mod_http2: Don't abort a debug build over a stream reclaimed unprocessed.
A stream created but never scheduled (e.g. after a connection-level
protocol error) is reclaimed with the session pool rather than
destroyed explicitly, which is harmless; use-after-free is still
caught by H2_STRM_ASSERT_MAGIC at each use. nghttp2 promoted various
stream errors to connection errors in 1.67.0, which triggers this
assertion.
* modules/http2/h2_stream.c (stream_pool_destroy): Trace-log rather than
assert for a stream reclaimed without an explicit destroy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Github: closes#775
Reviewed by: jorton, covener, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1938634 13f79535-47bb-0310-9956-ffa450edef68
Fix pre-1.1.0 compat macros for X509_get0_notBefore/notAfter/serialNumber
The compat macros added in 83d565f for pre-1.1.0 OpenSSL used incorrect
names (X509_get0_before/X509_get0_after) which don't match the actual
API names used in the code (X509_get0_notBefore/X509_get0_notAfter).
This caused link failures when building against OpenSSL 1.0.2.
Also add missing X509_get0_serialNumber compat macro which was used in
ssl_engine_log.c but never shimmed for pre-1.1.0.
Submitted by: Craig Lorentzen <crlorent amazon.com>
Github: closes#673, closes#742
Reviewed by: jorton, covener, rjung
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1938342 13f79535-47bb-0310-9956-ffa450edef68
PR59039 Digest not working with ap_expr based AuthName
Stop caching the configured realm during config processing and always
call ap_auth_name(r) to determine (=evaluate potential expression)
the configured realm
* modules/aaa/mod_auth_digest.c: Remove undocumented and unimplemented
AuthDigestNonceFormat directive.
PR: 70056
mod_auth_digest: Drop RFC 2069 and configurable qop support.
(RFC 2617, which replaced 2069, is now 26 years old)
* modules/aaa/mod_auth_digest.c (digest_config_rec): Remove qop_list
field.
(create_digest_dir_config): Remove qop_list initialization.
(set_qop): Deprecate AuthDigestQop, only "auth" is supported.
(note_digest_auth_failure): Always send qop="auth".
(check_nc): Remove handling for qop=none.
(old_digest): Remove function.
(authenticate_digest_user): Reject requests with missing or
non-"auth" qop value rather than falling back to RFC 2069.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR #661
* modules/aaa/mod_auth_digest.c: Remove "weird" override of AuthName
directive, which adds complexity for little benefit (avoids putting
20 bytes through SHA1 for each auth attempt).
(set_realm): Remove function.
(gen_nonce_hash): Create the nonce hash here from scratch.
(create_digest_dir_config): Always allocate a config struct.
Remove unused dir_name field from digest_config_rec.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR #661
* modules/aaa/mod_auth_digest.c (set_algorithm): Note that
conf->algorithm is a constant ("MD5") so there is no point
in overriding it at runtime. Simplify error case.
GitHub: PR #661
* modules/aaa/config.m4,
modules/aaa/mod_auth_digest.c (pre_init, initialize_module):
Prevent using mod_auth_digest without APR_HAS_SHARED_MEMORY.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c: Use apr_uint32_t for the
one-time-nonce counter.
(gen_nonce): Drop the fallback case for non-shmem builds
where otn_counter could be NULL previously. Use atomics
to increment the counter.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c (get_digest_rec):
Parse opaque more strictly.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c (cleanup_tables, initialize_tables,
initialize_child, gen_client): Replace mutex-protected opaque_cntr
with opaque_counter, incremented via atomics.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c (pre_init): Don't register
now-unused "authdigest-opaque" mutex type.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c: Remove checks for NULL client_shm
throughout.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c: Fix comments.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c (add_auth_info): Don't add
(Proxy-)Authentication-Info headers to 401/407 responses.
GitHub: PR #661
* modules/aaa/mod_auth_digest.c: Fix AuthDigestNcCheck: track the
nonce-count per-nonce, require it to increase (RFC 7616 3.4.3), and
record it only for a fully verified request.
* test/modules/aaa/test_007_replay.py: Add replay tests.
* test/modules/aaa/test_003_nccheck.py, test/modules/aaa/conftest.py:
Update for the new semantics.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c: Consolidate one-time nonce handling
in check_and_record_nonce, accepting a nonce iff it is newer than
the last used, and re-challenging as stale when reused.
* test/modules/aaa/test_008_onetime_nccheck.py: Add tests for one-time
nonces, alone and with AuthDigestNcCheck.
* test/modules/aaa/conftest.py: Add an AuthDigestNonceLifetime 0 plus
AuthDigestNcCheck location.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c (get_digest_rec): Rename to
parse_digest_header, returning the header status the caller stores
in resp->auth_hdr_sts. (parse_digest_header): Rename to
init_digest_request.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c: Don't let a client_entry pointer
escape the client_lock critical section; look up and release per
access rather than caching the pointer across the request.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c (note_digest_auth_failure): Return 503
when the client entry cannot be allocated, rather than sending a
challenge with no opaque. Default the opaque to NULL to match what
check_nonce() hashes when the client sends none.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c (client_generate): Skip a client id
of zero, which the counter hands out once it wraps: zero means "no
client", so add_client() refuses it.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c (gc): Return unsigned long, the type
the count is accumulated in and the type of the client_list counters.
