Mike,

On Oct 25, 2005, at 10:43 AM, Kenevel wrote:


> My question is why the server couldn't do some sort of reverse-
> lookup on its
> register of SSL certificates that are in use. Surely the server
> knows which
> certificate it is using to service the request (or else it wouldn't
> be able
>

No, it doesn't. At the moment the SSL connection handshake occurs,
the server needs to present a certificate to the client. The client
has certain expectations of the Common Name (CN) field of the
Distinguished Name (DN) string embedded in the certificate, so it is
important that the server sends the correct certificate.

At this point in the handshake, the server simply doesn't know enough
of what the client wants, unless the client connects to a distinct IP
address and the server has a virtual host configured on that IP
address. Otherwise, the decision on which virtual host to send the
request to is made way too late.


> to decrypt its contents) and hence work out which virtual host uses
> that
> certificate? This approach means of course that each name-based
> virtual host
> would have to use a different certificate - but as those sites are
> more than
> likely on different domains the certificates would necessarily be
> different.
>

There is an extension to the TLS ClientHello that allows the client
to indicate which servername it is trying to connect to: see http://
www.ietf.org/rfc/rfc3546.txt paragraph 3.1. However, I don't think
mod_ssl currently supports this. mod_gnutls may be closer, you may
want to check that out. Of course, until enough of your client base
supports this extension it is perfectly useless to you.

S.

--
sander@...              http://www.temme.net/sander/
PGP FP: 51B4 8727 466A 0BC3 69F4  B7B8 B2BE BC40 1529 24AF

Thanks Graham, Joost and Sander, I hadn't expected for Apache to need to
know which virtual host to use so early in the request process.

Cheers

Mike

>From: Sander Temme <sctemme@...>
>Reply-To: dev@...
>To: dev@...
>Subject: Re: NameVirtualHosts & SSL
>Date: Tue, 25 Oct 2005 11:34:40 -0700
>
>Mike,
>
>On Oct 25, 2005, at 10:43 AM, Kenevel wrote:
>
>
>>My question is why the server couldn't do some sort of reverse- lookup on
>>its
>>register of SSL certificates that are in use. Surely the server  knows
>>which
>>certificate it is using to service the request (or else it wouldn't  be
>>able
>>
>
>No, it doesn't. At the moment the SSL connection handshake occurs,   the
>server needs to present a certificate to the client. The client  has
>certain expectations of the Common Name (CN) field of the  Distinguished
>Name (DN) string embedded in the certificate, so it is  important that the
>server sends the correct certificate.
>
>At this point in the handshake, the server simply doesn't know enough  of
>what the client wants, unless the client connects to a distinct IP  address
>and the server has a virtual host configured on that IP  address.
>Otherwise, the decision on which virtual host to send the  request to is
>made way too late.
>
>
>>to decrypt its contents) and hence work out which virtual host uses  that
>>certificate? This approach means of course that each name-based  virtual
>>host
>>would have to use a different certificate - but as those sites are  more
>>than
>>likely on different domains the certificates would necessarily be
>>different.
>>
>
>There is an extension to the TLS ClientHello that allows the client  to
>indicate which servername it is trying to connect to: see http://
>www.ietf.org/rfc/rfc3546.txt paragraph 3.1. However, I don't think  mod_ssl
>currently supports this. mod_gnutls may be closer, you may  want to check
>that out. Of course, until enough of your client base  supports this
>extension it is perfectly useless to you.
>
>S.
>
>--
>sander@...              http://www.temme.net/sander/
>PGP FP: 51B4 8727 466A 0BC3 69F4  B7B8 B2BE BC40 1529 24AF
>
>


><< smime.p7s >>

Hi,

In the light of the issue reported by noodl at
http://eul0000113.eu.verio.net/~noodl/apache_issues.txt I decided to
implement multiple AuthUserFile support.

The behavior is the same as for a single AuthUserFile : the first line
matching the username is used, regardless of what's coming next.

The attached patch is against current httpd trunk (r328504), compiles
without warnings and has been tested successfully on my local Apache
build (Gcc 4.0.2, apr and apr-util from trunk, too).

** Since this is security related, and since I changed a little bit
the way check_password returns, I would be very pleased if this point
could be reviewed with particular attention. **

Regards,
- Sam

--
Maxime Petazzoni (http://www.bulix.org)
  -- gone crazy, back soon. leave message.

Index: modules/aaa/mod_authn_file.c
===================================================================
--- modules/aaa/mod_authn_file.c (revision 328504)
+++ modules/aaa/mod_authn_file.c (working copy)
@@ -28,33 +28,47 @@

  #include "mod_auth.h"

+struct file_prefix {
+    const char *file;
+};
+
  typedef struct {
-    char *pwfile;
+    apr_array_header_t *pwfiles;
  } authn_file_config_rec;

  static void *create_authn_file_dir_config(apr_pool_t *p, char *d)
  {
      authn_file_config_rec *conf = apr_palloc(p, sizeof(*conf));

-    conf->pwfile = NULL;     /* just to illustrate the default really */
+    conf->pwfiles = apr_array_make(p, 0, sizeof(struct file_prefix));
+
      return conf;
  }

  static const char *set_authn_file_slot(cmd_parms *cmd, void *offset,
-                                       const char *f, const char *t)
+ 			       const char *f, const char *t)
  {
+    authn_file_config_rec *conf;
+    struct file_prefix *item;
+
      if (t && strcmp(t, "standard")) {
          return apr_pstrcat(cmd->pool, "Invalid auth file type: ", t, NULL);
      }

-    return ap_set_file_slot(cmd, offset, f);
+    conf = (authn_file_config_rec *)offset;
+
+    /* Add the file to our AuthUserFile list */
+    item = (struct file_prefix *)apr_array_push(conf->pwfiles);
+    item->file = apr_pstrdup(cmd->pool, f);
+
+    return NULL;
  }

  static const command_rec authn_file_cmds[] =
  {
      AP_INIT_TAKE12("AuthUserFile", set_authn_file_slot,
-                   (void *)APR_OFFSETOF(authn_file_config_rec, pwfile),
-                   OR_AUTHCFG, "text file containing user IDs and passwords"),
+ 	   (void *)APR_OFFSETOF(authn_file_config_rec, pwfiles),
+ 	   OR_AUTHCFG, "text file containing user IDs and passwords"),
      {NULL}
  };

@@ -68,44 +82,63 @@
      ap_configfile_t *f;
      char l[MAX_STRING_LEN];
      apr_status_t status;
+    struct file_prefix *files;
      char *file_password = NULL;
+    int i;

-    status = ap_pcfg_openfile(&f, r->pool, conf->pwfile);
+    files = (struct file_prefix *)conf->pwfiles->elts;

-    if (status != APR_SUCCESS) {
-        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
-                      "Could not open password file: %s", conf->pwfile);
-        return AUTH_GENERAL_ERROR;
-    }
+    for (i=0; i < conf->pwfiles->nelts; i++) {
+        status = ap_pcfg_openfile(&f, r->pool, files[i].file);

-    while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
-        const char *rpw, *w;
+        if (status != APR_SUCCESS) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                          "Could not open password file: %s", files[i].file);
+            return AUTH_GENERAL_ERROR;
+        }

-        /* Skip # or blank lines. */
-        if ((l[0] == '#') || (!l[0])) {
-            continue;
+        while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
+            const char *rpw, *w;
+
+            /* Skip # or blank lines. */
+            if ((l[0] == '#') || (!l[0])) {
+                continue;
+            }
+
+            rpw = l;
+            w = ap_getword(r->pool, &rpw, ':');
+
+            if (!strcmp(user, w)) {
+                file_password = ap_getword(r->pool, &rpw, ':');
+                break;
+            }
          }
+        ap_cfg_closefile(f);

-        rpw = l;
-        w = ap_getword(r->pool, &rpw, ':');
+ /* If the user was found in this file, check his
+    authentification */
+ if (file_password) {
+     status = apr_password_validate(password, file_password);

-        if (!strcmp(user, w)) {
-            file_password = ap_getword(r->pool, &rpw, ':');
-            break;
-        }
+     /* If authentication succeeded, grant the access */
+     if (status == APR_SUCCESS) {
+         return AUTH_GRANTED;
+     }
+
+     /* Otherwise, deny the access immediately since only the
+        first entry found matching username is used */
+     else {
+         return AUTH_DENIED;
+     }
+ }
+
      }
-    ap_cfg_closefile(f);

      if (!file_password) {
          return AUTH_USER_NOT_FOUND;
      }

-    status = apr_password_validate(password, file_password);
-    if (status != APR_SUCCESS) {
-        return AUTH_DENIED;
-    }
-
-    return AUTH_GRANTED;
+    return AUTH_DENIED;
  }

  static authn_status get_realm_hash(request_rec *r, const char *user,
@@ -116,35 +149,41 @@
      ap_configfile_t *f;
      char l[MAX_STRING_LEN];
      apr_status_t status;
+    struct file_prefix *files;
      char *file_hash = NULL;
+    int i;

-    status = ap_pcfg_openfile(&f, r->pool, conf->pwfile);
+    files = (struct file_prefix *)conf->pwfiles->elts;

-    if (status != APR_SUCCESS) {
-        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
-                      "Could not open password file: %s", conf->pwfile);
-        return AUTH_GENERAL_ERROR;
-    }
+    for (i=0; i < conf->pwfiles->nelts; i++) {
+        status = ap_pcfg_openfile(&f, r->pool, files[i].file);

-    while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
-        const char *rpw, *w, *x;
-
-        /* Skip # or blank lines. */
-        if ((l[0] == '#') || (!l[0])) {
-            continue;
+        if (status != APR_SUCCESS) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+                          "Could not open password file: %s", files[i].file);
+            return AUTH_GENERAL_ERROR;
          }

-        rpw = l;
-        w = ap_getword(r->pool, &rpw, ':');
-        x = ap_getword(r->pool, &rpw, ':');
+        while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
+            const char *rpw, *w, *x;

-        if (x && w && !strcmp(user, w) && !strcmp(realm, x)) {
-            /* Remember that this is a md5 hash of user:realm:password.  */
-            file_hash = ap_getword(r->pool, &rpw, ':');
-            break;
+            /* Skip # or blank lines. */
+            if ((l[0] == '#') || (!l[0])) {
+                continue;
+            }
+
+            rpw = l;
+            w = ap_getword(r->pool, &rpw, ':');
+            x = ap_getword(r->pool, &rpw, ':');
+
+            if (x && w && !strcmp(user, w) && !strcmp(realm, x)) {
+                /* Remember that this is a md5 hash of user:realm:password.  */
+              file_hash = ap_getword(r->pool, &rpw, ':');
+              break;
+            }
          }
+        ap_cfg_closefile(f);
      }
-    ap_cfg_closefile(f);

      if (!file_hash) {
          return AUTH_USER_NOT_FOUND;

--On October 26, 2005 1:49:15 AM +0200 Maxime Petazzoni
<maxime.petazzoni@...> wrote:

> In the light of the issue reported by noodl at
> http://eul0000113.eu.verio.net/~noodl/apache_issues.txt I decided to
> implement multiple AuthUserFile support.

