"[mod_dav_fs etag handling] should really honor the FileETag setting".
- It now does.
- Add "Digest" to FileETag directive, allowing a strong ETag to be
generated using a file digest.
- Add ap_make_etag_ex() and ap_set_etag_fd() to allow full control over
ETag generation.
- Add concept of "binary notes" to request_rec, allowing packed bit flags
to be added to a request.
- First binary note - AP_REQUEST_STRONG_ETAG - allows modules to force
the ETag to a strong ETag to comply with RFC requirements, such as those
mandated by various WebDAV extensions.
Be defensive when the request is missing.
Remove tabs.
Use a dedicated constant for the base64 sha1 length.
Be defensive when calculating the digest. Make sure the offset is initialised
to zero before reading the current offset.
Seek to the start of the file when calculating the ETag.
Add log numbers to util_etag.c.
Add MMAP support to ETag generation.
Use a brigade instead of direct reads, allow APR to handle MMAP.
Yann Ylavic [Tue, 9 Mar 2021 16:09:07 +0000 (16:09 +0000)]
Merge r1875353 from trunk:
* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response): Clear any
possible returned buckets in the brigade in the error case. As we want to
close the connection anyway there is no sensible content we could still
sent and hence doing the needed life time transformation of the buckets
would be a waste.
Yann Ylavic [Tue, 9 Mar 2021 15:44:30 +0000 (15:44 +0000)]
Merge r1883668, r1886255 from trunk:
mod_http2: explicitely apr_thread_exit() at the end of slot_run().
Calling apr_thread_exit() before returning from the thread function avoids
leaking the thread's pool (until/unless APR-2.0 is used).
mod_http2: Fix workers synchronization on pchild cleanup.
When the MPM child exits and pre-workers_pool_cleanup() is called, all the
workers are not necessarily in their idle critical section, thus aborting slots
in the ->idle list only may leave worker threads alive, later blocked in the
idle critical section with no one to wake them.
Instead of the per-slot ->aborted flag, workers_pool_cleanup() will now set
workers->aborted "globally" such that slot_run() does not wait to be woken up
from idle in this case, and all workers really exit.
Also, for workers_pool_cleanup() to wait for all the workers to reach the
->zombies list before returning, a new ->all_done condition variable is armed
when the last thread exits. Since this depends on the atomic ->worker_count to
reach zero, for accuracy the increment in activate_slot() is moved before the
thread startup.
* modules/http2/h2_workers.h (struct h2_workers): volatilize ->aborted and
add the ->all_done condition variable.
* modules/http2/h2_workers.c (push_slot, pop_slot): volatilize the h2_slot*
being cas-ed.
* modules/http2/h2_workers.c (cleanup_zombies): rename to join_zombies(), and
move ->worker_count atomic inc to slot_done().
* modules/http2/h2_workers.c (get_next): when workers->aborted, leave and don't
wait for ->not_idle. Return an int/bool since it's gotten / not gotten.
* modules/http2/h2_workers.c (slot_done): signal ->all_done when the last
worker and the MPM child are exiting.
* modules/http2/h2_workers.c (slot_run): rework the loops now that get_next()
is the stop signal.
* modules/http2/h2_workers.c (workers_pool_cleanup): wait for ->all_done when
needed, and remove the !workers->aborted condition since the cleanup will
only be called once.
* modules/http2/h2_workers.c (activate_slot): move ->worker_count atomic inc
before the thread creation and handle failure rollback.
Joe Orton [Wed, 3 Mar 2021 17:43:04 +0000 (17:43 +0000)]
Merge r1874007 from trunk:
* modules/ssl/ssl_util_ocsp.c (serialize_request): Set the Connection header
to close to indicate that we do not want to keep the HTTP connection to the
OCSP responder alive. We don't reuse the connections currently and if the
OCSP responder keeps the connection alive this could cause us to wait for
keepalive timeout of the OCSP responder to timeout until we finish our
reading of the OCSP response.
mod_ssl: Extend the coalescing filter to avoid sending HTTP response
headers in a separate TLS record to the response body in some cases.
* modules/ssl/ssl_engine_io.c:
Increase size of coalesce buffer to AP_IOBUFSIZE (8Kb).
