[2.4.x] Add ap_*_timingsafe#639
Closed
notroj wants to merge 17 commits intoapache:2.4.xfrom
Closed
Conversation
Collaborator
notroj
commented
Apr 27, 2026
notroj
commented
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933313 13f79535-47bb-0310-9956-ffa450edef68
fix length checks in AJP msg_get functions git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933341 13f79535-47bb-0310-9956-ffa450edef68
fix ajp_msg_get_string buffer checks git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933343 13f79535-47bb-0310-9956-ffa450edef68
fix ajp_parse_data message len check +lognos git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933346 13f79535-47bb-0310-9956-ffa450edef68
fix ajp_msg_check_header check git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933348 13f79535-47bb-0310-9956-ffa450edef68
use AP_EXPR_FLAG_RESTRICTED in htaccess git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933350 13f79535-47bb-0310-9956-ffa450edef68
ocsp limits git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933352 13f79535-47bb-0310-9956-ffa450edef68
mod_dav_lock: use the right dav_lock_discovery git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933354 13f79535-47bb-0310-9956-ffa450edef68
mod_auth_digest: use apr_crypto_equals git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933356 13f79535-47bb-0310-9956-ffa450edef68
mod_authn_socache: validate URL earlier git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933358 13f79535-47bb-0310-9956-ffa450edef68
scan outgoing status line for newlines and controls git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933360 13f79535-47bb-0310-9956-ffa450edef68
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933362 13f79535-47bb-0310-9956-ffa450edef68
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933363 13f79535-47bb-0310-9956-ffa450edef68
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933377 13f79535-47bb-0310-9956-ffa450edef68
Add ap_*_timingsafe() constant-time comparison functions: * include/httpd.h: Declare ap_memeq_timingsafe(), ap_streq_timingsafe(), ap_strneq_timingsafe(). * server/util.c: Implement, wrapping apr_*_timingsafe() if APR >= 1.8, with a fallback to copied-in versions. * modules/aaa/mod_auth_digest.c: Replace apr_crypto_equals() with ap_memeq_timingsafe(). Remove apr_crypto.h include. * modules/session/mod_session_crypto.c: Replace local ap_crypto_equals() with ap_memeq_timingsafe(). Remove the local implementation and macro alias. * include/ap_mmn.h: Bump MMN minor. (cherry picked from commit 7f5de0a)
This reverts commit b8508bd.
asf-gitbox-commits
force-pushed
the
2.4.x
branch
from
129b1ed to
df13215
Compare
asf-gitbox-commits
pushed a commit
that referenced
this pull request
Apr 30, 2026
Add ap_*_timingsafe() constant-time comparison functions: * include/httpd.h: Declare ap_memeq_timingsafe(), ap_streq_timingsafe(), ap_strneq_timingsafe(). * server/util.c: Implement, wrapping apr_*_timingsafe() if APR >= 1.8, with a fallback to copied-in versions. * modules/aaa/mod_auth_digest.c: Replace apr_crypto_equals() with ap_memeq_timingsafe(). Remove apr_crypto.h include. * modules/session/mod_session_crypto.c: Replace local ap_crypto_equals() with ap_memeq_timingsafe(). Remove the local implementation and macro alias. * include/ap_mmn.h: Bump MMN minor. Submitted by: jorton Reviewed by: jorton, rpluem, covener Github: closes #639 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933444 13f79535-47bb-0310-9956-ffa450edef68
Collaborator
Author
|
Merged in e66cbab |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.