Correct the parser construction for several optimizations,
based on the fact that bad whitespace shall not be permitted
or corrected in any operating mode, while preserving the
ability to extract bad method/uri/proto for later reporting
and diagnostics.
This change causes badwhitespace in the request line or any
request field line to always fail, and not honor the setting
of the HttpProtocolOptions Unsafe option. Mult SP characters
or trailing SP characters in the request line are still
permitted in Unsafe mode.
Adjusted several error message emits to match these changes.
Folding StrictWhitespace into the Strict ruleset of RFC7230, per dev@ poll.
This choice is unanimous, although StrictURI (a different RFC) still hasn't
found absolute concensus.
An ap_mmn bump will follow (major, this removes a struct elt)
Eric Covener [Sat, 27 Aug 2016 23:15:11 +0000 (23:15 +0000)]
Stash the cgi PID earlier in mod_cgid
In some cases, a 2nd CGI using the same c->id can get into
the mod_cgid handler before cleanups have been run, causing
the new CGI pid to be used by the first CGI's cleanup function.
Instead of stashing c->id in the request processing thread,
just use it before leaving the handler to get the pid.
May indirectly fix PR57771, but it must have a slightly different
cause because stashing the conn_id slightly differently was
supposed to be sufficient there.
Drop the second reporting of HEAD over HTTP/0.9 requests, we short-circuit
this early now in read_request_line() when presented anything other than
the sole "GET" method permitted by spec.
First survey results, all intrinsicly bad input will be logged at the debug
level, no louder. This patch intentionally dodges the Limit* constrained tests
since administrators may shoot themselves in the foot, or be confronted with
impossibly long cookie values, etc.
Luca Toscano [Fri, 26 Aug 2016 11:00:44 +0000 (11:00 +0000)]
After a long discussion in dev@ I reviewed my previous commit to only warn
the admins about Last-Modified header violations rather than trying
to interpret datestrings (like the ones not in GMT).
I also added explicit comments to summarize the current assumptions,
so it will be easier for somebody in the future to modify the code.
The following use cases are covered:
1) (F)CGI backend sends a Last-Modified header not in GMT and considered in the future by httpd (like now() in the EU/Paris timezone)
2) (F)CGI backend sends a Last-Modified header not in GMT and not considered in the future by httpd (like now() + 2 hours in the PST timezone)
3) (F)CGI backend sends a Last-Modified header in GMT but with a datetime in the future
Rename LenientWhitespace to UnsafeWhitespace and change StrictWhitespace
to the default behavior, after discussion with fielding et al about the
purpose of section 3.5. Update the documentation to clarify this.
This patch removes whitespace considerations from the Strict|Unsafe toggle
and consolidates them all in the StrictWhitespace|UnsafeWhitespace toggle.
Added a bunch of logic comments to read_request_line parsing.
Dropped the badwhitespace list for an all-or-nothing toggle in rrl.
Leading space before the method is optimized to be evaluated only once.
Toggled the request from HTTP/0.9 to HTTP/1.0 for more BAD_REQUEST cases.
Moved s/[\n\v\f\r]/ / cleanup logic earlier in the cycle, to operate on
each individual line read, and catch bad whitespace errors earlier.
This changes the obs-fold to more efficiently condense whitespace and
forces concatinatination with a single SP, always. Overrides are not
necessary since obs-fold is clearly deprecated.
Jacob Champion [Mon, 22 Aug 2016 21:27:18 +0000 (21:27 +0000)]
docs: update the "SSL Strong Encryption" how-to
The how-to was a little behind the times. Update to modern ciphersuite
selections, and teach the reader more about *why* certain selections and
settings are chosen. Try to future-proof a little bit by including the
"last-reviewed" date and pointing to Mozilla's recommendation tool.
Joe Orton [Mon, 22 Aug 2016 11:10:58 +0000 (11:10 +0000)]
* modules/ssl/ssl_engine_kernel.c (ssl_callback_SessionTicket): Fail
if RAND_bytes() fails; possible per API, although not in practice
with the OpenSSL implementation.
