* modules/metadata/mod_remoteip.c
(remoteip_get_v2_len): Move definition before first use.
(remoteip_parse_v2_header): Add length validation for TCPv4
and TCPv6 address families before parsing, returning HDR_ERROR
if the header length is too short.
Jim Jagielski [Fri, 17 Jul 2026 15:49:01 +0000 (15:49 +0000)]
Make the Python test suites more robust:
o Call location independence
o Fully support pip or uv
o Better reporting of test results when both suites are run
o Support postitional args for test cases in a reliable manner
Joe Orton [Fri, 17 Jul 2026 14:20:18 +0000 (14:20 +0000)]
Add sanity checks for slotmem size calculations:
* modules/slotmem/mod_slotmem_plain.c,
modules/slotmem/mod_slotmem_shm.c
(slotmem_size_mul, slotmem_size_add): New helper functions for
checked arithmetic on apr_size_t values.
(slotmem_create): Use checked arithmetic for allocation size
calculations to prevent integer overflow.
(slotmem_grab): Add overflow check on size * id multiplication
before pointer arithmetic.
(slotmem_get): Validate dest_len against slot size before access,
move inuse pointer dereference after bounds checks.
(slotmem_put): Validate src_len against slot size before access,
move inuse pointer dereference after bounds checks.
* modules/slotmem/mod_slotmem_shm.c (slotmem_fgrab): Add overflow
check on size * id multiplication before pointer arithmetic.
(slotmem_attach): Validate shared memory segment size against
expected size computed with checked arithmetic. Use basesize
variable for inuse pointer calculation.
Joe Orton [Fri, 17 Jul 2026 13:58:04 +0000 (13:58 +0000)]
Use apr_isspace() instead of isspace() in cookie parsing
* modules/proxy/mod_proxy_balancer.c (find_session_route): Replace
isspace() with apr_isspace() to avoid locale-dependent behavior
and undefined behavior with negative char values.
Joe Orton [Fri, 17 Jul 2026 12:13:04 +0000 (12:13 +0000)]
mod_substitute: fix heap over-read in set_pattern() delimiter scanning
* modules/filters/mod_substitute.c (set_pattern): Guard the
pre-incrementing delimiter scan loops with a NUL check, preventing
a read past the end of the allocation when the from or to field has
no closing delimiter.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: closes #685
Joe Orton [Fri, 17 Jul 2026 12:12:54 +0000 (12:12 +0000)]
mod_substitute: reject overflow values in SubstituteMaxLineLength
* modules/filters/mod_substitute.c (set_max_line_length): Check that
the parsed value does not exceed APR_INT64_MAX / multiplier before
applying the K/M/G suffix, to avoid signed integer overflow UB.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
Joe Orton [Fri, 17 Jul 2026 12:12:40 +0000 (12:12 +0000)]
mod_ssl: fix set_challenge_creds() to return rv on failure
* modules/ssl/ssl_engine_kernel.c (set_challenge_creds): Return rv
rather than APR_SUCCESS unconditionally, so credential setup
failures are propagated to the ALPN selection callback.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
Joe Orton [Fri, 17 Jul 2026 12:12:32 +0000 (12:12 +0000)]
mod_ldap: fix race in LDAP URL cache child cache access
* modules/ldap/util_ldap.c: Hold the LDAP cache lock continuously
from URL node fetch through child cache access, closing the window
where a concurrent request could free the node between unlock and
re-lock. Re-fetch the URL node under the lock for write-back paths.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
Joe Orton [Fri, 17 Jul 2026 12:12:23 +0000 (12:12 +0000)]
mod_cern_meta: reject HTTP framing headers in metadata files
* modules/metadata/mod_cern_meta.c (scan_meta_file): Return a 500
error if a framing header is found in a .meta file rather than
merging it into the response headers.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
Joe Orton [Fri, 17 Jul 2026 12:12:12 +0000 (12:12 +0000)]
mod_ssl: fix NULL dereference in OCSP responder URI parsing
* modules/ssl/ssl_engine_ocsp.c (determine_responder_uri): Check
u->scheme is non-NULL before calling ap_cstr_casecmp(), since
apr_uri_parse() can succeed with a NULL scheme for scheme-less URIs.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
Joe Orton [Fri, 17 Jul 2026 12:12:05 +0000 (12:12 +0000)]
mod_remoteip: fix NULL dereference with PROXY v2 LOCAL command
* modules/metadata/mod_remoteip.c (remoteip_process_v2_header): Set
conn_conf->client_addr and client_ip for the LOCAL case, matching
the v1 UNKNOWN path.
Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685
Joe Orton [Fri, 17 Jul 2026 08:19:47 +0000 (08:19 +0000)]
Record all(?) the conventions on how to write CHANGES entries
here, tweak some existing text for clarity, reflow for
line length limits and use markdown-ish formatting.
Joe Orton [Tue, 14 Jul 2026 09:25:34 +0000 (09:25 +0000)]
* test/pyhttpd/log.py (HttpdErrorLog): Add regex patterns to detect
crash and sanitizer error messages in error log, and treat matching
lines as errors during log checking.
Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: closes #684
Joe Orton [Mon, 6 Jul 2026 12:51:39 +0000 (12:51 +0000)]
* modules/aaa/mod_auth_digest.c: Use apr_uint32_t for the
one-time-nonce counter.
(gen_nonce): Drop the fallback case for non-shmem builds
where otn_counter could be NULL previously. Use atomics
to increment the counter.
Joe Orton [Mon, 6 Jul 2026 12:51:01 +0000 (12:51 +0000)]
* modules/aaa/mod_auth_digest.c (set_algorithm): Note that
conf->algorithm is a constant ("MD5") so there is no point
in overriding it at runtime. Simplify error case.
Joe Orton [Mon, 6 Jul 2026 12:50:48 +0000 (12:50 +0000)]
* modules/aaa/mod_auth_digest.c: Remove "weird" override of AuthName
directive, which adds complexity for little benefit (avoids putting
20 bytes through SHA1 for each auth attempt).
(set_realm): Remove function.
(gen_nonce_hash): Create the nonce hash here from scratch.
(create_digest_dir_config): Always allocate a config struct.
Remove unused dir_name field from digest_config_rec.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR #661
Joe Orton [Mon, 6 Jul 2026 12:50:18 +0000 (12:50 +0000)]
mod_auth_digest: Drop RFC 2069 and configurable qop support.
(RFC 2617, which replaced 2069, is now 26 years old)
* modules/aaa/mod_auth_digest.c (digest_config_rec): Remove qop_list
field.
(create_digest_dir_config): Remove qop_list initialization.
(set_qop): Deprecate AuthDigestQop, only "auth" is supported.
(note_digest_auth_failure): Always send qop="auth".
(check_nc): Remove handling for qop=none.
(old_digest): Remove function.
(authenticate_digest_user): Reject requests with missing or
non-"auth" qop value rather than falling back to RFC 2069.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub: PR #661
Joe Orton [Mon, 6 Jul 2026 12:01:57 +0000 (12:01 +0000)]
mod_dav: Refactor Lock-Token parsing into dav_parse_locktoken()
helper in util.c, replacing duplicated inline parsing in
mod_dav.c and ms_wdv.c.
* modules/dav/main/util.c (dav_parse_locktoken): New function.
* modules/dav/main/mod_dav.h (dav_parse_locktoken): Declare it.
* modules/dav/main/mod_dav.c (dav_method_unlock): Use
dav_parse_locktoken() instead of inline bracket parsing.
* modules/dav/main/ms_wdv.c (dav_process_ms_wdv_lock): Likewise.
(dav_process_ms_wdv_if_header): Add length check before indexing
the If header value to avoid reading past an empty string.
Joe Orton [Mon, 6 Jul 2026 11:51:31 +0000 (11:51 +0000)]
* modules/proxy/balancers/mod_lbmethod_heartbeat.c (hb_parse_int):
New helper replacing atoi() with safe integer parsing via
apr_strtoi64, with range validation.
(readfile_heartbeats): Use hb_parse_int for busy, ready,
lastseen, and port fields.
(find_best_hb): Add overflow-safe saturation arithmetic for
openslots accumulation and the pick loop upper bound.
Ivan Zhakov [Mon, 29 Jun 2026 10:10:40 +0000 (10:10 +0000)]
Cast cmd_parms.info to correct type (apr_size_t).
APR_OFFSETOF() returns apr_size_t and functions
like ap_set_string_slot() stores it in cmd_parms.info.
* modules/filters/mod_sed.c
(sed_add_expr):
* modules/http/mod_mime.c
(attrib_info): Use apr_size_t instead of int for offset
field.
(add_extension_info, remove_extension_info): Cast
cmd_parms.info to apr_size instead of int.
* server/config.c
(ap_set_string_slot, ap_set_int_slot, ap_set_string_slot_lower,
ap_set_flag_slot, ap_set_flag_slot_char, ap_set_file_slot):
Cast cmd_parms.info to apr_size instead of int.
* server/core.c
(set_server_string_slot): Cast cmd_parms.info to apr_size instead
of int.
