从Apache整体结构入手分析Apache CVE-2021-40438

//include/http_connfig.hAP_DECLARE_HOOK(int,handler,(request_rec *r))

#define APR_DECLARE_EXTERNAL_HOOK(ns,link,ret,name,args) typedef ret ns##_HOOK_##name##_t args; link##_DECLARE(void) ns##_hook_##name(ns##_HOOK_##name##_t *pf,                                       const char * const *aszPre,                                       const char * const *aszSucc, int nOrder); link##_DECLARE(ret) ns##_run_##name args; APR_IMPLEMENT_HOOK_GET_PROTO(ns,link,name); typedef struct ns##_LINK_##name##_t     {     ns##_HOOK_##name##_t *pFunc;     const char *szName;     const char * const *aszPredecessors;     const char * const *aszSuccessors;     int nOrder;     } ns##_LINK_##name##_t;

#server/config.cAP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r){    ...    ap_run_insert_filter(r);  ...    result = invoke_filter_init(r, r->input_filters);    if (result != OK) {        return result;    }    result = invoke_filter_init(r, r->output_filters);   ....        result = ap_run_handler(r);

static void register_hooks(apr_pool_t *p)
    static const char * const aszSucc[] = { "mod_rewrite.c", NULL};
    static const char *const aszPred[] = { "mpm_winnt.c", "mod_proxy_balancer.c",                                           "mod_proxy_hcheck.c", NULL};    ...    ap_hook_handler(proxy_handler, NULL, NULL, APR_HOOK_FIRST);    /* filename-to-URI translation */    ap_hook_translate_name(proxy_trans, aszSucc, NULL, APR_HOOK_FIRST);    /* walk <Proxy > entries and suppress default TRACE behavior */    ap_hook_post_read_request(proxy_detect, NULL, NULL, APR_HOOK_FIRST);    ...    proxy_util_register_hooks(p);}
AP_DECLARE_MODULE(proxy) ={    STANDARD20_MODULE_STUFF,    create_proxy_dir_config,    /* create per-directory config structure */    merge_proxy_dir_config,     /* merge per-directory config structures */    create_proxy_config,        /* create per-server config structure */    merge_proxy_config,         /* merge per-server config structures */    proxy_cmds,                 /* command table */    register_hooks};

static int proxy_handler(request_rec *r){        ... 
        /* Try to obtain the most suitable worker */        access_status = ap_proxy_pre_request(&worker, &balancer, r, conf, &url);
        ...}