Commit bd6c33ec authored by Andre Malo's avatar Andre Malo
Browse files

mod_version_for_2.0.x branch: 

* Merge 219658 to 239611 from branches/2.0.x



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/mod_version_for_2.0.x@239612 13f79535-47bb-0310-9956-ffa450edef68
parent 06a60e6f

CHANGES

+129 −111

File changed.

Preview size limit exceeded, changes collapsed.

STATUS

+62 −94
Original line number Diff line number Diff line
@@ -104,90 +104,32 @@ CURRENT RELEASE NOTES: 


RELEASE SHOWSTOPPERS:



    * Various fixes to T-E and C-L processing from trunk



      Refactor mod_proxy_http.c's Transfer-Encoding/Content-Length elections

      since they didn't follow RFC 2616, in fact didn't seem to make much

      sense at all.  Patch to migrate request-body-handling from trunk/ based

      on 2.1-dev request body handling behavior (although just a bit more

      conservative on the side of C-L spooling)...

          http://people.apache.org/~wrowe/httpd-2.0-proxy-request-3.patch

      Revert r219061 to properly test this patch, as r219061 masks the

      underlying bug (although it is a -good- patch in and of itself).

    * Copy the backport branch of all of the mod_proxy_http.c's request body 

      handling security, protocol and bug fixes; by svn copy'ing the file

      httpd/httpd/branches/proxy-reqbody-2.0.x/modules/proxy/proxy_http.c back to

      httpd/branches/2.0.x/... preserving the detail of all of the individually

      backported changes.



       +1: wrowe, jim

       -1: jorton: this is a massive patch and extremely hard to review

           for actual interesting content; it is mixed in with all sorts

           of unrelated stuff.  It needs to at least be split up or

           the unrelated stuff removed.



           unrelated change: s/apr_strnatcasecmp/strcasecmp/

           unrelated change: s/b/bb/ on variable+parameter names a few times

           unrelated change: whitespaces changes all over the shop

           spurious change:? send_request_body() appears to have been inlined

           unrelated change: Via header handling



         trawick noted on list: we elected C-L not for efficiency, but because

                 it's the most widely supported [paraphrasing]

         wrowe   notes: I agree - this new patch always chooses C-L for any

                 C-L body received.  If the origin kicks out LENGTH_REQUIRED

                 for a T-E body it's always up to the client to react.

                 Note proxy-sendchunks can override this behavior.

         roy     Notes on list: we must always prefer C-L if it's going to fit

                 in our brigade.

         wrowe   good point; the revised patch prereads MAX_MEM_SPOOL and will

                 try reading that before choosing C-L or T-E.

         wrowe   adds; After testing, I've determined one brigade isn't enough,

                 so I've extended this to a loop up to MAX_MEM_SPOOL, we will

                 fetch up enough body to fill MAX_MEM_SPOOL and hopefully

                 hit the C-L code path most of the time.



         trawick We are counting bytes in stream_reqbody_cl but filters can

                 change the size? [p]

         wrowe   Yes - which is why the patch prefers spool_reqbody_cl unless

                 the filter stack is unchanged from proto_input_filters.  The

                 protocol filters shouldn't be changing content size.  And when

                 it happens, we have to barf or we have a split request.

                 The old behavior was worse; we would stream the request body

                 in additional cases without looking to see if the byte count

                 matched Content-Length.  Easy opportunity for split requests.



         trawick What specifically was done for conformance to RFC 2616? [p]

         wrowe   Elect the appropriate body handling, and ensure that body

                 request contains the required *single* T-E or C-L header,

                 and there are far few code paths to stream_reqbody_cl which

                 was most likely to create split requests by reporting the

                 wrong C-L.



         trawick Please split philosophy from rfc violations from security 

                 fixes in the CHANGES log? [p]

         wrowe   The others are all a bit to intertwined, the Watchfire report 

                 spelled out that it's different behavior and RFC 2616 deviations 

                 that cause the vulnerability, so I don't see how we can divide 

                 the issues of correctly sending the body and choosing the

                 transport flavor.

