Ruediger Pluem [Wed, 15 Feb 2006 20:29:13 +0000 (20:29 +0000)]
- Nitpicking style police: Add space between PR and number of PR
- Remove myself from credit list of fix for PR 38340, as this patch went
in unaltered.
Jim Jagielski [Wed, 15 Feb 2006 16:44:42 +0000 (16:44 +0000)]
*) mod_proxy: Fix KeepAlives not being allowed and set to
backend servers. PR38602. [Ruediger Pluem, Jim Jagielski]
Also, document previous patch:
*) Correctly initialize mod_proxy workers, which use a
combination of local and shared datasets. Adjust logging
to better trace usage. PR38403. [Jim Jagielski]
Jim Jagielski [Tue, 14 Feb 2006 17:35:36 +0000 (17:35 +0000)]
OK, handle better the initializing of worker, separating
"shared" and "local" inits, and being aware that if the
shared aspects are initialized, this doesn't mean
the local ones are :)
Garrett Rooney [Mon, 13 Feb 2006 02:34:26 +0000 (02:34 +0000)]
Clean up some code in mod_dav.
Submitted by: Dan Rall <dlr collab.net>
* modules/dav/main/mod_dav.c
(dav_error_response, dav_error_response_tag): Remove redundant assignment
of r->status_line which is handled by basic_http_header_check().
Garrett Rooney [Mon, 13 Feb 2006 02:25:53 +0000 (02:25 +0000)]
Make the worker and event MPMs support GracefulShutdownTimeout just like
the prefork MPM does.
Submitted by: Chris Darroch <chrisd pearsoncmg.com>
Ported to event MPM by: rooneg
Issue number: 38621
* server/mpm/worker/worker.c
(ap_mpm_run): Make the graceful shutdown log message refer to the right
signal, and respect the graceful shutdown timeout if there is one.
Ruediger Pluem [Sat, 11 Feb 2006 20:57:12 +0000 (20:57 +0000)]
* Do not remove the connection headers from r->headers_in. They are needed
by the http output filter to create the correct connection response headers.
Instead work on a copy of r->headers_in.
Solaris build proposal; don't fail on missing .h files within
a VPATH build, and don't test trees with -d (simply -f the
expected files) in case a tree such as srclib/apr is actually
a symlink rather than a true directory in ./buildconf.
Ruediger Pluem [Sat, 21 Jan 2006 23:22:23 +0000 (23:22 +0000)]
* Improve fix for PR38123. This fixes PR38123 and PR37790 (whose fix has been
already backported) by inserting the HTTP_IN filter uncondionally before
we call ap_send_error_response or ap_die. This ensures that
ap_discard_request_body called by ap_die and by ap_send_error_response works
correctly on status codes that do not cause the connection to be dropped and
in situations where the connection should be kept alive.
Ruediger Pluem [Tue, 17 Jan 2006 19:58:19 +0000 (19:58 +0000)]
* Add a sentence about DDOS.
* Mention problems with low Timeouts and long running CGIs.
* Stress out the experimental character of event MPM and that it does not
work with ssl currently.
Ruediger Pluem [Tue, 17 Jan 2006 15:12:23 +0000 (15:12 +0000)]
* Add CacheMinExpire directive to set the minimum time in seconds to cache a document
in the case that no valid expire time was supplied with the document.
Submitted by: Brian Akins <brian.akins turner.com>
Reviewed by: Ruediger Pluem
Drop redundant dependency, ms studio is quite good at resolving
nested dependencies (unless the dependency is consumed by both
modules.) See mod_ldap for a similar example.
Say 'whoops'. When you build the elements explicitly, you must order
them (win32 has no unresolved symbols linkage). modules/database/
is required before modules/aaa/
Garrett Rooney [Thu, 12 Jan 2006 22:51:00 +0000 (22:51 +0000)]
Make some error checking more clear by using the defined constants instead
of literal values.
Patch by: Dan Rall <dlr apache.org>
* server/request.c
(ap_process_request_internal): Check the return value of hook functions
against the constant OK instead of the magic number 0 to improve clarity.
Determined that yes; apr_general.h may be included in .rc files,
so eliminate a substitute declaration.
Correct version and copyright generation, this involves 'long line'
flavor of the first ASF copyright line; next step will be no more
awk generation of .rc files, so there we will use the new macro
AP_SERVER_COPYRIGHT and defined tokens from this file for versions.
