Tony Finch [Wed, 18 Oct 2000 04:50:25 +0000 (04:50 +0000)]
Restore functionality broken by the mod_rewrite security fix:
rewrite map lookup keys and default values are now expanded
so that the lookup can depend on the requested URI etc.
Because the new code is recursive you can now write configurations
like the following (with nested map lookups) which wasn't directly
possible before -- you had to use a RewriteCond and a %N backref
instead, as in http://www.apache.org/docs/vhosts/mass.html#xtra-conf
Tony Finch [Wed, 18 Oct 2000 04:48:34 +0000 (04:48 +0000)]
Tighten up the syntax checking of Host: headers to fix a
security bug in some mass virtual hosting configurations
that can allow a remote attacker to retrieve some files
on the system that should be inaccessible. The problem
occured with requests including the line "Host: ..." --
the last dot is stripped and the remaining ".." then
reveals a parent directory.
Reported by: Peter Christoffersen <pch@mindpass.com>
Message-ID: <8quts6$2el$1@news.inet.tele.dk>
Newsgroups: comp.infosystems.www.servers.unix
Ryan Bloom [Tue, 17 Oct 2000 21:53:41 +0000 (21:53 +0000)]
Add pool buckets to the bucket list. These buckets are not currently
used although I have begun to test them on my machine. The idea behind
these buckets is that data allocated out of a pool and put into a bucket
has to survive the death of the pool until the bucket is destroyed. To
accomplish this, we register a cleanup when we create the bucket. If the
pool is cleared, the cleanup converts the bucket to a heap bucket and
everything is good. If the pool isn't cleared, then we kill the cleanup
when the bucket is destroyed.
With this bucket type, all of the core buckets that were listed have been
implemented.
Jeff Trawick [Tue, 17 Oct 2000 20:43:35 +0000 (20:43 +0000)]
ap_get_client_block() allocates its brigade from r->pool (as it was
before today) so that we don't have a growth of these across many
pipelined requests.
http_filter() uses one brigade per connection which it reads into.
As it needs to deliver buckets to the caller, they are removed from
its brigade into the caller's brigade.
Submitted by: Ryan Bloom (but anything broken is my fault)
Jeff Trawick [Tue, 17 Oct 2000 15:28:57 +0000 (15:28 +0000)]
http_filter():
when delivering body bytes, only deliver one block of data (however
much is returned by bucket read) instead of delivering the entire
body at once; this gets painful with a large body
make a note of an issue with the blocking state of the socket;
currently, the socket is non-blocking, but when reading body bytes
we should feel free to wait for body bytes until a timeout occurs;
Jeff Trawick [Tue, 17 Oct 2000 01:35:12 +0000 (01:35 +0000)]
Rename output filters field ("filters") in core_dir_config to
"output_filters" for consistency with the name of the input
filters field ("input_filters").
Ryan Bloom [Tue, 17 Oct 2000 00:24:36 +0000 (00:24 +0000)]
Add a flush bucket type. This bucket advises filters to flush any data
they are currently storing. There is no way we can force them to flush,
but we can advise. This also adds the code to ap_rflush to use flush
buckets, although it isn't enabled yet. I will enable it once we remove
buff from the code. I also removed all calls to ap_rflush that are either
immediately before or immediately after a call to ap_finalize_protocol.
ap_finalize_protocol sends an EOS bucket, which also advises filters to
flush their data, so having both calls right next to each other is
redundant.
Ryan Bloom [Mon, 16 Oct 2000 23:15:55 +0000 (23:15 +0000)]
Add a sub-request filter. This filter just strips the EOS from the
brigade generated by the sub-request. If this is not done, then the
main-request's core_output_filter will get very confused, as will any other
filter in the main-request filter-stack that looks for EOS.
Jeff Trawick [Mon, 16 Oct 2000 20:08:14 +0000 (20:08 +0000)]
dechunk filter:
Get rid of an assertion which assumed that HTTP_IN is the filter
below us. Some other filter may play the same role.
ap_setup_client_block():
Get rid of a commented-out hack which was used to allow chunked
transport encoding of a request body received by mod_cgi[d].
ap_get_client_block():
Get rid of special handling for zero-length buckets... The main
loop handles that fine.
Submitted by: Ryan Bloom
Jeff Trawick [Mon, 16 Oct 2000 19:11:53 +0000 (19:11 +0000)]
input filtering changes:
get dechunking working
verify that infrastructure for input filters works
(use existing AddInputFilter directive)
Unlike with my previous patch, ap_get_client_block() saves state between
calls in the core's per-request dir config.
