Commits · b6f24a8bf7807297b42bc4121caac796c5720a12 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

25 Sep, 2011 1 commit

enable the SNI extension for proxy connections · b6f24a8b

Kaspar Brand authored Sep 25, 2011

to TLS backends (but avoid for pure SSLv2/SSLv3)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1175416 13f79535-47bb-0310-9956-ffa450edef68

b6f24a8b

19 Sep, 2011 1 commit

Add wrappers for malloc, calloc, realloc that check for out of memory · 4ab02751

Stefan Fritsch authored Sep 19, 2011

situations. Use them in most places where malloc, and friends are used.
This results in clean error messages in an out of memory situation instead of
segfaulting or silently malfunctioning. In some places, it just allows to
remove some logging code.

PR 51568, PR 51569, PR 51571.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172686 13f79535-47bb-0310-9956-ffa450edef68

4ab02751

17 Sep, 2011 2 commits

PR51371: cross-compile issues with cgi and apr_procattr_limit_*. · 7550c76f
Eric Covener authored Sep 17, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172019 13f79535-47bb-0310-9956-ffa450edef68
```
7550c76f

* Correctly obey ServerName / ServerAlias if the Host header from the · 2b52992e

Ruediger Pluem authored Sep 17, 2011

  request matches the VirtualHost address.

PR: 51709
Submitted by: Micha Lenk <micha lenk.info>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172002 13f79535-47bb-0310-9956-ffa450edef68

2b52992e

15 Sep, 2011 2 commits

initialize counter with random number · f3a1c13b

Stefan Fritsch authored Sep 15, 2011

PR: 45110


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1171249 13f79535-47bb-0310-9956-ffa450edef68

f3a1c13b

Create wrapper API for apr_random; · c973368e

Stefan Fritsch authored Sep 15, 2011

use in mod_lbmethod_heartbeat and mod_serf to
- replace some needles use of apr_generate_random_bytes
- remove code duplication


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1171247 13f79535-47bb-0310-9956-ffa450edef68

c973368e

12 Sep, 2011 1 commit

Add in MaxRangeOverlaps and MaxRangeReversals to accomodate · b3ec4d38

Jim Jagielski authored Sep 12, 2011

more control over acceptable Range headers:

See: http://trac.tools.ietf.org/wg/httpbis/trac/ticket/311

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1169756 13f79535-47bb-0310-9956-ffa450edef68

b3ec4d38

09 Sep, 2011 2 commits
- Reflect user-visible behavior change · 8c6dd01f
  William A. Rowe Jr authored Sep 09, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1167156 13f79535-47bb-0310-9956-ffa450edef68
```
  8c6dd01f
- Non-releases don't have user-visible regressions; now a contributor to the fix · 72b2c8de
  William A. Rowe Jr authored Sep 09, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1167151 13f79535-47bb-0310-9956-ffa450edef68
```
  72b2c8de
08 Sep, 2011 2 commits

mod_ldap: Optional function uldap_ssl_supported(r) always returned false · e662d7da

Eric Covener authored Sep 08, 2011

if called from a virtual host with mod_ldap directives in it. Did not
affect mod_authnz_ldap's usage of mod_ldap. [Eric Covener]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1166823 13f79535-47bb-0310-9956-ffa450edef68

e662d7da

Set Accept-Rangs: none instead of unsetting the Accept-Range header when we · 9fb0b822

Eric Covener authored Sep 08, 2011

have a filter that doesn't like byteranges.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1166667 13f79535-47bb-0310-9956-ffa450edef68

9fb0b822

07 Sep, 2011 1 commit

take care of some MaxRanges feedback: · 5cd117e2

Eric Covener authored Sep 07, 2011

 * allow "none" to be expressed in config
 * send Accept-Ranges: none with MaxRanges none
 * stop accepting confusing/ambiguous "0", start accepting "unlimited".



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1166282 13f79535-47bb-0310-9956-ffa450edef68

5cd117e2

06 Sep, 2011 1 commit

bump SECURITY issue to top of in-development 2.3.15 section. · e5861de4

Eric Covener authored Sep 06, 2011



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165779 13f79535-47bb-0310-9956-ffa450edef68

e5861de4

04 Sep, 2011 1 commit

Revamp CRL checking for client and remote servers: · 9c0582ab

Kaspar Brand authored Sep 04, 2011

- completely delegate CRL processing to OpenSSL
- introduce a new [Proxy]CARevocationCheck directive
- drop ssl_callback_SSLVerify_CRL from ssl_engine_kernel.c
- remove X509_STORE from modssl_ctx_t
- drop CRL store helper functions from ssl_util_ssl.c
- avoid sending "certificate_expired" SSL alerts to peers
  when the nextUpdate field of a CRL is in the past