(ssl_io_filter_coalesce): Try harder to fill the prefix which
gets coalesced, including a read&split of a morphing bucket type
* modules/ssl/ssl_engine_io.c: (ssl_io_filter_coalesce): Handle the
case of a bucket which morphs to a bucket short enough to fit within
the buffer without needing to split.
* modules/ssl/ssl_engine_io.c: Update comment, no function change,
* modules/ssl/ssl_engine_io.c (ssl_io_filter_coalesce): Treat zero-length
buckets consistently (ignore them) after a morphing bucket morphs.
* modules/ssl/ssl_engine_io.c (ssl_io_filter_coalesce): Handle the case
where apr_bucket_read fails with an error and hence our current bucket
remains the morphing bucket and is not replaced with a 'data' bucket.
If the error is not EAGAIN, error out with an AP_FILTER_ERROR,
otherwise just do not consider the morphing bucket that has no data for
coalesce.
* modules/ssl/ssl_engine_io.c (ssl_io_filter_coalesce): Further tweaks
to logic, comments and debugging:
- allow buffering up to exactly COALESCE_BYTES rather than COALESCE_BYTES-1.
- put bucket type name in logging output
- do not coalesce a single-bucket prefix of length equal to the
buffer size (which would be a pointless memory copy).
Yann Ylavic [Tue, 2 Mar 2021 20:51:55 +0000 (20:51 +0000)]
Merge r1885691 from trunk:
mod_proxy_hcheck: don't pile up health checks. PR 63010.
Prevent health checks from running for a worker until the last one is fully
finished, to avoid making things worse (memory growth, #connections, ..).
This is done by zeroing worker->s->updated before scheduling the worker in the
threadpool, and resetting the time when it's finished. The scheduler then does
nothing if worker->s->updated is zero.
Also, to save some apr_time_now() calls when !HC_USE_THREADS, *baton->now is
updated in the callback and reused by the scheduler.
Yann Ylavic [Tue, 2 Mar 2021 20:50:40 +0000 (20:50 +0000)]
Merge r1886141, r1886151 from trunk:
* We need to check for (!scheme && (u = strchr(url, ':')) && (u - url) > 14)
later as (!scheme || u[0] != '/' || u[1] != '/' || u[2] == '\0') is true
for requests with the CONNECT method which we need to decline. But in many
cases requests with the CONNECT method have (u - url) > 14 as in this
case (u - url) is the length of the FQDN the forward proxy should connect
to.
mod_proxy_http: follow up to r1886141, axe overlong scheme check.
Since mod_proxy can see CONNECT URIs, "hostname:port" versus "scheme:"
is hardly distinguishable (we don't want to limit the length of hostnames),
and we don't allocate the scheme anymore while parsing, let's simply decline
unrecognized schemes (overlong or not) and be caught by the no-handler case
if there really is no proxy handler interested.
Ruediger Pluem [Tue, 2 Mar 2021 20:02:32 +0000 (20:02 +0000)]
Merge r1398307, r1465839, r1530603, r1578759, r1729507 from trunk:
* If we face a timeout during receiving the response from the backend and if
we pinged it successfully before don't assume the whole backend has failed.
Assume that only the request has failed and return a gateway timeout then.
Add failontimeout to allow server admin to mark balancer member in err if IO timeout occurs.
ping tuning via Yann Ylavic <ylavic.dev@gmail.com>
Use 'apr_table_setn' instead of 'apr_table_set' when possible in order to save memory.
mod_proxy: axe negative "ping" parameter setting and handling.
This used to check for the backend connection readability only (instead of
the full ping/100-continue round-trip), but the case is already handled by
ap_proxy_connect_backend() which is always called.
Ruediger Pluem [Tue, 2 Mar 2021 07:43:35 +0000 (07:43 +0000)]
Merge r1885939, r1885940, r1885941, r1885945 from trunk:
Do not allow to set empty bind passwords to be set via AuthLDAPBindPassword
Binds with empty passwords always succeed, but in case the password of the
user was not empty subsequent LDAP operations fail.
Before doing any bind check that the provided username is not NULL and that the
password is neither NULL nor empty.
Binds with empty passwords always succeed, but in case the password of the
user was not empty subsequent LDAP operations fail.
