From 2c5775e2e05f4da47bfd6e6c9af52fb9c3e19b9dc0d632d69bcd6857453d7329 Mon Sep 17 00:00:00 2001 From: Roman Drahtmueller Date: Fri, 7 Oct 2011 15:12:49 +0000 Subject: [PATCH] - httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff fixes mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives. This is CVE-2011-3368. OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=344 --- apache2.changes | 7 + apache2.spec | 2 + ...-2.2.x-CVE-2011-3368-server_protocl_c.diff | 1864 +++++++++++++++++ 3 files changed, 1873 insertions(+) create mode 100644 httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff diff --git a/apache2.changes b/apache2.changes index fd9113c..7d07a99 100644 --- a/apache2.changes +++ b/apache2.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Fri Oct 7 17:11:56 CEST 2011 - draht@suse.de + +- httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff fixes mod_proxy + reverse exposure via RewriteRule or ProxyPassMatch directives. + This is CVE-2011-3368. + ------------------------------------------------------------------- Fri Oct 7 14:36:31 UTC 2011 - fcrozat@suse.com diff --git a/apache2.spec b/apache2.spec index 08033ee..1ffe1db 100644 --- a/apache2.spec +++ b/apache2.spec @@ -136,6 +136,7 @@ Patch101: httpd-2.2.19-linux3.patch Patch102: httpd-keepalivetimeout-millisecs.patch Patch104: httpd-mod_deflate_head.patch Patch105: ssl-mode-release-buffers.patch +Patch106: httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff Url: http://httpd.apache.org/ Icon: Apache.xpm Summary: The Apache Web Server Version 2.0 @@ -358,6 +359,7 @@ to administrators of web servers in general. %patch102 %patch104 %patch105 +%patch106 # cat $RPM_SOURCE_DIR/SUSE-NOTICE >> NOTICE # diff --git a/httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff b/httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff new file mode 100644 index 0000000..1dd61ec --- /dev/null +++ b/httpd-2.2.x-CVE-2011-3368-server_protocl_c.diff @@ -0,0 +1,1864 @@ +diff -rNU 20 ../httpd-2.2.21-o/modules/proxy/mod_proxy_ajp.c.rej ./modules/proxy/mod_proxy_ajp.c.rej +--- ../httpd-2.2.21-o/modules/proxy/mod_proxy_ajp.c.rej 1970-01-01 01:00:00.000000000 +0100 ++++ ./modules/proxy/mod_proxy_ajp.c.rej 2011-10-07 17:09:20.000000000 +0200 +@@ -0,0 +1,87 @@ ++*************** ++*** 197,237 **** ++ if (maxsize > AJP_MAX_BUFFER_SZ) ++ maxsize = AJP_MAX_BUFFER_SZ; ++ else if (maxsize < AJP_MSG_BUFFER_SZ) ++ maxsize = AJP_MSG_BUFFER_SZ; ++ maxsize = APR_ALIGN(maxsize, 1024); ++ ++ /* ++ * Send the AJP request to the remote server ++ */ ++ ++ /* send request headers */ ++ status = ajp_send_header(conn->sock, r, maxsize, uri); ++ if (status != APR_SUCCESS) { ++ conn->close++; ++ ap_log_error(APLOG_MARK, APLOG_ERR, status, r->server, ++ "proxy: AJP: request failed to %pI (%s)", ++ conn->worker->cp->addr, ++ conn->worker->hostname); ++ if (status == AJP_EOVERFLOW) ++ return HTTP_BAD_REQUEST; ++- else { ++ /* ++ * This is only non fatal when the method is idempotent. In this ++ * case we can dare to retry it with a different worker if we are ++ * a balancer member. ++ */ ++ if (is_idempotent(r) == METHOD_IDEMPOTENT) { ++ return HTTP_SERVICE_UNAVAILABLE; ++ } ++ return HTTP_INTERNAL_SERVER_ERROR; ++ } ++ } ++ ++ /* allocate an AJP message to store the data of the buckets */ ++ bufsiz = maxsize; ++ status = ajp_alloc_data_msg(r->pool, &buff, &bufsiz, &msg); ++ if (status != APR_SUCCESS) { ++ /* We had a failure: Close connection to backend */ ++ conn->close++; ++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, ++ "proxy: ajp_alloc_data_msg failed"); ++--- 197,239 ---- ++ if (maxsize > AJP_MAX_BUFFER_SZ) ++ maxsize = AJP_MAX_BUFFER_SZ; ++ else if (maxsize < AJP_MSG_BUFFER_SZ) ++ maxsize = AJP_MSG_BUFFER_SZ; ++ maxsize = APR_ALIGN(maxsize, 1024); ++ ++ /* ++ * Send the AJP request to the remote server ++ */ ++ ++ /* send request headers */ ++ status = ajp_send_header(conn->sock, r, maxsize, uri); ++ if (status != APR_SUCCESS) { ++ conn->close++; ++ ap_log_error(APLOG_MARK, APLOG_ERR, status, r->server, ++ "proxy: AJP: request failed to %pI (%s)", ++ conn->worker->cp->addr, ++ conn->worker->hostname); ++ if (status == AJP_EOVERFLOW) ++ return HTTP_BAD_REQUEST; +++ else if (status == AJP_EBAD_METHOD) { +++ return HTTP_NOT_IMPLEMENTED; +++ } else { ++ /* ++ * This is only non fatal when the method is idempotent. In this ++ * case we can dare to retry it with a different worker if we are ++ * a balancer member. ++ */ ++ if (is_idempotent(r) == METHOD_IDEMPOTENT) { ++ return HTTP_SERVICE_UNAVAILABLE; ++ } ++ return HTTP_INTERNAL_SERVER_ERROR; ++ } ++ } ++ ++ /* allocate an AJP message to store the data of the buckets */ ++ bufsiz = maxsize; ++ status = ajp_alloc_data_msg(r->pool, &buff, &bufsiz, &msg); ++ if (status != APR_SUCCESS) { ++ /* We had a failure: Close connection to backend */ ++ conn->close++; ++ ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, ++ "proxy: ajp_alloc_data_msg failed"); +diff -rNU 20 ../httpd-2.2.21-o/server/protocol.c ./server/protocol.c +--- ../httpd-2.2.21-o/server/protocol.c 2011-05-07 13:39:29.000000000 +0200 ++++ ./server/protocol.c 2011-10-07 17:10:46.000000000 +0200 +@@ -623,40 +623,64 @@ + + #if 0 + /* XXX If we want to keep track of the Method, the protocol module should do + * it. That support isn't in the scoreboard yet. Hopefully next week + * sometime. rbb */ + ap_update_connection_status(AP_CHILD_THREAD_FROM_ID(conn->id), "Method", + r->method); + #endif + + uri = ap_getword_white(r->pool, &ll); + + /* Provide quick information about the request method as soon as known */ + + r->method_number = ap_method_number_of(r->method); + if (r->method_number == M_GET && r->method[0] == 'H') { + r->header_only = 1; + } + + ap_parse_uri(r, uri); + ++/* ++ https://svn.apache.org/viewvc/httpd/httpd/trunk/server/protocol.c?r1=1178566&r2=1179239&pathrev=1179239&view=patch ++ This is the fix for CVE-2011-3368; via bnc#722545. ++ */ ++ ++ /* RFC 2616: ++ * Request-URI = "*" | absoluteURI | abs_path | authority ++ * ++ * authority is a special case for CONNECT. If the request is not ++ * using CONNECT, and the parsed URI does not have scheme, and ++ * it does not begin with '/', and it is not '*', then, fail ++ * and give a 400 response. */ ++ if (r->method_number != M_CONNECT ++ && !r->parsed_uri.scheme ++ && uri[0] != '/' ++ && !