core, proxy_fcgi: Honor responsefieldsize for FCGI response headers

changes-entries/64919.txt

@@ -0,0 +1,3 @@
+  *) mod_proxy_fcgi: Honor the responsefieldsize parameter of the worker for
+     the size of the response header lines, so that lines larger than the
+     default of 8192 bytes are supported.  PR 64919.  [Arturo Bernal]

docs/manual/mod/mod_proxy.xml

@@ -1220,6 +1220,8 @@ ProxyPass "/example" "http://backend.example.com" max=20 ttl=120 retry=300
             a proxied response. Setting the value to 0 will use the system
             default of 8192 bytes.<br />
         Available in Apache HTTP Server 2.4.34 and later.
+        <module>mod_proxy_fcgi</module> respects it as well, in 2.5.1 and
+        later.
     </td></tr>
     <tr><td>keepalive</td>
         <td>Off</td>

include/ap_mmn.h

@@ -739,14 +739,16 @@
  * 20211221.31 (2.5.1-dev) Add ap_*_timingsafe() to httpd.h
  * 20211221.32 (2.5.1-dev) Add ap_cstr_stripws() to httpd.h
  * 20211221.33 (2.5.1-dev) Add ap_size_parameter_parse() to httpd.h
+ * 20211221.34 (2.5.1-dev) Add ap_scan_script_header_err_brigade_limit() to
+ *                         util_script.h
  */
 
 #define MODULE_MAGIC_COOKIE 0x41503235UL /* "AP25" */
 
 #ifndef MODULE_MAGIC_NUMBER_MAJOR
 #define MODULE_MAGIC_NUMBER_MAJOR 20211221
 #endif
-#define MODULE_MAGIC_NUMBER_MINOR 33             /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 34             /* 0...n */
 
 /**
  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/util_script.h

@@ -156,6 +156,31 @@ AP_DECLARE(int) ap_scan_script_header_err_brigade_ex(request_rec *r,
                                                      char *buffer,
                                                      int module_index);
 
+/**
+ * Read headers output from a script like
+ * ap_scan_script_header_err_brigade_ex(), with a limit on the size of the
+ * header lines. A header line is read into a buffer of line_size bytes, so it
+ * can be at most line_size - 3 bytes long, without its line break.
+ * @param r The current request
+ * @param bb The brigade from which to read
+ * @param buffer Empty when calling the function.  On output, if there was an
+ *               error, the string that cause the error is stored here. If it
+ *               is not NULL, it must have room for line_size bytes.
+ * @param module_index The module index to be used for logging
+ * @param line_size The size of the buffer to read a header line into.
+ *                  MAX_STRING_LEN is what
+ *                  ap_scan_script_header_err_brigade_ex() uses.
+ * @return HTTP_OK on success, HTTP_INTERNAL_SERVER_ERROR or other 5xx status
+ *         code on failure, or a conditional status code (HTTP_NOT_MODIFIED or
+ *         HTTP_PRECONDITION_FAILED) to indicate that the script's response does
+ *         not meet the request's conditions
+ */
+AP_DECLARE(int) ap_scan_script_header_err_brigade_limit(request_rec *r,
+                                                        apr_bucket_brigade *bb,
+                                                        char *buffer,
+                                                        int module_index,
+                                                        apr_size_t line_size);
+
 /**
  * Read headers strings from a script, ensuring that the output is valid.  If
  * the output is valid, then the headers are added to the headers out of the

modules/proxy/mod_proxy_fcgi.c

@@ -614,8 +614,12 @@ static apr_status_t dispatch(proxy_conn_rec *conn, proxy_dir_conf *conf,
     char stack_iobuf[AP_IOBUFSIZE];
     apr_size_t iobuf_size = AP_IOBUFSIZE;
     char *iobuf = stack_iobuf;
+    apr_size_t header_line_size = HUGE_STRING_LEN;
 
     *err = NULL;
+    if (conn->worker->s->response_field_size_set) {
+        header_line_size = conn->worker->s->response_field_size;
+    }
     if (conn->worker->s->io_buffer_size_set) {
         iobuf_size = conn->worker->s->io_buffer_size;
         /* Allocate a buffer if the configured size is larger than the
@@ -830,8 +834,8 @@ static apr_status_t dispatch(proxy_conn_rec *conn, proxy_dir_conf *conf,
                             int status;
                             seen_end_of_headers = 1;
 
-                            status = ap_scan_script_header_err_brigade_ex(r, ob,
-                                NULL, APLOG_MODULE_INDEX);
+                            status = ap_scan_script_header_err_brigade_limit(r, ob,
+                                NULL, APLOG_MODULE_INDEX, header_line_size);
 
