Handle AP_CTIME_OPTION_MSEC to print time in a millisecond format.
* server/log.c (log_ctime):
Recognize the m time option in both fast-path and composite %{...}t formats.
Submitted by: Luboš Uhliarik <luhliari redhat.com>
* server/log.c (log_ctime): Fix syntax error in r1931452
(added by me when tweaking whitespace, not from the PR author).
Reviewed by: jorton, covener, jim
Github: closes#599
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934884 13f79535-47bb-0310-9956-ffa450edef68
*) mod_http2: update to version 2.0.39
Remove streams own memory allocator after reports of memory problems
with third party modules.
*) mod_http2: update to version 2.0.40
Fix error handling on upload requests when server runs out of file
handles that left beam bucket callbacks in place, potentially using
no longer valid references. Only applies on platforms with pipes
and file descriptor limits not healthy for a network server.
*) mod_http2: update to version 2.0.41
Fix cookie header accounting against LimitRequestFields.
*) mod_http2: update to version 2.0.42
Fix excessive file description use for non-TLS frontend connections when
sending files. Fixes <https://github.com/icing/mod_h2/issues/325>
Submitted By: icing
Reviewed By: various (icing, steffenal, covener jim)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934882 13f79535-47bb-0310-9956-ffa450edef68
The negative lookahead (?!...) is zero-width and non-capturing, so
the original pattern matched only the leading slash and \$1 was
undefined. Add a capturing group (.*)$ after the lookahead so that
\$1 contains the remainder of the URL-path.
Same as trunk r1934878.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934879 13f79535-47bb-0310-9956-ffa450edef68
* modules/dav/fs/repos.c (dav_fs_remove_resource):
Return a 404 if apr_file_remove() fails with an ENOENT error,
likely due to a race with another DELETE.
PR: 60746
Submitted by: jorton
Reviewed by: jorton, rpluem, covener
Github: closes#583
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934836 13f79535-47bb-0310-9956-ffa450edef68
unixd_drop_privileges and ap_unixd_setup_child are almost the same,
so let's remove the redundant code.
geteuid is always successful,
so remove errno reference.
Follow up r1617201:
Return EPERM if the uid is not root on chroot-ing.
Pointed out by trawick on
<CAKUrXK6EGmG1ZD4+UFZ05yznTe6twOU3n57YeO-Ney-_VV_dCQ@mail.gmail.com>
mod_unixd: Make CoreDumpDirectory work for FreeBSD 11+. PR 65819.
FreeBSD 11+ coredumping requires tracing enabled via procctl(PROC_TRACE_CTL).
Submitted by: David CARLIER <devnexen gmail.com>
Reviewed by: ylavic (by inspection)
* modules/arch/unix/mod_unixd.ci (ap_unixd_setup_child):
Do not test euid=0 before going chroot
Nowaday chroot need CAP_SYS_CHROOT capability in its user namespace, and could
work without root.
Will allow to use chroot with lesser permission.
Submitted by: Bastien Roucariès <rouca debian.org>
PR: 69767
Submitted by: takashi, ylavic, jorton
Reviewed by: jorton, rpluem, covener
Github: closes#588
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934835 13f79535-47bb-0310-9956-ffa450edef68
