summaryrefslogtreecommitdiffstats
path: root/include (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* In case one of the pre_connection hooks causes the hook run to stop by an errorRuediger Pluem2021-09-212-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | the pre_connection hook of the core module maybe did not run (it is APR_HOOK_REALLY_LAST) and hence we missed to - Put the socket in c->conn_config - Setup core output and input filters - Set socket options and timeouts For calls of ap_run_pre_connection where this matters create a wrapper named ap_pre_connection that ensures that this happens. * include/ap_mmn.h: Bump minor version as we added new ap_pre_connection function. * include/http_connection.h: Declare ap_pre_connection prototype. * server/connection.c: Make use of ap_pre_connection in ap_process_connection. * server/core.c: Implement ap_pre_connection. * server/mpm/event/event.c: Make use of ap_pre_connection. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1893497 13f79535-47bb-0310-9956-ffa450edef68
* core: Add ap_create_connection() to create a server or client/proxy connection.Yann Ylavic2021-09-092-1/+24
| | | | | | | | | | | | | | | | | | | | | | c->outgoing shouldn't be set by mod_ssl, ap_create_connection() allows that and this commit also replaces all the calls to ap_run_create_connection() in mod_proxy modules (not in the MPMs which create incoming connections only). * include/http_connection.h, server/connection.c: Declare and implement ap_create_connection(). * modules/proxy/proxy_util.c, modules/proxy/mod_proxy_connect.c, modules/proxy/mod_proxy_ftp.c: Use ap_create_connection() instead of ap_run_create_connection(), and don't provide a connection_id a scoreboard handle for outgoing connection. * server/log.c(do_errorlog_default): Use c->outgoing instead of c->sbh to determine if it's a "client" or "remote" connection. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1893184 13f79535-47bb-0310-9956-ffa450edef68
* *core: clarify comments and use hook API better to check for presence of ↵Stefan Eissing2021-09-091-3/+4
| | | | | | callbacks. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1893164 13f79535-47bb-0310-9956-ffa450edef68
* Fix some typo and doxygen issues.Christophe Jaillet2021-09-051-8/+8
| | | | | | | | | s/and array/an array/ Missing 's' so that @param match the names of the parameters of the function [skip ci] git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1892917 13f79535-47bb-0310-9956-ffa450edef68
* core: follow up to r1891148: WC bucket defaulting to FLUSH bucket.Yann Ylavic2021-08-202-4/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Define WC bucket semantics as: /** * @brief Write Completion (WC) bucket * * A WC bucket is a FLUSH bucket with special ->data == &ap_bucket_wc_data, * still both AP_BUCKET_IS_WC() and APR_BUCKET_IS_FLUSH() hold for them so * they have the same semantics for most filters, namely: * Everything produced before shall be passed to the next filter, including * the WC/FLUSH bucket itself. * The distinction between WC and FLUSH buckets is only for filters that care * about write completion (calling ap_filter_reinstate_brigade() with non-NULL * flush_upto), those can setaside WC buckets and the preceding data provided * they have first determined that the next filter(s) have pending data * already, usually by calling ap_filter_should_yield(f->next). */ The only filters that care about write completion for now are ap_core_output_filter() and ssl_io_filter_output(), which try to fill in the pipe as much as possible, using ap_filter_reinstate_brigade(&flush_upto) to determine whether they should flush (blocking) or setaside their remaining data. So ap_filter_reinstate_brigade() is made to not treat WC as FLUSH buckets and keep the above filters working as before (and correctly w.r.t. above WC bucket semantics). * include/ap_mmn.h, include/util_filter.h: Axe specific ap_bucket_type_wc and define global &ap_bucket_wc_data address to mark WC buckets checked by AP_BUCKET_IS_WC(). * server/util_filter.c (ap_filter_reinstate_brigade): Don't treat WC buckets as FLUSH buckets. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1892468 13f79535-47bb-0310-9956-ffa450edef68