(uri[0] == '*' && uri[1] == '\0')) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "invalid request-URI %s", uri); ++ r->args = NULL; ++ r->hostname = NULL; ++ r->status = HTTP_BAD_REQUEST; ++ r->uri = apr_pstrdup(r->pool, uri); ++ } ++ + if (ll[0]) { + r->assbackwards = 0; + pro = ll; + len = strlen(ll); + } else { + r->assbackwards = 1; + pro = "HTTP/0.9"; + len = 8; + } + r->protocol = apr_pstrmemdup(r->pool, pro, len); + + /* XXX ap_update_connection_status(conn->id, "Protocol", r->protocol); */ + + /* Avoid sscanf in the common case */ + if (len == 8 + && pro[0] == 'H' && pro[1] == 'T' && pro[2] == 'T' && pro[3] == 'P' + && pro[4] == '/' && apr_isdigit(pro[5]) && pro[6] == '.' + && apr_isdigit(pro[7])) { + r->proto_num = HTTP_VERSION(pro[5] - '0', pro[7] - '0'); + } +diff -rNU 20 ../httpd-2.2.21-o/server/protocol.c.orig ./server/protocol.c.orig +--- ../httpd-2.2.21-o/server/protocol.c.orig 1970-01-01 01:00:00.000000000 +0100 ++++ ./server/protocol.c.orig 2011-05-07 13:39:29.000000000 +0200 +@@ -0,0 +1,1701 @@ ++/* Licensed to the Apache Software Foundation (ASF) under one or more ++ * contributor license agreements. See the NOTICE file distributed with ++ * this work for additional information regarding copyright ownership. ++ * The ASF licenses this file to You under the Apache License, Version 2.0 ++ * (the "License"); you may not use this file except in compliance with ++ * the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the License for the specific language governing permissions and ++ * limitations under the License. ++ */ ++ ++/* ++ * protocol.c --- routines which directly communicate with the client. ++ * ++ * Code originally by Rob McCool; much redone by Robert S. Thau ++ * and the Apache Software Foundation. ++ */ ++ ++#include "apr.h" ++#include "apr_strings.h" ++#include "apr_buckets.h" ++#include "apr_lib.h" ++#include "apr_signal.h" ++#include "apr_strmatch.h" ++ ++#define APR_WANT_STDIO /* for sscanf */ ++#define APR_WANT_STRFUNC ++#define APR_WANT_MEMFUNC ++#include "apr_want.h" ++ ++#define CORE_PRIVATE ++#include "util_filter.h" ++#include "ap_config.h" ++#include "httpd.h" ++#include "http_config.h" ++#include "http_core.h" ++#include "http_protocol.h" ++#include "http_main.h" ++#include "http_request.h" ++#include "http_vhost.h" ++#include "http_log.h" /* For errors detected in basic auth common ++ * support code... */ ++#include "mod_core.h" ++#include "util_charset.h" ++#include "util_ebcdic.h" ++#include "scoreboard.h" ++ ++#if APR_HAVE_STDARG_H ++#include ++#endif ++#if APR_HAVE_UNISTD_H ++#include ++#endif ++ ++ ++APR_HOOK_STRUCT( ++ APR_HOOK_LINK(post_read_request) ++ APR_HOOK_LINK(log_transaction) ++ APR_HOOK_LINK(http_scheme) ++ APR_HOOK_LINK(default_port) ++) ++ ++AP_DECLARE_DATA ap_filter_rec_t *ap_old_write_func = NULL; ++ ++ ++/* Patterns to match in ap_make_content_type() */ ++static const char *needcset[] = { ++ "text/plain", ++ "text/html", ++ NULL ++}; ++static const apr_strmatch_pattern **needcset_patterns; ++static const apr_strmatch_pattern *charset_pattern; ++ ++AP_DECLARE(void) ap_setup_make_content_type(apr_pool_t *pool) ++{ ++ int i; ++ for (i = 0; needcset[i]; i++) { ++ continue; ++ } ++ needcset_patterns = (const apr_strmatch_pattern **) ++ apr_palloc(pool, (i + 1) * sizeof(apr_strmatch_pattern *)); ++ for (i = 0; needcset[i]; i++) { ++ needcset_patterns[i] = apr_strmatch_precompile(pool, needcset[i], 0); ++ } ++ needcset_patterns[i] = NULL; ++ charset_pattern = apr_strmatch_precompile(pool, "charset=", 0); ++} ++ ++/* ++ * Builds the content-type that should be sent to the client from the ++ * content-type specified. The following rules are followed: ++ * - if type is NULL, type is set to ap_default_type(r) ++ * - if charset adding is disabled, stop processing and return type. ++ * - then, if there are no parameters on type, add the default charset ++ * - return type ++ */ ++AP_DECLARE(const char *)ap_make_content_type(request_rec *r, const char *type) ++{ ++ const apr_strmatch_pattern **pcset; ++ core_dir_config *conf = ++ (core_dir_config *)ap_get_module_config(r->per_dir_config, ++ &core_module); ++ core_request_config *request_conf; ++ apr_size_t type_len; ++ ++ if (!type) { ++ type = ap_default_type(r); ++ } ++ ++ if (conf->add_default_charset != ADD_DEFAULT_CHARSET_ON) { ++ return type; ++ } ++ ++ request_conf = ++ ap_get_module_config(r->request_config, &core_module); ++ if (request_conf->suppress_charset) { ++ return type; ++ } ++ ++ type_len = strlen(type); ++ ++ if (apr_strmatch(charset_pattern, type, type_len) != NULL) { ++ /* already has parameter, do nothing */ ++ /* XXX we don't check the validity */ ++ ; ++ } ++ else { ++ /* see if it makes sense to add the charset. At present, ++ * we only add it if the Content-type is one of needcset[] ++ */ ++ for (pcset = needcset_patterns; *pcset ; pcset++) { ++ if (apr_strmatch(*pcset, type, type_len) != NULL) { ++ struct iovec concat[3]; ++ concat[0].iov_base = (void *)type; ++ concat[0].iov_len = type_len; ++ concat[1].iov_base = (void *)"; charset="; ++ concat[1].iov_len = sizeof("; charset=") - 1; ++ concat[2].iov_base = (void *)(conf->add_default_charset_name); ++ concat[2].iov_len = strlen(conf->add_default_charset_name); ++ type = apr_pstrcatv(r->pool, concat, 3, NULL); ++ break; ++ } ++ } ++ } ++ ++ return type; ++} ++ ++AP_DECLARE(void) ap_set_content_length(request_rec *r, apr_off_t clength) ++{ ++ r->clength = clength; ++ apr_table_setn(r->headers_out, "Content-Length", ++ apr_off_t_toa(r->pool, clength)); ++} ++ ++/* ++ * Return the latest rational time from a request/mtime (modification time) ++ * pair. We return the mtime unless it's in the future, in which case we ++ * return the current time. We use the request time as a reference in order ++ * to limit the number of calls to time(). We don't check for futurosity ++ * unless the mtime is at least as new as the reference. ++ */ ++AP_DECLARE(apr_time_t) ap_rationalize_mtime(request_rec *r, apr_time_t mtime) ++{ ++ apr_time_t now; ++ ++ /* For all static responses, it's almost certain that the file was ++ * last modified before the beginning of the request. So there's ++ * no reason to call time(NULL) again. But if the response has been ++ * created on demand, then it might be newer than the time the request ++ * started. In this event we really have to call time(NULL) again ++ * so that we can give the clients the most accurate Last-Modified. If we ++ * were given a time in the future, we return the current time - the ++ * Last-Modified can't be in the future. ++ */ ++ now = (mtime < r->request_time) ? r->request_time : apr_time_now(); ++ return (mtime > now) ? now : mtime; ++} ++ ++/* Min # of bytes to allocate when reading a request line */ ++#define MIN_LINE_ALLOC 80 ++ ++/* Get a line of protocol input, including any continuation lines ++ * caused by MIME folding (or broken clients) if fold != 0, and place it ++ * in the buffer s, of size n bytes, without the ending newline. ++ * ++ * If s is NULL, ap_rgetline_core will allocate necessary memory from r->pool. ++ * ++ * Returns APR_SUCCESS if there are no problems and sets *read to be ++ * the full length of s. ++ * ++ * APR_ENOSPC is returned if there is not enough buffer space. ++ * Other errors may be returned on other errors. ++ * ++ * The LF is *not* returned in the buffer. Therefore, a *read of 0 ++ * indicates that an empty line was read. ++ * ++ * Notes: Because the buffer uses 1 char for NUL, the most we can return is ++ * (n - 1) actual characters. ++ * ++ * If no LF is detected on the last line due to a dropped connection ++ * or a full buffer, that's