Bradley Nicholes [Wed, 11 Jan 2006 14:30:28 +0000 (14:30 +0000)]
Authz refactoring
Merge from branches/authz-dev
Basically here is a list of what has been done:
- Convert all of the authz modules from hook based to provider based
- Remove the ap_requires field from the core_dir_config structure
- Remove the function ap_requires() since its functionality is no
longer supported or necessary in the refactoring
- Remove the calls to ap_some_auth_required() in the core request
handling to allow the hooks to be called in all cases.
- Add the new module mod_authz_core which will act as the authorization
provider vector and contain common authz directives such as 'Require',
'Reject' and '<RequireAlias>'
- Add the new module mod_authn_core which will contain common
authentication directives such as 'AuthType', 'AuthName' and
'<AuthnProviderAlias>'
- Move the check for METHOD_MASK out of the authz providers and into
the authz_core provider vector
- Define the status codes that can be returned by the authz providers
as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR
- Remove the 'Satisfy' directive
- Implement the '<RequireAll>', '<RequireOne>' block directives to
handle the 'and' and 'or' logic for authorization.
- Remove the 'AuthzXXXAuthoritative' directives from all of the authz
providers
- Implement the 'Reject' directive that will deny authorization if the
argument is true
- Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>'
logic
- Reimplement the host based authorization functionality provided by
'allow', 'deny' and 'order' as authz providers
- Remove the 'allow', 'deny' and 'order' directives
- Merge mod_authn_alias into mod_authn_core
- Add '<RequireAlias>' functionality which is similar to
'<AuthnProviderAlias>' but specific to authorization aliasing
- Remove all of the references to the 'authzxxxAuthoritative'
directives from the documentation
- Remove the 'Satisfy' directive from the documentation
- Remove 'Allow', 'Deny', 'Order' directives from the documentation
- Document '<RequireAll>', '<RequireOne>', 'Reject' directives
- Reimplement the APIs ap_auth_type(), ap_auth_name() as optional
functions and move the actual implementation into mod_authn_core
- Reimplement the API ap_some_auth_required() as an optional function
and move the actual implementation into mod_authz_core
Major Changes:
- Added the directives <RequireAll>, <RequireOne>, <RequireAlias>,
Reject
- Expanded the functionality of the directive 'Require' to handle all
authorization and access control
- Added the new authz providers 'env', 'ip', 'host', 'all' to handle
host-based access control
- Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy',
'AuthzXXXAuthoritative'
- Removed the ap_require() API
- Moved the directives 'AuthType', 'AuthName' out of mod_core and into
mod_authn_core
- Moved the directive 'Require' out of mod_core and into
mod_authz_core
- Merged mod_authn_alias into mod_authn_core
- Renamed mod_authz_dbm authz providers from 'group' and 'file-group'
to 'dbm-group' and 'dbm-file-group'
Benefits:
- All authorization and access control is now handle through two
directives, 'Require' and 'Reject'
- Authorization has been expanded to allow for complex 'AND/OR' control
logic through the directives '<RequireAll>' and '<RequireOne>'
- Configuration is now much simpler and consistent across the board
- Other modules like mod_ssl and mod_proxy should be able to plug into
and take advantage of the same provider based authorization mechanism
by implementing their own providers
Issues:
- Backwards compatibility between 2.2 and 2.3 configurations will be
broken in the area of authorization and access control due to the fact
that the directives 'allow', 'deny', 'order' and 'satisfy' have been
removed. When moving from 2.2 to 2.3 these directives will have to be
changed to 'Require all granted', 'Require all denied' or some variation
of the authz host-based providers.
- Existing third party authorization modules will have to adapt to the
new structure.
Ruediger Pluem [Tue, 10 Jan 2006 21:34:11 +0000 (21:34 +0000)]
* Fix PR38017 by handling the selection of the hostname in the same way for
non proxied and reverse proxied requests.
We need to handle both cases in the same manner as for the reverse proxy
case we have the following situation:
If a cached entry is looked up by mod_cache's quick handler r->proxyreq
is still unset in the reverse proxy case as it only gets set in the
translate name hook (either by ProxyPass or mod_rewrite) which is run
after the quick handler hook. This is different to the forward proxy
case where it gets set before the quick handler is run (in the
post_read_request hook).
If a cache entry is created by the CACHE_SAVE filter we always have
r->proxyreq set correctly.
So we must ensure that in the reverse proxy case we use the same code
path and using the canonical name seems to be the right thing to do
in the reverse proxy case.
Ruediger Pluem [Thu, 5 Jan 2006 20:56:43 +0000 (20:56 +0000)]
* Fix a regression from 2.2.x: Set c->aborted to 1 if the return code from
writing to the client is different from APR_SUCCESS in the blocking case or
APR_SUCCESS or APR_EAGAIN in the non blocking case.
projects / apache / log