Skip to content
GitLab
  1. 01 Nov, 2016 2 commits
    • Jim Jagielski's avatar
      Merge r1688399 from trunk: · 95009316
      Jim Jagielski authored 
      mod_remoteip: Use r->useragent_addr as the root trusted address for verifying.

This fixes issue resulting in setting of bad useragent_ip when internal
redirection has been generated as response to the request (typically as
result of "ErrorDocument 40x").

In this case, the original request has been handled by mod_remoteip and its
useragent_ip has been changed properly, but when internal redirection
to ErrorDocument has been generated later, the mod_remoteip's handler has been
executed again with *the same* c->client_addr as in the original request. If
c->client_addr IP is trusted, this results in bad useragent_ip being set.

When using r->useragent_addr as the root trusted address instead of
c->client_addr, the internal redirection uses the first non-trusted
IP in this particular case, so it won't change the r->useragent_ip during
the internal redirection to ErrorDocument.

Submitted by: jkaluza
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1767483 13f79535-47bb-0310-9956-ffa450edef68
      95009316
    • Jim Jagielski's avatar
      Merge r1698239 from trunk: · 4b5ca1c7
      Jim Jagielski authored 
      Submitted by: covener
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1767482 13f79535-47bb-0310-9956-ffa450edef68
      4b5ca1c7
  3. 27 Oct, 2016 1 commit
  5. 24 Oct, 2016 1 commit
  7. 17 Oct, 2016 1 commit
  9. 11 Oct, 2016 1 commit
  11. 03 Oct, 2016 1 commit
  13. 19 Sep, 2016 1 commit
  15. 06 Sep, 2016 1 commit
    • Jim Jagielski's avatar
      Merge r1758307, r1758308, r1758309, r1758311 from trunk: · 0a4ab924
      Jim Jagielski authored 
      mpm_winnt: remove 'data' AcceptFilter in favor of 'connect'

The 'data' AcceptFilter optimization instructs Windows to wait until
data is received on a connection before completing the AcceptEx
operation. Unfortunately, it seems this isn't performed atomically --
AcceptEx "partially" accepts the incoming connection during the wait for
data, leaving all other incoming connections in the accept queue. This
opens the server to a denial of service.

Since the fix for this requires a substantial rearchitecture (likely
involving multiple outstanding calls to AcceptEx), disable the 'data'
filter for now and replace it with 'connect', which uses the AcceptEx
interface but does not wait for data.

Users running prior releases of httpd on Windows should explicitly move
to a 'connect' AcceptFilter in their configurations if they are
currently using the default 'data' filter.

Many thanks to mludha, Arthur Ramsey, Paul Spangler, and many others for
their assistance in tracking down and diagnosing this issue.

PR: 59970

mpm_winnt: remove the AcceptEx data network bucket

Follow-up to the prior commit: without an incoming data buffer, the
custom network bucket code is now orphaned and we can remove it
entirely. This has the added benefit that we are no longer using the
internal OVERLAPPED.Pointer field, which is discouraged by the MSDN
docs.

mpm_winnt: remove duplication of ap_process_connection

Further follow-up to the previous commit: now that we no longer patch a
network bucket into the brigade, we can revert to calling
ap_process_connection() directly instead of duplicating its logic.

docs: rebuild
Submitted by: jchampion
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1759471 13f79535-47bb-0310-9956-ffa450edef68
      0a4ab924
  17. 01 Sep, 2016 1 commit
  19. 30 Aug, 2016 1 commit
  21. 27 Aug, 2016 1 commit
  23. 25 Aug, 2016 5 commits
  25. 24 Aug, 2016 1 commit
  27. 16 Aug, 2016 5 commits
  29. 03 Aug, 2016 1 commit
  31. 22 Jul, 2016 1 commit
  33. 20 Jul, 2016 1 commit
  35. 10 Jul, 2016 1 commit
  37. 30 Jun, 2016 2 commits
  39. 28 Jun, 2016 1 commit
  41. 26 Jun, 2016 1 commit
  43. 22 Jun, 2016 2 commits
  45. 20 Jun, 2016 2 commits
  47. 16 Jun, 2016 2 commits
  49. 15 Jun, 2016 1 commit
  51. 14 Jun, 2016 1 commit
  53. 13 Jun, 2016 1 commit