As commented, ensure we don't flag a request as a rejected 0.9 request
if we identified any other parsing errors and handle all 0.9 request
errors as 400 BAD REQUEST, presuming HTTP/1.0 to deliver the error details.
Do not report 0.9 issues as 505 INVALID PROTOCOL because the client apparently
specified no protocol, and 505 post-dates the simple HTTP request mechanism.
Stefan Fritsch [Sat, 20 Aug 2016 20:48:13 +0000 (20:48 +0000)]
mpm_event: don't re-use scoreboard slots that are still in use
This causes inconsistent data in the scoreboard (due to async
connections) and makes it difficult to determine what is going on.
Therefore it is not a useful fix for the scoreboard-full issues (PR
53555).
The consent on the dev list is that we should allocate/use more
scoreboard entries instead.
Stefan Fritsch [Sat, 20 Aug 2016 20:21:39 +0000 (20:21 +0000)]
mod_status: note stopping procs in async info table
* add new column "stopping", denoting if a process is shutting down
* add additional "(old gen)", if a process is from before a graceful reload
* add counts of processes and stopping processes to summary line
Delay some memory allocation in order to save 272 bytes in the 'request' memory pool if mod_status handler is triggered and is not able to handle the request
Fix the number of column for 'Async connections'.
There are only 3 columns (writing, keep-alive, closing), not 4.
Try to improve the code layout for it to be more readable.
Each <th> is on its own line so keep the corresponding "colspan" <td> fields grouped together.
r1738628 introduced a new column, 'Slot'.
Add an empty cell for it in the last line of the table, in order to fix the layout of the Totals.
After lengthy investigation with covener's assistance, it seems we cannot
use a static table. We cannot change this to dynamic use of the local iconv
without build changes to avoid such use on cross-platform builds.
I'm satisfied if we trust iscntrl to at least catch all the most lethal
C0 Ctrls (we are promised it catches bad carriage control/line endings)
and leave this in the short term with an XXX to revisit at a future time.
The token stop never needed this table, because we can use the affirmative
list of token characters to define it.
Perform correct, strict parsing of the request line, handling the
http protocol tag, url and method appropriately, and attempting
to extract values even in the presence of unusual whitespace in
keeping with section 3.5, prior to responding with whatever
error reply is needed. Conforms to RFC7230 in all respects,
the section 3.5 optional behavior can be disabled by the user
with a new HttpProtocolOptions StrictWhitespace flag. In all
cases, the_request is regenerated from the parsed components
with exactly two space characters.
Shift sf's 'strict' method check from the Strict behavior because
it violates forward proxy logic, adding a new RegisteredMethods
flag, as it will certainly be useful to some.
Yann Ylavic [Tue, 16 Aug 2016 21:48:09 +0000 (21:48 +0000)]
mod_cache: Use the actual URI path and query-string for identifying the
cached entity (key), such that rewrites are taken into account when
running afterwards (CacheQuickHandler off). PR 21935.
Rename the previously undocumented HTTPProtocol directive
to EnforceHTTPProtocol, and invert the default behavior
to strictly observe RFC 7230 unless otherwise configured.
And Document This.
The relaxation option is renamed 'Unsafe'. 'Strict' is no
longer case sensitive. 'min=0.9|1.0' is now the verbose
'Allow0.9' or 'Require1.0' case-insenstive grammer. The
exclusivity tests have been modified to detect conflicts.
The 'strict,log' option failed to enforce strict conformance,
and has been removed. Unsafe, informational logging is possible
in any loadable module, after the request data is unsafely
accepted.
This triggers a group of failures in t/apache/headers.t as
expected since those patterns violated RFC 7230 section 3.2.4.
Yann Ylavic [Sun, 14 Aug 2016 20:42:16 +0000 (20:42 +0000)]
Follow up to r1750392: r1756186 should have also bumped MMN minor for
s/ap_proxy_check_backend/ap_proxy_check_connection/, and r1756328 really bump the MMN :p
projects / apache / log