Commits · 5735170e3f1382f0fe8958afb5bd7b352ba05f50 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

06 Sep, 2011 1 commit

bump SECURITY issue to top of in-development 2.3.15 section. · e5861de4

Eric Covener authored Sep 06, 2011



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165779 13f79535-47bb-0310-9956-ffa450edef68

e5861de4

04 Sep, 2011 1 commit

Revamp CRL checking for client and remote servers: · 9c0582ab

Kaspar Brand authored Sep 04, 2011

- completely delegate CRL processing to OpenSSL
- introduce a new [Proxy]CARevocationCheck directive
- drop ssl_callback_SSLVerify_CRL from ssl_engine_kernel.c
- remove X509_STORE from modssl_ctx_t
- drop CRL store helper functions from ssl_util_ssl.c
- avoid sending "certificate_expired" SSL alerts to peers
  when the nextUpdate field of a CRL is in the past


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165056 13f79535-47bb-0310-9956-ffa450edef68

9c0582ab

01 Sep, 2011 1 commit

* Fix a regression in the CVE-2011-3192 byterange fix: · 1f36e470

Ruediger Pluem authored Sep 01, 2011

  Range: bytes=-1

  Resulted in the first two bytes delivered, not in the last one.

PR: 51748
Submitted by: low_priority <lowprio20 gmail.com>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163985 13f79535-47bb-0310-9956-ffa450edef68

1f36e470

28 Aug, 2011 1 commit

add MaxRanges directive institute a default limit of 200 (post-merge where · fe1ee0a5

Eric Covener authored Aug 28, 2011

applicable) Ranges before returning the complete resource.

(minor mmn bump for core_dir_config addition)



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162584 13f79535-47bb-0310-9956-ffa450edef68

fe1ee0a5

15 Aug, 2011 3 commits

mod_cache: Ensure that CacheDisable can correctly appear within · ac4a323d

Graham Leggett authored Aug 15, 2011

a LocationMatch.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1158022 13f79535-47bb-0310-9956-ffa450edef68

ac4a323d

mod_cache: Fix the moving of the CACHE filter, which erroneously · 5ce23087

Graham Leggett authored Aug 15, 2011

stood down if the original filter was not added by configuration.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157976 13f79535-47bb-0310-9956-ffa450edef68

5ce23087

Improve ssl_log_cxerror(): · 633e1e4c

Kaspar Brand authored Aug 15, 2011

Fix logic of APLOG_IS_LEVEL check.
Use X509_NAME_print_ex() instead of deprecated X509_NAME_oneline().
Use i2a_ASN1_INTEGER for printing the serial number.
Add notBefore and notAfter dates to log line.
Check for null cert argument (addresses PR 47408).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157712 13f79535-47bb-0310-9956-ffa450edef68

633e1e4c

13 Aug, 2011 1 commit

Add ap_varbuf API for resizable buffers. · 63390a88

Stefan Fritsch authored Aug 13, 2011

Increase length limit of lines in the configuration file to 16MB.
Increase length limit of lines in the group file to 16MB.

PR: 45888, 50824, 43084

Windows and Netware build changes are untested.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157354 13f79535-47bb-0310-9956-ffa450edef68

63390a88

12 Aug, 2011 1 commit

Accept LDAP_OPT_CONNECT_TIMEOUT as an alternative to LDAP_OPT_NETWORK_TIMEOUT. · 50bd09a9

Eric Covener authored Aug 12, 2011

An alternative on at least some IBM client libraries:

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/topic/com.ibm.IBMDS.doc/progref281.htm#opttimeout

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157111 13f79535-47bb-0310-9956-ffa450edef68

50bd09a9

11 Aug, 2011 1 commit

mod_ldap: remove hard-coded loops of 10 retries w/o delay with a configurable · 3e6fd947

Eric Covener authored Aug 11, 2011

number of retries (LDAPRetries, default 3) and configurable delay between
retries (LDAPRetryDelay, no delay by default).

The LDAP connection is re-initted every other retry, instead of
on the fifth retry -- this was a much more recent addition then
the basic looping behavior.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1156790 13f79535-47bb-0310-9956-ffa450edef68

3e6fd947

10 Aug, 2011 1 commit

remove (the only) retry logic in mod_authnz_ldap's authentication path · 300d2d53

Eric Covener authored Aug 10, 2011

because it's causing the ample retries in mod_ldap to be multiplied by this
outter loop.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1156007 13f79535-47bb-0310-9956-ffa450edef68