considered an error. ++ */ ++AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n, ++ apr_size_t *read, request_rec *r, ++ int fold, apr_bucket_brigade *bb) ++{ ++ apr_status_t rv; ++ apr_bucket *e; ++ apr_size_t bytes_handled = 0, current_alloc = 0; ++ char *pos, *last_char = *s; ++ int do_alloc = (*s == NULL), saw_eos = 0; ++ ++ /* ++ * Initialize last_char as otherwise a random value will be compared ++ * against APR_ASCII_LF at the end of the loop if bb only contains ++ * zero-length buckets. ++ */ ++ if (last_char) { ++ *last_char = '\0'; ++ } ++ ++ for (;;) { ++ apr_brigade_cleanup(bb); ++ rv = ap_get_brigade(r->input_filters, bb, AP_MODE_GETLINE, ++ APR_BLOCK_READ, 0); ++ if (rv != APR_SUCCESS) { ++ return rv; ++ } ++ ++ /* Something horribly wrong happened. Someone didn't block! */ ++ if (APR_BRIGADE_EMPTY(bb)) { ++ return APR_EGENERAL; ++ } ++ ++ for (e = APR_BRIGADE_FIRST(bb); ++ e != APR_BRIGADE_SENTINEL(bb); ++ e = APR_BUCKET_NEXT(e)) ++ { ++ const char *str; ++ apr_size_t len; ++ ++ /* If we see an EOS, don't bother doing anything more. */ ++ if (APR_BUCKET_IS_EOS(e)) { ++ saw_eos = 1; ++ break; ++ } ++ ++ rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ); ++ if (rv != APR_SUCCESS) { ++ return rv; ++ } ++ ++ if (len == 0) { ++ /* no use attempting a zero-byte alloc (hurts when ++ * using --with-efence --enable-pool-debug) or ++ * doing any of the other logic either ++ */ ++ continue; ++ } ++ ++ /* Would this overrun our buffer? If so, we'll die. */ ++ if (n < bytes_handled + len) { ++ *read = bytes_handled; ++ if (*s) { ++ /* ensure this string is NUL terminated */ ++ if (bytes_handled > 0) { ++ (*s)[bytes_handled-1] = '\0'; ++ } ++ else { ++ (*s)[0] = '\0'; ++ } ++ } ++ return APR_ENOSPC; ++ } ++ ++ /* Do we have to handle the allocation ourselves? */ ++ if (do_alloc) { ++ /* We'll assume the common case where one bucket is enough. */ ++ if (!*s) { ++ current_alloc = len; ++ if (current_alloc < MIN_LINE_ALLOC) { ++ current_alloc = MIN_LINE_ALLOC; ++ } ++ *s = apr_palloc(r->pool, current_alloc); ++ } ++ else if (bytes_handled + len > current_alloc) { ++ /* Increase the buffer size */ ++ apr_size_t new_size = current_alloc * 2; ++ char *new_buffer; ++ ++ if (bytes_handled + len > new_size) { ++ new_size = (bytes_handled + len) * 2; ++ } ++ ++ new_buffer = apr_palloc(r->pool, new_size); ++ ++ /* Copy what we already had. */ ++ memcpy(new_buffer, *s, bytes_handled); ++ current_alloc = new_size; ++ *s = new_buffer; ++ } ++ } ++ ++ /* Just copy the rest of the data to the end of the old buffer. */ ++ pos = *s + bytes_handled; ++ memcpy(pos, str, len); ++ last_char = pos + len - 1; ++ ++ /* We've now processed that new data - update accordingly. */ ++ bytes_handled += len; ++ } ++ ++ /* If we got a full line of input, stop reading */ ++ if (last_char && (*last_char == APR_ASCII_LF)) { ++ break; ++ } ++ } ++ ++ /* Now NUL-terminate the string at the end of the line; ++ * if the last-but-one character is a CR, terminate there */ ++ if (last_char > *s && last_char[-1] == APR_ASCII_CR) { ++ last_char--; ++ } ++ *last_char = '\0'; ++ bytes_handled = last_char - *s; ++ ++ /* If we're folding, we have more work to do. ++ * ++ * Note that if an EOS was seen, we know we can't have another line. ++ */ ++ if (fold && bytes_handled && !saw_eos) { ++ for (;;) { ++ const char *str; ++ apr_size_t len; ++ char c; ++ ++ /* Clear the temp brigade for this filter read. */ ++ apr_brigade_cleanup(bb); ++ ++ /* We only care about the first byte. */ ++ rv = ap_get_brigade(r->input_filters, bb, AP_MODE_SPECULATIVE, ++ APR_BLOCK_READ, 1); ++ if (rv != APR_SUCCESS) { ++ return rv; ++ } ++ ++ if (APR_BRIGADE_EMPTY(bb)) { ++ break; ++ } ++ ++ e = APR_BRIGADE_FIRST(bb); ++ ++ /* If we see an EOS, don't bother doing anything more. */ ++ if (APR_BUCKET_IS_EOS(e)) { ++ break; ++ } ++ ++ rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ); ++ if (rv != APR_SUCCESS) { ++ apr_brigade_cleanup(bb); ++ return rv; ++ } ++ ++ /* Found one, so call ourselves again to get the next line. ++ * ++ * FIXME: If the folding line is completely blank, should we ++ * stop folding? Does that require also looking at the next ++ * char? ++ */ ++ /* When we call destroy, the buckets are deleted, so save that ++ * one character we need. This simplifies our execution paths ++ * at the cost of one character read. ++ */ ++ c = *str; ++ if (c == APR_ASCII_BLANK || c == APR_ASCII_TAB) { ++ /* Do we have enough space? We may be full now. */ ++ if (bytes_handled >= n) { ++ *read = n; ++ /* ensure this string is terminated */ ++ (*s)[n-1] = '\0'; ++ return APR_ENOSPC; ++ } ++ else { ++ apr_size_t next_size, next_len; ++ char *tmp; ++ ++ /* If we're doing the allocations for them, we have to ++ * give ourselves a NULL and copy it on return. ++ */ ++ if (do_alloc) { ++ tmp = NULL; ++ } else { ++ /* We're null terminated. */ ++ tmp = last_char; ++ } ++ ++ next_size = n - bytes_handled; ++ ++ rv = ap_rgetline_core(&tmp, next_size, ++ &next_len, r, 0, bb); ++ if (rv != APR_SUCCESS) { ++ return rv; ++ } ++ ++ if (do_alloc && next_len > 0) { ++ char *new_buffer; ++ apr_size_t new_size = bytes_handled + next_len + 1; ++ ++ /* we need to alloc an extra byte for a null */ ++ new_buffer = apr_palloc(r->pool, new_size); ++ ++ /* Copy what we already had. */ ++ memcpy(new_buffer, *s, bytes_handled); ++ ++ /* copy the new line, including the trailing null */ ++ memcpy(new_buffer + bytes_handled, tmp, next_len + 1); ++ *s = new_buffer; ++ } ++ ++ last_char += next_len; ++ bytes_handled += next_len; ++ } ++ } ++ else { /* next character is not tab or space */ ++ break; ++ } ++ } ++ } ++ ++ *read = bytes_handled; ++ return APR_SUCCESS; ++} ++ ++#if APR_CHARSET_EBCDIC ++AP_DECLARE(apr_status_t) ap_rgetline(char **s, apr_size_t n, ++ apr_size_t *read, request_rec *r, ++ int fold, apr_bucket_brigade *bb) ++{ ++ /* on ASCII boxes, ap_rgetline is a macro which simply invokes ++ * ap_rgetline_core with the same parms ++ * ++ * on EBCDIC boxes, each complete http protocol input line needs to be ++ * translated into the code page used by the compiler. Since ++ * ap_rgetline_core uses recursion, we do the translation in a wrapper ++ * function to insure that each input character gets translated only once. ++ */ ++ apr_status_t rv; ++ ++ rv = ap_rgetline_core(s, n, read, r, fold, bb); ++ if (rv == APR_SUCCESS) { ++ ap_xlate_proto_from_ascii(*s, *read); ++ } ++ return rv; ++} ++#endif ++ ++AP_DECLARE(int) ap_getline(char *s, int n, request_rec *r, int fold) ++{ ++ char *tmp_s = s; ++ apr_status_t rv; ++ apr_size_t len; ++ apr_bucket_brigade *tmp_bb; ++ ++ tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); ++ rv = ap_rgetline(&tmp_s, n, &len, r, fold, tmp_bb); ++ apr_brigade_destroy(tmp_bb); ++ ++ /* Map the out-of-space condition to the old API. */ ++ if (rv == APR_ENOSPC) { ++ return n; ++ } ++ ++ /* Anything else is just bad. */ ++ if (rv != APR_SUCCESS) { ++ return -1; ++ } ++ ++ return (int)len; ++} ++ ++/* parse_uri: break apart the uri ++ * Side Effects: ++ * - sets r->args to rest after '?' (or NULL if no '?') ++ * - sets r->uri to request uri (without r->args part) ++ * - sets r->hostname (if not set already) from request (scheme://host:port) ++ */ ++AP_CORE_DECLARE(void) ap_parse_uri(request_rec *r, const char *uri) ++{ ++ int status = HTTP_OK; ++ ++ r->unparsed_uri = apr_pstrdup(r->pool, uri); ++ ++ /* http://issues.apache.org/bugzilla/show_bug.cgi?id=31875 ++ * http://issues.apache.org/bugzilla/show_bug.cgi?id=28450 ++ * ++ * This is not in fact a URI, it's a path. That matters in the ++ * case of a leading double-slash. We need to resolve the issue ++ * by normalising that out before treating it as a URI. ++ */ ++ while ((uri[0] == '/') && (uri[1] == '/')) { ++ ++uri ; ++ } ++ if (r->method_number == M_CONNECT) { ++ status = apr_uri_parse_hostinfo(r->pool, uri, &r->parsed_uri); ++ } ++ else { ++ /* Simple syntax Errors in URLs are trapped by ++ * parse_uri_components(). ++ */ ++ status = apr_uri_parse(r->pool, uri, &r->parsed_uri); ++ } ++ ++ if (status == APR_SUCCESS) { ++ /* if it has a scheme we may need to do absoluteURI vhost stuff */ ++ if (r->parsed_uri.scheme ++ && !strcasecmp(r->parsed_uri.scheme, ap_http_scheme(r))) { ++ r->hostname = r->parsed_uri.hostname; ++ } ++ else if (r->method_number == M_CONNECT) { ++ r->hostname = r->parsed_uri.hostname; ++ } ++ ++ r->args = r->parsed_uri.query; ++ r->uri = r->parsed_uri.path ? r->parsed_uri.path ++ : apr_pstrdup(r->pool, "/"); ++ ++#if defined(OS2) || defined(WIN32) ++ /* Handle path translations for OS/2 and plug security hole. ++ * This will prevent "http://www.wherever.com/..\..\/" from ++ * returning a directory for the root drive. ++ */ ++ { ++ char *x; ++ ++ for (x = r->uri; (x = strchr(x, '\\')) != NULL; ) ++ *x = '/'; ++ } ++#endif /* OS2 || WIN32 */ ++ } ++ else { ++ r->args = NULL; ++ r->hostname = NULL; ++ r->status = HTTP_BAD_REQUEST; /* set error status */ ++ r->uri = apr_pstrdup(r->pool, uri); ++ } ++} ++ ++static int read_request_line(request_rec *r, apr_bucket_brigade *bb) ++{ ++ const char *ll; ++ const char *uri; ++ const char *pro; ++ ++#if 0 ++ conn_rec *conn = r->connection; ++#endif ++ int major = 1, minor = 0; /* Assume HTTP/1.0 if non-"HTTP" protocol */ ++ char http[5]; ++ apr_size_t len; ++ int num_blank_lines = 0; ++ int max_blank_lines = r->server->limit_req_fields; ++ ++ if (max_blank_lines <= 0) { ++ max_blank_lines = DEFAULT_LIMIT_REQUEST_FIELDS; ++ } ++ ++ /* Read past empty lines until we get a real request line, ++ * a read error, the connection closes (EOF), or we timeout. ++ * ++ * We skip empty lines because browsers have to tack a CRLF on to the end ++ * of POSTs to support old CERN webservers. But note that we may not ++ * have flushed any previous response completely to the client yet. ++ * We delay the flush as long as possible so that we can improve ++ * performance for clients that are pipelining requests. If a request ++ * is pipelined then we won't block during the (implicit) read() below. ++ * If the requests aren't pipelined, then the client is still waiting ++ * for the final buffer flush from us, and we will block in the implicit ++ * read(). B_SAFEREAD ensures that the BUFF layer flushes if it will ++ * have to block during a read. ++ */ ++ ++ do { ++ apr_status_t rv; ++ ++ /* insure ap_rgetline allocates memory each time thru the loop ++ * if there are empty lines ++ */ ++ r->the_request = NULL; ++ rv = ap_rgetline(&(r->the_request), (apr_size_t)(r->server->limit_req_line + 2), ++ &len, r, 0, bb); ++ ++ if (rv != APR_SUCCESS) { ++ r->request_time = apr_time_now(); ++ ++ /* ap_rgetline returns APR_ENOSPC if it fills up the ++ * buffer before finding the end-of-line. This is only going to ++ * happen if it exceeds the configured limit for a request-line. ++ */ ++ if (rv == APR_ENOSPC) { ++ r->status = HTTP_REQUEST_URI_TOO_LARGE; ++ r->proto_num = HTTP_VERSION(1,0); ++ r->protocol = apr_pstrdup(r->pool, "HTTP/1.0"); ++ } ++ else if (APR_STATUS_IS_TIMEUP(rv)) { ++ r->status = HTTP_REQUEST_TIME_OUT; ++ } ++ return 0; ++ } ++ } while ((len <= 0) && (++num_blank_lines < max_blank_lines)); ++ ++ /* we've probably got something to do, ignore graceful restart requests */ ++ ++ r->request_time = apr_time_now(); ++ ll = r->the_request; ++ r->method = ap_getword_white(r->pool, &ll); ++ ++#if 0 ++/* XXX If we want to keep track of the Method, the protocol module should do ++ * it. That support isn't in the scoreboard yet. Hopefully next week ++ * sometime. rbb */ ++ ap_update_connection_status(AP_CHILD_THREAD_FROM_ID(conn->id), "Method", ++ r->method); ++#endif ++ ++ uri = ap_getword_white(r->pool, &ll); ++ ++ /* Provide quick information about the request method as soon as known */ ++ ++ r->method_number = ap_method_number_of(r->method); ++ if (r->method_number == M_GET && r->method[0] == 'H') { ++ r->header_only = 1; ++ } ++ ++ ap_parse_uri(r, uri); ++ ++ if (ll[0]) { ++ r->assbackwards = 0; ++ pro = ll; ++ len = strlen(ll); ++ } else { ++ r->assbackwards = 1; ++ pro = "HTTP/0.9"; ++ len = 8; ++ } ++ r->protocol = apr_pstrmemdup(r->pool, pro, len); ++ ++ /* XXX ap_update_connection_status(conn->id, "Protocol", r->protocol); */ ++ ++ /* Avoid sscanf in the common case */ ++ if (len == 8 ++ && pro[0] == 'H' && pro[1] == 'T' && pro[2] == 'T' && pro[3] == 'P' ++ && pro[4] == '/' && apr_isdigit(pro[5]) && pro[6] == '.' ++ && apr_isdigit(pro[7])) { ++ r->proto_num = HTTP_VERSION(pro[5] - '0', pro[7] - '0'); ++ } ++ else if (3 == sscanf(r->protocol, "%4s/%u.%u", http, &major, &minor) ++ && (strcasecmp("http", http) == 0) ++ && (minor < HTTP_VERSION(1, 0)) ) /* don't allow HTTP/0.1000 */ ++ r->proto_num = HTTP_VERSION(major, minor); ++ else ++ r->proto_num = HTTP_VERSION(1, 0); ++ ++ return 1; ++} ++ ++AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r, apr_bucket_brigade *bb) ++{ ++ char *last_field = NULL; ++ apr_size_t last_len = 0; ++ apr_size_t alloc_len = 0; ++ char *field; ++ char *value; ++ apr_size_t len; ++ int fields_read = 0; ++ char *tmp_field; ++ ++ /* ++ * Read header lines until we get the empty separator line, a read error, ++ * the connection closes (EOF), reach the server limit, or we timeout. ++ */ ++ while(1) { ++ apr_status_t rv; ++ int folded = 0; ++ ++ field = NULL; ++ rv = ap_rgetline(&field, r->server->limit_req_fieldsize + 2, ++ &len, r, 0, bb); ++ ++ if (rv != APR_SUCCESS) { ++ if (APR_STATUS_IS_TIMEUP(rv)) { ++ r->status = HTTP_REQUEST_TIME_OUT; ++ } ++ else { ++ r->status = HTTP_BAD_REQUEST; ++ } ++ ++ /* ap_rgetline returns APR_ENOSPC if it fills up the buffer before ++ * finding the end-of-line. This is only going to happen if it ++ * exceeds the configured limit for a field size. ++ */ ++ if (rv == APR_ENOSPC && field) { ++ /* insure ap_escape_html will terminate correctly */ ++ field[len - 1] = '\0'; ++ apr_table_setn(r->notes, "error-notes", ++ apr_pstrcat(r->pool, ++ "Size of a request header field " ++ "exceeds server limit.