I don't get it.

mod_authn_alias is the solution here.  Like so:

---
<AuthnProviderAlias file foo>
      AuthUserFile conf/foo-user
</AuthnProviderAlias>

<AuthnProviderAlias file foo1>
      AuthUserFile conf/foo1-user
</AuthnProviderAlias>

AuthBasicProvider foo foo1
---

So, I don't think extending AuthUserFile doesn't make sense; and the
mod_authn_alias approach already works today...  -- justin

* Justin Erenkrantz <justin@...> [2005-10-25 17:05:57]:

> --On October 26, 2005 1:49:15 AM +0200 Maxime Petazzoni
> <maxime.petazzoni@...> wrote:
>
> >In the light of the issue reported by noodl at
> >http://eul0000113.eu.verio.net/~noodl/apache_issues.txt I decided to
> >implement multiple AuthUserFile support.
>
> I don't get it.
>
> mod_authn_alias is the solution here.  Like so:
>
> ---
> <AuthnProviderAlias file foo>
>     AuthUserFile conf/foo-user
> </AuthnProviderAlias>
>
> <AuthnProviderAlias file foo1>
>     AuthUserFile conf/foo1-user
> </AuthnProviderAlias>
>
> AuthBasicProvider foo foo1
> ---
>
> So, I don't think extending AuthUserFile doesn't make sense; and the
> mod_authn_alias approach already works today...  -- justin

You're right. But I don't think everybody as such an extensive
knowledge of the authentication configuration. The example you gave
may look simple to you, but I believe adding multiple AuthUserFile
lines to a "classic" Basic Auth configuration schema is a lot more
intuitive :

     AuthType Basic
     AuthName "Developpement HTTPd server"
     AuthUserFile /home/sam/.local/access.user
     AuthUserFile /home/sam/.local/access.user2
     Require valid-user

Just my 2 ¢,
- Sam

--
Maxime Petazzoni (http://www.bulix.org)
  -- gone crazy, back soon. leave message.

On Oct 25, 2005, at 2:33 AM, Joe Orton wrote:

> httpd-test runs against the trunk are failing all over the place
> today,
> I guess caused by one of these changes...
>
> prefork is failing like:
>
> Failed Test                Stat Wstat Total Fail  Failed  List of
> Failed
> ----------------------------------------------------------------------
> ---------
> t/modules/proxy.t                        13   11  84.62%  1-9 12-13
> t/modules/proxy_balancer.t                1    1 100.00%  1
> t/modules/rewrite.t                      22    5  22.73%  17-18 20-22
> t/protocol/echo.t           255 65280     8    8 100.00%  1-8
> t/security/CAN-2005-2700.t                2    1  50.00%  1
> ... plus almost all of t/ssl/* fail

Sorry about that.  I didn't have proxy and ssl compiled in when I
regression-tested with httpd-test.  I'll get started on a fix later this
evening.

Brian

Mike,

On Oct 25, 2005, at 10:43 AM, Kenevel wrote:

> My question is why the server couldn't do some sort of reverse-
> lookup on its
> register of SSL certificates that are in use. Surely the server
> knows which
> certificate it is using to service the request (or else it wouldn't
> be able

No, it doesn't. At the moment the SSL connection handshake occurs,
the server needs to present a certificate to the client. The client
has certain expectations of the Common Name (CN) field of the
Distinguished Name (DN) string embedded in the certificate, so it is
important that the server sends the correct certificate.

At this point in the handshake, the server simply doesn't know enough
of what the client wants, unless the client connects to a distinct IP
address and the server has a virtual host configured on that IP
address. Otherwise, the decision on which virtual host to send the
request to is made way too late.

> to decrypt its contents) and hence work out which virtual host uses
> that
> certificate? This approach means of course that each name-based
> virtual host
> would have to use a different certificate - but as those sites are
> more than
> likely on different domains the certificates would necessarily be
> different.

There is an extension to the TLS ClientHello that allows the client
to indicate which servername it is trying to connect to: see http://
www.ietf.org/rfc/rfc3546.txt paragraph 3.1. However, I don't think
mod_ssl currently supports this. mod_gnutls may be closer, you may
want to check that out. Of course, until enough of your client base
supports this extension it is perfectly useless to you.

S.

--
sander@...              http://www.temme.net/sander/
PGP FP: 51B4 8727 466A 0BC3 69F4  B7B8 B2BE BC40 1529 24AF

Hello,

I've been working on this patch to make apr and httpd work with SCTP
streams.

Stream Control Transmission Protocol (SCTP - RFC2960) is a transport
layer
protocol capable of providing reliable (in-order, no loss, no duplicates,
   no error) message oriented service to application.
Other interesting features of SCTP include multistreaming (many logical
pipes
in 1 SCTP association to transfer independent data like web objects
without
head of line blocking problem) and multihoming (ability to support more
than
1 interface/IP address at a SCTP endpoint).

The idea was to enable httpd to receive HTTP request on a particular SCTP
stream
and send the HTTP response on the same stream. Using different SCTP
streams
for independent objects might improve performance (preventing HOL as
mentioned
above).

To give an outline of the implementation with the files involved:

o I created apr_socket_send_sctp and apr_socket_recv_sctp which take an
extra
parameter - SCTP stream id. The recv function uses recvmsg function call
and gets the SCTP stream id on which the request came in. Similarly,
sendmsg
call is used in apr_socket_send_sctp (sendrecv.c in network_io/unix).
o I didnt want to change the signature of any other function so I decided
to
use buckets to pass the stream id info to and fro. The socket bucket read
puts the stream id (from recv) in a heap bucket and the caller takes
the responsibility of retrieving this. (apr_buckets_socket.c,
apr_brigade.c,
core_input_filter - core.c).
o core_input_filter stores the stream id in a field in the core_net_rec,
which is used by core_output_filter while sending response.
o Also, I changed Listen directive to take the transport layer protocol
as an extra argument so that web admin can choose SCTP or TCP.

Currently, I have this patch working for httpd-2.0.55/apr-0.9.6.

Would appreciate any feedback,
Preethi

I think I know what the problem with proxy is.  When reading the
response
header from the origin server, it falls out of ap_rgetline_core() at
this point:

          /* Something horribly wrong happened.  Someone didn't block! */
          if (APR_BRIGADE_EMPTY(bb)) {
              return APR_EGENERAL;
          }

It looks like the new core output filter is messing up the blocking mode
when it's called during the sending of the request to the origin server.
I'll continue tracking this down tomorrow.

Brian

On Oct 25, 2005, at 7:06 PM, Brian Pane wrote:

> On Oct 25, 2005, at 2:33 AM, Joe Orton wrote:
>
>
>> httpd-test runs against the trunk are failing all over the place
>> today,
>> I guess caused by one of these changes...
>>
>> prefork is failing like:
>>
>> Failed Test                Stat Wstat Total Fail  Failed  List of
>> Failed
>> ---------------------------------------------------------------------
>> ----------
>> t/modules/proxy.t                        13   11  84.62%  1-9 12-13
>> t/modules/proxy_balancer.t                1    1 100.00%  1
>> t/modules/rewrite.t                      22    5  22.73%  17-18 20-22
>> t/protocol/echo.t           255 65280     8    8 100.00%  1-8
>> t/security/CAN-2005-2700.t                2    1  50.00%  1
>> ... plus almost all of t/ssl/* fail
>>
>
> Sorry about that.  I didn't have proxy and ssl compiled in when I
> regression-tested with httpd-test.  I'll get started on a fix later
> this
> evening.
>
> Brian
>
>

Brian Pane wrote:
>
> It looks like the new core output filter is messing up the blocking mode
> when it's called during the sending of the request to the origin server.
> I'll continue tracking this down tomorrow.

Messing it up?  Or failing to set it up?

proxy_util.c invokes create_connection (which has some double-close socket
issues, if you follow the hook providers and then observe that we close the
socket locally in the proxy_util.c ap_proxy_connection_create).  When it
then runs the pre_connection hook, the initial blocking/timeout state is
set up correctly.

However, proxy_http (and possibly proxy_connect) fails to include the following
code fragment after invoking ap_proxy_connection_create();

          bb = apr_brigade_create(cdata->pool, cdata->bucket_alloc);
          rv = ap_get_brigade(cdata->input_filters, bb, AP_MODE_INIT,
                              APR_BLOCK_READ, 0);
          apr_brigade_destroy(bb);

          if (rv != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_ERR, rv, cdata->base_server,
                           "Failed to initialize the proxy ssl data stream");
              goto cleanup;
          }

so if the backend proxy connection is SSL, and we attempt to write before
we read (at least, that's http:) then the handshake isn't properly invoked.

I have to study proxy_connect to determine that we do a speculative read before
we attempt to write, such that we would always handshake SSL/TLS.

Bill

William A. Rowe, Jr. wrote:
>
> However, proxy_http (and possibly proxy_connect) fails to include the
> following code fragment after invoking ap_proxy_connection_create();
>
>         bb = apr_brigade_create(cdata->pool, cdata->bucket_alloc);
>         rv = ap_get_brigade(cdata->input_filters, bb, AP_MODE_INIT,
>                             APR_BLOCK_READ, 0);
>         apr_brigade_destroy(bb);
>
>         if (rv != APR_SUCCESS) {
>             ap_log_error(APLOG_MARK, APLOG_ERR, rv, cdata->base_server,
>                          "Failed to initialize the proxy ssl data stream");
>             goto cleanup;
>         }

Footnote; if you want to inject this snippet in the if (!connection) block
after ap_proxy_connection_create() - be sure to use 'status' in place of 'rv'.

Maxime Petazzoni wrote:

> You're right. But I don't think everybody as such an extensive
> knowledge of the authentication configuration. The example you gave
> may look simple to you, but I believe adding multiple AuthUserFile
> lines to a "classic" Basic Auth configuration schema is a lot more
> intuitive :
>
>     AuthType Basic
>     AuthName "Developpement HTTPd server"
>     AuthUserFile /home/sam/.local/access.user
>     AuthUserFile /home/sam/.local/access.user2
>     Require valid-user
>
> Just my 2 ¢,

+1.