300d2d53

08 Aug, 2011 2 commits

Allow to explicitly disable modules even with module selection 'reallyall' · 10251aa2
Stefan Fritsch authored Aug 08, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154875 13f79535-47bb-0310-9956-ffa450edef68
```
10251aa2

Prevent a crash if a non-existent internal RewriteMap is specified · 76a7b524

Eric Covener authored Aug 08, 2011

in a server context with RewiteEngine off, then later referenced.

Submitted By: Ben Noordhuis
Reviewed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154808 13f79535-47bb-0310-9956-ffa450edef68

76a7b524

07 Aug, 2011 3 commits

Enforce OpenSSL 0.9.7 as a minimum requirement in configure, and · 0b9b8854

Kaspar Brand authored Aug 07, 2011

remove #ifdef'ed code which was relevant for earlier versions only.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154688 13f79535-47bb-0310-9956-ffa450edef68

0b9b8854

Remove the ssl_toolkit_compat layer, which is no longer needed · 8ac1c932

Kaspar Brand authored Aug 07, 2011

after support for non-OpenSSL toolkits has been dropped.

Replace macros by their value proper where feasible, and keep
those definitions in ssl_private.h which depend on specific
OpenSSL versions.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154687 13f79535-47bb-0310-9956-ffa450edef68

8ac1c932

Drop support for the RSA BSAFE SSL-C toolkit from configure, · b7dec73d

Kaspar Brand authored Aug 07, 2011

and remove #ifdef'ed code from mod_ssl and ab where applicable.

Consensus for dropping support for SSL/TLS toolkits other
than OpenSSL was reached on dev@httpd in June 2010 (message
with ID <20100602162310.GA11156@redhat.com> and follow-ups).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154683 13f79535-47bb-0310-9956-ffa450edef68

b7dec73d

06 Aug, 2011 1 commit

PR29755: mod_usertrack gets skipped when modules return a status code from · 4818ae78

Eric Covener authored Aug 06, 2011

their fixup hook, and headers are also not sent on non-2xx responses.

Submitted by: Sami J. Mäkinen
Reviewed by: Eric Covener (modified to just run REALLY_FIRST)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154620 13f79535-47bb-0310-9956-ffa450edef68

4818ae78

05 Aug, 2011 2 commits

mod_proxy_http, mod_proxy_connect: Add 'proxy-status' and 'proxy-source-port' · 59f575b9

Stefan Fritsch authored Aug 05, 2011

request notes for logging

PR: 30195


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154342 13f79535-47bb-0310-9956-ffa450edef68

59f575b9

Enable ldap modules in 'all' and 'most' selections if ldap is compiled into · 41ccdea4
Stefan Fritsch authored Aug 05, 2011
```
apr-util