\n" ++ "
\n",
++                                           ap_escape_html(r->pool, field),
++                                           "
\n", NULL)); ++ } ++ return; ++ } ++ ++ if (last_field != NULL) { ++ if ((len > 0) && ((*field == '\t') || *field == ' ')) { ++ /* This line is a continuation of the preceding line(s), ++ * so append it to the line that we've set aside. ++ * Note: this uses a power-of-two allocator to avoid ++ * doing O(n) allocs and using O(n^2) space for ++ * continuations that span many many lines. ++ */ ++ apr_size_t fold_len = last_len + len + 1; /* trailing null */ ++ ++ if (fold_len >= (apr_size_t)(r->server->limit_req_fieldsize)) { ++ r->status = HTTP_BAD_REQUEST; ++ /* report what we have accumulated so far before the ++ * overflow (last_field) as the field with the problem ++ */ ++ apr_table_setn(r->notes, "error-notes", ++ apr_pstrcat(r->pool, ++ "Size of a request header field " ++ "after folding " ++ "exceeds server limit.
\n" ++ "
\n",
++                                               ap_escape_html(r->pool, last_field),
++                                               "
\n", NULL)); ++ return; ++ } ++ ++ if (fold_len > alloc_len) { ++ char *fold_buf; ++ alloc_len += alloc_len; ++ if (fold_len > alloc_len) { ++ alloc_len = fold_len; ++ } ++ fold_buf = (char *)apr_palloc(r->pool, alloc_len); ++ memcpy(fold_buf, last_field, last_len); ++ last_field = fold_buf; ++ } ++ memcpy(last_field + last_len, field, len +1); /* +1 for nul */ ++ last_len += len; ++ folded = 1; ++ } ++ else /* not a continuation line */ { ++ ++ if (r->server->limit_req_fields ++ && (++fields_read > r->server->limit_req_fields)) { ++ r->status = HTTP_BAD_REQUEST; ++ apr_table_setn(r->notes, "error-notes", ++ "The number of request header fields " ++ "exceeds this server's limit."); ++ return; ++ } ++ ++ if (!(value = strchr(last_field, ':'))) { /* Find ':' or */ ++ r->status = HTTP_BAD_REQUEST; /* abort bad request */ ++ apr_table_setn(r->notes, "error-notes", ++ apr_pstrcat(r->pool, ++ "Request header field is " ++ "missing ':' separator.
\n" ++ "
\n",
++                                               ap_escape_html(r->pool,
++                                                              last_field),
++                                               "
\n", NULL)); ++ return; ++ } ++ ++ tmp_field = value - 1; /* last character of field-name */ ++ ++ *value++ = '\0'; /* NUL-terminate at colon */ ++ ++ while (*value == ' ' || *value == '\t') { ++ ++value; /* Skip to start of value */ ++ } ++ ++ /* Strip LWS after field-name: */ ++ while (tmp_field > last_field ++ && (*tmp_field == ' ' || *tmp_field == '\t')) { ++ *tmp_field-- = '\0'; ++ } ++ ++ /* Strip LWS after field-value: */ ++ tmp_field = last_field + last_len - 1; ++ while (tmp_field > value ++ && (*tmp_field == ' ' || *tmp_field == '\t')) { ++ *tmp_field-- = '\0'; ++ } ++ ++ apr_table_addn(r->headers_in, last_field, value); ++ ++ /* reset the alloc_len so that we'll allocate a new ++ * buffer if we have to do any more folding: we can't ++ * use the previous buffer because its contents are ++ * now part of r->headers_in ++ */ ++ alloc_len = 0; ++ ++ } /* end if current line is not a continuation starting with tab */ ++ } ++ ++ /* Found a blank line, stop. */ ++ if (len == 0) { ++ break; ++ } ++ ++ /* Keep track of this line so that we can parse it on ++ * the next loop iteration. (In the folded case, last_field ++ * has been updated already.) ++ */ ++ if (!folded) { ++ last_field = field; ++ last_len = len; ++ } ++ } ++ ++ apr_table_compress(r->headers_in, APR_OVERLAP_TABLES_MERGE); ++} ++ ++AP_DECLARE(void) ap_get_mime_headers(request_rec *r) ++{ ++ apr_bucket_brigade *tmp_bb; ++ tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); ++ ap_get_mime_headers_core(r, tmp_bb); ++ apr_brigade_destroy(tmp_bb); ++} ++ ++request_rec *ap_read_request(conn_rec *conn) ++{ ++ request_rec *r; ++ apr_pool_t *p; ++ const char *expect; ++ int access_status; ++ apr_bucket_brigade *tmp_bb; ++ apr_socket_t *csd; ++ apr_interval_time_t cur_timeout; ++ ++ apr_pool_create(&p, conn->pool); ++ apr_pool_tag(p, "request"); ++ r = apr_pcalloc(p, sizeof(request_rec)); ++ r->pool = p; ++ r->connection = conn; ++ r->server = conn->base_server; ++ ++ r->user = NULL; ++ r->ap_auth_type = NULL; ++ ++ r->allowed_methods = ap_make_method_list(p, 2); ++ ++ r->headers_in = apr_table_make(r->pool, 25); ++ r->subprocess_env = apr_table_make(r->pool, 25); ++ r->headers_out = apr_table_make(r->pool, 12); ++ r->err_headers_out = apr_table_make(r->pool, 5); ++ r->notes = apr_table_make(r->pool, 5); ++ ++ r->request_config = ap_create_request_config(r->pool); ++ /* Must be set before we run create request hook */ ++ ++ r->proto_output_filters = conn->output_filters; ++ r->output_filters = r->proto_output_filters; ++ r->proto_input_filters = conn->input_filters; ++ r->input_filters = r->proto_input_filters; ++ ap_run_create_request(r); ++ r->per_dir_config = r->server->lookup_defaults; ++ ++ r->sent_bodyct = 0; /* bytect isn't for body */ ++ ++ r->read_length = 0; ++ r->read_body = REQUEST_NO_BODY; ++ ++ r->status = HTTP_OK; /* Until further notice */ ++ r->the_request = NULL; ++ ++ /* Begin by presuming any module can make its own path_info assumptions, ++ * until some module interjects and changes the value. ++ */ ++ r->used_path_info = AP_REQ_DEFAULT_PATH_INFO; ++ ++ tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); ++ ++ /* Get the request... */ ++ if (!read_request_line(r, tmp_bb)) { ++ if (r->status == HTTP_REQUEST_URI_TOO_LARGE) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "request failed: URI too long (longer than %d)", r->server->limit_req_line); ++ ap_send_error_response(r, 0); ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ ap_run_log_transaction(r); ++ apr_brigade_destroy(tmp_bb); ++ return r; ++ } ++ else if (r->status == HTTP_REQUEST_TIME_OUT) { ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ if (!r->connection->keepalives) { ++ ap_run_log_transaction(r); ++ } ++ apr_brigade_destroy(tmp_bb); ++ return r; ++ } ++ ++ apr_brigade_destroy(tmp_bb); ++ return NULL; ++ } ++ ++ /* We may have been in keep_alive_timeout mode, so toggle back ++ * to the normal timeout mode as we fetch the header lines, ++ * as necessary. ++ */ ++ csd = ap_get_module_config(conn->conn_config, &core_module); ++ apr_socket_timeout_get(csd, &cur_timeout); ++ if (cur_timeout != conn->base_server->timeout) { ++ apr_socket_timeout_set(csd, conn->base_server->timeout); ++ cur_timeout = conn->base_server->timeout; ++ } ++ ++ if (!r->assbackwards) { ++ ap_get_mime_headers_core(r, tmp_bb); ++ if (r->status != HTTP_OK) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "request failed: error reading the headers"); ++ ap_send_error_response(r, 0); ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ ap_run_log_transaction(r); ++ apr_brigade_destroy(tmp_bb); ++ return r; ++ } ++ ++ if (apr_table_get(r->headers_in, "Transfer-Encoding") ++ && apr_table_get(r->headers_in, "Content-Length")) { ++ /* 2616 section 4.4, point 3: "if both Transfer-Encoding ++ * and Content-Length are received, the latter MUST be ++ * ignored"; so unset it here to prevent any confusion ++ * later. */ ++ apr_table_unset(r->headers_in, "Content-Length"); ++ } ++ } ++ else { ++ if (r->header_only) { ++ /* ++ * Client asked for headers only with HTTP/0.9, which doesn't send ++ * headers! Have to dink things just to make sure the error message ++ * comes through... ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "client sent invalid HTTP/0.9 request: HEAD %s", ++ r->uri); ++ r->header_only = 0; ++ r->status = HTTP_BAD_REQUEST; ++ ap_send_error_response(r, 0); ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ ap_run_log_transaction(r); ++ apr_brigade_destroy(tmp_bb); ++ return r; ++ } ++ } ++ ++ apr_brigade_destroy(tmp_bb); ++ ++ /* update what we think the virtual host is based on the headers we've ++ * now read. may update status. ++ */ ++ ap_update_vhost_from_headers(r); ++ ++ /* Toggle to the Host:-based vhost's timeout mode to fetch the ++ * request body and send the response body, if needed. ++ */ ++ if (cur_timeout != r->server->timeout) { ++ apr_socket_timeout_set(csd, r->server->timeout); ++ cur_timeout = r->server->timeout; ++ } ++ ++ /* we may have switched to another server */ ++ r->per_dir_config = r->server->lookup_defaults; ++ ++ if ((!r->hostname && (r->proto_num >= HTTP_VERSION(1, 1))) ++ || ((r->proto_num == HTTP_VERSION(1, 1)) ++ && !apr_table_get(r->headers_in, "Host"))) { ++ /* ++ * Client sent us an HTTP/1.1 or later request without telling us the ++ * hostname, either with a full URL or a Host: header. We therefore ++ * need to (as per the 1.1 spec) send an error. As a special case, ++ * HTTP/1.1 mentions twice (S9, S14.23) that a request MUST contain ++ * a Host: header, and the server MUST respond with 400 if it doesn't. ++ */ ++ r->status = HTTP_BAD_REQUEST; ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "client sent HTTP/1.1 request without hostname " ++ "(see RFC2616 section 14.23): %s", r->uri); ++ } ++ ++ /* ++ * Add the HTTP_IN filter here to ensure that ap_discard_request_body ++ * called by ap_die and by ap_send_error_response works correctly on ++ * status codes that do not cause the connection to be dropped and ++ * in situations where the connection should be kept alive. ++ */ ++ ++ ap_add_input_filter_handle(ap_http_input_filter_handle, ++ NULL, r, r->connection); ++ ++ if (r->status != HTTP_OK) { ++ ap_send_error_response(r, 0); ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ ap_run_log_transaction(r); ++ return r; ++ } ++ ++ if ((access_status = ap_run_post_read_request(r))) { ++ ap_die(access_status, r); ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ ap_run_log_transaction(r); ++ return NULL; ++ } ++ ++ if (((expect = apr_table_get(r->headers_in, "Expect")) != NULL) ++ && (expect[0] != '\0')) { ++ /* ++ * The Expect header field was added to HTTP/1.1 after RFC 2068 ++ * as a means to signal when a 100 response is desired and, ++ * unfortunately, to signal a poor man's mandatory extension that ++ * the server must understand or return 417 Expectation Failed. ++ */ ++ if (strcasecmp(expect, "100-continue") == 0) { ++ r->expecting_100 = 1; ++ } ++ else { ++ r->status = HTTP_EXPECTATION_FAILED; ++ ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, ++ "client sent an unrecognized expectation value of " ++ "Expect: %s", expect); ++ ap_send_error_response(r, 0); ++ ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r); ++ ap_run_log_transaction(r); ++ return r; ++ } ++ } ++ ++ return r; ++} ++ ++/* if a request with a body creates a subrequest, remove original request's ++ * input headers which pertain to the body which has already been read. ++ * out-of-line helper function for ap_set_sub_req_protocol. ++ */ ++ ++static void strip_headers_request_body(request_rec *rnew) ++{ ++ apr_table_unset(rnew->headers_in, "Content-Encoding"); ++ apr_table_unset(rnew->headers_in, "Content-Language"); ++ apr_table_unset(rnew->headers_in, "Content-Length"); ++ apr_table_unset(rnew->headers_in, "Content-Location"); ++ apr_table_unset(rnew->headers_in, "Content-MD5"); ++ apr_table_unset(rnew->headers_in, "Content-Range"); ++ apr_table_unset(rnew->headers_in, "Content-Type"); ++ apr_table_unset(rnew->headers_in, "Expires"); ++ apr_table_unset(rnew->headers_in, "Last-Modified"); ++ apr_table_unset(rnew->headers_in, "Transfer-Encoding"); ++} ++ ++/* ++ * A couple of other functions which initialize some of the fields of ++ * a request structure, as appropriate for adjuncts of one kind or another ++ * to a request in progress. Best here, rather than elsewhere, since ++ * *someone* has to set the protocol-specific fields... ++ */ ++ ++AP_DECLARE(void) ap_set_sub_req_protocol(request_rec *rnew, ++ const request_rec *r) ++{ ++ rnew->the_request = r->the_request; /* Keep original request-line */ ++ ++ rnew->assbackwards = 1; /* Don't send headers from this. */ ++ rnew->no_local_copy = 1; /* Don't try to send HTTP_NOT_MODIFIED for a ++ * fragment. */ ++ rnew->method = "GET"; ++ rnew->method_number = M_GET; ++ rnew->protocol = "INCLUDED"; ++ ++ rnew->status = HTTP_OK; ++ ++ rnew->headers_in = apr_table_copy(rnew->pool, r->headers_in); ++ ++ /* did the original request have a body? (e.g. POST w/SSI tags) ++ * if so, make sure the subrequest doesn't inherit body headers ++ */ ++ if (apr_table_get(r->headers_in, "Content-Length") ++ || apr_table_get(r->headers_in, "Transfer-Encoding")) { ++ strip_headers_request_body(rnew); ++ } ++ rnew->subprocess_env = apr_table_copy(rnew->pool, r->subprocess_env); ++ rnew->headers_out = apr_table_make(rnew->pool, 5); ++ rnew->err_headers_out = apr_table_make(rnew->pool, 5); ++ rnew->notes = apr_table_make(rnew->pool, 5); ++ ++ rnew->expecting_100 = r->expecting_100; ++ rnew->read_length = r->read_length; ++ rnew->read_body = REQUEST_NO_BODY; ++ ++ rnew->main = (request_rec *) r; ++} ++ ++static void end_output_stream(request_rec *r) ++{ ++ conn_rec *c = r->connection; ++ apr_bucket_brigade *bb; ++ apr_bucket *b; ++ ++ bb = apr_brigade_create(r->pool, c->bucket_alloc); ++ b = apr_bucket_eos_create(c->bucket_alloc); ++ APR_BRIGADE_INSERT_TAIL(bb, b); ++ ap_pass_brigade(r->output_filters, bb); ++} ++ ++AP_DECLARE(void) ap_finalize_sub_req_protocol(request_rec *sub) ++{ ++ /* tell the filter chain there is no more content coming */ ++ if (!sub->eos_sent) { ++ end_output_stream(sub); ++ } ++} ++ ++/* finalize_request_protocol is called at completion of sending the ++ * response. Its sole purpose is to send the terminating protocol ++ * information for any wrappers around the response message body ++ * (i.e., transfer encodings). It should have been named finalize_response. ++ */ ++AP_DECLARE(void) ap_finalize_request_protocol(request_rec *r) ++{ ++ (void) ap_discard_request_body(r); ++ ++ /* tell the filter chain there is no more content coming */ ++ if (!r->eos_sent) { ++ end_output_stream(r); ++ } ++} ++ ++/* ++ * Support for the Basic authentication protocol, and a bit for Digest. ++ */ ++AP_DECLARE(void) ap_note_auth_failure(request_rec *r) ++{ ++ const char *type = ap_auth_type(r); ++ if (type) { ++ if (!strcasecmp(type, "Basic")) ++ ap_note_basic_auth_failure(r); ++ else if (!strcasecmp(type, "Digest")) ++ ap_note_digest_auth_failure(r); ++ } ++ else { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, ++ 0, r, "need AuthType to note auth failure: %s", r->uri); ++ } ++} ++ ++AP_DECLARE(void) ap_note_basic_auth_failure(request_rec *r) ++{ ++ const char *type = ap_auth_type(r); ++ ++ /* if there is no AuthType configure or it is something other than ++ * Basic, let ap_note_auth_failure() deal with it ++ */ ++ if (!type || strcasecmp(type, "Basic")) ++ ap_note_auth_failure(r); ++ else ++ apr_table_setn(r->err_headers_out, ++ (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" ++ : "WWW-Authenticate", ++ apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), ++ "\"", NULL)); ++} ++ ++AP_DECLARE(void) ap_note_digest_auth_failure(request_rec *r) ++{ ++ apr_table_setn(r->err_headers_out, ++ (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" ++ : "WWW-Authenticate", ++ apr_psprintf(r->pool, "Digest realm=\"%s\", nonce=\"" ++ "%" APR_UINT64_T_HEX_FMT "\"", ++ ap_auth_name(r), (apr_uint64_t)r->request_time)); ++} ++ ++AP_DECLARE(int) ap_get_basic_auth_pw(request_rec *r, const char **pw) ++{ ++ const char *auth_line = apr_table_get(r->headers_in, ++ (PROXYREQ_PROXY == r->proxyreq) ++ ? "Proxy-Authorization" ++ : "Authorization"); ++ const char *t; ++ ++ if (!(t = ap_auth_type(r)) || strcasecmp(t, "Basic")) ++ return DECLINED; ++ ++ if (!ap_auth_name(r)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, ++ 0, r, "need AuthName: %s", r->uri); ++ return HTTP_INTERNAL_SERVER_ERROR; ++ } ++ ++ if (!auth_line) { ++ ap_note_basic_auth_failure(r); ++ return HTTP_UNAUTHORIZED; ++ } ++ ++ if (strcasecmp(ap_getword(r->pool, &auth_line, ' '), "Basic")) { ++ /* Client tried to authenticate using wrong auth scheme */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "client used wrong authentication scheme: %s", r->uri); ++ ap_note_basic_auth_failure(r); ++ return HTTP_UNAUTHORIZED; ++ } ++ ++ while (*auth_line == ' ' || *auth_line == '\t') { ++ auth_line++; ++ } ++ ++ t = ap_pbase64decode(r->pool, auth_line); ++ r->user = ap_getword_nulls (r->pool, &t, ':'); ++ r->ap_auth_type = "Basic"; ++ ++ *pw = t; ++ ++ return OK; ++} ++ ++struct content_length_ctx { ++ int data_sent; /* true if the C-L filter has already sent at ++ * least one bucket on to the next output filter ++ * for this request ++ */ ++}; ++ ++/* This filter computes the content length, but it also computes the number ++ * of bytes sent to the client. This means that this filter will always run ++ * through all of the buckets in all brigades ++ */ ++AP_CORE_DECLARE_NONSTD(apr_status_t) ap_content_length_filter( ++ ap_filter_t *f, ++ apr_bucket_brigade *b) ++{ ++ request_rec *r = f->r; ++ struct content_length_ctx *ctx; ++ apr_bucket *e; ++ int eos = 0; ++ apr_read_type_e eblock = APR_NONBLOCK_READ; ++ ++ ctx = f->ctx; ++ if (!ctx) { ++ f->ctx = ctx = apr_palloc(r->pool, sizeof(*ctx)); ++ ctx->data_sent = 0; ++ } ++ ++ /* Loop through this set of buckets to compute their length ++ */ ++ e = APR_BRIGADE_FIRST(b); ++ while (e != APR_BRIGADE_SENTINEL(b)) { ++ if (APR_BUCKET_IS_EOS(e)) { ++ eos = 1; ++ break; ++ } ++ if (e->length == (apr_size_t)-1) { ++ apr_size_t len; ++ const char *ignored; ++ apr_status_t rv; ++ ++ /* This is probably a pipe bucket. Send everything ++ * prior to this, and then read the data for this bucket. ++ */ ++ rv = apr_bucket_read(e, &ignored, &len, eblock); ++ if (rv == APR_SUCCESS) { ++ /* Attempt a nonblocking read next time through */ ++ eblock = APR_NONBLOCK_READ; ++ r->bytes_sent += len; ++ } ++ else if (APR_STATUS_IS_EAGAIN(rv)) { ++ /* Output everything prior to this bucket, and then ++ * do a blocking read on the next batch. ++ */ ++ if (e != APR_BRIGADE_FIRST(b)) { ++ apr_bucket_brigade *split = apr_brigade_split(b, e); ++ apr_bucket *flush = apr_bucket_flush_create(r->connection->bucket_alloc); ++ ++ APR_BRIGADE_INSERT_TAIL(b, flush); ++ rv = ap_pass_brigade(f->next, b); ++ if (rv != APR_SUCCESS || f->c->aborted) { ++ apr_brigade_destroy(split); ++ return rv; ++ } ++ b = split; ++ e = APR_BRIGADE_FIRST(b); ++ ++ ctx->data_sent = 1; ++ } ++ eblock = APR_BLOCK_READ; ++ continue; ++ } ++ else { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, ++ "ap_content_length_filter: " ++ "apr_bucket_read() failed"); ++ return rv; ++ } ++ } ++ else { ++ r->bytes_sent += e->length; ++ } ++ e = APR_BUCKET_NEXT(e); ++ } ++ ++ /* If we've now seen the entire response and it's otherwise ++ * okay to set the C-L in the response header, then do so now. ++ * ++ * We can only set a C-L in the response header if we haven't already ++ * sent any buckets on to the next output filter for this request. ++ */ ++ if (ctx->data_sent == 0 && eos && ++ /* don't whack the C-L if it has already been set for a HEAD ++ * by something like proxy. the brigade only has an EOS bucket ++ * in this case, making r->bytes_sent zero. ++ * ++ * if r->bytes_sent > 0 we have a (temporary) body whose length may ++ * have been changed by a filter. the C-L header might not have been ++ * updated so we do it here. long term it would be cleaner to have ++ * such filters update or remove the C-L header, and just use it ++ * if present. ++ */ ++ !(r->header_only && r->bytes_sent == 0 && ++ apr_table_get(r->headers_out, "Content-Length"))) { ++ ap_set_content_length(r, r->bytes_sent); ++ } ++ ++ ctx->data_sent = 1; ++ return ap_pass_brigade(f->next, b); ++} ++ ++/* ++ * Send the body of a response to the client. ++ */ ++AP_DECLARE(apr_status_t) ap_send_fd(apr_file_t *fd, request_rec *r, ++ apr_off_t offset, apr_size_t len, ++ apr_size_t *nbytes) ++{ ++ conn_rec *c = r->connection; ++ apr_bucket_brigade *bb = NULL; ++ apr_bucket *b; ++ apr_status_t rv; ++ ++ bb = apr_brigade_create(r->pool, c->bucket_alloc); ++ b = apr_bucket_file_create(fd, offset, len, r->pool, c->bucket_alloc); ++ APR_BRIGADE_INSERT_TAIL(bb, b); ++ ++ rv = ap_pass_brigade(r->output_filters, bb); ++ if (rv != APR_SUCCESS) { ++ *nbytes = 0; /* no way to tell how many were actually sent */ ++ } ++ else { ++ *nbytes = len; ++ } ++ ++ return rv; ++} ++ ++#if APR_HAS_MMAP ++/* send data from an in-memory buffer */ ++AP_DECLARE(size_t) ap_send_mmap(apr_mmap_t *mm, request_rec *r, size_t offset, ++ size_t length) ++{ ++ conn_rec *c = r->connection; ++ apr_bucket_brigade *bb = NULL; ++ apr_bucket *b; ++ ++ bb = apr_brigade_create(r->pool, c->bucket_alloc); ++ b = apr_bucket_mmap_create(mm, offset, length, c->bucket_alloc); ++ APR_BRIGADE_INSERT_TAIL(bb, b); ++ ap_pass_brigade(r->output_filters, bb); ++ ++ return mm->size; /* XXX - change API to report apr_status_t? */ ++} ++#endif /* APR_HAS_MMAP */ ++ ++typedef struct { ++ apr_bucket_brigade *bb; ++} old_write_filter_ctx; ++ ++AP_CORE_DECLARE_NONSTD(apr_status_t) ap_old_write_filter( ++ ap_filter_t *f, apr_bucket_brigade *bb) ++{ ++ old_write_filter_ctx *ctx = f->ctx; ++ ++ AP_DEBUG_ASSERT(ctx); ++ ++ if (ctx->bb != 0) { ++ /* whatever is coming down the pipe (we don't care), we ++ * can simply insert our buffered data at the front and ++ * pass the whole bundle down the chain. ++ */ ++ APR_BRIGADE_PREPEND(bb, ctx->bb); ++ } ++ ++ return