Commits · e5861de44452c64dfe48fd48cd48fedf73df1530 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

06 Sep, 2011 1 commit

bump SECURITY issue to top of in-development 2.3.15 section. · e5861de4

Eric Covener authored Sep 06, 2011



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165779 13f79535-47bb-0310-9956-ffa450edef68

e5861de4

05 Sep, 2011 5 commits

* modules/http/byterange_filter.c (ap_byterange_filter): Don't reveal · d57bee11

Joe Orton authored Sep 05, 2011

  the pid in the boundary delimiter (part of CVE-2003-1418).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165268 13f79535-47bb-0310-9956-ffa450edef68

d57bee11

* Silence compiler warning · ca5275ba

Ruediger Pluem authored Sep 05, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165200 13f79535-47bb-0310-9956-ffa450edef68

ca5275ba

* Fix compiler warning by removing unused variable · 13fa60ed

Ruediger Pluem authored Sep 05, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165198 13f79535-47bb-0310-9956-ffa450edef68

13fa60ed

update xforms · 131c1105

Stefan Fritsch authored Sep 05, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165196 13f79535-47bb-0310-9956-ffa450edef68

131c1105

be explicit that REQUEST_URI is the path component only · d797a10f

Stefan Fritsch authored Sep 05, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165192 13f79535-47bb-0310-9956-ffa450edef68

d797a10f

04 Sep, 2011 4 commits

be explicit that REQUEST_URI is the path component only · c77b5034

Eric Covener authored Sep 04, 2011

(like r->uri)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165114 13f79535-47bb-0310-9956-ffa450edef68

c77b5034

Revert r1163833: · 2aaaf9d6

Stefan Fritsch authored Sep 04, 2011

    Send a 206 response for a "Range: bytes=0-" request, even if 200 would be
    more efficient.

As discussed on list: Clients that use the 206 response to detect range
support are considered broken and should be fixed to use the Accept-Ranges
header instead.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165062 13f79535-47bb-0310-9956-ffa450edef68

2aaaf9d6

we might also see GeneralizedTimes in certs nowadays · 27be51d1

Kaspar Brand authored Sep 04, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165060 13f79535-47bb-0310-9956-ffa450edef68

27be51d1

Revamp CRL checking for client and remote servers: · 9c0582ab

Kaspar Brand authored Sep 04, 2011

- completely delegate CRL processing to OpenSSL
- introduce a new [Proxy]CARevocationCheck directive
- drop ssl_callback_SSLVerify_CRL from ssl_engine_kernel.c
- remove X509_STORE from modssl_ctx_t
- drop CRL store helper functions from ssl_util_ssl.c
- avoid sending "certificate_expired" SSL alerts to peers
  when the nextUpdate field of a CRL is in the past


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165056 13f79535-47bb-0310-9956-ffa450edef68

9c0582ab

03 Sep, 2011 2 commits

Added MaxRanges to httpd.conf. · eb74280b

Guenter Knauf authored Sep 03, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1164861 13f79535-47bb-0310-9956-ffa450edef68

eb74280b

* Buckets of known length should be always splitable. So we don't need to care · 4af62d95

Ruediger Pluem authored Sep 03, 2011

  about the APR_ENOTIMPL case.

Submitted by: jorton
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1164840 13f79535-47bb-0310-9956-ffa450edef68

4af62d95

01 Sep, 2011 5 commits

* Fix a regression in the CVE-2011-3192 byterange fix: · 1f36e470

Ruediger Pluem authored Sep 01, 2011

  Range: bytes=-1

  Resulted in the first two bytes delivered, not in the last one.

PR: 51748
Submitted by: low_priority <lowprio20 gmail.com>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163985 13f79535-47bb-0310-9956-ffa450edef68

1f36e470

Remove log message left over from debugging. · 98bc0818

Stefan Fritsch authored Sep 01, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163920 13f79535-47bb-0310-9956-ffa450edef68

98bc0818

* Fix error message · 768392c0

Ruediger Pluem authored Sep 01, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163918 13f79535-47bb-0310-9956-ffa450edef68

768392c0

* Whitespace police. No functional change · 16f4d298

Ruediger Pluem authored Sep 01, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163917 13f79535-47bb-0310-9956-ffa450edef68

16f4d298

* Ranges like --2 or -0 are invalid · 5e3e9ec2

Ruediger Pluem authored Sep 01, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163916 13f79535-47bb-0310-9956-ffa450edef68

5e3e9ec2

31 Aug, 2011 2 commits

Fix some RFC 2616 14.35.1 compliance issues: · 6b8d5730

Stefan Fritsch authored Aug 31, 2011

- If there is at least one syntactically invalid byte-range-spec,
  we must ignore the whole header.
- If all ranges are unsatisfiable, send 416.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163851 13f79535-47bb-0310-9956-ffa450edef68

6b8d5730

Send a 206 response for a "Range: bytes=0-" request, even if 200 would be more · a84fb6eb
Stefan Fritsch authored Aug 31, 2011
```
efficient.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163833 13f79535-47bb-0310-9956-ffa450edef68
```
a84fb6eb