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165056 13f79535-47bb-0310-9956-ffa450edef68

9c0582ab

01 Sep, 2011 1 commit

* Fix a regression in the CVE-2011-3192 byterange fix: · 1f36e470

Ruediger Pluem authored Sep 01, 2011

  Range: bytes=-1

  Resulted in the first two bytes delivered, not in the last one.

PR: 51748
Submitted by: low_priority <lowprio20 gmail.com>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163985 13f79535-47bb-0310-9956-ffa450edef68

1f36e470

28 Aug, 2011 1 commit

add MaxRanges directive institute a default limit of 200 (post-merge where · fe1ee0a5

Eric Covener authored Aug 28, 2011

applicable) Ranges before returning the complete resource.

(minor mmn bump for core_dir_config addition)



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162584 13f79535-47bb-0310-9956-ffa450edef68

fe1ee0a5

15 Aug, 2011 3 commits

mod_cache: Ensure that CacheDisable can correctly appear within · ac4a323d

Graham Leggett authored Aug 15, 2011

a LocationMatch.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1158022 13f79535-47bb-0310-9956-ffa450edef68

ac4a323d

mod_cache: Fix the moving of the CACHE filter, which erroneously · 5ce23087

Graham Leggett authored Aug 15, 2011

stood down if the original filter was not added by configuration.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157976 13f79535-47bb-0310-9956-ffa450edef68

5ce23087

Improve ssl_log_cxerror(): · 633e1e4c

Kaspar Brand authored Aug 15, 2011

Fix logic of APLOG_IS_LEVEL check.
Use X509_NAME_print_ex() instead of deprecated X509_NAME_oneline().
Use i2a_ASN1_INTEGER for printing the serial number.
Add notBefore and notAfter dates to log line.
Check for null cert argument (addresses PR 47408).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157712 13f79535-47bb-0310-9956-ffa450edef68

633e1e4c

13 Aug, 2011 1 commit

Add ap_varbuf API for resizable buffers. · 63390a88

Stefan Fritsch authored Aug 13, 2011

Increase length limit of lines in the configuration file to 16MB.
Increase length limit of lines in the group file to 16MB.

PR: 45888, 50824, 43084

Windows and Netware build changes are untested.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157354 13f79535-47bb-0310-9956-ffa450edef68

63390a88

12 Aug, 2011 1 commit

Accept LDAP_OPT_CONNECT_TIMEOUT as an alternative to LDAP_OPT_NETWORK_TIMEOUT. · 50bd09a9

Eric Covener authored Aug 12, 2011

An alternative on at least some IBM client libraries:

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/topic/com.ibm.IBMDS.doc/progref281.htm#opttimeout

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157111 13f79535-47bb-0310-9956-ffa450edef68

50bd09a9

11 Aug, 2011 1 commit

mod_ldap: remove hard-coded loops of 10 retries w/o delay with a configurable · 3e6fd947

Eric Covener authored Aug 11, 2011

number of retries (LDAPRetries, default 3) and configurable delay between
retries (LDAPRetryDelay, no delay by default).

The LDAP connection is re-initted every other retry, instead of
on the fifth retry -- this was a much more recent addition then
the basic looping behavior.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1156790 13f79535-47bb-0310-9956-ffa450edef68

3e6fd947

10 Aug, 2011 1 commit

remove (the only) retry logic in mod_authnz_ldap's authentication path · 300d2d53

Eric Covener authored Aug 10, 2011

because it's causing the ample retries in mod_ldap to be multiplied by this
outter loop.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1156007 13f79535-47bb-0310-9956-ffa450edef68

300d2d53

08 Aug, 2011 2 commits

Allow to explicitly disable modules even with module selection 'reallyall' · 10251aa2
Stefan Fritsch authored Aug 08, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154875 13f79535-47bb-0310-9956-ffa450edef68
```
10251aa2

Prevent a crash if a non-existent internal RewriteMap is specified · 76a7b524

Eric Covener authored Aug 08, 2011

in a server context with RewiteEngine off, then later referenced.

Submitted By: Ben Noordhuis
Reviewed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154808 13f79535-47bb-0310-9956-ffa450edef68

76a7b524

07 Aug, 2011 3 commits

Enforce OpenSSL 0.9.7 as a minimum requirement in configure, and · 0b9b8854

Kaspar Brand authored Aug 07, 2011

remove #ifdef'ed code which was relevant for earlier versions only.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154688 13f79535-47bb-0310-9956-ffa450edef68

0b9b8854

Remove the ssl_toolkit_compat layer, which is no longer needed · 8ac1c932

Kaspar Brand authored Aug 07, 2011

after support for non-OpenSSL toolkits has been dropped.