Regards,
Graham
--

APACHE 2.0 STATUS:                                              -*-text-*-
Last modified at [$Date: 2005-10-24 15:02:33 -0400 (Mon, 24 Oct 2005) $]

The current version of this file can be found at:

   * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS

Documentation status is maintained seperately and can be found at:

   * docs/STATUS in this source tree, or
   * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/docs/STATUS

Consult the following STATUS files for information on related projects:

   * http://svn.apache.org/repos/asf/apr/apr/branches/0.9.x/STATUS
   * http://svn.apache.org/repos/asf/apr/apr-util/branches/0.9.x/STATUS

Consult the trunk/ for all new development and documentation efforts:

   * http://svn.apache.org/repos/asf/httpd/httpd/trunk/STATUS
   * http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS


Release history:

     2.0.56  : in development
     2.0.55  : tagged October 9, 2005
     2.0.54  : released April 17, 2005 as GA.
     2.0.53  : released February 7, 2005 as GA.
     2.0.52  : released September 28, 2004 as GA.
     2.0.51  : released September 15, 2004 as GA.
     2.0.50  : released June 30, 2004 as GA.
     2.0.49  : released March 19, 2004 as GA.
     2.0.48  : released October 29, 2003 as GA.
     2.0.47  : released July 09, 2003 as GA.
     2.0.46  : released May 28, 2003 as GA.
     2.0.45  : released April 1, 2003 as GA.
     2.0.44  : released January 20, 2003 as GA.
     2.0.43  : released October 3, 2002 as GA.
     2.0.42  : released September 24, 2002 as GA.
     2.0.41  : rolled September 16, 2002.  not released.
     2.0.40  : released August 9, 2002 as GA.
     2.0.39  : released June 17, 2002 as GA.
     2.0.38  : rolled June 16, 2002.  not released.
     2.0.37  : rolled June 11, 2002.  not released.
     2.0.36  : released May 6, 2002 as GA.
     2.0.35  : released April 5, 2002 as GA.
     2.0.34  : tagged March 26, 2002.
     2.0.33  : tagged March 6, 2002.  not released.
     2.0.32  : released Feburary 16, 2002 as beta.
     2.0.31  : rolled Feburary 1, 2002.  not released.
     2.0.30  : tagged January 8, 2002.  not rolled.
     2.0.29  : tagged November 27, 2001.  not rolled.
     2.0.28  : released November 13, 2001 as beta.
     2.0.27  : rolled November 6, 2001
     2.0.26  : tagged October 16, 2001.  not rolled.
     2.0.25  : rolled August 29, 2001
     2.0.24  : rolled August 18, 2001
     2.0.23  : rolled August 9, 2001
     2.0.22  : rolled July 29, 2001
     2.0.21  : rolled July 20, 2001
     2.0.20  : rolled July 8, 2001
     2.0.19  : rolled June 27, 2001
     2.0.18  : rolled May 18, 2001
     2.0.17  : rolled April 17, 2001
     2.0.16  : rolled April 4, 2001
     2.0.15  : rolled March 21, 2001
     2.0.14  : rolled March 7, 2001
     2.0a9   : released December 12, 2000
     2.0a8   : released November 20, 2000
     2.0a7   : released October 8, 2000
     2.0a6   : released August 18, 2000
     2.0a5   : released August 4, 2000
     2.0a4   : released June 7, 2000
     2.0a3   : released April 28, 2000
     2.0a2   : released March 31, 2000
     2.0a1   : released March 10, 2000


Contributors looking for a mission:

     * Just do an egrep on "TODO" or "XXX" in the source.

     * Review the bug database at: http://issues.apache.org/bugzilla/

     * Review the "PatchAvailable" bugs in the bug database:

      
http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED\
&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable

       After testing, you can append a comment saying "Reviewed and tested".

     * Open bugs in the bug database.


CURRENT RELEASE NOTES:

     * Forward binary compatibility is expected of Apache 2.0.x releases, such
       that no MMN major number changes will occur.  Such changes can only be
       made in the trunk.

     * All commits to branches/2.0.x must be reflected in SVN trunk,
       as well, if they apply.  Logical progression is commit to trunk,
       get feedback and votes on list or in STATUS, then merge into
       branches/2.2.x, and finally merge into branches/2.0.x, as applicable.


RELEASE SHOWSTOPPERS:


PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]

     *) mod_actions: Regression from 1.3: the file referred to must exist.
        Solve this by introducing the "virtual" modifier to the Action
        directive. PR 28553.
          modules/mappers/mod_actions.c: r1.32, r1.34
        jerenkrantz: Icky side-effect of the *t == '0' check.
        +1: nd, jerenkrantz, wrowe, jim
        -0: by rbb (inconsistent to 1.3, discussion on dev@)
           nd: I'm going to reverse the default
           jerenkrantz, striker: I'm confused as to the status of this backport.

     *) support/check_forensic: Fix tempfile usage
        svn rev 125495, 126224
        jerenkrantz says: r126224 fixes brokenness with r125495 on Solaris.
        +1: thommay, jerenkrantz, trawick
        trawick: "which" isn't portable; I've suggested a work-around on dev@
          (not standing in way of backport)
        jorton said: NetBSD's which isn't sufficient either.
        jerenkrantz: Since it's not in the critical path (and depends on
                     mod_log_forensic), I think it's still worth it to backport
                     it as-is.  For the one or two platforms that don't like
                     which, they can write their own version of the script.
        (jorton agrees)

     *) Win32: Move call to mpm_service_install to the rewrite_args hook
        from the post_config hook.
          http://svn.apache.org/viewcvs?view=rev&rev=154319
        +1: stoddard, striker, wrowe (as corrected in subsequent patches)

     *) Add httxt2dbm for creating RewriteMap DBM Files.
        http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev
        +1: pquerna, jorton, trawick

     *) Remove the base href tag from mod_proxy_ftp, as it breaks relative
        links for clients not using an Authorization header.
          modules/proxy/mod_proxy_ftp.c: r231044
        +1: minfrin, jim, nd


PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ please place SVN revisions from trunk here, so it is easy to
     identify exactly what the proposed changes are!  Add all new
     proposals to the end of this list. ]

     *) mod_headers: Support {...}s tag for SSL variable lookup.
        http://www.apache.org/~jorton/mod_headers-2.0-ssl.diff
        +1: jorton, trawick
        nd: two comments:
          (1) is the use of APR_ASCII_* ebcdic-safe? I.e. shouldn't we use the
              native chars here and it will be converted later? (I'm not sure)
        jorton: I have no idea, let an EBCDIC-er complain if it breaks?
        trawick: seems that '\r' and '\n' are the better chars to check
                 for; this is not raw data read from the network (or directly
                 from SSL) but instead it is either protocol data that has
                 already been converted to the native charset or it is other
                 data which was created inside the server in the native charset
          (2) I'd put out (null) only if val is NULL, not if it's empty.
        jorton: ssl_var_lookup() returns "" in place of NULL, that was really
           a deliberate choice... but maybe you're right.

     *) mod_log_config: Cleanup log_header_out function to allow multiple headers
        like Set-Cookie to be logged properly. PR 27787 (2.0 + 1.3)
          modules/loggers/mod_log_config.c: r1.116
        jerenkrantz asks: Isn't this what apr_table_merge is for?
        nd replies: yep. But cookies won't be merged, because browsers don't
                    support it.
        jerenkrantz: Couldn't we copy the table and merge the values somehow?
                     This just seems like a lot of code to duplicate what we
                     have already.  *shrug*  Regardless, patch looks okay...
        +1: nd, jerenkrantz

     *) Provide TLS/SSL upgrade functionality in mod_ssl allowing an unsecure
        connection to be upgraded to a secure connection upon request by the
        client.  The full patch is available at http://www.apache.org/~bnicholes/
        as well as a test client tlsupgrade.c. This functionality is mainly used
        by IPP clients today.
           modules/ssl/mod_ssl.c: r1.75, r1.97, r1.100
           modules/ssl/mod_ssl.h: r1.123
           modules/ssl/ssl_engine_config.c: r1.71, r1.90
           modules/ssl/ssl_engine_init.c: r1.107, r1.126
           modules/ssl/ssl_engine_io.c: r1.102, r1.124
           modules/ssl/ssl_engine_kernel.c: r1.83, r1.105, r1.108
           modules/ssl/ssl_util.c: r1.36
           modules/ssl/ssl_private.h: r1.2
        +1: bnicholes, wrowe
        -0: jerenkrantz (should wait for 2.2)
        -0: pquerna (2.2)
        -0: jorton (msgid <20040305083540.GA24529@...>)

      *) mod_ssl: Fix issues picking up ssl-unclean-shutdown setting
         for e.g. a reverse proxy config, breaking interop with MSIE
         in some cases.
         http://svn.apache.org/viewcvs?view=rev&rev=161958
         rediffed for 2.0.x as:
         http://issues.apache.org/bugzilla/attachment.cgi?id=14804
         PR: 34452
         +1: jorton, trawick

      *) mod_mime_magic: Handle CRLF-format^H^H^H^H^H^H^H magic files
         with any trailing whitespace so that it works with the
         default installation on Windows.
         http://svn.apache.org/viewcvs?rev=179622&view=rev
         http://svn.apache.org/viewcvs?rev=280114&view=rev
         +1: trawick, wrowe
          backported 280114 to 2.2.x branch already

      *) mod_cache: Fix handling of 'Vary: *". PR 16125.
         Trunk: r180341
         2.0.x Patch: http://issues.apache.org/bugzilla/attachment.cgi?id=15297
         +1: pquerna, jerenkrantz, colm
         jerenkrantz notes: I do prefer the version from r190033 (own if check).

      *) Reverse Proxy fixes: <Location> bug and Cookie support
         Patch is at
         http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=112365629308138&q=p4
         and is in production with Clients.
         +1: niq, nd
           niq: I'm seeing *a lot* of demand for this.
           jerenkrantz: Didn't a variant of this get committed to trunk?
                        If so, what revision?  And, is there a clean patch for
                        2.0?  (The patch in that message isn't clean.)

     *) Block mod_cgid usage on Solaris 10 due to OS bugs.  PR 34264.
        http://svn.apache.org/viewcvs?view=rev&rev=264866
        +1: jerenkrantz, colm
          rpluem: Now that patches for this bug are available I would prefer
                  Justins patch:
                          http://svn.apache.org/viewcvs?rev=326018&view=rev
                  which checks the patchlevel of the machine.
                  Maybe it should spit out a BIG warning about the
                  patches in any case as sometimes build machine and
                  install machine are different.

     *) mod_cgid: Fix PR 36410. Invoke the set_suexec_identity hook from
        the non-cgid side of the handler, where the full per-server/dir/etc
        configuration is available instead of using two mod_suexec and
        mod_userdir specific hacks. See mod_vhost_ldap for an example
        third-party get_suexec_identity implementation.
          http://people.apache.org/~colm/2.0.x-suexec-cgid.patch
        +1: colm

     *) Add ReceiveBufferSize directive to control the TCP receive buffer.
        code: http://svn.apache.org/viewcvs?view=rev&rev=157583
              http://svn.apache.org/viewcvs?rev=280401&view=rev
        docs: http://svn.apache.org/viewcvs?rev=280384&view=rev
        +1: stas, trawick
        -0: colm
            colm: It's a useful feature, but TCP window size selection
                  algorithims can be pretty "interesting", probably more
                  2.2.
            trawick: It is nevertheless true that POST performance can
                  sometimes improve dramatically by tweaking the receive
                  buffer size, and this relatively simple patch lets that
                  be controlled in a portable manner just for the web
                  server.  (old way: use system-specific configuration
                  knobs that affect all applications.)