Joe Orton [Tue, 23 Jun 2026 08:44:27 +0000 (08:44 +0000)]
Fix pre-1.1.0 compat macros for X509_get0_notBefore/notAfter/serialNumber
The compat macros added in 83d565f for pre-1.1.0 OpenSSL used incorrect
names (X509_get0_before/X509_get0_after) which don't match the actual
API names used in the code (X509_get0_notBefore/X509_get0_notAfter).
This caused link failures when building against OpenSSL 1.0.2.
Also add missing X509_get0_serialNumber compat macro which was used in
ssl_engine_log.c but never shimmed for pre-1.1.0.
Rich Bowen [Mon, 22 Jun 2026 17:21:58 +0000 (17:21 +0000)]
docs: Rewrite log rotation section in logs.xml
- Replace hand-rolled mv/graceful/sleep/gzip recipe with modern
practices: rotatelogs (recommended) and system logrotate
- Add examples for time-based, size-based, and strftime-pattern rotation
- Rewrite piped logs section: tighten prose, remove redundant
rotatelogs example, wrap highlight blocks in <example> tags
- Remove "In order to", "simply", bare "Apache" references
Rich Bowen [Fri, 19 Jun 2026 14:26:22 +0000 (14:26 +0000)]
docs: howto/ssi.xml complete rewrite for style and tone
- Full rewrite for style guide compliance and tone normalization
- Remove all first-person ("I'll talk about...")
- Remove TeX-style ``quoting'' throughout
- Remove dated references (hit counters, guestbooks, Win32)
- Reposition as "a practical, lightweight technique"
- Remove duplicated content between summary, body, and conclusion
- Fix bare "Apache" → "httpd"
- Update example date to 2026
- Add <example> wrappers around all <highlight> blocks
Rich Bowen [Fri, 19 Jun 2026 14:22:34 +0000 (14:22 +0000)]
docs: howto/htaccess.xml editorial cleanup
- Update example log dates to 2026
- Change error log highlight blocks from language="config" to "sh"
- Remove filler phrases: "in order to", "a lot of", "it is important
to remember that", "simply"
- Convert inline "Note that..." prose to <note> blocks
Rich Bowen [Fri, 19 Jun 2026 12:23:41 +0000 (12:23 +0000)]
docs: howto/cgi.xml tone normalization and mod_cgi/mod_cgid explanation
- Add paragraph explaining why two CGI modules exist: mod_cgid for
threaded MPMs (event, worker), mod_cgi for non-threaded (prefork)
and Windows; note they are configuration-compatible
- Link to both module reference pages for implementation details
- Clean up LoadModule note block (remove duplicate "A correctly
configured directive may look like this")
- Remove "Of course" asides and "In order to" constructions
- "There are two main differences" → direct statement
- Move bug-database advisory into <note> block
- Convert remaining Perl references to Python
Rich Bowen [Fri, 19 Jun 2026 12:16:23 +0000 (12:16 +0000)]
docs: howto/auth.xml tone normalization and deduplication
- Replace host-based access control section (Require ip/host examples)
with brief explanation and cross-reference to access.html howto
- Remove dated "HTTPD 2.3/2.4 introduces" from socache section
- Grammar and spelling fixes throughout
Rich Bowen [Thu, 18 Jun 2026 12:13:12 +0000 (12:13 +0000)]
docs: Editorial pass on howto/http2.xml
- Grammar and spelling fixes throughout (fixes bz#70115)
- Wrap overlong lines to match document style
- Replace dead browser extension links with current equivalents
- Update caniuse link to https
- Simplify browser support list (all modern browsers support HTTP/2)
- Note Server Push deprecation per RFC 9113; point to Early Hints
- Note Accept-Push-Policy draft expired and was never adopted
Rich Bowen [Wed, 17 Jun 2026 20:56:52 +0000 (20:56 +0000)]
docs: Modernize howto/http2.xml
- Update all RFC references from 7540 to 9113 (which obsoletes it)
- Remove duplicated RFC link in protocol overview
- Add Server Push deprecation note (deprecated in RFC 9113 §8.4,
removed by Chrome 106+/Edge 106+; recommend 103 Early Hints)
- Update Homebrew note: remove obsolete --with-openssl/--with-nghttp2
flags (Homebrew removed formula options in 2019; curl includes
HTTP/2 support by default now)
- Fix typos: "consistent releases" → "consistent across releases",
"as RFC do" → "as RFCs do", "they are" → "there are",
"at at time" → "at a time", "avoiding to re-instantiate" →
"avoiding the need to re-instantiate", "head of blocking" →
"head-of-line blocking"
projects / thirdparty / apache / httpd.git / log
