cvs commit: apache-1.3/src/os/win32 mod_isapi.c
dgaudet 98/02/02 23:29:54 Modified:src/os/win32 mod_isapi.c Log: r->finfo.st_mode == 0 should be the first test before using r->finfo in a handler Revision ChangesPath 1.7 +3 -3 apache-1.3/src/os/win32/mod_isapi.c Index: mod_isapi.c === RCS file: /export/home/cvs/apache-1.3/src/os/win32/mod_isapi.c,v retrieving revision 1.6 retrieving revision 1.7 diff -u -r1.6 -r1.7 --- mod_isapi.c 1998/01/07 16:47:08 1.6 +++ mod_isapi.c 1998/02/03 07:29:53 1.7 @@ -129,11 +129,11 @@ if (!(allow_options(r) & OPT_EXECCGI)) return FORBIDDEN; -if (S_ISDIR(r->finfo.st_mode)) - return FORBIDDEN; - if (r->finfo.st_mode == 0) return NOT_FOUND; + +if (S_ISDIR(r->finfo.st_mode)) + return FORBIDDEN; /* Load the module */
cvs commit: apache-1.3/src/os/win32 mod_isapi.c
dgaudet 98/03/12 02:29:14 Modified:src CHANGES src/include http_config.h httpd.h src/main http_config.c util_script.c src/modules/example mod_example.c src/modules/standard mod_alias.c mod_autoindex.c mod_cern_meta.c mod_include.c mod_mime.c mod_mime_magic.c mod_negotiation.c mod_rewrite.c src/os/bs2000 os.c src/os/win32 mod_isapi.c Log: As mentioned a month or two ago there were some implicit assumptions that the values in content_type, handler, content_encoding, ... were lowercase. I'm not referring to mod_negotiation here -- there were other cases where strcmp() was being used. But in addition, mod_negotiation could be convinced to call str_tolower() on r->content_language(s), which could possibly modify a "read-only" string... which wastes at least one memory page per child. Clean all that up by declaring that the content fields in request_rec (and related fields elsewhere) must be lowercase, and must not be modified in place. Naturally I chose this because it's more efficient... rather than going around needlessly pstrdup()ing and strcasecmp()ing everywhere. There are a few other tweaks in here I couldn't resist, along the lines of getting rid of unneeded pstrdup()s. Plus a new function set_string_slot_lower(). Revision ChangesPath 1.701 +25 -14apache-1.3/src/CHANGES Index: CHANGES === RCS file: /export/home/cvs/apache-1.3/src/CHANGES,v retrieving revision 1.700 retrieving revision 1.701 diff -u -r1.700 -r1.701 --- CHANGES 1998/03/11 09:57:23 1.700 +++ CHANGES 1998/03/12 10:28:52 1.701 @@ -1,5 +1,16 @@ Changes with Apache 1.3b6 + *) API: Clarify usage of content_type, handler, content_encoding, + content_language and content_languages fields in request_rec. They + must always be lowercased; and the strings pointed to shouldn't + be modified (you must copy them to modify them). Fix a few bugs + related to this. [Dean Gaudet] + + *) API: Clarification: except for RAW_ARGS, all command handlers can + treat the char * parameters as permanent, and modifiable. There + is no need to pstrdup() them. Clean up some needless pstrdup(). + [Dean Gaudet] + *) Now mod_so keeps track of which module shared objects with which names are loaded and thus avoids multiple loading and unloading and irritating error_log messages. [Ralf S. Engelschall] @@ -94,10 +105,10 @@ *) WIN32: Preserve trailing slash in canonical path (and hence in PATH_INFO). [Paul Sutton, Ben Laurie] - *) USE_PTHREAD_SERIALIZED_ACCEPT has proven unreliable depending on - the rev of Solaris and what