server

Send "100 Continue", if needed, before fetching/blocking on the request body in

spool_reqbody_cl(), otherwise mod_proxy and the client can wait for each other,

leading to a request timeout (408).

While at it, make so that ap_send_interim_response() uses the default status

line if none is set in r->status_line.

Reported and fixed by Christian Bartolomäus (bartolin gmx.de)

PR 63806

parser_multipart: fix NULL pointer dereference in nested multipart

create_multipart_context() can return NULL if the given Content-Type

was not recognized (if there is no "boundary" attribute). This

crashes libapreq2.

This bug was introduced by SVN commit 227276. Prior to this commit,

there was a NULL check, but the commit removed it:

http://svn.apache.org/viewvc/httpd/apreq/trunk/library/parser_multipart.c?r1=227276&r2=227275&pathrev=227276

Submitted by: max

Issue repported by Heather Lotz <knot22 hotmail.com>

-1 is a valid length value (for socket, pipe and cgi buckets for example)

All path I've checked cast the -1 to (apr_size_t) in order for the comparison to work. So do it as well here.

This has been like that in trunk since r708144, about 11 years ago, so I assume that it is not really an issue.

Spotted by gcc 9.1 and -Wextra

Submitted by ylavic

Remove an empty line that must have been missed in a backport.

because all pools have NULL allocators then.

This workaround is probably not very efficient,

but is only used when we do APR_POOL_DEBUG

and efficiency shouldn't be a big concern then.

more to write with streams ongoing (flow control block). The timeout waiting

for the client to send WINODW_UPDATE was incorrectly KeepAliveTimeout and not

Timeout as it should be. Fixes PR 63534. [Yann Ylavic, Stefan Eissing]

(it had an identical lifetime to the global pool).

r1837435, r1834553, r1833598, r1833452, r1833383, r1833368.

Undoes the following:

mod_ssl: OpenSSL now initializes fully through APR, use that.

mod_ssl: build with LibreSSL.

LibreSSL seems to be openssl-1.1 API compatible only in version 2.8 (master).

So use that for MODSSL_USE_OPENSSL_PRE_1_1_API instead of 2.7, the two 2.7

compatibility-exceptions are handled explicitely but overall it's simpler.

Regarding CRYPTO_malloc_init vs OPENSSL_malloc_init, libreSSL uses none, the

former used to be a no-op but depends is LIBRESSL_INTERNAL in latest versions,

while the latter has never been (and will never be) defined. So don't call any

with LibreSSL.

Follow up to r1833368: share openssl between modules.

Both libapr[-util], the core PRNG, mod_ssl, mod_crypto and mod_session_crypto

can use the same crypto library (e.g. openssl), use the new APR crypto loading

API so that they can work together and initialize/terminate the lib either once

for all or on demand and reusable by the others.

Follow up to r1833368: apr_crypto_prng_after_fork() now used a PID.

Make use of the new apr_crypto_rng API if available.

parent of pconf rather than creating another global pool.

PR: 43471

* server/core.c (reset_config): Rename from reset_config_defines;

tie core_state_dir to pconf lifetime in this cleanup.

(core_pre_config): Adjust accordingly.

* modules/md/mod_md_config.c (md_config_post_config): Pick up base_dir

from statedir in post-config phase so StateDir can influence it.

* modules/dav/fs/mod_dav_fs.c (dav_fs_create_server_config): Don't

init lockdb_path here. (dav_fs_post_config): New function; set

lockdb_path based on configured statedir.

For (internal) usage outside server/util.c, mod_log_forensic for now

and mod_cache (T_HTTP_TOKEN_STOP) in a few...

fails in maintainer mode w/ __attribute__(nonnull))

util.c:576:10: error: nonnull parameter 'name' will evaluate to 'true'

on first encounter [-Werror,-Wpointer-bool-conversion]

opt-out w/ `MergeSlashes OFF`.

We need not remember each child's bucket number in SHM for restarts, for the

lifetime of the httpd main process the bucket number can be bound to the slot

number such that: bucket = slot % num_buckets.

This both simplifies the logic and helps children maintenance per bucket in

threaded MPMs, where previously perform_idle_server_maintenance() could create

or kill children processes for the buckets it was not in charge of.