Stefan Eissing [Thu, 3 Mar 2022 09:31:51 +0000 (09:31 +0000)]
Merge of r1898127 from trunk:
*) mod_proxy: Use the maxium of front end and backend timeouts instead of the
minimum when tunneling requests (websockets, CONNECT requests).
Backend timeouts can be configured more selectively (per worker if needed)
as front end timeouts and typically the backend timeouts reflect the
application requirements better. PR 65886
Yann Ylavic [Mon, 28 Feb 2022 11:56:43 +0000 (11:56 +0000)]
ap_regex: Use Thread Local Storage (if efficient) to avoid allocations.
PCRE2 wants an opaque context by providing the API to allocate and free it, so
to minimize these calls we maintain one opaque context per thread (in Thread
Local Storage, TLS) grown as needed, and while at it we do the same for PCRE1
ints vectors. Note that this requires a fast TLS mechanism to be worth it,
which is the case of apr_thread_data_get/set() from/to apr_thread_current()
when APR_HAS_THREAD_LOCAL; otherwise we'll do the allocation and freeing for
each ap_regexec().
The small stack vector is used for PCRE1 && !APR_HAS_THREAD_LOCAL only now.
Follow up to r1897240: APR_HAS_THREAD_LOCAL wants #ifdef instead of #if.
Follow up to r1897240: CHANGES entry.
ap_regex: PCRE needs buffers sized against the number of captures only.
No more (useless), no less (or PCRE will allocate a new buffer by itself to
satisfy the needs), so we should base our buffer size solely on the number
of captures in the regex (determined at compile time from the pattern).
The nmatch provided by the user is used to fill in pmatch only (up to that),
but "our" buffers are sized exactly as needed to avoid oversized allocations
or PCRE allocating by itself.
ap_regex: Follow up to r1897244: Fix pmatch overflow and returned value at limits.
Don't write to pmatch[nlimit:] when ncaps > nmatch, rc should not exceed nmatch
either as before r1897244.
ap_regex: Follow up to r1897240: Fix issues spotted by Rüdiger (thanks!).
#include "apr_thread_proc.h" is enough/needed by util_pcre.c and main.c.
Fix compilation (vector => ovector) for !HAVE_PCRE2 && APR_HAS_THREAD_LOCAL.
Check pcre2_match_data_create() return value for HAVE_PCRE2 && !APR_HAS_THREAD_LOCAL.
ap_regex: Follow up to r1897240: runtime fallback to alloc/free.
Even though APR_HAS_THREAD_LOCAL is compiled in, ap_regexec() might still be
called by non a apr_thread_t thread, let's fall back to alloc/free in this
case too.
ap_regex: Follow up to r1897240: no ap_thread_current() yet.
ap_regex: Follow up to r1897240: cleanups.
ap_regex: Follow up to r1897240: cleanup PCRE2 match data on exit.
ap_regex: Follow up to r1897240: #if APR_HAS_THREAD_LOCAL, not #ifdef.
core: Efficient ap_thread_current() with APR < 1.8.
#define ap_thread_create, ap_thread_current_create and ap_thread_current to
their apr-1.8+ equivalent if available, or implement them using the compiler's
thread_local mechanism if available, or finally provide stubs otherwise.
#define AP_HAS_THREAD_LOCAL to 1 in the two former case or 0 otherwise, while
AP_THREAD_LOCAL is defined to the compiler's keyword iff AP_HAS_THREAD_LOCAL.
Replace all apr_thread_create() calls with ap_thread_create() so that httpd
threads can use ap_thread_current()'s pool data as Thread Local Storage.
Bump MMN minor.
* include/httpd.h():
Define AP_HAS_THREAD_LOCAL, AP_THREAD_LOCAL (eventually), ap_thread_create(),
ap_thread_current_create() and ap_thread_current().
* server/util.c:
Implement ap_thread_create(), ap_thread_current_create() and
ap_thread_current() when APR < 1.8.