mixture of modules are in use. So - it has been disabled, and Solaris is back to using - USE_FCNTL_SERIALIZED_ACCEPT. Users may experiment with + *) PORT: USE_PTHREAD_SERIALIZED_ACCEPT has proven unreliable + depending on the rev of Solaris and what mixture of modules + are in use. So it has been disabled, and Solaris is back to + using USE_FCNTL_SERIALIZED_ACCEPT. Users may experiment with USE_PTHREAD_SERIALIZED_ACCEPT at their own risk, it may speed up static content only servers. Or it may fail unpredictably. [Dean Gaudet] PR#1779, 1854, 1904 @@ -105,11 +116,11 @@ *) mod_test_util_uri.c created which tests the logic in util_uri.c. [Dean Gaudet] - *) Rewrite of absoluteURI handling, and in particular how absoluteURIs - match vhosts. Unless a request is a proxy request, a "http://host"; - url is treated as if a similar "Host:" header had been supplied. - This change was made to support future HTTP/1.x protocols which - may require clients to send absoluteURIs for all requests. + *) API: Rewrite of absoluteURI handling, and in particular how + absoluteURIs match vhosts. Unless a request is a proxy request, a + "http://host"; url is treated as if a similar "Host:" header had been + supplied. This change was made to support future HTTP/1.x protocols + which may require clients to send absoluteURIs for all requests. In order to achieve this change subtle changes were made to the API. In a request_rec, r->hostlen has been removed. r->unparsed_uri now exists so @@ -123,9 +134,9 @@ managed by the same httpd. [Dean Gaudet] - *) Cleanup of code in http_vhost.c, and remove vhost matching code from - mod_rewrite. The vhost matching is now performed by a globally - available function matches_request_vhost(). [Dean Gaudet] + *) API: Cleanup of code in http_vhost.c, and remove vhost matching + code from mod_rewrite. The vhost matching is now perf
cvs commit: apache-1.3/src/os/win32 mod_isapi.c
ben 98/05/09 08:09:31 Modified:src CHANGES src/os/win32 mod_isapi.c Log: Don't force ISAPI headers to finish with \n. PR: 2060 Submitted by: Jim Patterson <[EMAIL PROTECTED]>, Ben Laurie Revision ChangesPath 1.839 +6 -0 apache-1.3/src/CHANGES Index: CHANGES === RCS file: /export/home/cvs/apache-1.3/src/CHANGES,v retrieving revision 1.838 retrieving revision 1.839 diff -u -r1.838 -r1.839 --- CHANGES 1998/05/09 14:27:24 1.838 +++ CHANGES 1998/05/09 15:09:29 1.839 @@ -1,5 +1,11 @@ Changes with Apache 1.3b7 + *) WIN32: Check for buffer overflows in ap_os_canonical_filename. + [Ben Laurie] + + *) WIN32: Don't force ISAPI headers to finish with \n. + [Jim Patterson <[EMAIL PROTECTED]>, Ben Laurie] PR#2060 + *) When opening "configuration" files (like httpd.conf, htaccess and htpasswd), Apache will not allow them to be non-/dev/null device files. This closes a DoS hole. At the same time, 1.11 +19 -1 apache-1.3/src/os/win32/mod_isapi.c Index: mod_isapi.c === RCS file: /export/home/cvs/apache-1.3/src/os/win32/mod_isapi.c,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- mod_isapi.c 1998/04/11 12:01:05 1.10 +++ mod_isapi.c 1998/05/09 15:09:31 1.11 @@ -85,6 +85,10 @@ /* We use the exact same header file as the original */ #include +/* Seems IIS does not enforce the requirement for \r\n termination on HSE_REQ_SEND_RESPONSE_HEADER, + define this to conform */ +#define