Merge r661506 from trunk:

* According to RFC 2616 8.2.3 we are not allowed to forward an
  Expect: 100-continue to an HTTP/1.0 server. Instead we MUST return
  a HTTP_EXPECTATION_FAILED.

Submitted by: rpluem
Reviewed by: jim, rpluem, niq

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@678203 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 9b11c534ae95e3f6793fb227bff6e2d23184cb94..dcd4361c51e732e4517bfd4597b3c1acc655cb62 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.2.10
 
+  *) mod_proxy_http: Do not forward requests with 'Expect: 100-continue' to
+     known HTTP/1.0 servers. Return 'Expectation failed' (417) instead.
+     [Ruediger Pluem]
 
 Changes with Apache 2.2.9
 

diff --git a/STATUS b/STATUS
index 309869afd8f77ea1258d5256ea14c18cfa377919..aa0d3f64c5d532f261922b69d5f7708e4f79b73f 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -83,14 +83,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
- * mod_proxy_http: Do not forward an Expect: 100-continue to
-   an HTTP/1.0 server
-   Trunk version of patch:
-         http://svn.apache.org/viewvc?view=rev&revision=661506
-   Backport version for 2.2.x of patch:
-         Trunk version of patch works
-   +1: jim, rpluem, niq
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 

diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
index 3ca21895f72ca19f8bfd93258a1b6e836b0abf07..b8dcbbaa0843ed0f165c08c1f7a6f7f4176a56c6 100644 (file)
--- a/modules/proxy/mod_proxy_http.c
+++ b/modules/proxy/mod_proxy_http.c
@@ -699,6 +699,14 @@ int ap_proxy_http_request(apr_pool_t *p, request_rec *r,
     if (apr_table_get(r->subprocess_env, "force-proxy-request-1.0")) {
         buf = apr_pstrcat(p, r->method, " ", url, " HTTP/1.0" CRLF, NULL);
         force10 = 1;
+        /*
+         * According to RFC 2616 8.2.3 we are not allowed to forward an
+         * Expect: 100-continue to an HTTP/1.0 server. Instead we MUST return
+         * a HTTP_EXPECTATION_FAILED
+         */
+        if (r->expecting_100) {
+            return HTTP_EXPECTATION_FAILED;
+        }
         p_conn->close++;
     } else {
         buf = apr_pstrcat(p, r->method, " ", url, " HTTP/1.1" CRLF, NULL);