Commit c9fb49a0 authored by William A. Rowe Jr's avatar William A. Rowe Jr
Browse files 

  Backport trunk changes as recorded in branches/proxy-reqbody-2.0.x,
  refactoring http_proxy.c request body handling.  This correction
  satisfies the vetoed issues in the originally backported proxy
  request body handling from trunk/ in 171205.

Reviewed by: jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@290517 13f79535-47bb-0310-9956-ffa450edef68
parent 6057883e

CHANGES

+7 −0
Changes for CHANGES: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.55









  *) SECURITY: CAN-2005-2088 (cve.mitre.org)









     proxy: Correctly handle the Transfer-Encoding and Content-Length









     headers.  Discard the request Content-Length whenever T-E: chunked









     is used, always passing one of either C-L or T-E: chunked whenever 









     the request includes a request body.  Resolves an entire class of









     proxy HTTP Request Splitting/Spoofing attacks.  [William Rowe]

















  *) Added TraceEnable [on|off|extended] per-server directive to alter









     the behavior of the TRACE method.  This addresses a flaw in proxy









     conformance to RFC 2616 - previously the proxy server would accept


































STATUS



+0
−23



























Changes for STATUS: 0 added lines, 23 removed lines.



Original line number
Diff line number
Diff line







@@ -104,29 +104,6 @@ CURRENT RELEASE NOTES:

















RELEASE SHOWSTOPPERS:



















    * Copy the backport branch of all of the mod_proxy_http.c's request body 









      handling security, protocol and bug fixes; by svn copy'ing the file









      httpd/httpd/branches/proxy-reqbody-2.0.x/modules/proxy/proxy_http.c back to









      httpd/branches/2.0.x/... preserving the detail of all of the individually









      backported changes.



















       +1: wrowe, jim, minfrin









       -1:



















      For a complete history of individual unit changes, see r230703 - r230744 in









      http://svn.apache.org/viewcvs.cgi/httpd/httpd/branches/proxy-reqbody-2.0.x/









      [...]  modules/proxy/proxy_http.c?&view=log









      Cite the specific patch with justification for each specific objection.



















      Suggested; revert r219061 to thoroughly test this patch, as r219061 masks 









      some underlying bugs (although it is a -good- patch in and of itself and









      provides additional protection to other content-handling modules).      



















    * TRACE must not have a request body per RFC2616; see the -trace.patch









      below for one of two alternatives.  The other alternative; simply









      hack mod_proxy.c to reject TRACE when a body is seen, again see that









      -trace.patch for an illustration.





























PATCHES ACCEPTED TO BACKPORT FROM TRUNK:









  [ start all new proposals below, under PATCHES PROPOSED. ]


































modules/proxy/proxy_http.c
0 → 100644



+1700
−0




























File added.
Preview size limit exceeded, changes collapsed.