     *) Fix all non-http protocol modules that were modeled after the
        broken mod_echo.c example; remove the -initial- timeout setting
        from NET_TIME (never inserted by non-request based protocols)
        and move it to the core pre_connection logic, so every core
        connection can read with timeout on Linux, Solaris, instead of
        read (untimed) blocking on Linux, and failing read non-block on
        Solaris.  Leaves NET_TIME intact until after the 2.0.x branch.
          http://people.apache.org/~wrowe/httpd-2.0-proto-timeout.patch
          +1: wrowe

     *) Add missing va_end call
          http://svn.apache.org/viewcvs?rev=321500&view=rev
        +1: nd, trawick, colm

     *) mod_proxy: Fix PR37145
        (data loss with httpd-2.0.55 reverse proxy method=post).
        Trunk version of patch:
           http://svn.apache.org/viewcvs.cgi?rev=327590&view=rev
        Backport version for 2.0.x of patch:
           http://issues.apache.org/bugzilla/attachment.cgi?id=16744
        +1: rpluem, trawick


PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON:

     *) Replace some of the mutex locking in the worker MPM with
        atomic operations for higher concurrency.
          server/mpm/worker/fdqueue.c 1.24, 1.25
        +1: brianp, ianh, jjclar
        trawick: Doesn't this make Apache 2.0.next slower except
                 when the right atomic operations are available/
                 implemented?  (Due to under-the-covers mutex
                 operations when the dummy atomics are used?)
        pquerna: Has anyone tested the performance differences
                 for different platforms? At this point I would
                 favour waiting for 2.2.
        -0: stoddard (at least until the performance implications are clarified)

     *) Allow mod_dav to do weak entity comparison functions.
        modules/dav/main/util.c: r1.45
        [ This one is under review.  Don't merge.  ]
        +1:

     *) mod_negotiation: parse quality values independent from
        the current locale and level values as integers. PR 17564.
        (essentially: get a rid of atof()) (2.0 + 1.3)
        modules/mappers/mod_negotiation.c: r1.114
        +1: nd
          We need to decide what happens with unparsable qvalues. RFC 2616
          states that q defaults to 1. (see 14.1 - 14.4). So should wrong
          qvalues be returned as 1.0 or 0.0 (as atof() did)?
          1.0: nd
          0.0: jim (a default != an "errored" value)

     *) Keep the same SSLMutex for the lifetime of the parent process
        (instead of having children using different mutexes and failing
        to lock the session cache across restarts.)
        New patch forthcoming - JimJag's changes make the merge ugly.
        +1: wrowe
        +1 (concept): jim (final vote when the patch is available)

     *) Fix the SSLMutex config parser so that all 'mechanisms' can take
        a filename, even if ignored, and they are rooted to the full path
        to the server (except for posixsem locks).  This allows a very
        cross-platform default:logs/ssl_mutex to be used everywhere.  Also
        eliminates the '.pid' suffix so that the name given is the name.
        Allows Win32 and other non-unicies to use named locks.
        New patch forthcoming - JimJag's changes make the merge ugly.
        +1: wrowe
        +1 (concept): jim (final vote when the patch is available)

     *) mod_ssl: Drop SSL_EXPERIMENTAL_ENGINE test in favor of testing for the
        ENGINE_init() function in config.m4, and use HAVE_ENGINE_INIT instead.
        wrowe notes that this feature is a noop until configured with SSLEngine.
        http://www.apache.org/~wrowe/have_engine_init.patch for a clean 2.0
patch.
        modules/ssl/README 1.40
        modules/ssl/config.m4 1.14
        modules/ssl/mod_ssl.c 1.79
        modules/ssl/mod_ssl.h 1.135
        modules/ssl/ssl_engine_config.c 1.78
        modules/ssl/ssl_engine_init.c 1.113
        modules/ssl/ssl_toolkit_compat.c 1.33
        +0: wrowe {Pending research into how to get AC to use -lsockets et. al.,
                   shows breakage on Solaris which can't -lcrypto -lssl without
                   the extra pkgconfig/openssl.pc Libs: * foo }

     *) mod_ssl: fix a link failure when the openssl-engine libraries are
        present but the engine headers are missing.
          modules/ssl/mod_ssl.c: r1.87
          modules/ssl/mod_ssl.h: r1.139
          modules/ssl/ssl_engine_config.c: r1.82
        PREREQ: Blow away of SSL_EXPERIMENTAL_ENGINE (see above)
        +1: jwoolley, trawick, jim, jerenkrantz

     *) When UseCanonicalName is set to OFF, allow ap_get_server_port to
        check r->connection->local_addr->port before defaulting to
        server->port or ap_default_port()
          server/core.c r1.247
        +1: bnicholes, jim, wrowe
        0: nd, jerenkrantz
           nd: can the local_addr->port ever be 0?
	   bnicholes response: I couldn't tell you for sure if local_addr->port
	     could be 0.  But it makes sense that if it were then Apache
	     wouldn't be listening on any port so it wouldn't matter anyway.
           nd replies: But if it can't be 0 the alternatives thereafter make no
             sense anymore, right?
	   jim proposes: UseCanonicalName Client directive
	     which implements this, keeping UseCanonicalName Off
 	     "as is".

     *) ThreadStackSize for Win32 and threaded MPMs
        trawick will eventually put together a patch for httpd 2.0.next
        +1 concept: trawick, nd, stoddard, wrowe

     *) don't propagate input headers describing a body to a GET subrequest
        with no body
        http://svn.apache.org/viewcvs?view=rev&rev=158798
        http://svn.apache.org/viewcvs?view=rev&rev=159410
        http://svn.apache.org/viewcvs?view=rev&rev=160573
        +1: gregames, wrowe (provided this is applied to ALL subreq types!)
        -1: jerenkrantz (read_length isn't a sufficient check to see if a body
                        is present in the request; presence of T-E and C-L in
                        the headers is the correct flag.)
            gregames: addressed jerenkrantz' objection in rev 160573
            wrowe: this has a negative impact on modules who wish to 'inspect'
              the headers, e.g. an xml transformation affected by the query
              string or request POST args.  The right solution is adopt apreq,
              providing an API for filters to participate in POST bodies.
            gregames: this does not affect POSTs.  the affected function helps
              create a GET subrequest with no body and is unprepared to deal with
              subrequest bodies.  any modules or applications wishing to
              inspect headers will in fact work better because the headers will
              reflect reality.
            wrowe: I've reconsidered - the simple fact is that subrequests
              don't have a good mechanism to 'share' the input body with the
              main request, and it's gotta be up to the main request to handle
              the input body.  If the module wants to use apreq-provided data,
              then it's going to have to ask apreq for the data instead of
              looking at the headers.  For that matter, why are subreq's even
              propogating POST or other non-GET types?  It seems that almost
              any subreq should be handled as a GET in 2.0.

CURRENT VOTES:

     *) httpd-std.conf and friends;

       a) httpd-std.conf should be tailored by install (from src or
          binbuild) even if user has existing httpd.conf
          +1:   trawick, slive, gregames, ianh, Ken, wrowe, jwoolley, jim, nd,
                erikabele
            wrowe - prefer httpd.default.conf to avoid ambiguity with cvs,
                    note that win32 installer creates just that file
                    (.default.conf rather than .conf.default so that win32
                     can recognize .conf files as text configuration files.)

       c) tailored httpd-std.conf should be installed to
          sysconfdir/examples or manualdir/exampleconf/
          +1:   slive, trawick, Ken, nd (prefer the latter), erikabele

     *) If the parent process dies, should the remaining child processes
        "gracefully" self-terminate. Or maybe we should make it a runtime
        option, or have a concept of 2 parent processes (one being a
        "hot spare").
        See: Message-ID: <3C58232C.FE91F19F@...>

        Self-destruct: Ken, Martin
        Not self-destruct: BrianP, Ian, Cliff, BillS
        Make it runtime configurable: Aaron, Justin, wrowe, rederpj, jim, nd

        /* The below was a concept on *how* to handle the problem */
        Have 2 parents: +1: jim
                        -1: Justin, wrowe, rederpj, nd
                        +0: Martin (while standing by, could it do
                                   something useful?)

     *) Make the worker MPM the default MPM for threaded Unix boxes.
        +1:   Justin, Ian, Cliff, BillS, striker
        +0:   BrianP, Aaron (mutex contention is looking better with the
              latest code, let's continue tuning and testing), rederpj, jim
        -0:   Lars, wrowe (let's make this defacto for the 2.2 release.),
              nd (for 2.0)


RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:

     * There is a bug in how we sort some hooks, at least the pre-config
       hook.  The first time we call the hooks, they are in the correct
       order, but the second time, we don't sort them correctly.  Currently,
       the modules/http/config.m4 file has been renamed to
       modules/http/config2.m4 to work around this problem, it should moved
       back when this is fixed.

         OtherBill offers that this is a SERIOUS problem.  We do not sort
         correctly by the ordering arguments passed to the register hook
         functions.  This was proven when I reordered the open_logs hook
         to attempt to open the error logs prior to the access logs.  Possibly
         the entire sorting code needs to be refactored.

     * pipes deadlock on all platforms with limited pipe buffers (e.g. both
       Linux and Win32, as opposed to only Win32 on 1.3).  The right solution
       is either GStein's proposal for a "CGI Brigade", or OtherBill's proposal
       for "Poll Buckets" for "Polling Filter Chains".  Or perhaps both :-)

     * All handlers should always send content down even if r->header_only
       is set.  If not, it means that the HEAD requests don't generate the
       same headers as a GET which is wrong.

     * HP/UX 10.20: compile breakage in APR.  Looks like it should be easy
       to fix, probably just some extraneous #include's that are fouling
       things up.
       PR: 9457
       Jeff: See my reply and patch in the PR (and previous commit to
       stop using "pipe" as a field name).  If patch is committed, we
       should be okay.  I'll wait to see if the user tests the patch.
       Update by Jeff 20020722: I got an account on HP 10.20.  It looks
       like some of the APR thread detection is screwed up.  If we find
       pthread.h but we can't compile the pthread test program we still
       think we can use threads.  For that reason, the patch I posted
       to the PR won't work as-is since a failed compile of the test
       program means nothing.

     * exec cmd and suexec arg-passing enhancements
       Status: Patches proposed
       Message-ID: <20020526041748.A29148@...>
       (see the "proc.patch" and "suexec-shell.patch" links in this message)

     * The 2.0.36 worker MPM graceless shutdown changes work but are
       a bit clunky on some platforms; eg, on Linux, the loop to
       join each worker thread seems to hang, and the parent ends up
       killing off the child with SIGKILL.  But at least it shuts down.

     * --enable-mods-shared="foo1 foo2" is busted on Darwin.  Pier
         posted a patch (Message-ID: <B8DBBE8D.575A%pier@...>).

     * We do not properly substitute the prefix-variables in the configuration
       scripts or generated-configs.  (i.e. if sysconfdir is etc,
       httpd-std.conf points to conf.)

     * If any request gets through ap_process_request_internal() and is
       scheduled to be served by the core handler, without a flag that this
       r->filename was tested by dir/file_walk, we need to 500 at the very
       end of the ap_process_request_internal() processing so sub_req-esters
       know this request cannot be run.  This provides authors of older
       modules better compatibility, while still improving the security and
       robustness of 2.0.