                             /* FCGI has its own body framing mechanism which we don't
                              * match against any provided Content-Length, so let the

server/util_script.c

@@ -25,6 +25,8 @@
 #include <stdlib.h>
 #endif
 
+#include <limits.h>             /* for INT_MAX */
+
 #include "ap_config.h"
 #include "httpd.h"
 #include "http_config.h"
@@ -479,13 +481,16 @@ static int set_cookie_doo_doo(void *v, const char *key, const char *val)
 #define HTTP_UNSET (-HTTP_OK)
 #define SCRIPT_LOG_MARK  __FILE__,__LINE__,module_index
 
-AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
-                                       int (*getsfunc) (char *, int, void *),
-                                       void *getsfunc_data,
-                                       int module_index)
+/* Scan the headers read by getsfunc using lines of up to bufsize bytes,
+ * the buffer being the caller's if there is one. */
+static int scan_script_header_err(request_rec *r, char *buffer,
+                                  apr_size_t bufsize,
+                                  int (*getsfunc) (char *, int, void *),
+                                  void *getsfunc_data, int module_index)
 {
     char x[MAX_STRING_LEN];
     char *w, *l;
+    int len;
     apr_size_t p;
     int cgi_status = HTTP_UNSET;
     apr_table_t *merge;
@@ -496,7 +501,19 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
     if (buffer) {
         *buffer = '\0';
     }
-    w = buffer ? buffer : x;
+    if (bufsize > INT_MAX) {
+        bufsize = INT_MAX;
+    }
+    if (buffer) {
+        w = buffer;
+    }
+    else if (bufsize > sizeof(x)) {
+        w = apr_palloc(r->pool, bufsize);
+    }
+    else {
+        w = x;
+    }
+    len = bufsize > 1 ? (int)bufsize - 1 : 1;
 
     /* temporary place to hold headers to merge in later */
     merge = apr_table_make(r->pool, 10);
@@ -512,7 +529,7 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
 
     while (1) {
 
-        int rv = (*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data);
+        int rv = (*getsfunc) (w, len, getsfunc_data);
         if (rv == 0) {
             const char *msg = "Premature end of script headers";
             if (first_header)
@@ -627,7 +644,7 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
         if (!(l = strchr(w, ':'))) {
             if (!buffer) {
                 /* Soak up all the script output - may save an outright kill */
-                while ((*getsfunc)(w, MAX_STRING_LEN - 1, getsfunc_data) > 0) {
+                while ((*getsfunc)(w, len, getsfunc_data) > 0) {
                     continue;
                 }
             }
@@ -751,6 +768,15 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
     return OK;
 }
 
+AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
+                                       int (*getsfunc) (char *, int, void *),
+                                       void *getsfunc_data,
+                                       int module_index)
+{
+    return scan_script_header_err(r, buffer, MAX_STRING_LEN, getsfunc,
+                                  getsfunc_data, module_index);
+}
+
 AP_DECLARE(int) ap_scan_script_header_err_core(request_rec *r, char *buffer,
                                        int (*getsfunc) (char *, int, void *),
                                        void *getsfunc_data)
@@ -830,17 +856,29 @@ AP_DECLARE(int) ap_scan_script_header_err_brigade(request_rec *r,
                                                   apr_bucket_brigade *bb,
                                                   char *buffer)
 {
-    return ap_scan_script_header_err_core_ex(r, buffer, getsfunc_BRIGADE, bb,
-                                             APLOG_MODULE_INDEX);
+    return ap_scan_script_header_err_brigade_limit(r, bb, buffer,
+                                                   APLOG_MODULE_INDEX,
+                                                   MAX_STRING_LEN);
 }
 
 AP_DECLARE(int) ap_scan_script_header_err_brigade_ex(request_rec *r,
                                                      apr_bucket_brigade *bb,
                                                      char *buffer,
                                                      int module_index)
 {
-    return ap_scan_script_header_err_core_ex(r, buffer, getsfunc_BRIGADE, bb,
-                                             module_index);
+    return ap_scan_script_header_err_brigade_limit(r, bb, buffer,
+                                                   module_index,
+                                                   MAX_STRING_LEN);
+}
+
+AP_DECLARE(int) ap_scan_script_header_err_brigade_limit(request_rec *r,
+                                                        apr_bucket_brigade *bb,
+                                                        char *buffer,
+                                                        int module_index,
+                                                        apr_size_t line_size)
+{
+    return scan_script_header_err(r, buffer, line_size, getsfunc_BRIGADE, bb,
+                                  module_index);
 }
 
 

test/modules/proxy/env.py

@@ -71,8 +71,8 @@ def __init__(self, env: 'HttpdTestEnv'):
         super().__init__(env=env)
         self.add_source_dir(os.path.dirname(inspect.getfile(ProxyTestSetup)))
         self.add_modules(["proxy", "proxy_http", "proxy_ajp", "proxy_balancer",
-                          "proxy_connect", "proxy_uwsgi", "lbmethod_byrequests",
-                          "remoteip"])
+                          "proxy_connect", "proxy_fcgi", "proxy_uwsgi",
+                          "lbmethod_byrequests", "remoteip"])
 
 
 class ProxyTestEnv(HttpdTestEnv):