Unlike with my previous patch, HTTP_IN keeps a count of remaining bytes
in the conn_rec. Code that needs to prod it to deliver a certain amount
of request body plays with conn_rec->remain directly.
Renamed all MODULE_EXPORT symbols to AP_MODULE_DECLARE and all symbols
for CORE_EXPORT to AP_CORE_DECLARE (namespace protecting the wrapper)
and retitled API_EXPORT as AP_DECLARE and APR_EXPORT as APR_DECLARE.
All _VAR_ flavors changes to _DATA to be absolutely clear.
Thank you Greg, for the most obvious suggestion.
Eliminating a bunch-o-junk from the Win32 os.h header that now lives
in apr or isn't used. Please review closely (every symbol removed was
grep't for, and no references were found.)
Ryan Bloom [Sun, 15 Oct 2000 18:15:13 +0000 (18:15 +0000)]
Stop using the index into the array for the bucket type. Now we just use
a pointer to a static structure. The ap_foo_type functions have also been
replaced with simple macro calls. I am going to replace the
ap_bucket_(read|split|setaside|destroy) functions with macros soon.
Reviewed by: Will Rowe
David Reid [Sun, 15 Oct 2000 11:46:22 +0000 (11:46 +0000)]
Some fixes and a general tidy up of ab. With these changes ab can now
support concurrency levels > 1 against the loopback on BONE and will
actually use all the connections it starts.
Change to buckets for isapi output. Still requires emulation of IO
Completion/Async behavior, but a non-async REQ_HSE_TRANSMIT_FILE is
now implemented.
Ryan Bloom [Sat, 14 Oct 2000 06:53:02 +0000 (06:53 +0000)]
Cleanup ap_get_client_block a bit. All of the code that I am removing
doesn't actually do anything useful, it was meant to remove all zero
length buckets before trying to read from the brigade. However, it is
perfectly fine to not do this, and to just read those buckets along with
the rest of them.
Ryan Bloom [Sat, 14 Oct 2000 06:21:38 +0000 (06:21 +0000)]
My last patch had most of the code to insert the eos bucket, but it was
missing some major pieces that I only found after the commit. This patch
fixes the problem, and makes sure that request bodies are always ended
with an EOS bucket.
Ryan Bloom [Sat, 14 Oct 2000 04:37:22 +0000 (04:37 +0000)]
Get non-chunked input body filtering working with an EOS bucket. The
basic design has ap_setup_client_block setting a field in the conn_rec
which tells http_filter how much data is in the body (with chunking this
will represent how much data is in the chunk). The ap_get_client_block
then calls down the stack with the maximum amount of data that it can
receive back. When http_filter reads all of the data, it adds an eos
bucket to the end of the brigade. ap_get_client_block continues to read
data until it gets the eos bucket. This allows filters to increase the
size of the body data.
Jeff Trawick [Fri, 13 Oct 2000 18:39:18 +0000 (18:39 +0000)]
Introduce ap_debug_assert() macro, like ap_assert() but only active if
AP_DEBUG is defined.
ap_get_client_block():
. avoid some cases where we leak a temporary bucket brigade
. clean up/fix the logic to copy a brigade into the caller's buffer;
the wrong length was used in some cases
. add an AP_DEBUG-only assertion for some assumptions made regarding
the brigade returned by the filters
Submitted by: partly by Greg Stein, but of course anything bad is mine
Jeff Trawick [Fri, 13 Oct 2000 17:54:24 +0000 (17:54 +0000)]
getline() fixes...
If ap_get_brigade() returns APR_SUCCESS but an empty brigade, bail out.
Previously, we kept going and sometimes segfaulted while operating on
what we thought was the first bucket.
Ryan Bloom [Fri, 13 Oct 2000 05:35:57 +0000 (05:35 +0000)]
Remove all function pointers from the ap_bucket type. These function
pointers are replaced with a global table that allows modules to register
their bucket types. Those bucket types are then allowed to be used in
the server processing. This also required removing all direct calls to
those functions. The ap_bucket type has an index into an array, so in
each ap_bucket_* function, we use that index to find the correct set of
functions.
Jeff Trawick [Fri, 13 Oct 2000 03:38:35 +0000 (03:38 +0000)]
mod_cgid: In the handler, shut down the Unix socket (only for write)
once we finish writing the request body to the cgi child process;
otherwise, the client doesn't hit EOF on stdin. Small request bodies
worked without this change (for reasons I don't understand), but large
ones didn't.