RELAX_HEADER_RULE + module isapi_module; /* Our "Connection ID" structure */ @@ -421,6 +425,10 @@ char *value, *lf = strchr(data, '\n'); int p; +#ifdef RELAX_HEADER_RULE + if (lf) + *lf = '\0'; +#else if (!lf) { /* Huh? Invalid data, I think */ ap_log_error(APLOG_MARK, APLOG_ERR, r->server, "ISA sent invalid headers: %s", r->filename); @@ -430,12 +438,16 @@ /* Get rid of \n and \r */ *lf = '\0'; +#endif p = strlen(data); if (p > 0 && data[p-1] == '\r') data[p-1] = '\0'; /* End of headers */ if (*data == '\0') { - data = lf + 1; /* Reset data */ +#ifdef RELAX_HEADER_RULE + if (lf) +#endif + data = lf + 1; /* Reset data */ break; } @@ -477,6 +489,12 @@ } /* Reset data */ +#ifdef RELAX_HEADER_RULE + if (!lf) { + data += p; + break; + } +#endif data = lf + 1; }
cvs commit: apache-1.3/src/os/win32 mod_isapi.c
ben 98/06/13 08:23:19 Modified:src CHANGES src/include alloc.h httpd.h util_script.h src/main alloc.c http_config.c http_protocol.c http_request.c util.c util_script.c src/modules/proxy mod_proxy.c mod_proxy.h proxy_cache.c proxy_http.c proxy_util.c src/modules/standard mod_actions.c mod_asis.c mod_autoindex.c mod_cern_meta.c mod_cgi.c mod_imap.c mod_include.c mod_log_config.c mod_mime.c mod_negotiation.c mod_rewrite.c mod_speling.c mod_usertrack.c src/os/win32 mod_isapi.c Log: Constify tables. Revision ChangesPath 1.914 +2 -0 apache-1.3/src/CHANGES Index: CHANGES === RCS file: /export/home/cvs/apache-1.3/src/CHANGES,v retrieving revision 1.913 retrieving revision 1.914 diff -u -r1.913 -r1.914 --- CHANGES 1998/06/13 12:05:58 1.913 +++ CHANGES 1998/06/13 15:22:46 1.914 @@ -1,5 +1,7 @@ Changes with Apache 1.3.1 + *) Make table elements const. This may prevent obscure errors. [Ben Laurie] + *) Fix parsing of FTP `SIZE' responses in proxy module: The newline was not truncated which forced following HTTP headers to be data in the HTTP reponse. Although the reponse now is copied out from the response buffer 1.60 +1 -1 apache-1.3/src/include/alloc.h Index: alloc.h === RCS file: /export/home/cvs/apache-1.3/src/include/alloc.h,v retrieving revision 1.59 retrieving revision 1.60 diff -u -r1.59 -r1.60 --- alloc.h 1998/05/28 22:09:45 1.59 +++ alloc.h 1998/06/13 15:22:48 1.60 @@ -179,7 +179,7 @@ API_EXPORT(table *) ap_make_table(pool *p, int nelts); API_EXPORT(table *) ap_copy_table(pool *p, const table *); API_EXPORT(void) ap_clear_table(table *); -API_EXPORT(char *) ap_table_get(const table *, const char *); +API_EXPORT(const char *) ap_table_get(const table *, const char *); API_EXPORT(void) ap_table_set(table *, const char *name, const char *val); API_EXPORT(void) ap_table_setn(table *, const char *name, const char *val); API_EXPORT(void) ap_table_merge(table *, const char *name, const char *more_val); 1.224 +7 -7 apache-1.3/src/include/httpd.h Index: httpd.h === RCS file: /export/home/cvs/apache-1.3/src/include/httpd.h,v retrieving revision 1.223 retrieving revision 1.224 diff -u -r1.223 -r1.224 --- httpd.h 1998/06/10 09:02:02 1.223 +++ httpd.h 1998/06/13 15:22:49 1.224 @@ -600,7 +600,7 @@ int header_only; /* HEAD request, as opposed to GET */ char *protocol; /* Protocol, as given to us, or HTTP/0.9 */ int proto_num; /* Number version of protocol; 1.1 = 1001 */ -char *hostname; /* Host, as set by full URI or Host: */ +const char *hostname;/* Host, as