         Status: still need to decide where this goes, OtherBill comments...
         Message-ID: <065701c14526$495203b0$96c0b0d0@...>
         [Deleted comments regarding the ap_run_handler phase, as irrelevant
             as BillS points out that "common case will be caught in
  	     default_handler already (with the r->finfo.filetype == 0 check)"
             and the issue is detecting this -before- we try to run the req.]

	 gregames says: can this happen somehow without a broken module
             being involved?  If not, why waste cycles trying to defend against
             potential broken modules?  It seems futile.
         wrowe counters: no, it shouldn't happen unless the module is broken.
             But the right answer is to fail the request up-front in dir/file
             walk if the path was entirely invalid; and we can't do that either
             UNTIL 2.1 or we break modules that haven't hooked map_to_storage.

     * With AP_MODE_EXHAUSTIVE in the core, it is finally clear to me
       how the Perchild MPM should be re-written.  It hasn't worked
       correctly since filters were added because it wasn't possible to
       get the content that had already been written and the socket at
       the same time.  This mode lets us do that, so the MPM can be
       fixed.

     * htpasswd blindly processes the file you give it, and does no
       sanity checking before totally corrupting whatever file it was
       you thought you had. It should check the input file and bail
       if it finds non-comment lines that do not contain exactly 1
       ':' character.
         Message-ID: <20020217150457.A31632@...>

     * Can a static httpd be built reliably?
         Message-ID: <20020207142751.T31582@...>

     * [Ken] Test suite failures:
       o worker is also failing some of the 'cgi' subtests
       (see <URL:http://Source-Zone.Org/Apache/regression/>):
         Justin says: "Worker should be fine and passes httpd-test here.
                       I think it's a perl or a httpd-test problem."

     * Usage of APR_BRIGADE_NORMALIZE in core_input_filter should be
       removed if possible.
         Message-ID:
<Pine.LNX.4.33.0201202232430.318-100000@...>
         Jeff wonders if we still care about this.  It is no longer an
         API issue but simply an extra trip through the brigade.

     * The Add...Filter and Set...Filter directives do not allow the
       administrator to order filters, beyond the order of filename (mime)
       extensions.  It isn't clear if Set...Filter(s) should be inserted
       before or after the Add...Filter(s) which are ordered by sequence of
       filename extensions.  At minimum, some sort of +-[0-10] syntax seems
       like a nice solution.  See ROADMAP.

     * Get perchild to work on platforms other than Linux. This
       will require a portable mechanism to pass data and file/socket
       descriptors between vhost child groups. An API was proposed
       on dev@apr:
         Message-ID: <20020111115006.K1529@...>

     * Try to get libtool inter-library dependency code working on AIX.
         Message-ID: <cm3n10lx555.fsf@...>

       Justin says: If we get it working on AIX, we can enable this
                    on all platforms and clean up our build system
                    somewhat.
       Jeff says:   I thought I tested a patch for you sometime in
                    January that you were going to commit within a few
                    days.

     * Handling of %2f in URIs.  Currently both 1.3 and 2.0
       completely disallow %2f in the request URI path (see
       ap_unescape_url() in util.c).  It's permitted and passed
       through in the query string, however.  Roy says the
       original reason for disallowing it, from five years ago,
       was to protect CGI scripts that applied PATH_INFO to
       a filesystem location and which might be tricked by
       ..%2f..%2f(...).  We *should* allow path-info of the
       form 'http://foo.com/index.cgi/path/to/path%2finfo'.
       Since we've revamped a lot of our processing of path
       segments, it would be nice to allow this, or at least
       allow it conditionally with a directive.

         OtherBill adds that %2f as the SECOND character of a multibyte
         sequence causes the request to fail!  This happens notably in
         the ja-jis encoding.

       OtherBill is -0.5 for even considering this until 2.2 because
       it removes some protection we provided to third party modules
       that would mysteriously 'evaporate', exposing potential holes
       in security.  Putting this change into 2.1 development now (with
       strong warnings!) will give authors a chance to vet their code.

     * There is increasing demand from module writers for an API
       that will allow them to control the server à la apachectl.
       Reasons include sole-function servers that need to die if
       an external dependency (e.g., a database) fails, et cetera.
       Perhaps something in the (ever more abused) scoreboard?

              On the other hand, we already have a pipe that goes between parent
              and child for graceful shutdown events, along with an API that
              can be used to send a message down that pipe.  In threaded MPMs,
              it is easy enough to make that one pipe be used for graceful
              and graceless events, and it is also easy to open that pipe
              to both parent and child for writing.  Then we just need to
              figure out how to do graceless on non-threaded MPMs.

     * Win32: Rotatelogs sometimes is not terminated when Apache
       goes down hard.  FirstBill was looking at possibly tracking the
       child's-child processes in the parent process.
         stoddard: Shared scoreboard might offer a good way for the parent
         to keep track of 'other child' processes and whack them if the child
         goes down.
         Other thoughts on walking the process chain using the NT kernel
         have also been proposed on APR.

     * Eliminate unnecessary creation of pipes in mod_cgid

     * Combine log_child and piped_log_spawn. Clean up http_log.c.
       Common logging API.

     * There are still a number of places in the code where we are
       losing error status (i.e. throwing away the error returned by a
       system call and replacing it with a generic error code)

     * Mass vhosting version of suEXEC.

     * All DBMs suffer from confusion in support/dbmmanage (perl script) since
       the dbmmanage employs the first-matched dbm format.  This is not
       necessarily the library that Apache was built with.  Aught to
       rewrite dbmmanage upon installation to bin/ with the proper library
       for predictable mod_auth_dbm administration.
         Questions; htdbm exists, time to kill dbmmanage, or does it remain
                    useful as a perl dbm management example?  If we keep it,
                    do we address the issue above?
         March discussion summary; we are missing group support.  With that
                    added to trunk, this script will go away.  It will remain
                    in 2.0 based on our versioning approach.

     * Integrate mod_dav.
         Some additional items remaining:
         - case_preserved_filename stuff
             (use the new canonical name stuff?)
         - find a new home for ap_text(_header)
         - is it possible to remove the DAV: namespace stuff from util_xml?

     * ap_core_translate() and its use by mod_mmap_static and mod_file_cache
       are a bit wonky.  The function should probably be exposed as a utility
       function (such as ap_translate_url2fs() or ap_validate_fs_url() or
       something).  Another approach would be a new hook phase after
       "translate" which would allow the module to munge what the
       translation has decided to do.
         Status: Greg +1 (volunteers)

     * Explore use of a post-config hook for the code in http_main.c which
       calls ap_fixup_virutal_hosts(), ap_fini_vhost_config(), and
       ap_sort_hooks()  [to reduce the logic in main()]

     * read the config tree just once, and process N times (as necessary)
         OtherBill adds that the 'good' solution of three passes against the
         config tree within one read is the better solution, but breaks many
         modules.  Best left for 2.2?
         -0.5:  OtherBill

     * (possibly) use UUIDs in mod_unique_id and/or mod_usertrack

     * (possibly) port the bug fix for PR 6942 (segv when LoadModule is put
       into a VirtualHost container) to 2.0.

     * shift stuff to mod_core.h

     * callers of ap_run_create_request() should check the return value
       for failure (Doug volunteers)

     * Win32: Get Apache working on Windows 95/98. The following work
         (at least) needs to be done:
         - Document warning that OSR2 is required (for Crypt functions, in
         rand.c, at least.)  This could be resolved with an SSL library, or
         randomization in APR itself.
         - Bring the Win9xConHook.dll from 1.3 into 2.0 (no sense till it
         actually works) and add in a splash of Win9x service code.

     * Fix the worker MPM to use POD to kill child processes instead
       of ap_os_killpg, regardless of how they should die.

     * Scoreboard structures could be changed in the future such that
       proper alignment is not maintained, leading to segfaults on
       some systems.  Cliff posted a patch to deal with this issue but
       later recanted. See this message to dev@...:
       Message-ID: <Pine.LNX.4.44.0203011354090.16457-200000@deepthought
                   .cs.virginia.edu>

     * ap_discard_request should be converted to use the bucket API
       directly rather than waste cycles copying buffers with the old API.

     * SIGSEGV on Linux (glibc 2.1.2) isn't caught properly by a
       sigwaiting thread. We need to work around this, perhaps unless
       there is hope soon for a fixed glibc.


EXPERIMENTAL MODULES:

     mod_auth_ldap/util_ldap:
     * General stabilization and testing

     * Fix the shared memory cache

APACHE 2.1 STATUS:                                              -*-text-*-
Last modified at [$Date: 2005-10-16 14:05:27 -0400 (Sun, 16 Oct 2005) $]

The current version of this file can be found at:

   * http://svn.apache.org/repos/asf/httpd/httpd/trunk/STATUS

Documentation status is maintained seperately and can be found at:

   * docs/STATUS in this source tree, or
   * http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS

Consult the following STATUS files for information on related projects:

   * http://svn.apache.org/repos/asf/apr/apr/trunk/STATUS
   * http://svn.apache.org/repos/asf/apr/apr-util/trunk/STATUS

Patches considered for backport are noted in their branches' STATUS:

   * http://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x/STATUS
   * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS


Release history:
     [NOTE that only Alpha/Beta releases occur in 2.1 development]

     2.1.9   : in development
     2.1.8   : Released on 1/10/2005 as beta.
     2.1.7   : Released on 12/09/2005 as beta.
     2.1.6   : Released on  6/27/2005 as alpha.
     2.1.5   : Tagged on 6/17/2005.
     2.1.4   : not released.
     2.1.3   : Released on  2/22/2005 as alpha.
     2.1.2   : Released on 12/08/2004 as alpha.
     2.1.1   : Released on 11/19/2004 as alpha.
     2.1.0   : not released.


Contributors looking for a mission:

     * Just do an egrep on "TODO" or "XXX" in the source.

     * Review the bug database at: http://issues.apache.org/bugzilla/

     * Review the "PatchAvailable" bugs in the bug database:

      
http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED\
&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable

       After testing, you can append a comment saying "Reviewed and tested".

     * Open bugs in the bug database.


CURRENT RELEASE NOTES:


RELEASE SHOWSTOPPERS:

     * Handling of non-trailing / config by non-default handler is broken
       http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105451701628081&w=2
       jerenkrantz asks: Why should this block a release?
       wsanchez agrees: this may be a change in behavior, but isn't
         clearly wrong, and even if so, it doesn't seem like a
         showstopper.

     * the edge connection filter cannot be removed
       http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105366252619530&w=2

       jerenkrantz asks: Why should this block a release?

       stas replies: because it requires a rewrite of the filters stack
             implementation (you have suggested that) and once 2.2 is
             released you can't do that anymore.


