mod_journald: New module implementing error_log provider for systemd-journald.


git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610339 13f79535-47bb-0310-9956-ffa450edef68
Remove backported item.


git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610341 13f79535-47bb-0310-9956-ffa450edef68
Remove some 'register' in variable declaration.
Save a few cycles by calling 'apr_isalnum' instead of 'apr_isalpha' and 'apr_isdigit'.

git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610353 13f79535-47bb-0310-9956-ffa450edef68
Remove some 'register' in variable declaration.

git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610366 13f79535-47bb-0310-9956-ffa450edef68
Simplify code.

Cases where 'loc' doesn't have any ':' or is  starting with ':' are already handled by 'ap_ir_url()'
Calling 'apr_isascii()' seems useless.

git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610383 13f79535-47bb-0310-9956-ffa450edef68
SECURITY (CVE-2014-0226): Fix a race condition in scoreboard handling,
which could lead to a heap buffer overflow.  Thanks to Marek Kroemeke
working with HP's Zero Day Initiative for reporting this.

* include/scoreboard.h: Add ap_copy_scoreboard_worker.

* server/scoreboard.c (ap_copy_scoreboard_worker): New function.

* modules/generators/mod_status.c (status_handler): Use it.

* modules/lua/lua_request.c (lua_ap_scoreboard_worker): Likewise.

Reviewed by: trawick, jorton, covener, jim
Submitted by: jorton, covener


git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610491 13f79535-47bb-0310-9956-ffa450edef68
  *) SECURITY: CVE-2014-0118 (cve.mitre.org)
     mod_deflate: The DEFLATE input filter (inflates request bodies) now
     limits the length and compression ratio of inflated request bodies to avoid
     denial of sevice via highly compressed bodies.  See directives 
     DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
     and DeflateInflateRatioBurst.

Thanks to Giancarlo Pellegrino and Davide Balzarotti for reporting the issue.

Submitted By: ylavic, covener
Reviewed By: jorton, covener, jim




git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610501 13f79535-47bb-0310-9956-ffa450edef68
SECURITY: CVE-2014-0231 (cve.mitre.org): Part two of two, with r1535125:

   mod_cgid: Fix a denial of service against CGI scripts that do
   not consume stdin that could lead to lingering HTTPD child processes
   filling up the scoreboard and eventually hanging the server.
   [Rainer Jung, Eric Covener, Yann Ylavic]

Submitted By: rjung, covener, ylavic
Reviewed By: trawick, jorton, covener, jim
   


git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610509 13f79535-47bb-0310-9956-ffa450edef68
Add missing APLOGNO + fix a typo in a comment

git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610518 13f79535-47bb-0310-9956-ffa450edef68
SECURITY (CVE-2014-3523): Fix a memory consumption denial of
service in the WinNT MPM used in all Windows installations.
Workaround: AcceptFilter <protocol> {none|connect}

Submitted by: trawick
Reviewed by: jorton, covener, jim


git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610652 13f79535-47bb-0310-9956-ffa450edef68
SECURITY (CVE-2014-0117): Fix a crash in mod_proxy.  In a reverse
proxy configuration, a remote attacker could send a carefully crafted
request which could crash a server process, resulting in denial of
service.

Thanks to Marek Kroemeke working with HP's Zero Day Initiative for
reporting this issue.

* server/util.c (ap_parse_token_list_strict): New function.

* modules/proxy/proxy_util.c (find_conn_headers): Use it here.

* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response):
  Send a 400 for a malformed Connection header.

Submitted by: Edward Lu, breser, covener


git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610674 13f79535-47bb-0310-9956-ffa450edef68
allow two character mod_log_config formats



git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610686 13f79535-47bb-0310-9956-ffa450edef68
Suggestion from Rick Houser -- for compatibility, pick an unusual
character as the first character in a 2/3 character pattern.



git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610707 13f79535-47bb-0310-9956-ffa450edef68
fix logic in ap_method_list_(add|remove) in order:
       - to correctly reset bits
       - not to modify the 'method_mask' bitfield unnecessarily

Also remove a useless 'register' in the declaration of a variable.

git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610813 13f79535-47bb-0310-9956-ffa450edef68
  *) SECURITY: CVE-2013-5704 (cve.mitre.org)
     core: HTTP trailers could be used to replace HTTP headers
     late during request processing, potentially undoing or
     otherwise confusing modules that examined or modified
     request headers earlier.  Adds "MergeTrailers" directive to restore
     legacy behavior.  

Submitted By: Edward Lu, Yann Ylavic, Joe Orton, Eric Covener
Committed By: covener



git-svn-id: http://svn.apache.org/repos/asf/httpd/httpd/trunk@1610814 13f79535-47bb-0310-9956-ffa450edef68