Joe Orton [Wed, 3 Mar 2021 17:43:04 +0000 (17:43 +0000)]
Merge r1874007 from trunk:
* modules/ssl/ssl_util_ocsp.c (serialize_request): Set the Connection header
to close to indicate that we do not want to keep the HTTP connection to the
OCSP responder alive. We don't reuse the connections currently and if the
OCSP responder keeps the connection alive this could cause us to wait for
keepalive timeout of the OCSP responder to timeout until we finish our
reading of the OCSP response.
mod_ssl: Extend the coalescing filter to avoid sending HTTP response
headers in a separate TLS record to the response body in some cases.
* modules/ssl/ssl_engine_io.c:
Increase size of coalesce buffer to AP_IOBUFSIZE (8Kb).
(ssl_io_filter_coalesce): Try harder to fill the prefix which
gets coalesced, including a read&split of a morphing bucket type
* modules/ssl/ssl_engine_io.c: (ssl_io_filter_coalesce): Handle the
case of a bucket which morphs to a bucket short enough to fit within
the buffer without needing to split.
* modules/ssl/ssl_engine_io.c: Update comment, no function change,
* modules/ssl/ssl_engine_io.c (ssl_io_filter_coalesce): Treat zero-length
buckets consistently (ignore them) after a morphing bucket morphs.
* modules/ssl/ssl_engine_io.c (ssl_io_filter_coalesce): Handle the case
where apr_bucket_read fails with an error and hence our current bucket
remains the morphing bucket and is not replaced with a 'data' bucket.
If the error is not EAGAIN, error out with an AP_FILTER_ERROR,
otherwise just do not consider the morphing bucket that has no data for
coalesce.
* modules/ssl/ssl_engine_io.c (ssl_io_filter_coalesce): Further tweaks
to logic, comments and debugging:
- allow buffering up to exactly COALESCE_BYTES rather than COALESCE_BYTES-1.
- put bucket type name in logging output
- do not coalesce a single-bucket prefix of length equal to the
buffer size (which would be a pointless memory copy).
Yann Ylavic [Tue, 2 Mar 2021 20:51:55 +0000 (20:51 +0000)]
Merge r1885691 from trunk:
mod_proxy_hcheck: don't pile up health checks. PR 63010.
Prevent health checks from running for a worker until the last one is fully
finished, to avoid making things worse (memory growth, #connections, ..).
This is done by zeroing worker->s->updated before scheduling the worker in the
threadpool, and resetting the time when it's finished. The scheduler then does
nothing if worker->s->updated is zero.
Also, to save some apr_time_now() calls when !HC_USE_THREADS, *baton->now is
updated in the callback and reused by the scheduler.
Yann Ylavic [Tue, 2 Mar 2021 20:50:40 +0000 (20:50 +0000)]
Merge r1886141, r1886151 from trunk:
* We need to check for (!scheme && (u = strchr(url, ':')) && (u - url) > 14)
later as (!scheme || u[0] != '/' || u[1] != '/' || u[2] == '\0') is true
for requests with the CONNECT method which we need to decline. But in many
cases requests with the CONNECT method have (u - url) > 14 as in this
case (u - url) is the length of the FQDN the forward proxy should connect
to.
mod_proxy_http: follow up to r1886141, axe overlong scheme check.
Since mod_proxy can see CONNECT URIs, "hostname:port" versus "scheme:"
is hardly distinguishable (we don't want to limit the length of hostnames),
and we don't allocate the scheme anymore while parsing, let's simply decline
unrecognized schemes (overlong or not) and be caught by the no-handler case
if there really is no proxy handler interested.
Ruediger Pluem [Tue, 2 Mar 2021 20:02:32 +0000 (20:02 +0000)]
Merge r1398307, r1465839, r1530603, r1578759, r1729507 from trunk:
* If we face a timeout during receiving the response from the backend and if
we pinged it successfully before don't assume the whole backend has failed.
Assume that only the request has failed and return a gateway timeout then.