* clarification/fixes around the replace() functionEric Covener2021-08-031-2/+3
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1891990 13f79535-47bb-0310-9956-ffa450edef68
* Corrected MODULE_MAGIC_NUMBER_MINOR.Stefan Eissing2021-07-311-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1891924 13f79535-47bb-0310-9956-ffa450edef68
* * core/mpm: add hook 'child_stopping` that gets called when the MPM isStefan Eissing2021-07-312-0/+11
| | | | | | | | | stopping a child process. The additional `graceful` parameter allows registered hooks to free resources early during a graceful shutdown. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1891919 13f79535-47bb-0310-9956-ffa450edef68
* mod_proxy: Avoid confusion of prefix/regex matching workers at loading. PR ↵Yann Ylavic2021-07-051-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | 65429. ap_proxy_get_worker() needs to know whether it should lookup for prefix or match or both matching workers, depending on the context. For instance <Proxy[Match]> or ProxyPass[Match] directives need to lookup for an existing worker with the same type as the directive (*Match or not), because they will define one with that matching type if none exists. On the contrary, "ProxySet <url>" at load time or ap_proxy_pre_request() at run time need to find a worker matching an url whether it's by prefix or by regex. So this commit adds ap_proxy_get_worker_ex() which takes a bitmask for the matching type and calls it appropriately where needed. For consistency, ap_proxy_define_worker_ex() is also added, using the same bitmask flags, deprecating ap_proxy_define_match_worker(). Follow up to r1891206. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1891284 13f79535-47bb-0310-9956-ffa450edef68
* core: Write Completion (WC) bucket type.Yann Ylavic2021-06-292-1/+27
| | | | | | | | | | | | | | | | | | A WC bucket is meant to prevent buffering/coalescing filters from retaining data, but unlike a FLUSH bucket it won't cause the core output filter to block trying to flush anything before. It can be passed by async handlers which want to never block, followed by ap_filter_should_yield() to check for pending data and eventually suspend processing until MPM/asynchronous write completion finishes. In this commit it's used that way by the tunneling loop of mod_proxy to prevent SSL coaslescing. gh: closes #200 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1891148 13f79535-47bb-0310-9956-ffa450edef68
* *) core/mod_proxy/mod_ssl:Stefan Eissing2021-06-083-1/+40
| | | | | | | | | | | | | | | | | | | | Adding `outgoing` flag to conn_rec, indicating a connection is initiated by the server to somewhere, in contrast to incoming connections from clients. Adding 'ap_ssl_bind_outgoing()` function that marks a connection as outgoing and is used by mod_proxy instead of the previous optional function `ssl_engine_set`. This enables other SSL module to secure proxy connections. The optional functions `ssl_engine_set`, `ssl_engine_disable` and `ssl_proxy_enable` are now provided by the core to have backward compatibility with non-httpd modules that might use them. mod_ssl itself no longer registers these functions, but keeps them in its header for backward compatibility. The core provided optional function wrap any registered function like it was done for `ssl_is_ssl`. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1890605 13f79535-47bb-0310-9956-ffa450edef68
* Allow the tunnelled connections to report theJean-Frederic Clere2021-05-061-1/+4
| | | | | | | read and trasnfered to the back-end worker. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1889550 13f79535-47bb-0310-9956-ffa450edef68
* core/ap_ssl_*: changes after review by rpluemStefan Eissing2021-04-203-19/+9
| | | | | | | | | | | | | | | - removed no longer needed (char*) casts when looking up ssl variables. - move 'goto cleanup;' on separate source line - fixed check for wrong optional function in ap_run_ssl_var_lookup - remove ap_bytes_t again from httpd.h and passes now ocsp identifier as separate const char* and apr_size_t. This follows more how such data is passed in the rest of the server. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1889009 13f79535-47bb-0310-9956-ffa450edef68