30 Aug, 2011 1 commit

* Silence compiler warning · 7a293327

Ruediger Pluem authored Aug 30, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1163197 13f79535-47bb-0310-9956-ffa450edef68

7a293327

29 Aug, 2011 5 commits

Typo correction. · e6047e5b

Richard Bowen authored Aug 29, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162935 13f79535-47bb-0310-9956-ffa450edef68

e6047e5b

Remove some unused code that was included in r1162131 by accident or merge · d8637f77
Stefan Fritsch authored Aug 29, 2011
```
error.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162878 13f79535-47bb-0310-9956-ffa450edef68
```
d8637f77
* We don't need a copy of the original range as we don't change it. A pointer to it is sufficient · b52dfe78
Ruediger Pluem authored Aug 29, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162687 13f79535-47bb-0310-9956-ffa450edef68
```
b52dfe78

* Bit operators should be more efficient then the modulo operator (provided... · 72007291

Ruediger Pluem authored Aug 29, 2011

* Bit operators should be more efficient then the modulo operator (provided the compiler does not optimize on its own)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162669 13f79535-47bb-0310-9956-ffa450edef68

72007291

Unset Content-Length if we call ap_pass_brigade several times · b5ec7c1e
Stefan Fritsch authored Aug 29, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162665 13f79535-47bb-0310-9956-ffa450edef68
```
b5ec7c1e

28 Aug, 2011 11 commits

simple doc for MaxRanges. · 87507824

Eric Covener authored Aug 28, 2011



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162587 13f79535-47bb-0310-9956-ffa450edef68

87507824

add MaxRanges directive institute a default limit of 200 (post-merge where · fe1ee0a5

Eric Covener authored Aug 28, 2011

applicable) Ranges before returning the complete resource.

(minor mmn bump for core_dir_config addition)



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162584 13f79535-47bb-0310-9956-ffa450edef68

fe1ee0a5

Fix iteration over string · b14e8a73

Stefan Fritsch authored Aug 28, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162581 13f79535-47bb-0310-9956-ffa450edef68

b14e8a73

Every 32 ranges, pass the prepared ranges down the filter chain. · 81439676
Stefan Fritsch authored Aug 28, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162579 13f79535-47bb-0310-9956-ffa450edef68
```
81439676

* Do a better estimation on how elements we should allocate: · b7df1544

Ruediger Pluem authored Aug 28, 2011

Preallocate the number of ranges as number of elements as this works good
for well behaving clients which we assume to be the most cases, but do
cut this at the arbitrary number of 100 to avoid too large preallocations.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162565 13f79535-47bb-0310-9956-ffa450edef68

b7df1544

* Silence compiler warning · 132589ab

Ruediger Pluem authored Aug 28, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162560 13f79535-47bb-0310-9956-ffa450edef68

132589ab

* Damm it. Missed another superflous whitespace. · 57d681b0

Ruediger Pluem authored Aug 28, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162559 13f79535-47bb-0310-9956-ffa450edef68

57d681b0

* More style police. No functional changes · 2abcc2c9

Ruediger Pluem authored Aug 28, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162558 13f79535-47bb-0310-9956-ffa450edef68

2abcc2c9

* Style police. No functional changes · baab6a2a

Ruediger Pluem authored Aug 28, 2011

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162556 13f79535-47bb-0310-9956-ffa450edef68

baab6a2a

Better safe than sorry: with OpenSSL 1.0, X509_STORE_CTX_get_current_cert() · f68e2921

Kaspar Brand authored Aug 28, 2011

may not always return a cert.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162553 13f79535-47bb-0310-9956-ffa450edef68

f68e2921

Fix the default OCSP responder timeout for client cert · 8752bf47

Kaspar Brand authored Aug 28, 2011

validation - 10 µsec is a tad too aggressive.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162552 13f79535-47bb-0310-9956-ffa450edef68

8752bf47

27 Aug, 2011 4 commits

merge some more adjacent ranges such as a-n,n+1-b, and · efb10270

Eric Covener authored Aug 27, 2011

refactor/reduce the tests on the start/end positions.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162440 13f79535-47bb-0310-9956-ffa450edef68

efb10270

reverting. got feedback that maybe we don't want to merge 4-5,1-2 into 1-5 · c5a97a06
Greg Ames authored Aug 27, 2011
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162436 13f79535-47bb-0310-9956-ffa450edef68
```
c5a97a06

merge totally reversed ranges like 4-5,1-2 into 1-5 · 2f01f6ff

Greg Ames authored Aug 27, 2011

I interpret the former test
if (!(end <= ostart || start-1 >= oend)) {

as

if (not(end is bad || start is good)) { merge }

ORing the bad condition with the good doesn't produce the desired result.

it is not necessary to test "end" due to the conditions tested in the assert.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162434 13f79535-47bb-0310-9956-ffa450edef68

2f01f6ff

fix typo · ba010068

Stefan Fritsch authored Aug 27, 2011


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162419 13f79535-47bb-0310-9956-ffa450edef68

ba010068