       -1:



      For a complete history of individual unit changes, see r230703 - r230744 in

      http://svn.apache.org/viewcvs.cgi/httpd/httpd/branches/proxy-reqbody-2.0.x/

      [...]  modules/proxy/proxy_http.c?&view=log

      Cite the specific patch with justification for each specific objection.



PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ please append new backports at the end of this list not the top. ]

      Suggested; revert r219061 to thoroughly test this patch, as r219061 masks 

      some underlying bugs (although it is a -good- patch in and of itself and

      provides additional protection to other content-handling modules).      



    *) ap_proxy_canonenc() is over-eager in handling '%' for reverse

       proxies (PR: 29554).

         Index: modules/proxy/proxy_util.c

             -       if (isenc && ch == '%') {

             +       if (isenc && (isenc != PROXYREQ_REVERSE) && ch == '%') {

    * TRACE must not have a request body per RFC2616; see the -trace.patch

      below for one of two alternatives.  The other alternative; simply

      hack mod_proxy.c to reject TRACE when a body is seen, again see that

      -trace.patch for an illustration.



       +1: jim, pquerna, wrowe



    *) Fix fd leak in piped logging code, fix error handling, and remove

       dead errno handling.

         http://svn.apache.org/viewcvs?rev=170441&view=rev

         http://svn.apache.org/viewcvs?rev=170537&view=rev

         http://svn.apache.org/viewcvs?rev=170719&view=rev

       all-in-one patch incremental to the PR 26467 fix:

         http://people.apache.org/~jorton/ap_pipedlog2.diff

       +1: jorton, trawick, wrowe

       [yes, I will write a CHANGES entry too]

PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ please append new backports at the end of this list not the top. ]



    *) several changes to improve logging of connection-oriented errors, including

       ap_log_cerror() API (needs minor bump in addition to changes below)
@@ -253,11 +195,38 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK: 
      Votes from before the integration branch:

          +1: jerenkrantz, wrowe (trivial, would even be cool in 1.3)



     *) proxy FTP: Fix confusion about globbing characters which could lead

        to getting a directory listing when a file was requested.  PR 34512.

        2.1 patch was http://svn.apache.org/viewcvs?rev=179704&view=rev

        2.0 version: http://people.apache.org/~trawick/179704-20.txt

        +1: trawick, jorton, wrowe



    *) Prevent bad dereferencing of non-existent req struct in

       mod_auth_ldap's mod_auth_ldap_auth_checker() if

       mod_auth_ldap_check_user_id() was never (fully) called.

       Similar behavior to that in 2.1/2.2.

         http://people.apache.org/~jim/mod_auth_ldap-2.0.patch

       +1: jim, minfrin, bnicholes



     *) Add httxt2dbm for creating RewriteMap DBM Files.

        http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev

        +1: pquerna, jorton, trawick



PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ please place SVN revisions from trunk here, so it is easy to

    identify exactly what the proposed changes are! ]



    *) Fix CAN-2005-2491, integer overflow in pcre.

         http://svn.apache.org/viewcvs?rev=233493&view=rev

       rediff for 2.0: http://people.apache.org/~jorton/CAN-2005-2491.patch

       test case: perl-framework/t/security/CAN-2005-2491.t

       +1: jorton, nd



    *) Remove the base href tag from mod_proxy_ftp, as it breaks relative

       links for clients not using an Authorization header.

         modules/proxy/mod_proxy_ftp.c: r231044

       +1: minfrin, jim, nd



    *) Correct RFC 2616 non-compliance by refusing to proxy a request body 

       in a TRACE request, unless TraceEnable extended is configured.

       Introduces TraceEnable [on|off|extended] to give the administrator
@@ -325,23 +294,21 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 
        http://svn.apache.org/viewcvs?rev=178262&view=rev

        (With 2.0.x it is the same code in the same function, but in 

        a different source file.)

        +1: trawick

        +1: trawick, wrowe, nd



     *) Support the suppress-error-charset setting, as with Apache 1.3.x.