* *) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. ↵Stefan Eissing2021-04-133-1/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | This allows modules to access and provide OCSP response data without being tied of each other. The data is exchanged in standard, portable formats (PEM encoded certificates and DER encoded responses), so that the actual SSL/crypto implementations used by the modules are independant of each other. Registration and retrieval happen in the context of a server (server_rec) which modules may use to decide if they are configured for this or not. The area of changes: 1. core: defines 2 functions in include/http_ssl.h, so that modules may register a certificate, together with its issuer certificate for OCSP response provisioning and ask for current response data (DER bytes) later. Also, 2 hooks are defined that allow modules to implement this OCSP provisioning. 2. mod_ssl uses the new functions, in addition to what it did already, to register its certificates this way. If no one is interested in providing OCSP, it falls back to its own (if configured) stapling implementation. 3. mod_md registers itself at the core hooks for OCSP provisioning. Depending on configuration, it will accept registrations of its own certificates only, all certficates or none. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1888723 13f79535-47bb-0310-9956-ffa450edef68
* *) core: provide ap_ssl_* functions in new http_ssl.h header file.Stefan Eissing2021-03-263-157/+201
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1888083 13f79535-47bb-0310-9956-ffa450edef68
* Changed ap_ssl_answer_challenge() and its hook to provide PEM data forStefan Eissing2021-03-031-8/+19
| | | | | | | | | | | certificate and key instead of file names. Added support for this in mod_ssl and verified with a local mod_md version that uses it. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1887151 13f79535-47bb-0310-9956-ffa450edef68
* Adding more ap_ssl_* functions and hooks to the core server.Stefan Eissing2021-03-022-1/+87
| | | | | | | | | | | | | | | | | | - ap_ssl_add_cert_files() to enable other modules like mod_md to provide certificate and keys for an SSL module like mod_ssl. - ap_ssl_add_fallback_cert_files() to enable other modules like mod_md to provide a fallback certificate in case no 'proper' certificate is available for an SSL module like mod_ssl. - ap_ssl_answer_challenge() to enable other modules like mod_md to provide a certificate as used in the RFC 8555 'tls-alpn-01' challenge for the ACME protocol for an SSL module like mod_ssl. - Hooks for 'ssl_add_cert_files', 'ssl_add_fallback_cert_files' and 'ssl_answer_challenge' where modules like mod_md can provide providers to the above mentioned functions. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1887085 13f79535-47bb-0310-9956-ffa450edef68
* *) core: Adding SSL related inquiry functions to the server API.Stefan Eissing2021-02-232-1/+62
| | | | | | | | | | | | | | | | | | | | | | | These function are always available, even when no module providing SSL is loaded. They provide their own "shadowing" implementation for the optional functions of similar name that mod_ssl and impersonators of mod_ssl provide. This enables loading of several SSL providing modules when all but one of them registers itself into the new hooks. Two old-style SSL modules will not work, as they replace the others optional functions with their own. Modules using the old-style optional functions will continue to work as core supplies its own versions of those. The following has been added so far: - ap_ssl_conn_is_ssl() to query if a connection is using SSL. - ap_ssl_var_lookup() to query SSL related variables for a server/connection/request. - Hooks for 'ssl_conn_is_ssl' and 'ssl_var_lookup' where modules providing SSL can install their own value supplying functions. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1886840 13f79535-47bb-0310-9956-ffa450edef68
* s/2020/2021/Christophe Jaillet2021-01-231-1/+1