Jeff Trawick [Fri, 13 Oct 2000 03:12:54 +0000 (03:12 +0000)]
Fix a couple of problems related to large request bodies:
http_filter() - this was referencing e->length even though e->length
is sometimes -1 (if we have to read the socket bucket to get the
next bit of the request body); now it does e->read() to force a
socket need if required
ap_get_client_block() - this was getting a brigade back with the
desired amount of data (yeah, right) but only copying out the first
bucket
Modify ap_make_dirstr_prefix, platforms with HAVE_DRIVE_LETTERS or NETWARE
can request 0 elements, returning the '/' root.
[William Rowe, Tim Costello] from 1.3, with documentation
Ryan Bloom [Thu, 12 Oct 2000 18:01:30 +0000 (18:01 +0000)]
Remove the offset field from ap_bucket type. This is a file bucket
specific value, and therefore it belongs in the ap_bucket_file type,
which was also created with this commit. ap_bucket needs to be as generic
as possible to make it easily extensible, which means we have to keep
the generic ap_bucket type very separate from ap_bucket_foo.
Ryan Bloom [Thu, 12 Oct 2000 16:35:39 +0000 (16:35 +0000)]
Implement a length argument on input filters. There are three possible
values for the length, -1, 0, and a positive number. -1 means that the
next filter should return all the data it has, the current filter will
take care to ensure that the protocol is followed. Most filters will
never use this, because it implies they are implementing a conn_based
input filter. 0 means give me exactly one line of data. A positive
number means give me a maximum of n bytes.
I hope this clarifies. Greg is absolutely correct, there is no need for
any modules symbol other than AP_MODULE_DECLARE_DATA, since module .h
files containing imports and exports imply something more sophisticated,
as the early mod_dav.c example illustrated.
Ryan Bloom [Thu, 12 Oct 2000 04:47:21 +0000 (04:47 +0000)]
We never actually store anything in input_data (from the conn_rec), so it
doesn't make much sense to check to see if there is something there. This
removes the input_data brigade from the conn_rec altogether. There is no
good reason for a filter to be accessing a bucket brigade from within the
conn_rec. This shouldn't be here anymore, just like the output_filter
shouldn't be storing the data in the conn_rec.
Ryan Bloom [Thu, 12 Oct 2000 03:57:45 +0000 (03:57 +0000)]
This is pretty much the wrong solution, but at least it makes POSTs work
again. Chunking input doesn't work with this change, but that is because
this is a stop-gap to get POSTs working again.
Jeff Trawick [Thu, 12 Oct 2000 02:54:38 +0000 (02:54 +0000)]
In read_request_line(), we don't have to check any sort of EOF flag
anymore because getline() returns < 0 upon EOF.
There are also a few very minor tweaks to getline() -- remove an
unused variable, remove a couple of unnecessary comments, simplify
an error path.
Ryan Bloom [Wed, 11 Oct 2000 23:27:03 +0000 (23:27 +0000)]
Clean up the input filtering a lot. This makes the code a bit easier
to follow. This code works for browser based requests and line-based
telnet requests. It is untested with character-based telnet requests.
I will be testing that very soon.
Ryan Bloom [Wed, 11 Oct 2000 18:32:19 +0000 (18:32 +0000)]
Cleanup the input filtering a bit. This does not work with telnet
currently, but it is a step in the right direction. Input filtering
should be slowly improving from here on out.
Submitted by: Greg Ames, Ryan Bloom, Jeff Trawick
Jeff Trawick [Wed, 11 Oct 2000 17:37:22 +0000 (17:37 +0000)]
In getline() and ap_get_client_block(), use ap_bucket_destroy()
instead of bucket->destroy(). bucket->destroy() wasn't being
called correctly and also we were leaking the storage for the
bucket itself since bucket->destroy() doesn't free the ap_bucket.
Submitted by: Ryan Bloom, Jeff Trawick
Parallels the commit to apr.h.in/apr.hw for the apache core library.
Only mod_dav/mod_dav_fs and ap_hooks.h (as best examples) will use these
symbols until it is acceptable to all or the new symbols are backed out.
This symbol rename will have the unique quality that
strlen("API_EXPORT") == strlen("AP_DECLARE"), therefore the mass symbol
rename will not throw off function continuation lines.
This one is odd, it's not the patch either of us are concerned with, it's
the logic that they started with. If problems we never knew about just
go away, don't blame us.
Submitted by: William Rowe
Reviewed by: Bill Stoddard
Jeff Trawick [Tue, 10 Oct 2000 17:04:19 +0000 (17:04 +0000)]
minor cleanups in http_filter() and ap_get_client_block()
this is not the change to allow us to read broken-up header lines again :(
. http_filter()
- respect apr_status_t as set by bucket->read() or ap_get_brigade()
- return apr_status_t instead of length
. ap_get_client_block()
- remove a confusing line which set the length parameter before
- passing it to bucket->read()
projects / apache / log