Joe Orton 7f5de0aebf Add ap_*_timingsafe() constant-time comparison functions: ...

* include/httpd.h: Declare ap_memeq_timingsafe(),
  ap_streq_timingsafe(), ap_strneq_timingsafe().

* server/util.c: Implement, wrapping apr_*_timingsafe() if
  APR >= 1.8, with a fallback to copied-in versions.

* modules/aaa/mod_auth_digest.c: Replace apr_crypto_equals()
  with ap_memeq_timingsafe(). Remove apr_crypto.h include.

* modules/session/mod_session_crypto.c: Replace local
  ap_crypto_equals() with ap_memeq_timingsafe(). Remove
  the local implementation and macro alias.

Github: closes #638


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1933389 13f79535-47bb-0310-9956-ffa450edef68

2026-04-27 12:54:48 +00:00

..

.indent.pro

…

ap_compat.h

…

ap_config_layout.h.in

Define "state directory" for storing persistent child-writable state,

2018-10-05 15:25:04 +00:00

ap_config.h

add attribute nonnull to a few functions

2012-11-18 19:31:39 +00:00

ap_expr.h

clarification/fixes around the replace() function

2021-08-03 18:29:35 +00:00

ap_hooks.h

core: Add missing AP_IMPLEMENT_OPTIONAL_HOOK_RUN_FIRST.

2016-03-22 17:38:20 +00:00

ap_listen.h

Make the value set for the socket option TCP_DEFER_ACCEPT configurable

2025-08-19 12:45:15 +00:00

ap_mmn.h

Add ap_*_timingsafe() constant-time comparison functions:

2026-04-27 12:54:48 +00:00

ap_mpm.h

mpm_event,mod_http2,mod_status: Follow up to r1918257: CONN_STATE_ASYNC_WAITIO.

2024-06-21 09:48:12 +00:00

ap_provider.h

Add new ap_list_provider_groups() API for mod_info

2011-12-30 10:55:00 +00:00

ap_regex.h

regex: Add AP_REG_NOTEMPTY_ATSTART maching option.

2024-01-16 16:56:58 +00:00

ap_regkey.h

Cleanup effort in prep for GA push:

2011-09-23 13:38:09 +00:00

ap_release.h

Happy New Year 2026

2026-01-04 15:11:13 +00:00

ap_slotmem.h

Error detection and a quick validity check when restoring...

2013-11-08 19:38:20 +00:00

ap_socache.h

* include/ap_socache.h: Update comment only, to remove reference to

2023-11-22 09:03:34 +00:00

apache_noprobes.h

More cleanup: Expand tabs and some more indentation fixes

2011-09-23 18:08:42 +00:00

heartbeat.h

Doxygen fix + reorg to match how other header files are built

2014-05-26 20:09:09 +00:00

http_config.h

Include header file for the explicit regex.

2023-04-14 14:03:03 +00:00

http_connection.h

*) core: adding a new hook and method to the API:

2022-03-18 09:52:52 +00:00

http_core.h

add UNCList directive on Windows

2024-06-24 17:19:44 +00:00

http_log.h

Add missing module_index in the APLOG_MARK note for ap_log_error

2026-02-28 13:07:27 +00:00

http_main.h

Clarify pool lifetime constraints when modifying ap_server_config_defines.

2019-06-20 07:27:06 +00:00

http_protocol.h

add ap_set_content_type_ex to differentiate

2024-06-24 17:22:51 +00:00

http_request.h

* Fix copy and paste error

2023-06-09 11:18:02 +00:00

http_ssl.h

Fix some typo

2022-05-08 12:31:31 +00:00

http_vhost.h

Add StrictHostCheck

2018-08-14 21:47:22 +00:00

httpd.h

Add ap_*_timingsafe() constant-time comparison functions:

2026-04-27 12:54:48 +00:00

mod_auth.h

core: Add the token_checker hook, that allows authentication to take

2023-04-25 17:35:08 +00:00

mod_core.h

Merge PR 311:

2022-04-13 07:40:17 +00:00

mod_request.h

Expose "new" ap_parse_form_data() function instead of requiring

2011-02-18 18:40:31 +00:00

mpm_common.h

Add --enable-sigusr2 to use SIGUSR2 rather than SIGWINCH for graceful

2026-01-19 11:05:38 +00:00

scoreboard.h

*) scoreboard/mod_http2: record durations of HTTP/2 requests.

2025-02-12 09:43:40 +00:00

util_cfgtree.h

Cleanup effort in prep for GA push:

2011-09-23 13:38:09 +00:00

util_charset.h

Move comment from .c to .h in order to make use of it in doxygen.

2014-07-19 13:36:52 +00:00

util_cookies.h

Rename ap_func_attr_* macros to AP_FN_ATTR_*

2012-01-09 13:06:18 +00:00

util_ebcdic.h

Improve doxygen comment.

2014-07-19 08:35:51 +00:00

util_fcgi.h

Fix spelling errors found by codespell. [skip ci]

2020-02-13 18:15:57 +00:00

util_filter.h

core: follow up to r1891148: WC bucket defaulting to FLUSH bucket.

2021-08-20 09:36:19 +00:00

util_ldap.h

mod_ldap: Use the LDAP API directly to implement the rebind callback

2020-06-16 14:31:26 +00:00

util_md5.h

core: Remove support for the Content-MD5 header, removed in RFC7231.

2020-07-03 12:44:53 +00:00

util_mutex.h

Add -D DUMP_RUN_CFG option to dump some configuration items

2011-10-09 18:35:23 +00:00

util_script.h

let httpd handle CL/TE for non-http handlers

2024-04-03 11:49:53 +00:00

util_time.h

core: Add millisecond support to ErrorLogFormat time specifiers

2026-01-21 11:05:12 +00:00

util_varbuf.h

Fix typo spotted by Mike Rumph

2014-07-17 21:36:02 +00:00

util_xml.h

Improve doxygen comment.

2014-07-16 22:22:49 +00:00