| | | | | | | | Happy New Year! [skip ci] git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1885835 13f79535-47bb-0310-9956-ffa450edef68
* core: axe struct core_net_rec.Yann Ylavic2020-12-142-16/+3
| | | | | | | | It was only used internally (by the core filters), and it's public API was redundant with conn_config_t. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1884431 13f79535-47bb-0310-9956-ffa450edef68
* Follow up to r1769760: MMN minor bump for ap_get_status_line_ex().Yann Ylavic2020-12-081-1/+2
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1884218 13f79535-47bb-0310-9956-ffa450edef68
* mod_proxy: provide prefetching and spooling mechanisms to all proxy modules.Yann Ylavic2020-12-031-1/+4
| | | | | | | | | | | Export ap_proxy_prefetch_input(), ap_proxy_spool_input() and ap_proxy_read_input() from mod_proxy_http to mod_proxy.h/proxy_util.c so that they are usable by all proxy modules. mod_proxy_fcgi will use them in a following commit. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1884067 13f79535-47bb-0310-9956-ffa450edef68
* mod_dav: Some DAV extensions, like CalDAV, specify both documentGraham Leggett2020-07-151-1/+3
| | | | | | | | | | elements and property elements that need to be taken into account when generating a property. The document element and property element are made available in the dav_liveprop_elem structure under the DAV_PROP_ELEMENT key in the resource pool. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879889 13f79535-47bb-0310-9956-ffa450edef68
* mod_dav: Add utility functions dav_validate_root_ns(),Graham Leggett2020-07-151-1/+4
| | | | | | | | dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() and dav_find_attr() so that other modules get to play too. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879888 13f79535-47bb-0310-9956-ffa450edef68
* Extend method_precondition hook to be called during the PROPFINDGraham Leggett2020-07-051-1/+2
| | | | | | | and LABEL walkers, once for each walked resource. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879522 13f79535-47bb-0310-9956-ffa450edef68
* Bump MMN correctly.Graham Leggett2020-07-031-2/+2
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879479 13f79535-47bb-0310-9956-ffa450edef68
* core: Remove support for the Content-MD5 header, removed in RFC7231.Graham Leggett2020-07-033-17/+2
| | | | | | | | Functions ap_md5digest() and ap_md5contextTo64() removed, and ContentDigest directive. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879472 13f79535-47bb-0310-9956-ffa450edef68
* mod_dav: Allow other DAV modules to use dav_get_resource().Graham Leggett2020-07-031-2/+3
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879466 13f79535-47bb-0310-9956-ffa450edef68
* Follow up to r1879449: yet better MPM poll callback API.Yann Ylavic2020-07-023-7/+5
| | | | | | | | | Let pass a const pfds to the MPM, for it to make a copy on the given pool as needed. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879451 13f79535-47bb-0310-9956-ffa450edef68
* mpm_common: add pool argument to mpm_register_poll_callback[_timeout] hooks.Yann Ylavic2020-07-023-9/+22
| | | | | | | | | | | This is cleaner API than using pfds->pool implicitely. MAJOR bump but reusing the existing hooks (with an API/ABI breakage) because it's trunk material only. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879449 13f79535-47bb-0310-9956-ffa450edef68
* mpm_common: remove ap_mpm_unregister_poll_callback().Yann Ylavic2020-07-023-19/+4
| | | | | | | | | | | It's now called automatically by mpm_event and anyway can't be called safely outside the MPM code without racing. MAJOR bump. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879422 13f79535-47bb-0310-9956-ffa450edef68
* mod_dav: Add method_precondition hook. WebDAV extensions defineGraham Leggett2020-06-291-1/+2
| | | | | | | | conditions that must exist before a WebDAV method can be executed. This hook allows a WebDAV extension to verify these preconditions. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879339 13f79535-47bb-0310-9956-ffa450edef68
* Add hooks deliver_report and gather_reports to mod_dav.h. Allows otherGraham Leggett2020-06-281-1/+3