Add failontimeout to allow server admin to mark balancer member in err if IO timeout occurs.
ping tuning via Yann Ylavic <ylavic.dev@gmail.com>
Use 'apr_table_setn' instead of 'apr_table_set' when possible in order to save memory.
mod_proxy: axe negative "ping" parameter setting and handling.
This used to check for the backend connection readability only (instead of
the full ping/100-continue round-trip), but the case is already handled by
ap_proxy_connect_backend() which is always called.
Ruediger Pluem [Tue, 2 Mar 2021 07:43:35 +0000 (07:43 +0000)]
Merge r1885939, r1885940, r1885941, r1885945 from trunk:
Do not allow to set empty bind passwords to be set via AuthLDAPBindPassword
Binds with empty passwords always succeed, but in case the password of the
user was not empty subsequent LDAP operations fail.
Before doing any bind check that the provided username is not NULL and that the
password is neither NULL nor empty.
Binds with empty passwords always succeed, but in case the password of the
user was not empty subsequent LDAP operations fail.
This causes authentications that use user supplied credentials
(AuthLDAPInitialBindAsUser set to on) to fail with status code 500 instead of
401 if the user supplied an empty password.
Add an example.
Synch with 2.4.x (syntax highlight) + secret introduced in 2.4.42.
Small doc rearrangement so that the "Beyond this list of basic attributes" is actually after the description of all items.
Add some missing hyper links to directives.
Remove some <var> in <syntax> to be more consistant with the rest of the doc.
Remove a duplicated traling ".".
* When ap_cstr_casecmp[n] have been introduced, in r1747469, it has
introduced many differences between 2.4.x and trunk.
Direct backporting was not that easy because:
- it was initialy introduced as ap_casecmpstr[n] with several patches
- it touched some files that were not in 2.4.x branch
Later, parts of it have already been backported.
This patch tries to clean all this.
Submitted by: many people
Reviewed by: jailletc36, minfrin, ylavic
Backported by: jailletc36
Graham Leggett [Sun, 17 Jan 2021 17:07:42 +0000 (17:07 +0000)]
Backport to v2.4:
*) Easy patches: synch 2.4.x and trunk
- mod_dav: save a few cycles
- mod_{ssl,md}: init_stapling_status hooks should return an int
- util_md5: avoid temporary stack result in ap_md5_binary()
- mod_proxy_balancer: Add a missing </tr>
- mod_md: get_stapling_status hooks should return an int
- mod_session: Improve a message about SessionExpiryUpdateInterval values
trunk patch:
http://svn.apache.org/r1837388
http://svn.apache.org/r1876549
http://svn.apache.org/r1877551
http://svn.apache.org/r1882210
http://svn.apache.org/r1882399
http://svn.apache.org/r1883414
2.4.x patch: svn merge -c 1837388,1876549,1877551,1882210,1882399,1883414 ^/httpd/httpd/trunk .
+1: jailletc36, ylavic, minfrin
Graham Leggett [Sun, 17 Jan 2021 16:41:47 +0000 (16:41 +0000)]
Backport to 2.4:
*) mod_proxy: common spooling code to allow mod_proxy_fgci proxy-sendcl. BZ 57087
trunk patch: https://svn.apache.org/r1884067
https://svn.apache.org/r1884068
https://svn.apache.org/r1884069
https://svn.apache.org/r1884070
2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-mod_proxy_fcgi-sendcl-5on5.patch
https://github.com/apache/httpd/pull/162
+1: ylavic, covener, minfrin
ylavic: Long standing BZ (always send Content-Length, according to the CGI
specs) which is addressed by reusing mod_proxy_http's spooling
code (moved to proxy_util) in mod_proxy_fcgi. The user still needs
to SetEnv proxy-sendcl for that (2.4 compat).