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154114 13f79535-47bb-0310-9956-ffa450edef68
```
41ccdea4

03 Aug, 2011 1 commit

Stefan Fritsch authored Aug 03, 2011

- add new NOT_IN_HTACCESS flag for ap_check_cmd_context() 
- describe the need for this in new_api_2_4.xml
- forbid Define and UnDefine in .htaccess


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1153676 13f79535-47bb-0310-9956-ffa450edef68

b44a451a

01 Aug, 2011 2 commits

Fix endless loop if first bucket is metadata · 86a42c4e

Stefan Fritsch authored Aug 01, 2011

PR: 51590
Submitted by: Torsten Foertsch <torsten foertsch gmx net>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152943 13f79535-47bb-0310-9956-ffa450edef68

86a42c4e

And we are at 2.3.15-dev · ac2b508e

Jim Jagielski authored Aug 01, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152855 13f79535-47bb-0310-9956-ffa450edef68

ac2b508e

30 Jul, 2011 1 commit

Improve logging for mod_proxy_ajp. · 6319a159

Rainer Jung authored Jul 30, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152452 13f79535-47bb-0310-9956-ffa450edef68

6319a159

29 Jul, 2011 2 commits

mod_proxy_ajp: Respect "reuse" flag in END_REPONSE · 965e3e23

Rainer Jung authored Jul 29, 2011

packets.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152379 13f79535-47bb-0310-9956-ffa450edef68

965e3e23

mod_proxy: enable absolute URLs to be rewritten with ProxyPassReverse, · 5aa2aef8

Nick Kew authored Jul 29, 2011

e.g. to reverse proxy "Location: https://other-internal-server/login" with
ProxyPassReverse https://public-address/ https://other-internal-server/

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152273 13f79535-47bb-0310-9956-ffa450edef68

5aa2aef8

26 Jul, 2011 3 commits

Install signal handlers for crashes before detaching. Previously, there · 13942b53

Stefan Fritsch authored Jul 26, 2011

was a time span where crashes would be neither visible on the console nor
logged in the error log.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1151234 13f79535-47bb-0310-9956-ffa450edef68

13942b53

Reduce period during startup and restart where a successive signal may be lost · 7d40d570

Stefan Fritsch authored Jul 26, 2011

    
PR: 43696
Submitted by: Arun Bhalla <arun shme net>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1151233 13f79535-47bb-0310-9956-ffa450edef68

7d40d570

mod_allowmethods: Correct Merging of "reset" and do · 64d3bf0f

Rainer Jung authored Jul 26, 2011

not allow an empty parameter list for the
AllowMethods directive.

Furthermore switch from AP_MODULE_DECLARE_DATA
to AP_DECLARE_MODULE (the module was brought in
after the big logging refactoring).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1151143 13f79535-47bb-0310-9956-ffa450edef68

64d3bf0f

24 Jul, 2011 1 commit

Add a CHANGES entry for all the module selection changes · 28a96db6

Stefan Fritsch authored Jul 24, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1150474 13f79535-47bb-0310-9956-ffa450edef68

28a96db6

23 Jul, 2011 1 commit

Add change log entry, bump MMN · 3432f3fb

Stefan Fritsch authored Jul 23, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/revert-ap-ldap@1150173 13f79535-47bb-0310-9956-ffa450edef68

3432f3fb

18 Jul, 2011 1 commit

* server/vhost.c (get_addresses): For '*' and '_default_', return · 9255bb93

Joe Orton authored Jul 18, 2011

  address(es) for any address family, not IPv4 only.
  (dump_a_vhost): Use '*' for v4 or v6 wildcard address.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147806 13f79535-47bb-0310-9956-ffa450edef68

9255bb93

17 Jul, 2011 2 commits

Make the SERVER_NAME variable include [ ] for literal IPv6 addresses, as · 4b6afc2e

Stefan Fritsch authored Jul 17, 2011

mandated by RFC 3875

PR: 26005


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147614 13f79535-47bb-0310-9956-ffa450edef68

4b6afc2e

Fix parsing of Content-Length in type maps · 501bad24

Stefan Fritsch authored Jul 17, 2011

PR: 42203
Submitted by: Nagae Hidetake <nagae eagan jp>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147557 13f79535-47bb-0310-9956-ffa450edef68

501bad24

16 Jul, 2011 1 commit

Add more (trace) logging to the ap_scan_script_header*() functions · 450813c7

Stefan Fritsch authored Jul 16, 2011

Add ap_scan_script_header*_ex() functions that take a module index for
logging.
Make mod_cgi, mod_cgid, mod_proxy_fcgi, mod_proxy_scgi, mod_isapi use the
new functions.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147493 13f79535-47bb-0310-9956-ffa450edef68

450813c7

15 Jul, 2011 1 commit

Add a mod_dir option to allow the used DirectoryIndex to · b9a47143

Eric Covener authored Jul 15, 2011

be externally redirected.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147327 13f79535-47bb-0310-9956-ffa450edef68

b9a47143

13 Jul, 2011 3 commits

Don't try to compress requests with a zero sized body. · d60ec2d6

Stefan Fritsch authored Jul 13, 2011

PR: 51350


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1146418 13f79535-47bb-0310-9956-ffa450edef68

d60ec2d6

Use APR_UNSPEC to allow startup on IP6-only systems. · 22ed401f

Stefan Fritsch authored Jul 13, 2011

PR: 50592
Submitted by: Joe Orton, 2510 <root linkage white-void net>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1146256 13f79535-47bb-0310-9956-ffa450edef68

22ed401f

Add some environment variables to the whitelist in suexec · d50fa346

Stefan Fritsch authored Jul 13, 2011

PR: 51499
Submitted by: Graham Laverty <graham reg ca>, Stefan Fritsch


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1146244 13f79535-47bb-0310-9956-ffa450edef68

d50fa346

06 Jul, 2011 1 commit

Fix regexp RewriteCond with NoCase, · bdba2f7a

Stefan Fritsch authored Jul 06, 2011

reported by Steffen <info apachelounge com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1143541 13f79535-47bb-0310-9956-ffa450edef68

bdba2f7a

05 Jul, 2011 1 commit

Allow to specify module specific custom linker flags · 231256db

Rainer Jung authored Jul 05, 2011

via the MOD_XXX_LDADD variables.

Use APR_ADDTO instead of APR_SETVAR or direct
variable assignment.

This is especially useful when building mod_lua
or mod_deflate against a lua resp. libz which
are installed in non-standard locations.
One can add "-R ..." to MOD_LUA_LDADD and
MOD_DEFLATE_LDADD before configure to fix
the RPATH/RUNPATH of those modules.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1142938 13f79535-47bb-0310-9956-ffa450edef68

231256db