This causes authentications that use user supplied credentials
(AuthLDAPInitialBindAsUser set to on) to fail with status code 500 instead of
401 if the user supplied an empty password.
Add an example.
Synch with 2.4.x (syntax highlight) + secret introduced in 2.4.42.
Small doc rearrangement so that the "Beyond this list of basic attributes" is actually after the description of all items.
Add some missing hyper links to directives.
Remove some <var> in <syntax> to be more consistant with the rest of the doc.
Remove a duplicated traling ".".
* When ap_cstr_casecmp[n] have been introduced, in r1747469, it has
introduced many differences between 2.4.x and trunk.
Direct backporting was not that easy because:
- it was initialy introduced as ap_casecmpstr[n] with several patches
- it touched some files that were not in 2.4.x branch
Later, parts of it have already been backported.
This patch tries to clean all this.
Submitted by: many people
Reviewed by: jailletc36, minfrin, ylavic
Backported by: jailletc36
Graham Leggett [Sun, 17 Jan 2021 17:07:42 +0000 (17:07 +0000)]
Backport to v2.4:
*) Easy patches: synch 2.4.x and trunk
- mod_dav: save a few cycles
- mod_{ssl,md}: init_stapling_status hooks should return an int
- util_md5: avoid temporary stack result in ap_md5_binary()
- mod_proxy_balancer: Add a missing </tr>
- mod_md: get_stapling_status hooks should return an int
- mod_session: Improve a message about SessionExpiryUpdateInterval values
trunk patch:
http://svn.apache.org/r1837388
http://svn.apache.org/r1876549
http://svn.apache.org/r1877551
http://svn.apache.org/r1882210
http://svn.apache.org/r1882399
http://svn.apache.org/r1883414
2.4.x patch: svn merge -c 1837388,1876549,1877551,1882210,1882399,1883414 ^/httpd/httpd/trunk .
+1: jailletc36, ylavic, minfrin
Graham Leggett [Sun, 17 Jan 2021 16:41:47 +0000 (16:41 +0000)]
Backport to 2.4:
*) mod_proxy: common spooling code to allow mod_proxy_fgci proxy-sendcl. BZ 57087
trunk patch: https://svn.apache.org/r1884067
https://svn.apache.org/r1884068
https://svn.apache.org/r1884069
https://svn.apache.org/r1884070
2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-mod_proxy_fcgi-sendcl-5on5.patch
https://github.com/apache/httpd/pull/162
+1: ylavic, covener, minfrin
ylavic: Long standing BZ (always send Content-Length, according to the CGI
specs) which is addressed by reusing mod_proxy_http's spooling
code (moved to proxy_util) in mod_proxy_fcgi. The user still needs
to SetEnv proxy-sendcl for that (2.4 compat).
Graham Leggett [Sun, 17 Jan 2021 16:21:35 +0000 (16:21 +0000)]
Backport to v2.4:
*) mod_proxy_http: handle upgrade/tunneling protocols. BZ 61616 is about
mod_proxy_connect but there has been wstunnel reports
on dev@ about that too lately.
trunk patch: https://svn.apache.org/r1678771
https://svn.apache.org/r1832348
https://svn.apache.org/r1869338
https://svn.apache.org/r1869420
https://svn.apache.org/r1878367
https://svn.apache.org/r1877557
https://svn.apache.org/r1877558
https://svn.apache.org/r1877646
https://svn.apache.org/r1877695
https://svn.apache.org/r1879401
https://svn.apache.org/r1879402
https://svn.apache.org/r1880200
https://svn.apache.org/r1885239
https://svn.apache.org/r1885240
https://svn.apache.org/r1885244
2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-mod_proxy_http-upgrade-4on5-v2.patch
https://github.com/apache/httpd/pull/158
+1: ylavic, covener, minfrin
ylavic: All the corresponding trunk changes to mod_proxy_wstunnel (but
r1885239) have been dropped for this backport proposal, the goal
being to handle upgrade in mod_proxy_http from now, while r1885239
allows to benefit from the Upgrade improvements done in proxy_http
with existing wstunnel configurations (provided mod_proxy_http
module is loaded).
projects / thirdparty / apache / httpd.git / log