| | | | | | | modules apart from versioning implementations to handle the REPORT method. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879306 13f79535-47bb-0310-9956-ffa450edef68
* Add dav_get_provider(), dav_open_lockdb() and dav_close_lockdb() mod_dav.h.Graham Leggett2020-06-281-1/+3
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879305 13f79535-47bb-0310-9956-ffa450edef68
* "[mod_dav_fs etag handling] should really honor the FileETag setting".Graham Leggett2020-06-284-10/+99
| | | | | | | | | | | | | | | | - It now does. - Add "Digest" to FileETag directive, allowing a strong ETag to be generated using a file digest. - Add ap_make_etag_ex() and ap_set_etag_fd() to allow full control over ETag generation. - Add concept of "binary notes" to request_rec, allowing packed bit flags to be added to a request. - First binary note - AP_REQUEST_STRONG_ETAG - allows modules to force the ETag to a strong ETag to comply with RFC requirements, such as those mandated by various WebDAV extensions. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879285 13f79535-47bb-0310-9956-ffa450edef68
* Follow up to r1879080: replace ProxyUseOriginalURI by mapping=encoded.Yann Ylavic2020-06-241-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of having a separate ProxyUseOriginalURI directive to control pre_ vs normal translate stage, let's handle this at each ProxyPass level, with the mapping= parameter. At pre_translate stage mod_proxy will handle the "encoded" mapping only, and at translate stage only the others (unless a worker was already elected at the first stage). Note that since mapping=servlet needs to happen encoded too, it's defined like: #define PROXYPASS_MAP_ENCODED 0x08 #define PROXYPASS_MAP_SERVLET 0x18 /* + MAP_ENCODED */ so uch that proxy_trans does the right thing. Follow up to r1879080: replace ProxyUseOriginalURI by mapping=encoded. Instead of having a separate ProxyUseOriginalURI directive to control pre_ vs normal translate stage, let's handle this at each ProxyPass level, with the mapping= parameter. At pre_translate stage mod_proxy will handle the "encoded" mapping only, and at translate stage only the others (unless a worker was already elected at the first stage). Note that since mapping=servlet needs to happen encoded too, it's defined like: #define PROXYPASS_MAP_ENCODED 0x08 #define PROXYPASS_MAP_SERVLET 0x18 /* + MAP_ENCODED */ so that proxy_trans does the right thing. This allows for simpler and consistent mapping configuration, where the translate stage depends only on the mapping= parameter. To implement a fast path (do nothing) when no encoded mapping is configured at pre_trans stage, or all mappings are encoded at translate stage, two bits are added to proxy_server_conf (map_encoded_one:1, map_encoded_all:1) and updated at load time. Thus MINOR is bumped too. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879145 13f79535-47bb-0310-9956-ffa450edef68
* Follow up to r1879079, r1879080: change to DONE semantics for pre_trans hooks.Yann Ylavic2020-06-241-1/+4
| | | | | | | | | | | Don't decode r->uri when pre_trans returns DONE instead of OK, which allows to preserve previous behaviour where decoding was avoided for "ProxyRequests on" or post_read_request RewriteRule [P] only, but not ProxyPass'ed requests. This also preserves decoded location walk in most/same cases. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879137 13f79535-47bb-0310-9956-ffa450edef68
* Add "v6only" Listen option to enable IPV6_V6ONLY in v4mapped buildsJoe Orton2020-06-231-0/+1
| | | | | | | | | | | | | | | where it is otherwise always disabled. * include/ap_listen.h: Define AP_LISTEN_V6ONLY. * server/listen.c (make_sock): Set v6only_setting to 1 if AP_LISTEN_V6ONLY flag is set for the listener. (parse_listen_flags): Parse "v6only" flag. PR: 54878 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879106 13f79535-47bb-0310-9956-ffa450edef68
* Follow up to r1879076: axe stray copy/paste in pre_translate_name description.Yann Ylavic2020-06-221-1/+0
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879095 13f79535-47bb-0310-9956-ffa450edef68
* Add pre_translate_name hook running before URI-path decoding.Yann Ylavic2020-06-222-1/+12