CURRENT VOTES:

     * httpd-std.conf and friends

       a) httpd-std.conf should be tailored by install (from src or
          binbuild) even if user has existing httpd.conf
          +1:   trawick, slive, gregames, ianh, Ken, wrowe, jwoolley, jim, nd,
                erikabele
            wrowe - prefer httpd.default.conf to avoid ambiguity with cvs

       b) tailored httpd-std.conf should be copied by install to
          sysconfdir/examples
          -0:   striker

       c) tailored httpd-std.conf should be installed to
          sysconfdir/examples or manualdir/exampleconf/
          +1:   slive, trawick, Ken, nd (prefer the latter), erikabele
          +1:   wsanchez (propose sysconfdir/examples/<version> for diffiness)

       d) Installing a set of default config files when upgrading a server
          doesn't make ANY sense at all.
          +1:   ianh - medium/big sites don't use 'standard config' anyway, as it
                       usually needs major customizations
          -1:   Ken, wrowe, jwoolley, jim, nd, erikabele
            wrowe - diff is wonderful when comparing old/new default configs,
                    even for customized sites that ianh mentions
            jim - ... assuming that the default configs have been updated
                      with the required inline docs to explain the
                      changes

     * If the parent process dies, should the remaining child processes
       "gracefully" self-terminate. Or maybe we should make it a runtime
       option, or have a concept of 2 parent processes (one being a
       "hot spare").
       See: Message-ID: <3C58232C.FE91F19F@...>

       Self-destruct: Ken, Martin, Lars
       Not self-destruct: BrianP, Ian, Cliff, BillS
       Make it runtime configurable: Aaron, jim, Justin, wrowe, rederpj, nd

       /* The below was a concept on *how* to handle the problem */
       Have 2 parents: +1: jim
                       -1: Justin, wrowe, rederpj, nd
                       +0: Lars, Martin (while standing by, could it do
                                         something useful?)

     * Make the worker MPM the default MPM for threaded Unix boxes.
       +1:   Justin, Ian, Cliff, BillS, striker, wrowe, nd
       +0:   BrianP, Aaron (mutex contention is looking better with the
             latest code, let's continue tuning and testing), rederpj, jim
       -0:   Lars

       pquerna: Do we want to change this for 2.2?


RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:

     * Patches submitted to the bug database:
      
http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED\
&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable

     * Filter stacks and subrequests, redirects and fast redirects.
       There's at least one PR that suffers from the current unclean behaviour
       (which lets the server send garbage): PR 17629
       nd says: Every subrequest should get its own filter stack with the
                subreq_core filter as bottom-most. That filter does two things:
                  - swallow EOS buckets
                  - redirect the data stream to the upper request's (rr->main)
                    filter chain directly after the subrequest's starting
                    point.
                Once we have a clean solution, we can try to optimize
                it, so that the server won't be slow down too much.

     * RFC 2616 violations.
       Closed PRs: 15857.
       Open PRs: 15852, 15859, 15861, 15864, 15865, 15866, 15868, 15869,
                 15870, 16120, 16125, 16126, 16133, 16135, 16136, 16137,
                 16138, 16139, 16140, 16142, 16518, 16520, 16521,
       jerenkrantz says: need to decide how many we need to backport and/or
                         if these rise to showstopper status.
       wrowe suggests: it would be nice to see "MUST" v.s. "SHOULD" v.s. "MAY"
                       out of this list, without reviewing them individually.

     * There is a bug in how we sort some hooks, at least the pre-config
       hook.  The first time we call the hooks, they are in the correct
       order, but the second time, we don't sort them correctly.  Currently,
       the modules/http/config.m4 file has been renamed to
       modules/http/config2.m4 to work around this problem, it should moved
       back when this is fixed.

         OtherBill offers that this is a SERIOUS problem.  We do not sort
         correctly by the ordering arguments passed to the register hook
         functions.  This was proven when I reordered the open_logs hook
         to attempt to open the error logs prior to the access logs.  Possibly
         the entire sorting code needs to be refactored.

     * pipes deadlock on all platforms with limited pipe buffers (e.g. both
       Linux and Win32, as opposed to only Win32 on 1.3).  The right solution
       is either GStein's proposal for a "CGI Brigade", or OtherBill's proposal
       for "Poll Buckets" for "Polling Filter Chains".  Or maybe both :-)

     * All handlers should always send content down even if r->header_only
       is set.  If not, it means that the HEAD requests don't generate the
       same headers as a GET which is wrong.

     * exec cmd and suexec arg-passing enhancements
       Status: Patches proposed
       Message-ID: <20020526041748.A29148@...>
       (see the "proc.patch" and "suexec-shell.patch" links in this message)

     * The 2.0.36 worker MPM graceless shutdown changes work but are
       a bit clunky on some platforms; eg, on Linux, the loop to
       join each worker thread seems to hang, and the parent ends up
       killing off the child with SIGKILL.  But at least it shuts down.

     * --enable-mods-shared="foo1 foo2" is busted on Darwin.  Pier
         posted a patch (Message-ID: <B8DBBE8D.575A%pier@...>).

     * We do not properly substitute the prefix-variables in the configuration
       scripts or generated-configs.  (i.e. if sysconfdir is etc,
       httpd-std.conf points to conf.)

     * If any request gets through ap_process_request_internal() and is
       scheduled to be served by the core handler, without a flag that this
       r->filename was tested by dir/file_walk, we need to 500 at the very
       end of the ap_process_request_internal() processing so sub_req-esters
       know this request cannot be run.  This provides authors of older
       modules better compatibility, while still improving the security and
       robustness of 2.0.

         Status: still need to decide where this goes, OtherBill comments...
         Message-ID: <065701c14526$495203b0$96c0b0d0@...>
         [Deleted comments regarding the ap_run_handler phase, as irrelevant
             as BillS points out that "common case will be caught in
  	     default_handler already (with the r->finfo.filetype == 0 check)"
             and the issue is detecting this -before- we try to run the req.]

	 gregames says: can this happen somehow without a broken module
             being involved?  If not, why waste cycles trying to defend against
             potential broken modules?  It seems futile.
         wrowe counters: no, it shouldn't happen unless the module is broken.
             But the right answer is to fail the request up-front in dir/file
             walk if the path was entirely invalid; and we can't do that either
             UNTIL 2.1 or we break modules that haven't hooked map_to_storage.

     * With AP_MODE_EXHAUSTIVE in the core, it is finally clear to me
       how the Perchild MPM should be re-written.  It hasn't worked
       correctly since filters were added because it wasn't possible to
       get the content that had already been written and the socket at
       the same time.  This mode lets us do that, so the MPM can be
       fixed.

     * Can a static httpd be built reliably?
         Message-ID: <20020207142751.T31582@...>

     * Usage of APR_BRIGADE_NORMALIZE in core_input_filter should be
       removed if possible.
         Message-ID:
<Pine.LNX.4.33.0201202232430.318-100000@...>
         Jeff wonders if we still care about this.  It is no longer an
         API issue but simply an extra trip through the brigade.

     * Get perchild to work on platforms other than Linux. This
       will require a portable mechanism to pass data and file/socket
       descriptors between vhost child groups. An API was proposed
       on dev@apr:
         Message-ID: <20020111115006.K1529@...>

     * Try to get libtool inter-library dependency code working on AIX.
         Message-ID: <cm3n10lx555.fsf@...>

       Justin says: If we get it working on AIX, we can enable this
                    on all platforms and clean up our build system
                    somewhat.
       Jeff says:   I thought I tested a patch for you sometime in
                    January that you were going to commit within a few
                    days.

     * Handling of %2f in URIs.  Currently both 1.3 and 2.0
       completely disallow %2f in the request URI path (see
       ap_unescape_url() in util.c).  It's permitted and passed
       through in the query string, however.  Roy says the
       original reason for disallowing it, from five years ago,
       was to protect CGI scripts that applied PATH_INFO to
       a filesystem location and which might be tricked by
       ..%2f..%2f(...).  We *should* allow path-info of the
       form 'http://foo.com/index.cgi/path/to/path%2finfo'.
       Since we've revamped a lot of our processing of path
       segments, it would be nice to allow this, or at least
       allow it conditionally with a directive.

         OtherBill adds that %2f as the SECOND character of a multibyte
         sequence causes the request to fail!  This happens notably in
         the ja-jis encoding.

     * FreeBSD, threads, and worker MPM.  All seems to work fine
       if you only have one worker process with many threads.  Add
       a second worker process and the accept lock seems to be
       lost.  This might be an APR issue with how it deals with
       the child_init hook (i.e. the fcntl lock needs to be resynced).
       More examination and analysis is required.
         Status: Works with FreeBSD 5.3. Does not work in previous versions.
                 This has also been reported on Cygwin.

     * There is increasing demand from module writers for an API
       that will allow them to control the server à la apachectl.
       Reasons include sole-function servers that need to die if
       an external dependency (e.g., a database) fails, et cetera.
       Perhaps something in the (ever more abused) scoreboard?

              On the other hand, we already have a pipe that goes between parent
              and child for graceful shutdown events, along with an API that
              can be used to send a message down that pipe.  In threaded MPMs,
              it is easy enough to make that one pipe be used for graceful
              and graceless events, and it is also easy to open that pipe
              to both parent and child for writing.  Then we just need to
              figure out how to do graceless on non-threaded MPMs.

     * Allow the DocumentRoot directive within <Location > scopes?  This
       allows the beloved (crusty) Alias /foo/ /somepath/foo/ followed
       by a <Directory /somepath/foo> to become simply
       <Location /foo/> DocumentRoot /somefile/foo (IMHO a bit more legible
       and in-your-face.)  DocumentRoot unset would be accepted [and would
       not permit content to be served, only virtual resources such as
       server-info or server-status.
       This proposed change would _not_ depricate Alias.
         striker: See the thread starting with Message-ID:
           JLEGKKNELMHCJPNMOKHOGEEJFBAA.striker@....

     * Win32: Rotatelogs sometimes is not terminated when Apache
       goes down hard.  FirstBill was looking at possibly tracking the
       child's-child processes in the parent process.
         stoddard: Shared scoreboard might offer a good way for the parent
         to keep track of 'other child' processes and whack them if the child
         goes down.
         Other thoughts on walking the process chain using the NT kernel
         have also been proposed on APR.

     * Eliminate unnecessary creation of pipes in mod_cgid

     * Combine log_child and piped_log_spawn. Clean up http_log.c.
       Common logging API.

     * Platforms that do not support fork (primarily Win32 and AS/400)
       Architect start-up code that avoids initializing all the modules
       in the parent process on platforms that do not support fork.

     * There are still a number of places in the code where we are
       losing error status (i.e. throwing away the error returned by a
       system call and replacing it with a generic error code)

     * Mass vhosting version of suEXEC.

     * All DBMs suffer from confusion in support/dbmmanage (perl script) since
       the dbmmanage employs the first-matched dbm format.  This is not
       necessarily the library that Apache was built with.  Aught to
       rewrite dbmmanage upon installation to bin/ with the proper library
       for predictable mod_auth_dbm administration.
         Questions; htdbm exists, time to kill dbmmanage, or does it remain
                    useful as a perl dbm management example?  If we keep it,
                    do we address the issue above?

     * Integrate mod_dav.
         Some additional items remaining:
         - case_preserved_filename stuff
             (use the new canonical name stuff?)
         - find a new home for ap_text(_header)
         - is it possible to remove the DAV: namespace stuff from util_xml?