set by full URI or Host: */ time_t request_time; /* When the request started */ @@ -645,7 +645,7 @@ int chunked; /* sending chunked transfer-coding */ int byterange; /* number of byte ranges */ char *boundary; /* multipart/byteranges boundary */ -char *range; /* The Range: header */ +const char *range; /* The Range: header */ long clength;/* The "real" content length */ long remaining; /* bytes left to read */ @@ -675,11 +675,11 @@ * content_languages MUST be lowercased strings. They may be pointers * to static strings; they should not be modified in place. */ -char *content_type; /* Break these out --- we dispatch on 'em */ -char *handler; /* What we *really* dispatch on */ +const char *content_type;/* Break these out --- we dispatch on 'em */ +const char *handler; /* What we *really* dispatch on */ -char *content_encoding; -char *content_language; /* for back-compat. only -- do not use */ +const char *content_encoding; +const char *content_language;/* for back-compat. only -- do not use */ array_header *content_languages; /* array of (char*) */ int no_cache; @@ -862,7 +862,7 @@ API_EXPORT(char *) ap_getword_conf(pool *p, const char **line); API_EXPORT(char *) ap_getword_conf_nc(pool *p, char **line); -API_EXPORT(char *) ap_get_token(pool *p, char **accept_line, int accept_white); +API_EXPORT(char *) ap_get_token(pool *p, const char **accept_line, int accept_white); API_EXPORT(int) ap_find_token(pool *p, const char *line, const cha
cvs commit: apache-1.3/src/os/win32 mod_isapi.c
dgaudet 98/08/06 10:31:34 Modified:src CHANGES src/include http_config.h http_core.h http_log.h src/main http_config.c http_core.c http_log.c http_main.c http_protocol.c http_request.c util_script.c src/modules/proxy mod_proxy.c proxy_cache.c proxy_connect.c proxy_ftp.c proxy_http.c proxy_util.c src/modules/standard mod_access.c mod_actions.c mod_asis.c mod_auth.c mod_auth_anon.c mod_auth_db.c mod_auth_dbm.c mod_autoindex.c mod_cern_meta.c mod_cgi.c mod_digest.c mod_expires.c mod_imap.c mod_include.c mod_info.c mod_mime_magic.c mod_negotiation.c mod_rewrite.c mod_speling.c mod_status.c src/os/win32 mod_isapi.c Log: Correct the error_log mess in a uniform manner. Add ap_log_rerror() which includes the client ip address in the log message (it takes a request_rec * instead of a server_rec *). PR: 2661 Revision ChangesPath 1.1004+5 -0 apache-1.3/src/CHANGES Index: CHANGES === RCS file: /export/home/cvs/apache-1.3/src/CHANGES,v retrieving revision 1.1003 retrieving revision 1.1004 diff -u -r1.1003 -r1.1004 --- CHANGES 1998/08/06 00:10:36 1.1003 +++ CHANGES 1998/08/06 17:30:18 1.1004 @@ -1,5 +1,10 @@ Changes with Apache 1.3.2 + *) Restore the client IP address to the error log messages, this + was lost during the transition from 1.2 to 1.3. Add a new + function ap_log_rerror() which takes a request_rec * and + formats it appropriately. [Dean Gaudet] PR#2661 + *) Cure ap_cfg_getline() of its nasty habit of compressing internal whitespace in input lines -- including within quoted strings. [Ken Coar] 1.91 +1 -1 apache-1.3/src/include/http_config.h Index: http_config.h === RCS file: /export/home/cvs/apache-1.3/src/include/http_config.h,v retrieving revision 1.90 retrieving revision 1.91 diff -u -r1.90 -r1.91 --- http_config.h 1998/07/13 11:32:35 1.90 +++ http_config.h 