Ruediger Pluem [Tue, 17 Jan 2006 19:58:19 +0000 (19:58 +0000)]
* Add a sentence about DDOS.
* Mention problems with low Timeouts and long running CGIs.
* Stress out the experimental character of event MPM and that it does not
work with ssl currently.
Ruediger Pluem [Tue, 17 Jan 2006 15:12:23 +0000 (15:12 +0000)]
* Add CacheMinExpire directive to set the minimum time in seconds to cache a document
in the case that no valid expire time was supplied with the document.
Submitted by: Brian Akins <brian.akins turner.com>
Reviewed by: Ruediger Pluem
Drop redundant dependency, ms studio is quite good at resolving
nested dependencies (unless the dependency is consumed by both
modules.) See mod_ldap for a similar example.
Say 'whoops'. When you build the elements explicitly, you must order
them (win32 has no unresolved symbols linkage). modules/database/
is required before modules/aaa/
Garrett Rooney [Thu, 12 Jan 2006 22:51:00 +0000 (22:51 +0000)]
Make some error checking more clear by using the defined constants instead
of literal values.
Patch by: Dan Rall <dlr apache.org>
* server/request.c
(ap_process_request_internal): Check the return value of hook functions
against the constant OK instead of the magic number 0 to improve clarity.
Determined that yes; apr_general.h may be included in .rc files,
so eliminate a substitute declaration.
Correct version and copyright generation, this involves 'long line'
flavor of the first ASF copyright line; next step will be no more
awk generation of .rc files, so there we will use the new macro
AP_SERVER_COPYRIGHT and defined tokens from this file for versions.
Bradley Nicholes [Wed, 11 Jan 2006 14:30:28 +0000 (14:30 +0000)]
Authz refactoring
Merge from branches/authz-dev
Basically here is a list of what has been done:
- Convert all of the authz modules from hook based to provider based
- Remove the ap_requires field from the core_dir_config structure
- Remove the function ap_requires() since its functionality is no
longer supported or necessary in the refactoring
- Remove the calls to ap_some_auth_required() in the core request
handling to allow the hooks to be called in all cases.
- Add the new module mod_authz_core which will act as the authorization
provider vector and contain common authz directives such as 'Require',
'Reject' and '<RequireAlias>'
- Add the new module mod_authn_core which will contain common
authentication directives such as 'AuthType', 'AuthName' and
'<AuthnProviderAlias>'
- Move the check for METHOD_MASK out of the authz providers and into
the authz_core provider vector
- Define the status codes that can be returned by the authz providers
as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR
- Remove the 'Satisfy' directive
- Implement the '<RequireAll>', '<RequireOne>' block directives to
handle the 'and' and 'or' logic for authorization.
- Remove the 'AuthzXXXAuthoritative' directives from all of the authz
providers
- Implement the 'Reject' directive that will deny authorization if the
argument is true
- Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>'
logic
- Reimplement the host based authorization functionality provided by
'allow', 'deny' and 'order' as authz providers
- Remove the 'allow', 'deny' and 'order' directives
- Merge mod_authn_alias into mod_authn_core
- Add '<RequireAlias>' functionality which is similar to
'<AuthnProviderAlias>' but specific to authorization aliasing
- Remove all of the references to the 'authzxxxAuthoritative'
directives from the documentation
- Remove the 'Satisfy' directive from the documentation
- Remove 'Allow', 'Deny', 'Order' directives from the documentation
- Document '<RequireAll>', '<RequireOne>', 'Reject' directives
- Reimplement the APIs ap_auth_type(), ap_auth_name() as optional
functions and move the actual implementation into mod_authn_core
- Reimplement the API ap_some_auth_required() as an optional function
and move the actual implementation into mod_authz_core
Major Changes:
- Added the directives <RequireAll>, <RequireOne>, <RequireAlias>,
Reject
- Expanded the functionality of the directive 'Require' to handle all
authorization and access control
- Added the new authz providers 'env', 'ip', 'host', 'all' to handle
host-based access control
- Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy',
'AuthzXXXAuthoritative'
- Removed the ap_require() API
- Moved the directives 'AuthType', 'AuthName' out of mod_core and into
mod_authn_core
- Moved the directive 'Require' out of mod_core and into
mod_authz_core
- Merged mod_authn_alias into mod_authn_core
- Renamed mod_authz_dbm authz providers from 'group' and 'file-group'
to 'dbm-group' and 'dbm-file-group'
Benefits:
- All authorization and access control is now handle through two
directives, 'Require' and 'Reject'
- Authorization has been expanded to allow for complex 'AND/OR' control
logic through the directives '<RequireAll>' and '<RequireOne>'
- Configuration is now much simpler and consistent across the board
- Other modules like mod_ssl and mod_proxy should be able to plug into
and take advantage of the same provider based authorization mechanism
by implementing their own providers
Issues:
- Backwards compatibility between 2.2 and 2.3 configurations will be
broken in the area of authorization and access control due to the fact
that the directives 'allow', 'deny', 'order' and 'satisfy' have been
removed. When moving from 2.2 to 2.3 these directives will have to be
changed to 'Require all granted', 'Require all denied' or some variation
of the authz host-based providers.
- Existing third party authorization modules will have to adapt to the
new structure.
Ruediger Pluem [Tue, 10 Jan 2006 21:34:11 +0000 (21:34 +0000)]
* Fix PR38017 by handling the selection of the hostname in the same way for
non proxied and reverse proxied requests.
We need to handle both cases in the same manner as for the reverse proxy
case we have the following situation:
If a cached entry is looked up by mod_cache's quick handler r->proxyreq
is still unset in the reverse proxy case as it only gets set in the
translate name hook (either by ProxyPass or mod_rewrite) which is run
after the quick handler hook. This is different to the forward proxy
case where it gets set before the quick handler is run (in the
post_read_request hook).