        PR 31274. (current docs say it works with Apache from 2.0.40 ;) )

        http://svn.apache.org/viewcvs?rev=170354&view=rev

        +1: trawick, jorton



     *) proxy FTP: Fix confusion about globbing characters which could lead

        to getting a directory listing when a file was requested.  PR 34512.

        2.1 patch was http://svn.apache.org/viewcvs?rev=179704&view=rev

        2.0 version: http://people.apache.org/~trawick/179704-20.txt

        +1: trawick, jorton

        +1: trawick, jorton, nd



     *) mod_mime_magic: Handle CRLF-format magic files so that it works with

        the default installation on Windows. 

        http://svn.apache.org/viewcvs?rev=179622&view=rev

        +1: trawick

        +1: trawick, wrowe

        wrowe asks: is it possible to simply strip trailing whitespace instead

                    of special handling for the end of line characters?  

                    Seems more portable.

        trawick says: makes sense; searching for bandwidth



     *) mod_cache: Fix handling of 'Vary: *". PR 16125.

        Trunk: r180341
@@ -357,16 +324,20 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 
        includes.

        http://svn.apache.org/viewcvs?rev=179763&view=rev

        2.0.x patch: http://people.apache.org/~jorton/ap_pr12655.patch

        test case in perl-framework/t/modules/include.t

        PR: 12655

        +1: jorton

        +1: jorton, nd



     *) mod_auth_digest: Fix hostinfo validation for CONNECT requests.

        http://svn.apache.org/viewcvs.cgi?rev=193127&view=rev

        +1: jorton

        +1: jorton, nd



     *) Add httxt2dbm for creating RewriteMap DBM Files.

        http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev

        +1: pquerna

     *) Reverse Proxy fixes: <Location> bug and Cookie support

        Patch is at

        http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=112365629308138&q=p4

        and is in production with Clients.

        +1: niq, nd

          niq: I'm seeing *a lot* of demand for this.



PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON:
@@ -517,9 +488,6 @@ PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON: 


CURRENT VOTES:



    * Reverse proxy cookie patch from PR#10722 (c.f. comment 16)

      +1: niq



    * Promote mod_ldap and mod_auth_ldap from experimental to

      non experimental status.

      +1: bnicholes, wrowe

docs/manual/dns-caveats.html.es

+14 −14
Original line number Diff line number Diff line
@@ -47,8 +47,8 @@ 
    



    <div class="example"><p><code>

      &lt;VirtualHost www.abc.com&gt; <br />

      ServerAdmin webgirl@abc.com <br />

      &lt;VirtualHost www.abc.dom&gt; <br />

      ServerAdmin webgirl@abc.dom <br />

      DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt;

    </code></p></div>
@@ -60,7 +60,7 @@ 
    responderá a las peticiones que se produzcan. El ejemplo

    mostrado arriba no incluye la direccion IP, de manera que Apache

    tiene que usar una resolución DNS para encontrar la

    dirección IP correspondiente a <code>www.abc.com</code>. Si

    dirección IP correspondiente a <code>www.abc.dom</code>. Si

    por alguna razón la resolución DNS no está

    disponible en el momento en que su servidor está analizando

    sintánticamente su fichero de configuración, entonces
@@ -69,12 +69,12 @@ 
    hagan a ese host virtual (en las versiones de Apache anteriores a

    la 1.2 el servidor ni siquiera se iniciaba).</p>



    <p>Suponga que <code>www.abc.com</code> tiene como dirección

    <p>Suponga que <code>www.abc.dom</code> tiene como dirección

    IP la 10.0.0.1. Considere la siguiente configuración:</p>



    <div class="example"><p><code>

      &lt;VirtualHost 10.0.0.1&gt; <br />

      ServerAdmin webgirl@abc.com <br />

      ServerAdmin webgirl@abc.dom <br />

      DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt;