1998/08/06 17:30:23 1.91 @@ -275,7 +275,7 @@ * handle it back-compatibly, or at least signal an error). */ -#define MODULE_MAGIC_NUMBER 19980713 +#define MODULE_MAGIC_NUMBER 19980806 #define STANDARD_MODULE_STUFF MODULE_MAGIC_NUMBER, -1, __FILE__, NULL, NULL /* Generic accessors for other modules to get at their own module-specific 1.45 +19 -0 apache-1.3/src/include/http_core.h Index: http_core.h === RCS file: /export/home/cvs/apache-1.3/src/include/http_core.h,v retrieving revision 1.44 retrieving revision 1.45 diff -u -r1.44 -r1.45 --- http_core.h 1998/07/01 21:19:51 1.44 +++ http_core.h 1998/08/06 17:30:24 1.45 @@ -86,9 +86,28 @@ #define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_SYM_LINKS|OPT_EXECCGI) /* options for get_remote_host() */ +/* REMOTE_HOST returns the hostname, or NULL if the hostname + * lookup fails. It will force a DNS lookup according to the + * HostnameLookups setting. + */ #define REMOTE_HOST (0) + +/* REMOTE_NAME returns the hostname, or the dotted quad if the + * hostname lookup fails. It will force a DNS lookup according + * to the HostnameLookups setting. + */ #define REMOTE_NAME (1) + +/* REMOTE_NOLOOKUP is like REMOTE_NAME except that a DNS lookup is + * never forced. + */ #define REMOTE_NOLOOKUP (2) + +/* REMOTE_DOUBLE_REV will always force a DNS lookup, and also force + * a double reverse lookup, regardless of the HostnameLookups + * setting. The result is the (double reverse checked) hostname, + * or NULL if any of the lookups fail. + */ #define REMOTE_DOUBLE_REV (3) #define SATISFY_ALL 0 1.31 +6 -0 apache-1.3/src/include/http_log.h Index: http_log.h === RCS file: /export/home/cvs/apache-1.3/src/include/http_log.h,v retrieving revision 1.30 retrieving revision 1.31 diff -u -r1.30 -r1.31 --- http_log.h1998/05/03 17:31:08 1.30 +++ http_log.h1998/08/06 17:30:24 1.31 @@ -108,9 +108,15 @@ API_EXPORT(void) ap_log_error(const char *file, int line, int level, const server_rec *s, const char *fmt, ...) __attribute__((format(printf,5,6))); +API_EXPORT(void) ap_log_rerror(const char *file, int line, int level, + const request_rec *s, const char *fmt, ...) + __attribute__((format(printf,5,6))
cvs commit: apache-1.3/src/os/win32 mod_isapi.c
dgaudet 98/08/10 09:26:33 Modified:src/os/win32 mod_isapi.c Log: another O(n^2) attack Revision ChangesPath 1.15 +1 -0 apache-1.3/src/os/win32/mod_isapi.c Index: mod_isapi.c === RCS file: /export/home/cvs/apache-1.3/src/os/win32/mod_isapi.c,v retrieving revision 1.14 retrieving revision 1.15 diff -u -r1.14 -r1.15 --- mod_isapi.c 1998/08/06 17:31:34 1.14 +++ mod_isapi.c 1998/08/10 16:26:31 1.15 @@ -365,6 +365,7 @@ return TRUE; } +/* XXX: There is an O(n^2) attack possible here. */ BOOL WINAPI ServerSupportFunction (HCONN hConn, DWORD dwHSERequest, LPVOID lpvBuffer, LPDWORD lpdwSize, LPDWORD lpdwDataType) {
cvs commit: apache-1.3/src/os/win32 mod_isapi.c