Graham Leggett [Sun, 17 Jan 2021 16:21:35 +0000 (16:21 +0000)]
Backport to v2.4:
*) mod_proxy_http: handle upgrade/tunneling protocols. BZ 61616 is about
mod_proxy_connect but there has been wstunnel reports
on dev@ about that too lately.
trunk patch: https://svn.apache.org/r1678771
https://svn.apache.org/r1832348
https://svn.apache.org/r1869338
https://svn.apache.org/r1869420
https://svn.apache.org/r1878367
https://svn.apache.org/r1877557
https://svn.apache.org/r1877558
https://svn.apache.org/r1877646
https://svn.apache.org/r1877695
https://svn.apache.org/r1879401
https://svn.apache.org/r1879402
https://svn.apache.org/r1880200
https://svn.apache.org/r1885239
https://svn.apache.org/r1885240
https://svn.apache.org/r1885244
2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-mod_proxy_http-upgrade-4on5-v2.patch
https://github.com/apache/httpd/pull/158
+1: ylavic, covener, minfrin
ylavic: All the corresponding trunk changes to mod_proxy_wstunnel (but
r1885239) have been dropped for this backport proposal, the goal
being to handle upgrade in mod_proxy_http from now, while r1885239
allows to benefit from the Upgrade improvements done in proxy_http
with existing wstunnel configurations (provided mod_proxy_http
module is loaded).
Graham Leggett [Sat, 16 Jan 2021 14:22:41 +0000 (14:22 +0000)]
Backport 2.4:
*) mod_proxy_http: individual status codes for ProxyErrorOverride. BZ 63628
trunk patch: https://svn.apache.org/r1754974
https://svn.apache.org/r1754975
https://svn.apache.org/r1876404
https://svn.apache.org/r1877696
https://svn.apache.org/r1877697
https://svn.apache.org/r1877728
2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-mod_proxy_http-override-3on5.patch
https://github.com/apache/httpd/pull/157
+1: ylavic, covener, minfrin
ylavic: Besides ProxyErrorOverride individual status codes, merging now
the non-functional changes in ap_proxy_http_process_response()
around ProxyErrorOverride code helps reducing conflicts with the
following commits, and with trunk/2.4 alignment still.
Graham Leggett [Sat, 16 Jan 2021 14:08:29 +0000 (14:08 +0000)]
Backport to 2.4:
*) core: output filtering improvements (ease following patches, align trunk/2.4)
trunk patch: https://svn.apache.org/r1836032
https://svn.apache.org/r1884295
https://svn.apache.org/r1884296
https://svn.apache.org/r1884304
https://svn.apache.org/r1836237
https://svn.apache.org/r1836258
https://svn.apache.org/r1836354
https://svn.apache.org/r1843939
2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-core_output_filtering-2on5.patch
https://github.com/apache/httpd/pull/156
+1: ylavic, covener, minfrin
ylavic: These core output filter changes are needed for the proxy
tunneling loop to work properly/non-blocking (PR 158 below). They
do not include the major filter setaside/reinstate changes from
trunk, reluing on existing 2.4 c->data_in_{input,output}_filter
flags only.
Graham Leggett [Sat, 16 Jan 2021 13:03:49 +0000 (13:03 +0000)]
Backport to 2.4:
*) core: Make writing the pidfile atomic to avoid startup failures
after (e.g.) system crashes, but also races with multiple
concurrent "httpd -k restart" runs which have a race between
reading and writing a fresh pidfile.
trunk patch: https://svn.apache.org/r1875153
https://svn.apache.org/r1875240
https://svn.apache.org/r1877645
2.4.x patch: https://patch-diff.githubusercontent.com/raw/apache/httpd/pull/163.patch
+1: jorton, covener, ylavic
Yann Ylavic [Tue, 5 Jan 2021 10:30:09 +0000 (10:30 +0000)]
Merge r1883744 from trunk:
mod_proxy: pconf vs pchild consistency, and correctness in ONE_PROCESS mode.
Consistently use pconf for ap_proxy_define_{worker,balancer}() and pchild for
ap_proxu_initialize_{worker,balancer}() in mod_proxy [child_]init code.
pchild is needed in _initialize() for mutexes/shms' child_init and cleanup,
and to avoid a crash on shutdown (i.e. ap_terminate) in ONE_PROCESS mode,
where worker->cp->pool is destroyed twice, let's register conn_pool_cleanup()
as a pre_cleanup of pchild.
projects / thirdparty / apache / httpd.git / log