     * ap_core_translate() and its use by mod_mmap_static and mod_file_cache
       are a bit wonky.  The function should probably be exposed as a utility
       function (such as ap_translate_url2fs() or ap_validate_fs_url() or
       something).  Another approach would be a new hook phase after
       "translate" which would allow the module to munge what the
       translation has decided to do.
         Status: Greg +1 (volunteers)

     * Explore use of a post-config hook for the code in http_main.c which
       calls ap_fixup_virutal_hosts(), ap_fini_vhost_config(), and
       ap_sort_hooks()  [to reduce the logic in main()]

     * read the config tree just once, and process N times (as necessary)

     * (possibly) use UUIDs in mod_unique_id and/or mod_usertrack

     * (possibly) port the bug fix for PR 6942 (segv when LoadModule is put
       into a VirtualHost container) to 2.0.

     * shift stuff to mod_core.h

     * callers of ap_run_create_request() should check the return value
       for failure (Doug volunteers)

     * Win32: Get Apache working on Windows 95/98. The following work
         (at least) needs to be done:
         - Document warning that OSR2 is required (for Crypt functions, in
         rand.c, at least.)  This could be resolved with an SSL library, or
         randomization in APR itself.
         - Bring the Win9xConHook.dll from 1.3 into 2.0 (no sense till it
         actually works) and add in a splash of Win9x service code.

     * Fix the worker MPM to use POD to kill child processes instead
       of ap_os_killpg, regardless of how they should die.

     * Scoreboard structures could be changed in the future such that
       proper alignment is not maintained, leading to segfaults on
       some systems.  Cliff posted a patch to deal with this issue but
       later recanted. See this message to dev@...:
       Message-ID: <Pine.LNX.4.44.0203011354090.16457-200000@deepthought
                   .cs.virginia.edu>

     * APXS either needs to be fixed completely for use when apr is out of tree,
       or it should drop query mode altogether, and we just grow an
       httpd-config or similar arrangement.
       To quote a discussion in STATUS earlier:

           thommay: this doesn't fix all the problems with apxs and out of
                    tree apr/apr-util, but it's a good start. There's still the
                    query cases; but I'm beginning to think that in these cases
                    the app should be querying ap{r,u}-config directly
           gstein: agreed. apxs should deprecate the -q flag
           pquerna: I vote for a httpd-config, and to deprecate the -q flag.
           minfrin: +1 for httpd-config, and to deprecate -q.


TODO ISSUES REMAINING IN MOD_SSL:

     * In order to use a DSO version of mod_ssl we have to link with
       -lssl and -lcrypto. A workaround is in place right now where the
       entire EXTRA_LIBS macro is being appended to the objects list, but
       this is a hack. We should either revamp the APACHE_CHECK_SSL_TOOLKIT
       autoconf function or come up with some other autoconf checks to
       search for libssl and libcrypto and properly add them to mod_ssl's
       link flags.

     * SSL renegotiations in combination with POST request

     * Port or dispose all code inside #if 0...#endif blocks that remain
       from the porting effort.

     * Do we need SSL_set_read_ahead()?

     * the ssl_expr api is NOT THREAD SAFE.  race conditions exist:
        -in ssl_expr_comp() if SSLRequire is used in .htaccess
         (ssl_expr_info is global)
        -is ssl_expr_eval() if there is an error
         (ssl_expr_error is global)

     * SSLRequire directive (parsing of) leaks memory

     * Diffie-Hellman-Parameters for temporary keys are hardcoded in
       ssl_engine_dh.c, while the comment in ssl_engine_kernel.c says:
       "it is suggested that keys be changed daily or every 500
       transactions, and more often if possible."

     * ssl_var_lookup could be rewritten to be MUCH faster

     * CRL callback should be pluggable

     * session cache store should be pluggable

     * init functions should return status code rather than ssl_die()

     * ssl_engine_pphrase.c needs to be reworked so it is generic enough
       to also decrypt proxy keys

     * the shmcb code should just align its memory segment rather than
       jumping through all the "safe" memcpy and memset hoops


WISH LIST
     * mod_proxy: Ability to run SSL over proxy gateway connections,
       encrypting (or reencrypting) at the proxy.

     * mod_cache: Handle ESI tags.

     * mod_cache: Resolve issue of how to cache page fragements (or perhaps
       -if- we want to cache page fragements). Today, mod_cache/mod_mem_cache
       will cache #include 'virtual' requests (but not #include 'file'
       requests). This was accomplished by making CACHE_IN a
       CONTENT_SET-1 filter to force it to run before the SUBREQ_CORE
       filter.  But now responses cannot be cached that include the
       effects of having been run through CONTENT_SET filters
       (mod_deflate, mod_expires, etc).  We could rerun all the
       CONTENT_SET filters on the cached response, but this will not
       work in all cases. For example, mod_expires relies on installing
       the EXPIRATION filter during fixups. Contents served out of
       mod_cache (out of the quick_handler) bypass -all- the request
       line server hooks (Ryan really hated this. It is great for
       performance, but bad because of the complications listed above).

     mod_cache/mod_mem_cache/mod_disk_cache:

     * mod_mem_cache: Consider adding a RevalidateTimeout directive to
       specify time at which local cached content is to be revalidated
       (ie, underlying file stat'ed to see if it has changed).

     * mod_cache: CacheEnable/CacheDisable should accept regular expressions.
       jerenkrantz says: Too slow.  Get regexs away from speedy caches by
                         default.  Introduce a new CacheEnableRegex if you want.

     * mod_mem_cache/mod_disk_cache: Need to be able to query cache
       status (num of entries, cache object properties, etc.).
       mod_status could be extended to query optional hooks defined
       by modules for the purpose of reporting module status.
       mod_cache (et. al.) could define optional hooks that are called
       to collect status.  Status should be queryable by
       HTTP or SNMP?
       jerenkrantz says: Yawn.  Who cares.

     * MaxRequestsPerChild measures connections, not requests.
         Until someone has a better way, we'll probably just rename it
         "MaxConnectionsPerChild".

     * Regex containers don't work in an intutive way
         Status: No one has come up with an efficient way to fix this
         behavior. Dean has suggested getting rid of regex containers
         completely.
         OtherBill suggests: We at least seem to agree on eliminating
                             the <Container ~ foo> forms, and using only
                             <ContainerMatch foo> semantics.

     * orig_ct in the byterange/multipart handling may not be
       needed. Apache 1.3 just never stashed "multipart" into
       r->content_type. We should probably follow suit since the
       byterange stuff doesn't want the rest of the code to see the
       multipart content-type; the other code should still think it is
       dealing with the <orig_ct> stuff.
         Status: Greg volunteers to investigate (esp. since he was most
                 likely the one to break it :-)

EXPERIMENTAL MODULES:

     Experimental modules should eventually be be promoted to fully supported
     status or removed from the repository entirely (ie, the
     'experiment' failed). This section tracks what needs to happen to
     get the modules promoted to fully supported status.

Justin Erenkrantz wrote:
> --On August 11, 2005 10:21:37 AM +0100 Colm MacCarthaigh
> <colm@...> wrote:
>
>> On Wed, Aug 10, 2005 at 03:38:17PM -0700, Justin Erenkrantz wrote:
>>> --On August 8, 2005 1:25:46 PM +0100 Colm MacCarthaigh <colm@...>
>>> wrote:
>>>
>>> > O.k., I've merged our two patches, but I've changed a few things, tell
>>> > me if there's anothing you think is wrong;
>>>
>>> Would you mind writing up a log message for this patch?
>>
>> No problem;
>>
>>     Fix incorrectly served 304 responses when expired cache entity
>>     is valid, but cache is unwritable and headers cannot be updated.
>>     Submitted by colm stdlib.net
>>
>>     Remove entities from the cache when re-validation receives a
>>     404 or other content-no-longer-present error.
>>     Submitted by ruediger.pluem vodafone.com
>
> Thanks!  I've committed this in r231486, r231487, and r231488.  I
> re-split them up to make it easier for people to review the commits.
>
> However, there remains an issue in mod_disk_cache's remove_url: I don't
> think it properly handles removing the Vary condition files.  I went
> ahead and committed it because it gets us closer to the desired solution.
>
> The code will remove the header file and the disk file; but it also
> likely needs to go up a 'level' and remove all variants.  Because if we
> get a 404 on a varied entity, it also means that all variants should be
> removed, no?
>
> I think what this means is that we need to recompute the hash - verify
> that it either meets the 'base' URL (we're done then), or we need to
> then go through and wack all of the varied headers/bodies and such.
> Now, I *think* it's possible after Paul's latest rewrite to just wack
> some subdirectories - but I'm fuzzy on this.  (Paul??)

No need to recompute the hash.  Just rm -rf <hash>.vary, which is a
directory. Inside that directory is another layer of hashes, but thats
only based on the varied headers...

Anyways, best path would be to atomically rename the .vary to a tempdir,
and then recursively delete it.

-Paul

Hi!

I developed an extended version of the auth_ldap module and use it currently
in Apache 1.3. Now I want to port this to Apache 2.
I got everything ported except the follwing 2 problems:

1) It seems the functions ap_mm_malloc, ap_mm_strdup and ap_mm_free from
"ap_mm.h" aren't there anymore? How do I port them to Apache 2?

2) When I include the module in Apache 2 (2.0.52) and request a Directory
per Webbrowser that is auth_ldap-protected, I get a segfault in the
authenticate user function because this line returns NULL :

   auth_ldap_config_rec *sec =
     (auth_ldap_config_rec *)ap_get_module_config(r->per_dir_config,
&ep_auth_module);

This line always gives me a NULL-pointer, but it did not in the 1.3 version.
I investigated a bit and found, that the function
ap_get_module_config just does a vector lookup:
r->per_dir_config[ep_auth_module.module_index]

I echoed the array r->per_dir_config to stderr and I got the following
output:

ep_auth_module.module_index = 21

(although it is the ONY module I load in my configuration; it gets
initialized using STANDARD_20MODULE_STUFF with the value of -1)

Now the list of the pointers in r->per_dir_config :

ptr[0]=0x816e720
ptr[1]=(nil)
ptr[2]=(nil)
ptr[3]=(nil)
ptr[4]=(nil)
ptr[5]=(nil)
ptr[6]=0x809e2de
ptr[7]=(nil)
ptr[8]=(nil)
ptr[9]=(nil)
ptr[10]=(nil)
ptr[11]=(nil)
ptr[12]=(nil)
ptr[13]=(nil)
ptr[14]=(nil)
ptr[15]=(nil)
ptr[16]=(nil)
ptr[17]=(nil)
ptr[18]=(nil)
ptr[19]=(nil)
ptr[20]=(nil)
ptr[21]=(nil)
ptr[22]=(nil)
ptr[23]=(nil)
ptr[24]=(nil)
ptr[25]=(nil)
ptr[26]=(nil)

As you can see, index 21 is NULL.

I even tried to force the not-NULL indices by writing:
   auth_ldap_config_rec *sec = r->per_dir_config[6];
and
   auth_ldap_config_rec *sec = r->per_dir_config[0];

But this gave me a segfault at another location ...


I don't know whether I'm doing something wrong in the Module source, or in
the way I build it...