fielding99/01/08 09:54:44 Modified:src CHANGES src/include ap_compat.h httpd.h util_script.h src/main http_protocol.c http_request.c src/modules/standard mod_asis.c src/os/win32 mod_isapi.c Log: Renamed macros status_drops_connection to ap_status_drops_connection and vestigial scan_script_header to ap_scan_script_header_err, mostly for aesthetic reasons. Reviewed by: Ralf S. Engelschall, Dean Gaudet Revision ChangesPath 1.1207+4 -0 apache-1.3/src/CHANGES Index: CHANGES === RCS file: /home/cvs/apache-1.3/src/CHANGES,v retrieving revision 1.1206 retrieving revision 1.1207 diff -u -r1.1206 -r1.1207 --- CHANGES 1999/01/08 08:48:44 1.1206 +++ CHANGES 1999/01/08 17:54:37 1.1207 @@ -1,5 +1,9 @@ Changes with Apache 1.3.4 + *) Renamed macros status_drops_connection to ap_status_drops_connection + and vestigial scan_script_header to ap_scan_script_header_err, + mostly for aesthetic reasons. [Roy Fielding] + *) The query switch "httpd -S" didn't exit after showing the vhost settings. That was inconsistent with the other query functions. [Martin Kraemer] 1.15 +2 -0 apache-1.3/src/include/ap_compat.h Index: ap_compat.h === RCS file: /home/cvs/apache-1.3/src/include/ap_compat.h,v retrieving revision 1.14 retrieving revision 1.15 diff -u -r1.14 -r1.15 --- ap_compat.h 1998/07/13 11:32:33 1.14 +++ ap_compat.h 1999/01/08 17:54:39 1.15 @@ -325,6 +325,7 @@ #define rvputs ap_rvputs #define rwrite ap_rwrite #define satisfies ap_satisfies +#define scan_script_header(a1,a2) ap_scan_script_header_err(a1,a2,NULL) #define scan_script_header_err ap_scan_script_header_err #define scan_script_header_err_buffap_scan_script_header_err_buff #define scoreboard_fname ap_scoreboard_fname @@ -372,6 +373,7 @@ #define standalone ap_standalone #define start_restart ap_start_restart #define start_shutdown ap_start_shutdown +#define status_drops_connectionap_status_drops_connection #define str_tolowerap_str_tolower #define strcasecmp_match ap_strcasecmp_match #define strcmp_match ap_strcmp_match 1.259 +2 -1 apache-1.3/src/include/httpd.h Index: httpd.h === RCS file: /home/cvs/apache-1.3/src/include/httpd.h,v retrieving revision 1.258 retrieving revision 1.259 diff -u -r1.258 -r1.259 --- httpd.h 1999/01/05 08:17:27 1.258 +++ httpd.h 1999/01/08 17:54:39 1.259 @@ -529,7 +529,8 @@ #define ap_is_HTTP_CLIENT_ERROR(x) (((x) >= 400)&&((x) < 500)) #define ap_is_HTTP_SERVER_ERROR(x) (((x) >= 500)&&((x) < 600)) -#define status_drops_connection(x) (((x) == HTTP_BAD_REQUEST) || \ +#define ap_status_drops_connection(x) \ + (((x) == HTTP_BAD_REQUEST) || \ ((x) == HTTP_REQUEST_TIME_OUT) || \ ((x) == HTTP_LENGTH_REQUIRED) || \ ((x) == HTTP_REQUEST_ENTITY_TOO_LARGE) || \ 1.36 +0 -1 apache-1.3/src/include/util_script.h Index: util_script.h === RCS file: /home/cvs/apache-1.3/src/include/util_script.h,v retrieving revision 1.35 retrieving revision 1.36 diff -u -r1.35 -r1.36 --- util_script.h 1999/01/01 19:04:42 1.35 +++ util_script.h 1999/01/08 17:54:40 1.36 @@ -74,7 +74,6 @@ API_EXPORT(int) ap_find_path_info(const char *uri, const char *path_info); API_EXPORT(void) ap_add_cgi_vars(request_rec *r); API_EXPORT(void) ap_add_common_vars(request_rec *r); -#define scan_script_header(a1,a2) ap_scan_script_header_err(a1,a2,NULL) API_EXPORT(int) ap_scan_script_header_err(request_rec *r, FILE *f, char *buffer); API_EXPORT(int) ap_scan_script_header_err_buff(request_rec *r, BUFF *f, char *buffer); 1.253 +1 -1 apache-1.3/src/main/http_protocol.c Index: http_protocol.c === RCS file: /home/cvs/apache-1.3/src/main/http_protocol.c,v retrieving revision 1.252 retrieving revision 1.253 diff -u -r1.252 -r1.253 --- http_protocol.c 1999/01/01 19:04:49 1.252 +++ http_protocol.c 1999/01/08 17:54:41 1.253 @@ -305,7 +305,7 @@ (r->server->keep_alive