    </code></p></div>
@@ -95,8 +95,8 @@ 


    <div class="example"><p><code>

      &lt;VirtualHost 10.0.0.1&gt; <br />

      ServerName www.abc.com <br />

      ServerAdmin webgirl@abc.com <br />

      ServerName www.abc.dom <br />

      ServerAdmin webgirl@abc.dom <br />

      DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt;

    </code></p></div>
@@ -111,17 +111,17 @@ 
    de las dos búsquedas de DNS mencionadas arriba falla para

    cualquiera de sus hosts virtuales. En algunos casos estas

    búsquedas DNS puede que no estén bajo su control; por

    ejemplo, si <code>abc.com</code> es uno de sus clientes y ellos

    ejemplo, si <code>abc.dom</code> es uno de sus clientes y ellos

    controlan su propia DNS, pueden forzar a su servidor (pre-1.2) a

    fallar al iniciarse simplemente borrando el registro

    <code>www.abc.com</code>.</p>

    <code>www.abc.dom</code>.</p>



    <p>Otra formas pueden ser bastante más complicadas. Fíjese

    en esta configuración:</p>



    <div class="example"><p><code>

      &lt;VirtualHost www.abc.com&gt; <br />

      &nbsp;&nbsp;ServerAdmin webgirl@abc.com <br />

      &lt;VirtualHost www.abc.dom&gt; <br />

      &nbsp;&nbsp;ServerAdmin webgirl@abc.dom <br />

      &nbsp;&nbsp;DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt; <br />

      <br />
@@ -132,19 +132,19 @@ 
    </code></p></div>



    <p>Suponga que ha asignado la dirección 10.0.0.1 a

    <code>www.abc.com</code> y 10.0.0.2 a

    <code>www.abc.dom</code> y 10.0.0.2 a

    <code>www.def.com</code>. Todavía más, suponga que

    <code>def.com</code> tiene el control de sus propias DNS. Con esta

    configuración ha puesto <code>def.com</code> en una

    posición en la que puede robar todo el trafico destinado a

    <code>abc.com</code>. Para conseguirlo, todo lo que tiene que

    <code>abc.dom</code>. Para conseguirlo, todo lo que tiene que

    hacer es asignarle a <code>www.def.com</code> la dirección

    10.0.0.1. Como ellos controlan sus propias DNS no puede evitar que

    apunten el registro <code>www.def.com</code> a donde quieran.</p>



    <p>Las peticiones dirigidas a la dirección 10.0.0.1

    (incluídas aquellas en las los usuarios escriben URLs de tipo

    <code>http://www.abc.com/whatever</code>) serán todas

    <code>http://www.abc.dom/whatever</code>) serán todas

    servidas por el host virtual <code>def.com</code>. Comprender por

    qué ocurre esto requiere una discusión más profunda

    acerca de como Apache asigna las peticiones que recibe a los hosts

docs/manual/dns-caveats.xml.es

+14 −14
Original line number Diff line number Diff line
@@ -40,8 +40,8 @@ 
    <title>Un ejemplo sencillo</title>



    <example>

      &lt;VirtualHost www.abc.com&gt; <br />

      ServerAdmin webgirl@abc.com <br />

      &lt;VirtualHost www.abc.dom&gt; <br />

      ServerAdmin webgirl@abc.dom <br />

      DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt;

    </example>
@@ -53,7 +53,7 @@ 
    responder&#225; a las peticiones que se produzcan. El ejemplo

    mostrado arriba no incluye la direccion IP, de manera que Apache

    tiene que usar una resoluci&#243;n DNS para encontrar la

    direcci&#243;n IP correspondiente a <code>www.abc.com</code>. Si

    direcci&#243;n IP correspondiente a <code>www.abc.dom</code>. Si

    por alguna raz&#243;n la resoluci&#243;n DNS no est&#225;

    disponible en el momento en que su servidor est&#225; analizando

    sint&#225;nticamente su fichero de configuraci&#243;n, entonces
@@ -62,12 +62,12 @@ 
    hagan a ese host virtual (en las versiones de Apache anteriores a

    la 1.2 el servidor ni siquiera se iniciaba).</p>



    <p>Suponga que <code>www.abc.com</code> tiene como direcci&#243;n

    <p>Suponga que <code>www.abc.dom</code> tiene como direcci&#243;n

    IP la 10.0.0.1. Considere la siguiente configuraci&#243;n:</p>



    <example>

      &lt;VirtualHost 10.0.0.1&gt; <br />

      ServerAdmin webgirl@abc.com <br />

      ServerAdmin webgirl@abc.dom <br />

      DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt;