If a cache entry is created by the CACHE_SAVE filter we always have
r->proxyreq set correctly.
So we must ensure that in the reverse proxy case we use the same code
path and using the canonical name seems to be the right thing to do
in the reverse proxy case.
Ruediger Pluem [Thu, 5 Jan 2006 20:56:43 +0000 (20:56 +0000)]
* Fix a regression from 2.2.x: Set c->aborted to 1 if the return code from
writing to the client is different from APR_SUCCESS in the blocking case or
APR_SUCCESS or APR_EAGAIN in the non blocking case.
Ruediger Pluem [Thu, 5 Jan 2006 13:46:57 +0000 (13:46 +0000)]
* If a subrequest has a broken backend also set no_cache for the main request
and ensure that the chunk filter does not sent the last chunk marker in this
case.
modules/http/chunk_filter.c: Memorize HTTP_BAD_GATEWAY error buckets that
had been seen in filter context to ensure
that we do not sent the last chunk marker in
this case.
modules/proxy/proxy_util.c : Set no_cache also for main request if we are
a subrequest.
Thanks to Joe Orton and André Malo for the "invented unique pointer" trick.
Ruediger Pluem [Mon, 2 Jan 2006 16:39:22 +0000 (16:39 +0000)]
* Correctly signal broken backend connections up the chain also for the ajp
backend (see also r357461). Furthermore move common code in mod_proxy_http.c
and mod_proxy_ajp.c into a new function (ap_proxy_backend_broke) in
proxy_util.c.
modules/proxy/mod_proxy_ajp.c : Signal broken backend connection for ajp backend
modules/proxy/proxy_util.c : Add ap_proxy_backend_broke
modules/proxy/mod_proxy_http.c: - Use ap_proxy_backend_broke
- Return DONE also if backend broke
modules/proxy/mod_proxy.h : Add declaration of ap_proxy_backend_broke
Nick Kew [Sun, 1 Jan 2006 17:51:03 +0000 (17:51 +0000)]
PR#38084
Correct DBDParams string in example
INOUE Seiichiro (who reported the bug) suggests referencing the
pgsql documentation. I disagree, but I wonder if PgSQL is really
a good choice of example, since it (untypically) parses the params
itself rather than have the apr_dbd driver do it.
Brian Pane [Sat, 31 Dec 2005 23:45:11 +0000 (23:45 +0000)]
Refactoring of ap_read_request() to store partial request state
in the request rec. The point of this is to allow asynchronous
MPMs do do nonblocking reads of requests. (Backported from the
async-read-dev branch)
Brian Pane [Sat, 31 Dec 2005 07:16:09 +0000 (07:16 +0000)]
Removed the destruction of the bucket allocator prior to
clearing the transaction pool. The bucket allocator will
now get destroyed when apr_pool_clear() invokes its cleanup
callback. With the old logic, memory corruption was possible
if the pool contained any brigades that referenced any
buckets allocated from the bucket allocator.
Sander Temme [Fri, 30 Dec 2005 05:36:08 +0000 (05:36 +0000)]
General cleanup:
* Change version number to 2.3
* Change documentation links to new layout
* Updated, concise but hopefully correct discussion of build system
behaviour w.r.t. threads on FreeBSD
* A little more discussion of buildconf and minimum libtool version on
Darwin
* More caveat on availability of Windows sourceballs and installers
Initially submitted by pgolluci, subsequently kicked around some.
Ruediger Pluem [Sun, 18 Dec 2005 22:09:05 +0000 (22:09 +0000)]
* Move code for broken backend detection out of core filter into a new http
protocol filter (ap_http_broken_backend_filter) that is only run in the
proxy case.
Ruediger Pluem [Sun, 18 Dec 2005 12:07:39 +0000 (12:07 +0000)]
* If the mod_proxy backend connection broke in the middle of the response,
then
- Do not cache it.
- Signal the client that something went wrong by closing the connection
and not sending the last-chunk marker if the response was T-E chunked.
server/core_filters.c : Close the connection to the client by setting
c->keepalive to AP_CONN_CLOSE.
modules/http/chunk_filter.c : Do not send last-chunk marker in the case
the backend broke.
modules/proxy/mod_proxy_http.c: Signal that the backend connection broke.
modules/cache/mod_disk_cache.c: Respect r->no_cache for discarding the response
Submitted by: Roy T. Fielding, Jim Jagielski, Ruediger Pluem
Reviewed by: Roy T. Fielding, Jim Jagielski, Ruediger Pluem
Joe Orton [Fri, 16 Dec 2005 13:08:32 +0000 (13:08 +0000)]
* modules/debug/mod_bucketeer.c (bucketeer_out_filter): Only pass on
the brigade if the pass delimiter is reached and not for any flush
delimiter; allows creating brigades with a flush bucket in the middle.
Fail if ap_pass_brigade() fails.
Ruediger Pluem [Sun, 11 Dec 2005 00:15:27 +0000 (00:15 +0000)]
* Move handling of backends that broke after the headers have been sent
into the proxy handler of mod_proxy.
This patch still sets r->connection->aborted to 1 which is currently
vetoed by Roy. Moving it from the scheme handler to the proxy handler
should ease the reimplementation of this, as the scheme handlers only
needs to return PROXY_BACKEND_BROKEN to signal the above situation to
the proxy handler.
mod_proxy.h: Add define for PROXY_BACKEND_BROKEN
mod_proxy.c: Handle PROXY_BACKEND_BROKEN in proxy handler
mod_proxy_http.c: Sent back PROXY_BACKEND_BROKEN if backend broke
after we sent the headers.
projects / apache / log