Replace macros by their value proper where feasible, and keep
those definitions in ssl_private.h which depend on specific
OpenSSL versions.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154687 13f79535-47bb-0310-9956-ffa450edef68

8ac1c932

Drop support for the RSA BSAFE SSL-C toolkit from configure, · b7dec73d

Kaspar Brand authored Aug 07, 2011

and remove #ifdef'ed code from mod_ssl and ab where applicable.

Consensus for dropping support for SSL/TLS toolkits other
than OpenSSL was reached on dev@httpd in June 2010 (message
with ID <20100602162310.GA11156@redhat.com> and follow-ups).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154683 13f79535-47bb-0310-9956-ffa450edef68

b7dec73d

06 Aug, 2011 1 commit

PR29755: mod_usertrack gets skipped when modules return a status code from · 4818ae78

Eric Covener authored Aug 06, 2011

their fixup hook, and headers are also not sent on non-2xx responses.

Submitted by: Sami J. Mäkinen
Reviewed by: Eric Covener (modified to just run REALLY_FIRST)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154620 13f79535-47bb-0310-9956-ffa450edef68

4818ae78

05 Aug, 2011 2 commits

mod_proxy_http, mod_proxy_connect: Add 'proxy-status' and 'proxy-source-port' · 59f575b9

Stefan Fritsch authored Aug 05, 2011

request notes for logging

PR: 30195


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154342 13f79535-47bb-0310-9956-ffa450edef68

59f575b9

Enable ldap modules in 'all' and 'most' selections if ldap is compiled into · 41ccdea4
Stefan Fritsch authored Aug 05, 2011
```
apr-util


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154114 13f79535-47bb-0310-9956-ffa450edef68
```
41ccdea4

03 Aug, 2011 1 commit

Stefan Fritsch authored Aug 03, 2011

- add new NOT_IN_HTACCESS flag for ap_check_cmd_context() 
- describe the need for this in new_api_2_4.xml
- forbid Define and UnDefine in .htaccess


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1153676 13f79535-47bb-0310-9956-ffa450edef68

b44a451a

01 Aug, 2011 2 commits

Fix endless loop if first bucket is metadata · 86a42c4e

Stefan Fritsch authored Aug 01, 2011

PR: 51590
Submitted by: Torsten Foertsch <torsten foertsch gmx net>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152943 13f79535-47bb-0310-9956-ffa450edef68

86a42c4e

And we are at 2.3.15-dev · ac2b508e

Jim Jagielski authored Aug 01, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152855 13f79535-47bb-0310-9956-ffa450edef68

ac2b508e

30 Jul, 2011 1 commit

Improve logging for mod_proxy_ajp. · 6319a159

Rainer Jung authored Jul 30, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152452 13f79535-47bb-0310-9956-ffa450edef68

6319a159

29 Jul, 2011 2 commits

mod_proxy_ajp: Respect "reuse" flag in END_REPONSE · 965e3e23

Rainer Jung authored Jul 29, 2011

packets.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152379 13f79535-47bb-0310-9956-ffa450edef68

965e3e23

mod_proxy: enable absolute URLs to be rewritten with ProxyPassReverse, · 5aa2aef8

Nick Kew authored Jul 29, 2011

e.g. to reverse proxy "Location: https://other-internal-server/login" with
ProxyPassReverse https://public-address/ https://other-internal-server/

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1152273 13f79535-47bb-0310-9956-ffa450edef68

5aa2aef8

26 Jul, 2011 3 commits

Install signal handlers for crashes before detaching. Previously, there · 13942b53

Stefan Fritsch authored Jul 26, 2011

was a time span where crashes would be neither visible on the console nor
logged in the error log.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1151234 13f79535-47bb-0310-9956-ffa450edef68

13942b53

Reduce period during startup and restart where a successive signal may be lost · 7d40d570

Stefan Fritsch authored Jul 26, 2011

    
PR: 43696
Submitted by: Arun Bhalla <arun shme net>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1151233 13f79535-47bb-0310-9956-ffa450edef68

7d40d570

mod_allowmethods: Correct Merging of "reset" and do · 64d3bf0f

Rainer Jung authored Jul 26, 2011

not allow an empty parameter list for the
AllowMethods directive.

Furthermore switch from AP_MODULE_DECLARE_DATA
to AP_DECLARE_MODULE (the module was brought in
after the big logging refactoring).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1151143 13f79535-47bb-0310-9956-ffa450edef68

64d3bf0f