    </example>
@@ -88,8 +88,8 @@ 


    <example>

      &lt;VirtualHost 10.0.0.1&gt; <br />

      ServerName www.abc.com <br />

      ServerAdmin webgirl@abc.com <br />

      ServerName www.abc.dom <br />

      ServerAdmin webgirl@abc.dom <br />

      DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt;

    </example>
@@ -104,17 +104,17 @@ 
    de las dos b&#250;squedas de DNS mencionadas arriba falla para

    cualquiera de sus hosts virtuales. En algunos casos estas

    b&#250;squedas DNS puede que no est&#233;n bajo su control; por

    ejemplo, si <code>abc.com</code> es uno de sus clientes y ellos

    ejemplo, si <code>abc.dom</code> es uno de sus clientes y ellos

    controlan su propia DNS, pueden forzar a su servidor (pre-1.2) a

    fallar al iniciarse simplemente borrando el registro

    <code>www.abc.com</code>.</p>

    <code>www.abc.dom</code>.</p>



    <p>Otra formas pueden ser bastante m&#225;s complicadas. F&#237;jese

    en esta configuraci&#243;n:</p>



    <example>

      &lt;VirtualHost www.abc.com&gt; <br />

      &#xA0;&#xA0;ServerAdmin webgirl@abc.com <br />

      &lt;VirtualHost www.abc.dom&gt; <br />

      &#xA0;&#xA0;ServerAdmin webgirl@abc.dom <br />

      &#xA0;&#xA0;DocumentRoot /www/abc <br />

      &lt;/VirtualHost&gt; <br />

      <br />
@@ -125,19 +125,19 @@ 
    </example>



    <p>Suponga que ha asignado la direcci&#243;n 10.0.0.1 a

    <code>www.abc.com</code> y 10.0.0.2 a

    <code>www.abc.dom</code> y 10.0.0.2 a

    <code>www.def.com</code>. Todav&#237;a m&#225;s, suponga que

    <code>def.com</code> tiene el control de sus propias DNS. Con esta

    configuraci&#243;n ha puesto <code>def.com</code> en una

    posici&#243;n en la que puede robar todo el trafico destinado a

    <code>abc.com</code>. Para conseguirlo, todo lo que tiene que

    <code>abc.dom</code>. Para conseguirlo, todo lo que tiene que

    hacer es asignarle a <code>www.def.com</code> la direcci&#243;n

    10.0.0.1. Como ellos controlan sus propias DNS no puede evitar que

    apunten el registro <code>www.def.com</code> a donde quieran.</p>



    <p>Las peticiones dirigidas a la direcci&#243;n 10.0.0.1

    (inclu&#237;das aquellas en las los usuarios escriben URLs de tipo

    <code>http://www.abc.com/whatever</code>) ser&#225;n todas

    <code>http://www.abc.dom/whatever</code>) ser&#225;n todas

    servidas por el host virtual <code>def.com</code>. Comprender por

    qu&#233; ocurre esto requiere una discusi&#243;n m&#225;s profunda

    acerca de como Apache asigna las peticiones que recibe a los hosts

docs/manual/howto/auth.html

+4 −0
Original line number Diff line number Diff line
@@ -2,6 +2,10 @@ URI: auth.html.en 
Content-Language: en

Content-type: text/html; charset=ISO-8859-1



URI: auth.html.es

Content-Language: es

Content-type: text/html; charset=ISO-8859-1



URI: auth.html.ja.euc-jp

Content-Language: ja

Content-type: text/html; charset=EUC-JP