(add_client): Log those counters with %lu, all being unsigned.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
* modules/aaa/mod_auth_digest.c: Fail the build without APR_HAS_RANDOM
or APR_HAS_SHARED_MEMORY, rather than testing at runtime. configure
already declines to build the module without them.
Assisted-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR #705
Submitted by: covener, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton, jorton
Reviewed by:
Github: closes#706
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1937721 13f79535-47bb-0310-9956-ffa450edef68
graceful GOAWAY (error code 0) while streams it opened are still being
processed; drain the open streams instead of tearing the session down
(RFC 9113 compliant, bounded by Timeout). Async MPMs hit this far more
than event. Independently useful; also a prerequisite for mpm_motorz+h2
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1937717 13f79535-47bb-0310-9956-ffa450edef68
mod_md: Add OpenSSL 4.0 compatibility:
* Use getters instead of direct member access.
* Struct was made opaque in OpenSSL 4. Getters exist since OpenSSL 1.1.0.
* Keep OpenSSL 1.0.2 compatibility.
Merge from icing/md:
9fd90380db
Backport of r1935161 from trunk, [mod_md CTR]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1935449 13f79535-47bb-0310-9956-ffa450edef68
The number of members in ostat_by_id may be up to UINT_MAX
and there are no guarantees that all types of members (good,
revoked or unknown) are present. An integer overflow may also
occur in md_ocsp_get_summary() when they are summed as ints.
Change types of good, revoked and unknown to unsigned.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Submitted by: Anastasia Belova <nabelova31 gmail.com>
Github: closes#534
Backport of r1930710 from trunk, [mod_md CTR]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1935448 13f79535-47bb-0310-9956-ffa450edef68
mod_proxy_html: Simplify to use the ap_varbuf API.
* modules/filters/mod_proxy_html.c: Include util_varbuf.h.
(saxctxt): Replace buf/offset/avail members with struct ap_varbuf vb.
(DEFAULT_BUFSZ): New macro.
(normalise): Take struct ap_varbuf * parameter instead of char *.
(preserve, pappend): Remove functions, replaced by ap_varbuf_grow
and ap_varbuf_strmemcat respectively.
(dump_content): Use ap_varbuf for regex substitutions via
ap_varbuf_regsub, avoiding manual buffer resizing with
preserve/memmove/memcpy. Use a temporary ap_varbuf for building
regex replacement results.
(pcharacters, pcomment): Use ap_varbuf_strmemcat and ap_varbuf_strcat
in place of pappend.
(pendElement): Check vb.strlen instead of offset.
(pstartElement): Use ap_varbuf for attribute URL rewriting with the
same ap_varbuf_regsub approach. Use a temporary ap_varbuf for
regex replacements.
(proxy_html_filter): Initialize the ap_varbuf with a clamped bufsz.
(proxy_html_merge): Use DEFAULT_BUFSZ macro.
Assisted-by: Claude Opus 4.6 (claude-opus-4-6)
Reviewed by: covener, jfclere, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934977 13f79535-47bb-0310-9956-ffa450edef68
Fix OpenSSL 4.0 compatibility and test that in CI.
CI: Update to test OpenSSL 4.0.0 explicitly.
CI: No longer disable deprecated-declaration warnings for OpenSSL 3.4 -Werror build.
* modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Change name to
const X509_NAME *.
(ssl_callback_proxy_cert): Change ca_name, issuer, and ca_issuer to
const X509_NAME *.
* modules/ssl/ssl_engine_log.c (ssl_log_cert_error): Change cert
parameter to const X509 *. Use X509_get0_serialNumber,
X509_get0_notBefore, and X509_get0_notAfter instead of non-const
variants.
(ssl_log_xerror, ssl_log_cxerror, ssl_log_rxerror): Change cert
parameter to const X509 *.
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn): Change
xsname parameter to const X509_NAME *.
(ssl_var_lookup_ssl_cert_dn_oneline): Change xsname parameter to
const X509_NAME *.
(ssl_var_lookup_ssl_cert): Change xsname to const X509_NAME *.
(ssl_var_lookup_ssl_cert_rfc4523_cea): Change issuer to const
X509_NAME *.
* modules/ssl/ssl_private.h (ssl_log_xerror, ssl_log_cxerror,
ssl_log_rxerror): Update declarations to use const X509 *.
* modules/ssl/ssl_util_ssl.c (modssl_X509_NAME_to_string): Change dn
parameter to const X509_NAME *.
(getIDs): Change subj to const X509_NAME *.
* modules/ssl/ssl_util_ssl.h (modssl_X509_NAME_to_string): Update
declaration to use const X509_NAME *.
* support/ab.c (ssl_print_cert_info): Change dn to const X509_NAME *.
mod_ssl: use ASN1_STRING accessor API in dump_extn_value:
* modules/ssl/ssl_engine_vars.c (dump_extn_value): Use
ASN1_STRING_get0_data() and ASN1_STRING_length() rather than
directly dereferencing the ASN1_OCTET_STRING structure, which is
opaque in OpenSSL 4.0.