ap_pass_brigade(f->next, bb); ++} ++ ++static apr_status_t buffer_output(request_rec *r, ++ const char *str, apr_size_t len) ++{ ++ conn_rec *c = r->connection; ++ ap_filter_t *f; ++ old_write_filter_ctx *ctx; ++ ++ if (len == 0) ++ return APR_SUCCESS; ++ ++ /* future optimization: record some flags in the request_rec to ++ * say whether we've added our filter, and whether it is first. ++ */ ++ ++ /* this will typically exit on the first test */ ++ for (f = r->output_filters; f != NULL; f = f->next) { ++ if (ap_old_write_func == f->frec) ++ break; ++ } ++ ++ if (f == NULL) { ++ /* our filter hasn't been added yet */ ++ ctx = apr_pcalloc(r->pool, sizeof(*ctx)); ++ ap_add_output_filter("OLD_WRITE", ctx, r, r->connection); ++ f = r->output_filters; ++ } ++ ++ /* if the first filter is not our buffering filter, then we have to ++ * deliver the content through the normal filter chain ++ */ ++ if (f != r->output_filters) { ++ apr_bucket_brigade *bb = apr_brigade_create(r->pool, c->bucket_alloc); ++ apr_bucket *b = apr_bucket_transient_create(str, len, c->bucket_alloc); ++ APR_BRIGADE_INSERT_TAIL(bb, b); ++ ++ return ap_pass_brigade(r->output_filters, bb); ++ } ++ ++ /* grab the context from our filter */ ++ ctx = r->output_filters->ctx; ++ ++ if (ctx->bb == NULL) { ++ ctx->bb = apr_brigade_create(r->pool, c->bucket_alloc); ++ } ++ ++ return ap_fwrite(f->next, ctx->bb, str, len); ++} ++ ++AP_DECLARE(int) ap_rputc(int c, request_rec *r) ++{ ++ char c2 = (char)c; ++ ++ if (r->connection->aborted) { ++ return -1; ++ } ++ ++ if (buffer_output(r, &c2, 1) != APR_SUCCESS) ++ return -1; ++ ++ return c; ++} ++ ++AP_DECLARE(int) ap_rputs(const char *str, request_rec *r) ++{ ++ apr_size_t len; ++ ++ if (r->connection->aborted) ++ return -1; ++ ++ if (buffer_output(r, str, len = strlen(str)) != APR_SUCCESS) ++ return -1; ++ ++ return len; ++} ++ ++AP_DECLARE(int) ap_rwrite(const void *buf, int nbyte, request_rec *r) ++{ ++ if (r->connection->aborted) ++ return -1; ++ ++ if (buffer_output(r, buf, nbyte) != APR_SUCCESS) ++ return -1; ++ ++ return nbyte; ++} ++ ++struct ap_vrprintf_data { ++ apr_vformatter_buff_t vbuff; ++ request_rec *r; ++ char *buff; ++}; ++ ++static apr_status_t r_flush(apr_vformatter_buff_t *buff) ++{ ++ /* callback function passed to ap_vformatter to be called when ++ * vformatter needs to write into buff and buff.curpos > buff.endpos */ ++ ++ /* ap_vrprintf_data passed as a apr_vformatter_buff_t, which is then ++ * "downcast" to an ap_vrprintf_data */ ++ struct ap_vrprintf_data *vd = (struct ap_vrprintf_data*)buff; ++ ++ if (vd->r->connection->aborted) ++ return -1; ++ ++ /* r_flush is called when vbuff is completely full */ ++ if (buffer_output(vd->r, vd->buff, AP_IOBUFSIZE)) { ++ return -1; ++ } ++ ++ /* reset the buffer position */ ++ vd->vbuff.curpos = vd->buff; ++ vd->vbuff.endpos = vd->buff + AP_IOBUFSIZE; ++ ++ return APR_SUCCESS; ++} ++ ++AP_DECLARE(int) ap_vrprintf(request_rec *r, const char *fmt, va_list va) ++{ ++ apr_size_t written; ++ struct ap_vrprintf_data vd; ++ char vrprintf_buf[AP_IOBUFSIZE]; ++ ++ vd.vbuff.curpos = vrprintf_buf; ++ vd.vbuff.endpos = vrprintf_buf + AP_IOBUFSIZE; ++ vd.r = r; ++ vd.buff = vrprintf_buf; ++ ++ if (r->connection->aborted) ++ return -1; ++ ++ written = apr_vformatter(r_flush, &vd.vbuff, fmt, va); ++ ++ if (written != -1) { ++ int n = vd.vbuff.curpos - vrprintf_buf; ++ ++ /* last call to buffer_output, to finish clearing the buffer */ ++ if (buffer_output(r, vrprintf_buf,n) != APR_SUCCESS) ++ return -1; ++ ++ written += n; ++ } ++ ++ return written; ++} ++ ++AP_DECLARE_NONSTD(int) ap_rprintf(request_rec *r, const char *fmt, ...) ++{ ++ va_list va; ++ int n; ++ ++ if (r->connection->aborted) ++ return -1; ++ ++ va_start(va, fmt); ++ n = ap_vrprintf(r, fmt, va); ++ va_end(va); ++ ++ return n; ++} ++ ++AP_DECLARE_NONSTD(int) ap_rvputs(request_rec *r, ...) ++{ ++ va_list va; ++ const char *s; ++ apr_size_t len; ++ apr_size_t written = 0; ++ ++ if (r->connection->aborted) ++ return -1; ++ ++ /* ### TODO: if the total output is large, put all the strings ++ * ### into a single brigade, rather than flushing each time we ++ * ### fill the buffer ++ */ ++ va_start(va, r); ++ while (1) { ++ s = va_arg(va, const char *); ++ if (s == NULL) ++ break; ++ ++ len = strlen(s); ++ if (buffer_output(r, s, len) != APR_SUCCESS) { ++ return -1; ++ } ++ ++ written += len; ++ } ++ va_end(va); ++ ++ return written; ++} ++ ++AP_DECLARE(int) ap_rflush(request_rec *r) ++{ ++ conn_rec *c = r->connection; ++ apr_bucket_brigade *bb; ++ apr_bucket *b; ++ ++ bb = apr_brigade_create(r->pool, c->bucket_alloc); ++ b = apr_bucket_flush_create(c->bucket_alloc); ++ APR_BRIGADE_INSERT_TAIL(bb, b); ++ if (ap_pass_brigade(r->output_filters, bb) != APR_SUCCESS) ++ return -1; ++ ++ return 0; ++} ++ ++/* ++ * This function sets the Last-Modified output header field to the value ++ * of the mtime field in the request structure - rationalized to keep it from ++ * being in the future. ++ */ ++AP_DECLARE(void) ap_set_last_modified(request_rec *r) ++{ ++ if (!r->assbackwards) { ++ apr_time_t mod_time = ap_rationalize_mtime(r, r->mtime); ++ char *datestr = apr_palloc(r->pool, APR_RFC822_DATE_LEN); ++ ++ apr_rfc822_date(datestr, mod_time); ++ apr_table_setn(r->headers_out, "Last-Modified", datestr); ++ } ++} ++ ++typedef struct hdr_ptr { ++ ap_filter_t *f; ++ apr_bucket_brigade *bb; ++} hdr_ptr; ++ ++static int send_header(void *data, const char *key, const char *val) ++{ ++ ap_fputstrs(((hdr_ptr*)data)->f, ((hdr_ptr*)data)->bb, ++ key, ": ", val, CRLF, NULL); ++ return 1; ++} ++ ++AP_DECLARE(void) ap_send_interim_response(request_rec *r, int send_headers) ++{ ++ hdr_ptr x; ++ char *status_line = NULL; ++ request_rec *rr; ++ ++ if (r->proto_num < 1001) { ++ /* don't send interim response to HTTP/1.0 Client */ ++ return; ++ } ++ if (!ap_is_HTTP_INFO(r->status)) { ++ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, NULL, ++ "Status is %d - not sending interim response", r->status); ++ return; ++ } ++ ++ /* if we send an interim response, we're no longer in a state of ++ * expecting one. Also, this could feasibly be in a subrequest, ++ * so we need to propagate the fact that we responded. ++ */ ++ for (rr = r; rr != NULL; rr = rr->main) { ++ rr->expecting_100 = 0; ++ } ++ ++ status_line = apr_pstrcat(r->pool, AP_SERVER_PROTOCOL, " ", r->status_line, CRLF, NULL); ++ ap_xlate_proto_to_ascii(status_line, strlen(status_line)); ++ ++ x.f = r->connection->output_filters; ++ x.bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); ++ ++ ap_fputs(x.f, x.bb, status_line); ++ if (send_headers) { ++ apr_table_do(send_header, &x, r->headers_out, NULL); ++ apr_table_clear(r->headers_out); ++ } ++ ap_fputs(x.f, x.bb, CRLF); ++ ap_fflush(x.f, x.bb); ++ apr_brigade_destroy(x.bb); ++} ++ ++AP_IMPLEMENT_HOOK_RUN_ALL(int,post_read_request, ++ (request_rec *r), (r), OK, DECLINED) ++AP_IMPLEMENT_HOOK_RUN_ALL(int,log_transaction, ++ (request_rec *r), (r), OK, DECLINED) ++AP_IMPLEMENT_HOOK_RUN_FIRST(const char *,http_scheme, ++ (const request_rec *r), (r), NULL) ++AP_IMPLEMENT_HOOK_RUN_FIRST(unsigned short,default_port, ++ (const request_rec *r), (r), 0)