How can I fix thee?  let me count the ways...

  * pass a chunked body always (no-body requests don't go chunked).

  * validate that the C-L counted body length doesn't change.

  * follow RFC 2616 for C-L / T-E in the request body C-L / T-E
    election logic.

  * do not forward HTTP/1.0 requests as HTTP/1.1, unless the admin
    configures force-proxy-request-1.1

  * conn was illegible, use 2.0's p_conn.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@218978 13f79535-47bb-0310-9956-ffa450edef68

  Added TraceEnable, and note Request Splitting/Response Splitting.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209903 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209854 13f79535-47bb-0310-9956-ffa450edef68

Fix the CHANGES to reflect when things were really fixed. Also remove the security tag from the proxy change, as suggested by Joe.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209832 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209827 13f79535-47bb-0310-9956-ffa450edef68

So don't bother to store it, but still force OpenSSL
to provide a Session ID.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209821 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209723 13f79535-47bb-0310-9956-ffa450edef68

  Add notation of Georg's patch to capture SSL_COMPRESS_METHOD.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209656 13f79535-47bb-0310-9956-ffa450edef68

Add the httxt2dbm utility to create DBM files for RewriteMap.  This replaces the txt2dbm script in the manual, and allows the use of any available DBM format.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@209539 13f79535-47bb-0310-9956-ffa450edef68

after changes to the config files.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@208967 13f79535-47bb-0310-9956-ffa450edef68

*) server/mpm_common.c: Send a simple HTTP 1.0 request to every listener socket, instead of just closing the socket.  This fixes shutdown of the Worker MPM on FreeBSD, when Accept Filters are enabled.

In the future, we need a method to send a simple request for all protocols.  Currently this is very specific to HTTP and FreeBSD's Accept Filter.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@202027 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@201579 13f79535-47bb-0310-9956-ffa450edef68

Submitted by: Eric Covener <covener gmail.com>
Reviewed by:  trawick



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@201455 13f79535-47bb-0310-9956-ffa450edef68

Content-Length, remove the Content-Length and don't reuse the
connection, stopping some HTTP Request smuggling attacks.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@193205 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:        Steve Kemp <steve steve.org.uk>
Reviewed/tweaked by: trawick



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@192995 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@191100 13f79535-47bb-0310-9956-ffa450edef68

If a request contains both a T-E and C-L, remove the C-L, stopping some HTTP Request Smuggling attacks exploited when using HTTPD as a forward or reverse proxy.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@191005 13f79535-47bb-0310-9956-ffa450edef68

I will be adding documentation for the new directives hopefully in the next day or so.

* server/core.c: Added 'Protocol' to the core module config
                 Added ap_{set,get}_server_protocol API.
                 Added new directive: 'AcceptFilter'.
                 Enable 'httpready' by default on systems that support it.  Use dataready filters for others.

* server/listen.c: Attempt to inherit protocols from Listener Records to Server configs.
                   The 'Listen' directive can now optionally take a protocol arg
                   Move bits that determined which accept filter is applied to core.c.
                   Added bits to find the correct accept filter based on the core's configuration.

* include/{ap_listen.h,http_core.h}: Add Protocol to respective structures.

* include/http_core.h: Add the accf_map table to the core_server_config structure

* include/ap_mmn.h: Minor MMN Bump for the new interfacces.

* modules/ssl/ssl_engine_init.c: Use the new protocol framework to enable mod_ssl for 'https' websites.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190563 13f79535-47bb-0310-9956-ffa450edef68

These Vary headers are used to build a new hash for a URL, based on the 
client's headers.  This allows mod_disk_cache to store many variations of one 
URI, where previously it would only store a single variant.

htcacheclean needs to be updated to understand the new file format.  I plan on 
updating htcacheclean in the next couple days.

PR: 35211


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190530 13f79535-47bb-0310-9956-ffa450edef68

- Use apr_file_mktemp() and rename the header data file to its final location, instead of opening it and then writing it out as we go.  Should prevent race conditions on busy servers.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190043 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@189572 13f79535-47bb-0310-9956-ffa450edef68

PR: 16125


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@180341 13f79535-47bb-0310-9956-ffa450edef68

'generate_name' is too generic to be in the public symbols. Rename it to ap_cache_generate_name. No functional changes.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@179877 13f79535-47bb-0310-9956-ffa450edef68

off-by-one.

PR: 35081
Submitted by: Marc Stern <mstern csc.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@179781 13f79535-47bb-0310-9956-ffa450edef68

user-visible misprocessing in proxy ftp which could result
in directory listing for regular file retrieval


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@179745 13f79535-47bb-0310-9956-ffa450edef68

the default installation on Windows.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@179622 13f79535-47bb-0310-9956-ffa450edef68

- Use a hash for the configuration command lookup implementation.  Now modules can properly directives without dependence on the LoadModule order.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@178990 13f79535-47bb-0310-9956-ffa450edef68

server.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@178262 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@178222 13f79535-47bb-0310-9956-ffa450edef68

PR: 34834
Submitted by: Timo Viipuri <viipuri dlc.fi>
Reviewed by: Paul Querna


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@178209 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@171206 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@170729 13f79535-47bb-0310-9956-ffa450edef68

enable it by default when the --enable-ssl is passed to configure.
Adds support for -Z and -f arguments to tweak SSL protocol options.

Submitted by: Masaoki Kobayashi <masaoki techfirm.co.jp>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@170612 13f79535-47bb-0310-9956-ffa450edef68

With Apache 1.3.x, it is a bit simpler as the request does
not go through ap_make_content_type().

Modules can set custom error responses but not be able to
set the charset, so they have to code the charset in the
html.  Thus, it is useful to preserve 1.3.x behavior exactly.

PR: 26467


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@170354 13f79535-47bb-0310-9956-ffa450edef68

the time of graceful restart. 

PR:          26467
Reviewed by: Joe Orton



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@170281 13f79535-47bb-0310-9956-ffa450edef68

Listen-Protocol Branch that my -dev workspace was using. 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@169789 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@169711 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@169693 13f79535-47bb-0310-9956-ffa450edef68

Make sure mod_rewrite always runs before mod_proxy in the translate_name hook.  This makes doing RewriteRules on a Reverse Proxy.. Slightly more predictable than the order of LoadModules.

Reported By: David D. Miller <justdave bugzilla.org>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@169692 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@168340 13f79535-47bb-0310-9956-ffa450edef68