| | | | | | | | | | | | | | This allows any module to work with un-decoded URI-path (besides unreserved characters) in r->uri, and eventually to avoid decoding by returning OK. The first candidate is mod_proxy (following commit) when ProxyMappingDecoded is disabled, such that the forwarded URI is equivalent to the original one. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879076 13f79535-47bb-0310-9956-ffa450edef68
* Add ap_normalize_path() to replace ap_getparents() (with options).Yann Ylavic2020-06-222-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | include/httpd.h: Declare ap_normalize_path() and flags. AP_NORMALIZE_ALLOW_RELATIVE: Don't require that the path be absolute as per RFC 7230. This is needed for lookup subrequests. AP_NORMALIZE_NOT_ABOVE_ROOT: Check that directory traversal ("..") don't go above root, or initial directory with relative paths. AP_NORMALIZE_DECODE_UNRESERVED: Decode unreserved characters (like '.') first since they have the same semantics encoded and decoded. AP_NORMALIZE_MERGE_SLASHES: Merge multiple slahes into a single one. AP_NORMALIZE_DROP_PARAMETERS: Ignore path parameters (";foo=bar"). Not used by httpd but since ap_normalize_path() is taken from mod_jk's jk_servlet_normalize() it can allow them to use the upstream version now. server/util.c: Implement ap_normalize_path(). modules/dav/main/util.c: Replace call to ap_getparents() using ap_normalize_path() with AP_NORMALIZE_DECODE_UNRESERVED flag since the path comes from an obsolute URL (thus potentially %-encoded). modules/generators/mod_autoindex.c: Replace call to ap_getparents() using ap_normalize_path() with AP_NORMALIZE_ALLOW_RELATIVE and AP_NORMALIZE_NOT_ABOVE_ROOT flags to be consistent with original code. include/ap_mmn.h: MINOR bump for ap_normalize_path(). git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879074 13f79535-47bb-0310-9956-ffa450edef68
* Axe an empty line in a dox comment in order to synch with 2.4.xChristophe Jaillet2020-06-191-1/+0
| | | | | | [skip ci] git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879009 13f79535-47bb-0310-9956-ffa450edef68
* mod_ldap: Use the LDAP API directly to implement the rebind callbackJoe Orton2020-06-161-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | for modern versions of OpenLDAP, avoiding the overhead of the apr-util implementation. * modules/ldap/util_ldap.c: Define USE_APR_LDAP_REBIND if a modern version of OpenSSL is used. (uldap_rebind_proc): New function. (uldap_rebind_init, uldap_rebind_add): Define, using either the callback or the (bad) APR-util versions. (uldap_connection_unbind): Clear the rebind pool to remove rebind references prior to destroying the LDAP *. Omit for !USE_APR_LDAP_REBIND. (uldap_connection_init): Use new wrappers, only create the rebind pool if USE_APR_LDAP_REBIND. * include/util_ldap.h: Don't include apr_ldap_rebind.h here. PR: 64414 Github: closes #124 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1878890 13f79535-47bb-0310-9956-ffa450edef68
* core,modules: provide/use ap_parse_strict_length() helper.Yann Ylavic2020-05-202-1/+11
| | | | | | | | | It helps simplifying a lot of duplicated code based on apr_strtoff(), while also rejecting leading plus/minus signs which are dissalowed in Content-Length and (Content-)Range headers. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1877954 13f79535-47bb-0310-9956-ffa450edef68
* mod_proxy_http: handle Upgrade requests and upgraded protocol forwarding.Yann Ylavic2020-05-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the request Upgrade header matches the worker upgrade= parameter and the backend switches the protocol, do the tunneling in mod_proxy_http. This allows to keep the protocol to HTTP until the backend really switches the protocol, and apply usual output filters. When configured to forward Upgrade mechanism, we want the backend to be able to announce its Upgrade protocol to the client (e.g. with 426 Upgrade Required response) and thus forward back the Upgrade header that matches the one(s) configured in the worker upgrade= parameter. modules/proxy/mod_proxy.h: modules/proxy/proxy_util.c: ap_proxy_worker_can_upgrade(): added helper to determine whether a proxy worker is configured to forward an Upgrade protocol. include/ap_mmn.h: Bump MMN minor for ap_proxy_worker_can_upgrade(). modules/proxy/mod_proxy.c: set_worker_param(): handle worker parameter upgrade=ANY as upgrade=* (should the "any" protocol scheme be something some day..). modules/proxy/mod_proxy_wstunnel.c: proxy_wstunnel_handler(): use ap_proxy_worker_can_upgrade() to match the Upgrade header. Axe handling of upgrade=NONE, it makes no sense to Upgrade a connection if the client did not ask for it, nor to configure mod_proxy_wstunnel to use a worker with upgrade=NONE by the way. modules/proxy/mod_proxy_http.c: proxy_http_req_t: add fields force10 (force HTTP/1.0) and upgrade (value of the Upgrade header sent by the client if it matches the configuration, NULL otherwise). proxy_http_handler(): use ap_proxy_worker_can_upgrade() to determine whether the request is electable for end to end protocol upgrading and set req->upgrade accordingly. terminate_headers(): handle Connection and Upgrade headers to send to the backend, according to req->force10 and req->upgrade set before. ap_proxy_http_prefetch(): use req->force10 and terminate_headers(). send_continue_body(): added helper to send the body retained for end to end 100-continue handling. ap_proxy_http_process_response(): use ap_proxy_worker_can_upgrade() to match the response Upgrade header and forward it back if it matches the configured one(s). That is for 101 Switching Protocol obviously but also any other status code which is not overidden, at the backend wish. If the protocol is switching, create a proxy tunnel and run it, using the minimal timeout from the client or backend connection. Github: closes #125 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1877646 13f79535-47bb-0310-9956-ffa450edef68
* util_filter: export ap_filter_adopt_brigade() since mod_ssl uses it.Yann Ylavic2020-05-102-1/+13
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1877548 13f79535-47bb-0310-9956-ffa450edef68
* util_filter: axe misleading AP_BUCKET_IS_MORPHING() macro and fix comments.Yann Ylavic2020-04-271-9/+0
| | | | | | | | | Morphing buckets are not only those with ->length == -1, so the macro is misleading. Modify comments to talk about opaque buckets when length == -1 and about morphing buckets (once) for opaque and FILE buckets. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1877077 13f79535-47bb-0310-9956-ffa450edef68
* Add optional options= argument to Listen to add listener-specificJoe Orton2020-04-232-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | socket options. Reimplement "use_specific_errors" listener flag under generic ap_listen_rec flags field holding all listener-specific options. * include/ap_listen.h: Add AP_LISTEN_* flags. (ap_listen_rec): Rename use_specific_errors to flags. * server/listen.c (make_sock): Set APR_SO_FREEBIND if AP_LISTEN_FREEBIND flag is set on listener; set APR_SO_REUSEPORT unconditionally if AP_LISTEN_REUSEPORT is set. (alloc_listener): Take flags argument. (ap_setup_listeners): Set AP_LISTEN_SPECIFIC_ERRORS flag here. (ap_set_listener): Parse optional options=... argument, catch typos and fail if protocol name contains a "=". (ap_duplicate_listeners): Duplicate flags. Submitted by: jkaluza, Lubos Uhliarik <luhliari redhat.com>, jorton PR: 61865 Github: closes #114 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1876865 13f79535-47bb-0310-9956-ffa450edef68
* core, h2: common ap_parse_request_line() and ap_check_request_header() code.Yann Ylavic2020-04-172-1/+17
| | | | | | | | | Extract parsing/validation code from read_request_line() and ap_read_request() into ap_parse_request_line() and ap_check_request_header() helpers such that mod_http2 can validate its HTTP/1 request with the same/configured policy. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1876674 13f79535-47bb-0310-9956-ffa450edef68
* Axe remainder from r1875947.Yann Ylavic2020-04-161-1/+0
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1876595 13f79535-47bb-0310-9956-ffa450edef68
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 02:31:56 +0100