* modules/ssl/ssl_private.h: Add compat macros for
ASN1_STRING_get0_data and ASN1_STRING_length for pre-1.1 API.
mod_ssl: constify ASN1_TIME pointers, use X509_get0_not{Before,After}:
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_valid,
ssl_var_lookup_ssl_cert_remain): Constify ASN1_TIME * parameter.
(ssl_var_lookup_ssl_cert): Use X509_get0_notBefore() and
X509_get0_notAfter() which return const pointers.
(ssl_var_lookup_ssl_cert_remain): Use ASN1_TIME_check() directly
rather than INVALID_ASN1_TIME macro which dereferences the
ASN1_TIME structure.
(dump_extn_value): Constify ASN1_OCTET_STRING * parameter.
* modules/ssl/ssl_private.h: Add compat macros for
X509_get0_before and X509_get0_after for pre-1.1 API.
mod_ssl: constify X509_NAME_ENTRY and X509_EXTENSION pointers:
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn,
extract_dn): Constify X509_NAME_ENTRY * variables, constify
X509_NAME * parameter of extract_dn, drop unnecessary casts
on X509_NAME_ENTRY_get_object() calls.
(ssl_ext_list): Use MODSSL_X509_EXT_CONST for X509_EXTENSION *
since X509_EXTENSION accessors are only constified in OpenSSL 4.
* modules/ssl/ssl_util_ssl.c, modules/ssl/ssl_util_ssl.h
(modssl_X509_NAME_ENTRY_to_string): Constify X509_NAME_ENTRY *
parameter.
* modules/ssl/ssl_private.h: Add MODSSL_X509_EXT_CONST, defined
as const for OpenSSL 4+ and empty otherwise.
* modules/ssl/ssl_util_ssl.c (asn1_string_convert): Constify
ASN1_STRING * argument.
* modules/ssl/ssl_engine_ocsp.c (extract_responder_uri): Use
modssl_ASN1_STRING_convert instead of directly accessing ASN1_STRING
data pointer.
* modules/ssl/ssl_util_ssl.c (modssl_ASN1_STRING_convert): Rename from
asn1_string_convert and export function.
(asn1_string_to_utf8): Update to use modssl_ASN1_STRING_convert.
(modssl_X509_NAME_ENTRY_to_string): Update to use
modssl_ASN1_STRING_convert.
* modules/ssl/ssl_util_ssl.h (modssl_ASN1_STRING_convert): Declare new
function.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CI: Add OpenSSL 3.1 builds, including a no-engine build.
(attempt to use 3.2 failed, unsure why)
- add OpenSSL build binaries to $PATH
CI: add OpenSSL 3.2, test OpenSSL 3.x using Apache::Test
trunk to pick up r1916067.
CI: The OpenSSL no-engine config option is redundant as of 4.0, remove.
CI: Try to fix ab failures during OpenSSL ech job, set RPATH via LDFLAGS
CI: For OpenSSL branch builds, always build a fresh version of the
OpenSSL branch and cache the commit hash to allow checking for freshness.
Also clone with --depth=1 to save time+bandwidth.
Reviewed by: jorton, covener (skimmed+CI results), rpluem
Github: closes#642
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934973 13f79535-47bb-0310-9956-ffa450edef68
mod_ssl: Set auth type to \"ClientCert\" after authentication
When client certificate authentication has been performed r->ap_auth_type was
never populated and env AUTH_TYPE was empty.
We now set auth type to \"ClientCert\".
PR: 45058
Submitted by: Michael Osipov <michaelo@apache.org>
Reviewed by: michaelo, jorton, rpluem
Github: closes#645
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934901 13f79535-47bb-0310-9956-ffa450edef68
mod_ssl: Expose serialNumber (2.5.4.5) as standard env var from certificate DN
serialNumber (2.5.4.5) is a standard LDAP attribute embedded in the subject's
and/or issuer's DN, extract it by standard means from the DN and expose
via StdEnvVars.
PR: 35154
Co-authored-by: Michael Osipov <michaelo@apache.org>
Submitted by: Benjamin Demarteau <benjamin.demarteau@liege.be>
Reviewed By: michaelo, jorton, rpluem
Github: closes#644
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934900 13f79535-47bb-0310-9956-ffa450edef68
expr parse fail should hide conditional content
these are neither true or false, the enclosing content should not
be printed
Submitted by: covener
Reviewed by: covener, jorton, rpluem
Github: closes#658
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934899 13f79535-47bb-0310-9956-ffa450edef68
memchr() takes a char * as a first parameter, and 'buf' is a const char *.
This breaks build process at least with gcc 16.1.1 and maintainer-mode enabled.
Without maintainer-mode, only a warning is generated.
strchr() takes a char * as a first parameter, and in the cases a const char * is passed.
This breaks build process at least with gcc 16.1.1 and maintainer-mode enabled.
Without maintainer-mode, only a warning is generated.
Submitted by: jailletc36
Reviewed by: jailletc36, jim, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934885 13f79535-47bb-0310-9956-ffa450edef68