* modules/core/mod_watchdog.c, modules/http2/h2_workers.c,
modules/ssl/mod_ssl_ct.c:
Use ap_thread_create() instead of apr_thread_create.
* server/main.c:
Use AP_HAS_THREAD_LOCAL and ap_thread_current_create instead of APR's.
* server/util_pcre.c:
Use AP_HAS_THREAD_LOCAL and ap_thread_current instead of APR's.
* server/mpm/event/event.c, server/mpm/worker/worker.c,
server/mpm/prefork/prefork.c:
Use ap_thread_create() instead of apr_thread_create.
Create an apr_thread_t/ap_thread_current() for the main chaild thread usable
at child_init().
* server/mpm/winnt/child.c:
Use ap_thread_create() instead of CreateThread().
Create an apr_thread_t/ap_thread_current() for the main chaild thread usable
Follow up to r1897460: APLOGNOs.
Follow up to r1897460: !APR_HAS_THREAD implies no ap_thread_* either.
core: Follow up to r1897460: Implement and use ap_thread_current_after_fork().
thread_local variables are not (always?) reset on fork(), so we need a way
to set the current_thread to NULL in the child process.
Implement and use ap_thread_current_after_fork() for that.
* server/mpm/event/event.c, server/mpm/prefork/prefork.c,
server/mpm/worker/worker.c:
Use ap_thread_current_after_fork().
* server/mpm/winnt/child.c:
Windows processes are not fork()ed and each child runs the main(), so
ap_thread_current_create() was already called there.
core: Follow up to r1897460: Provide ap_thread_main_create().
Replace ap_thread_current_create() by ap_thread_main_create() which is how
it's used by httpd. The former is now a local helper only to implement the
latter.
This allows to consolidate/factorize common code in the main() of httpd and
the unix MPMs.
ap_regex: Follow up to r1897240: Fetch the ovector _after_ the match.
Possibly(?) pcre2_match() can modifiy the given pcre2_match_data and invalidate
the old ovector, be safe and fetch it after.
main: Follow up to r1897240: Fix bad log copypasta.
Don't stderr printf the "stat" and "failed" results from the previous
apr_app_initialize() call for an error in ap_thread_main_create().
core: Follow up to r1897240: Opt-out for AP_HAS_THREAD_LOCAL and/or pcre's usage.
If the compiler's thread_local is not efficient enough on some platforms, or
not desired, have a way to disable its usage in httpd (at compile time).
Handle -DAP_NO_THREAD_LOCAL and/or -DAPREG_NO_THREAD_LOCAL as build opt-out for
thread_local usage in httpd gobally and/or in ap_regex only (respectively).
core: Follow up to r1897240: Provide/export ap_thread_current_create()
For completness, and possibly to ease backport to 2.4.x for MPM winnt.
core: Follow up to r1897240 & r1897691: Syntax.
Add compiled and loaded PCRE version numbers
to "httpd -V" output and to mod_info page.
PCRE 8.45 from May '21 is at end-of-life and will not receive security
vulnerability attention. pcre2-10.x replaces this and has been updated
(as of this time) as recently as Oct '21.
This patch removes the needless assignment of re_erroffset in the conf pool
by the worker threads; such mistakes break the shared copy-on-write pages of
memory that should have remained common between all httpd worker processes.
Two de-optimizations are inherent in this patch, the former ovector-on-stack
opportunity is lost. This is by design of pcre2, more serious exploits were
available with stack array underrun/overrun manipulation. Heap for all pcre
array processing is the recommendation of the implementor, enforced by API.
Safer that we either create a new general context using pool allocation
in heap (requires thread-pool args we don't have in our api), or recycle
a per-req, per-pool, TLS match_data buffer on heap of some arbitrary 10 elts
or so, for these most common cases. Since this can't be done portably in C89
we may revisit this optimization in post-2.4 releases.
This logic refuses to consider --without-pcre, which is nonsequitor.
Merge r1897325, r1897326, r1897329, r1898255 from trunk
APR and APU must be at least 1.3 to be able to configure and build httpd 2.4.x.
So remove some osbolete #if in the source code.
