mod_proxy_fcgi.c

mod_proxy_fcgi: SECURITY: CVE-2014-3583 (cve.mitre.org)

Fix a potential crash with response headers' size above 8K.

The code changes to mod_authnz_fcgi keep the handle_headers()

function in sync between the two modules. mod_authnz_fcgi

does not have this issue because it allocated a separate byte

for terminating '\0'.

Submitted by: ylavic, trawick

Reviewed by: ylavic, trawick, mrumph

Add missing APLOGNO.

Refactor to keep APLOGNO on the same line as ap_log_error, when applicable.

Add missing APLOGNO.

Refactor some lines to keep APLOGNO on the same line as ap_log_error, when applicable.

Split lines longer than 80.

Improve alignment.

Submitted by: jailletc36

Reviewed/backported by: jim

mod_proxy_fcgi: Fix faulty logging of large amounts of stderr from the

application.

PR: 56858

Submitted by: Manuel Mausz <manuel-asf mausz.at>

Reviewed by: trawick

Submitted by: trawick

Reviewed/backported by: jim

mod_proxy_fcgi: Fix occasional high CPU when handling request bodies.

Submitted by: trawick

Reviewed by: covener, ylavic

mod_proxy_fcgi: better error messages, and fix an old bug where the error

condition was forgotten

Submitted by: trawick

Reviewed by: ylavic, covener

Fix bug introduced in r1591508 which resulted in the final empty

FCGI_STDIN not being sent. Interaction with latest uWSGI (and

probably other protocol implementations) breaks without this.

Reindent after small fix in r1603027

mod_proxy_fcgi: follow up to r1592032.

Also break the outer loop when "sending stdin" fails.

Submitted by: trawick, ylavic

Reviewed/backported by: jim

mod_proxy_fcgi: Support iobuffersize parameter.

Submitted by: trawick

Reviewed by: jim, ylavic

mod_proxy_fcgi: remove wasted memset() calls and other historical bits

Submitted by: trawick

Reviewed by: jim, ylavic

mod_proxy_fcgi: Don't segfault when failing to connect to the backend.

now understood why users haven't reported the segfault (yet) when mod_proxy_fcgi

can't connect to the application

Submitted by: trawick

Reviewed/backported by: jim

mod_proxy_fcgi: Fix sending of response without some HTTP headers

that might be set by filters.

The problem occurs when no body bytes were read while reading the

response headers, resulting in an empty brigade being sent down

the filter stack. One particualr filter that mishandles the empty

initial brigade is mod_deflate. It neglects to add to the response

header fields.

PR: 55558

Submitted by: Jim Riggs <jim riggs.me>

Reviewed by: trawick

Submitted by: trawick

Reviewed/backported by: jim

We were not being consistent between http and others

if we added the default port or not during the canonizing

phase... Baseline the http method (don't add unless the

port provided isn't the default).

Reviewed/backported by: jim

Switch from private FastCGI protocol handling to util_fcgi API.

Use apr_socket_timeout_get instead of hard-coded 30 seconds timeout.

Bring some envvar flexibility from mod_authnz_fcgi to mod_proxy_fcgi:

mod_proxy_fcgi: Remove 64K limit on encoded length of all envvars.

An individual envvar with an encoded length of more than 16K will be

omitted.

Borrow a fix from mod_authnz_fcgi:

mod_proxy_fcgi: Handle reading protocol data that is split between

packets.

Use ap_log_rdata() to dump the FastCGI header, axing a bunch

of custom data dumping code.

Submitted by: trawick, jkaluza, trawick, trawick, trawick

Reviewed/backported by: jim

trunk patch: http://svn.apache.org/r1500345

http://svn.apache.org/r1500362

http://svn.apache.org/r1500423

http://svn.apache.org/r1500483

http://svn.apache.org/r1500519

Submitted by: fuankg

Reviewed by: jim, minfrin

If there is an error reading the headers from the backend,

send an error to the client

add PR reference

Submitted by: sf

Reviewed/backported by: jim

Handle cases, esp when using mod_proxy_fcgi, when we do not

want SCRIPT_FILENAME to include the query string.

Reviewed/backported by: jim

Add lots of unique tags to error log messages

ssl_util.c: Downgrade some dynamic locking messages from level DEBUG

to TRACE1-3

great proxy logging cleanup:

* remove "proxy:", "FCGI", etc. prefixes and pid which are now

included in the error log format

* propagate frontend request's logconfig to backend request

* use ap_log_rerror where possible

* remove obsolete APLOG_NOERRNO