- mod_socache_memcache
- mod_authn_dbd
- mod_log_config
- mod_proxy_ftp and proxy-util
Merge r1881379, r1892422, r1893011, r1897270, r1897271 from trunk
Easy patches: synch 2.4.x and trunk
- mod_ssl: Fix a few warnings on 64 bits windows compilation
- ap_escape_quotes(): Remove unneeded checks to improve performance
- test/time-sem.c: unlock the accept mutex before exiting (error conditions)
- mod_ext_filter: Fix a spurious -1 used as a APR_SIZE_T_FMT in an error message
- mod_sed: fix some format string (s/lld/APR_INT64_T_FMT/)
*) Add the ldap function to the expression API, allowing LDAP filters and
distinguished names based on expressions to be escaped correctly to
guard against LDAP injection.
Stefan Eissing [Mon, 14 Feb 2022 16:52:26 +0000 (16:52 +0000)]
Merge of r1896278 from trunk:
*) mod_tls: Fix a linkage issue with rustls when compiled
with rust 1.55, 1.56 or 1.57. This prevents the loading
of the module because of an undefined symbol: fmaf
See https://github.com/rustls/rustls-ffi/issues/133
[Christophe Jaillet]
Ruediger Pluem [Wed, 9 Feb 2022 12:29:13 +0000 (12:29 +0000)]
Merge r1897182, r1897614, r1897615, r1897619 from trunk:
* Allocate the dav_liveprop_elem structure only once in the lifetime of the
resource->pool and reuse it to avoid unnecessary huge memory allocations
during collection walks.
Stefan Eissing [Tue, 8 Feb 2022 12:28:37 +0000 (12:28 +0000)]
* mod_md) do not interfere with requests to /.well-known/acme-challenge/
resources if challenge type 'http-01' is not configured for a domain.
Fixes <https://github.com/icing/mod_md/issues/279>.
Stefan Eissing [Tue, 8 Feb 2022 10:00:21 +0000 (10:00 +0000)]
*) mod_md: the status description in MDomain's JSON, exposed in the
md-status handler (if configure) did sometimes not carry the correct
message when certificates needed renew.
Ruediger Pluem [Mon, 17 Jan 2022 08:43:50 +0000 (08:43 +0000)]
Merge r1896505 from trunk:
mpm_event: Fix a possible listener deadlock. PR 65769.
When the listener starts accepting more connections than the number of workers
already started (due to scheduling), the listening sockets gets disabled (per
AH03269) but nothing was re-enabling them before the end of the connections,
despite the creation of more idle/available workers in the meantime.
In the wost case there is no idle worker when the listener accepts the first
connection thus nothing to wake up the listener blocked in poll() with no
socket, hence a deadlock.
Fix this by waking up the listener when a worker becomes idle and this unblocks
connections_above_limit(). This is also worthwhile when all the workers are
started (fully initialized runtime) since the number of idle workers is a
condition for connections_above_limit() anyway so the sooner the listeners are
re-enabled the better (the other condition is the number of connections which
is unblocked appropriately by decrement_connection_count() already).
Also when a child exists with ps->quiescing == 1 and it's caught by
server_main_loop() before perform_idle_server_maintenance(), active_daemons was
not decrement as needed (including accross restarts), leading to an invalid
active_daemons accounting.
* server/mpm/event/event.c(should_enable_listensocks):
New helper that returns whether listenning sockets can be poll()ed again.
* server/mpm/event/event.c(decrement_connection_count, listener_thread):
Use should_enable_listensocks() where previously open-coded.
* server/mpm/event/event.c(worker_thread):
Wake up the listener when is_idle => 1 and should_enable_listensocks().
Have a single point of exit when workers_may_exit to make sure that the
wake always occurs (even when exiting).
* server/mpm/event/event.c(server_main_loop):
Decrement active_daemons not only when !ps->quiescing but also when
ps->quiescing == 1, i.e. all the cases not handled by
perform_idle_server_maintenance() already.
projects / thirdparty / apache / httpd.git / log