I compile it using:
   CFLAGS=-c -g -march=i586 -mcpu=i686 -fmessage-length=0 -Wall -DEAPI_MM
-fPIC -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DHARD_SERVER_LIMIT=2048
-DDYNAMIC_MODULE_LIMIT=128 -DSSL_EXPERIMENTAL_PERDIRCA_IGNORE
-DSSL_EXPERIMENTAL_PROXY_IGNORE -DLINUX=22 -DMOD_SSL=208115 -DEAPI
-DWITH_SHARED_LDAP_CACHE -DWITH_OPENLDAP -fPIC -Wall -DSHARED_MODULE
   LIB=-lmm -lldap -lcrypt -lpq

   And Linking is done as shared object: $(LD) $(LIB) -o $@ -shared  $^


Does somebody have a clue what's wrong here? If you need more info, just let
me know.

Thanks in advance!
Stefan

--
Stefan Gaffga, Systementwickler          _____  _____
EP:ElectronicPartner GmbH               / ___/ / _  /  __
Mündelheimer Weg 40, 40472 Düsseldorf  / __/  / ___/  /_/
Tel:0211/4156-223 Fax:0211/4156-308   /____/ /_/     /_/

On Thursday 27 October 2005 09:32, Gaffga, Stefan wrote:
> Hi!
>
> I developed an extended version of the auth_ldap module and use it
> currently in Apache 1.3. Now I want to port this to Apache 2.
> I got everything ported except the follwing 2 problems:

For future reference, you'd be more on-topic on the apache-modules list.

> 1) It seems the functions ap_mm_malloc, ap_mm_strdup and ap_mm_free from
> "ap_mm.h" aren't there anymore? How do I port them to Apache 2?

You use APR pools.  See http://www.apachetutor.org/dev/pools

> 2) When I include the module in Apache 2 (2.0.52) and request a Directory
> per Webbrowser that is auth_ldap-protected, I get a segfault in the
> authenticate user function because this line returns NULL :
>
>   auth_ldap_config_rec *sec =
>     (auth_ldap_config_rec *)ap_get_module_config(r->per_dir_config,
> &ep_auth_module);

The per-dir config is whatever you set it to.  If it's null then presumably it
hasn't been set in this request.  See http://www.apachetutor.org/dev/config

--
Nick Kew

On Oct 25, 2005, at 2:33 AM, Joe Orton wrote:

> On Mon, Oct 24, 2005 at 03:33:17AM -0000, Brian Pane wrote:
>
>> Author: brianp
>> Date: Sun Oct 23 20:33:14 2005
>> New Revision: 327945
>>
>> URL: http://svn.apache.org/viewcvs?rev=327945&view=rev
>> Log:
>> Async write completion for Event MPM
>> (backported from async-dev branch to 2.3 trunk)
>>
>
> httpd-test runs against the trunk are failing all over the place
> today,
> I guess caused by one of these changes...

I just committed a fix.  The problem was that the new
ap_core_output_filter
was leaving the socket timeout set to zero.  In situations where the
output
filter runs _before_ the input filter, like the communication to the
origin
server in mod_proxy, the zero timeout was causing reads in the input
filter to fail.

Brian

I'm still working on mod_dav_userdir, so naturally I have more questions.

Its passing most of the tests in litmus, with the only exceptions being some
locking stuff that neither windows nor osx seem to care about. Now I'm testing
other stuff, namely large file uploading. I have two large files that I'm
working with, one is about 150MB and the other is just over 4GB. My test client
is OS X Tiger 10.4.2 and the server is 2.0.55 (Sempron 3000+ with 1GB of RAM).

With the 4GB file I eventually get the errors:

[Thu Oct 27 21:15:19 2005] [error] [client 192.168.0.1] Invalid Content-Length
[Thu Oct 27 21:15:19 2005] [error] [client 192.168.0.1] (34)Result too large:
Could not get next bucket brigade  [500, #0]

At this point nothing has been written to the database, even though the client
has been transferring for several minutes.

I can't find any mention of the bucket brigade error in the httpd source code,
so I have no idea what to do about it. Any ideas?

I have to admit I don't really understand how to interface with the bucket
brigade stuff, I blindly followed the example in mod_dav_fs. Even though the
brigade handling appears to break large files into pieces, it looks like the
entire file is loaded before the repository handler gets it. If that's the case,
maybe the above errors are related to memory starvation?

FWIW, mod_dav_userdir, unlike catacomb, breaks the files into 64KB rows in the
database. Consequently I could easily benefit from being given the incoming bits
in chunks, but I have no idea how to accomplish that. Any suggestions?

During my travails I've noticed that the progress bars on the client machines
(osx or win2k) progress signifcantly faster than the rows are inserted into the
database. I'm not entirely sure what that means or what to do about it, but it
would be nice to keep things in sync.

BTW, if any of you feel like pounding my server for me, feel free. The test
server is at http://site46.com (that's a reverse proxy to the real test
server...let me know if it doesn't work). The real server is partially at
http://terran-bank.com. How was that for a shameless plug? :)

BTW2, if anyone cares I can make the source for mod_dav_userdir available. It's
BSD, but I haven't gotten around to posting it yet.

Thanks

> BTW2, if anyone cares I can make the source for mod_dav_userdir available.
It's BSD, but I haven't gotten around to posting it yet.

Posting Code would help us with the problems and be able to reproduce
them here too.

Brandon Fosdick wrote:
> I'm still working on mod_dav_userdir, so naturally I have more questions.
>
> Its passing most of the tests in litmus, with the only exceptions being some
locking stuff that neither windows nor osx seem to care about. Now I'm testing
other stuff, namely large file uploading. I have two large files that I'm
working with, one is about 150MB and the other is just over 4GB. My test client
is OS X Tiger 10.4.2 and the server is 2.0.55 (Sempron 3000+ with 1GB of RAM).

What OS on the server?

Can you try 2.1.8-beta? Lots of Large File Support fixes are present in
2.1.xx

-Paul

On Thu, Oct 27, 2005 at 10:18:00PM -0700, Brandon Fosdick wrote:
> I'm still working on mod_dav_userdir, so naturally I have more questions.
>
> Its passing most of the tests in litmus, with the only exceptions
> being some locking stuff that neither windows nor osx seem to care
> about. Now I'm testing other stuff, namely large file uploading. I
> have two large files that I'm working with, one is about 150MB and the
> other is just over 4GB. My test client is OS X Tiger 10.4.2 and the
> server is 2.0.55 (Sempron 3000+ with 1GB of RAM).
>
> With the 4GB file I eventually get the errors:

2.0.x doesn't support large request bodies (for some definition of
"large" depending on the platform, >2Gb for 32-bit hosts), this works
with 2.1.x as Paul says.

Regards,

joe

On Thu, Oct 27, 2005 at 09:20:49PM -0700, Brian Pane wrote:
> I just committed a fix.  The problem was that the new
> ap_core_output_filter was leaving the socket timeout set to zero.  In
> situations where the output filter runs _before_ the input filter,
> like the communication to the origin server in mod_proxy, the zero
> timeout was causing reads in the input filter to fail.

There are still crashes in free() for an --enable-pool-debug build
(prefork); backtraces like the below seem to show that r->pool is
getting destroyed way too early by the looks of it.

#7  0x08070ecb in eor_bucket_destroy (data=0x89e8ff8) at eor_bucket.c:55
#8  0x0807138e in remove_empty_buckets (bb=0x89f21f8) at
core_filters.c:611
#9  0x080713c6 in setaside_remaining_output (f=0x88de828, ctx=0x8a03910,
     bb=0x89f21f8, make_a_copy=1, c=0x8a13770) at core_filters.c:491
#10 0x08071afd in ap_core_output_filter (f=0x88de828, new_bb=0x89f21f8)
     at core_filters.c:479
#11 0x0807d33f in ap_process_async_request (r=0x89e8ff8) at
http_request.c:260
#12 0x0807d41c in ap_process_request (r=0x0) at http_request.c:279
#13 0x0807afdb in ap_process_http_connection (c=0x8a13770) at
http_core.c:166
#14 0x08077ce6 in ap_run_process_connection (c=0x8a13770) at
connection.c:43

Hi,

  I already posted this as bugzilla #37287, but someone suggested I drop
this here also.

#### From bz #37287

In order to "harden" some pages on a HTTPS server, I have deployed the
"FakeBasicAuth" method from mod_ssl. This works almost OK, but has the
annoying effect that people whose CN does not match the allowed set for
a page get the login-popup in their browser. For FakeBasicAuth this
makes no sense, as:

a) this is supposed to be an automatic process
b) the user cannot legally supply valid credentials manually anyway.

I solved this by developing the attached small patch for mod_auth. If
the new keyword "AuthTolerant" is set to "off", HTTP_FORBIDDEN is sent
instead of HTTP_UNAUTHORIZED. The default is to send HTTP_UNAUTHORIZED
as usual.

Not sure whether this is a (good) solution, but I believe it is useful
for some cases.

The patch is against 2.0.55. If the proposal is welcome, I believe it
should go into the 2.1 stream.

Cheers
Martin

------------------------------------------------------
Martin Knoblauch
email: k n o b i AT knobisoft DOT de
www:   http://www.knobisoft.de

Can we get a vote on this?



Brian Akins wrote:
> Paul Querna wrote:
>
>> Brian Akins wrote:
>>
>>> It seems no matter what the setting of ServerTokens, mod_proxy uses
>>> something like this when ProxyVia is set to Full:
>>>
>>> Via: 1.1 i.cnn.net (Apache/2.1.8)
>>>
>>> Should this honor ServerTokens?
>>>
>>>
>>
>> Yes.
>>
>
>
> --- mod_proxy_http.c.orig       2005-09-26 11:43:45.893872108 -0400
> +++ mod_proxy_http.c    2005-09-26 12:06:48.390005516 -0400
> @@ -641,7 +641,7 @@
>                                          HTTP_VERSION_MAJOR(r->proto_num),
>                                          HTTP_VERSION_MINOR(r->proto_num),
>                                          server_name, server_portstr,
> -                                        AP_SERVER_BASEVERSION)
> +                                        ap_get_server_version())
>                           : apr_psprintf(p, "%d.%d %s%s",
>                                          HTTP_VERSION_MAJOR(r->proto_num),
>                                          HTTP_VERSION_MINOR(r->proto_num),
> @@ -1296,7 +1296,7 @@
>
> HTTP_VERSION_MINOR(r->proto_num),
>                                             server_name,
>                                             server_portstr,
> -                                           AP_SERVER_BASEVERSION)
> +                                           ap_get_server_version())
>                                       : apr_psprintf(p, "%d.%d %s%s",
>
> HTTP_VERSION_MAJOR(r->proto_num),
>
> HTTP_VERSION_MINOR(r->proto_num),
>
>


--
Brian Akins
Lead Systems Engineer
CNN Internet Technologies

Another one.  Can we get a vote?

Sorry to be a pest, just don't want these to be forgotten.

Brian Akins wrote:
> Here's a new patch that changes the option name to CacheVaryOverride and
> does some of the stuff Justin recommened.
>
>
>
> ------------------------------------------------------------------------
>
> diff -ru httpd-trunk.orig/modules/cache/cache_storage.c
httpd-trunk.new/modules/cache/cache_storage.c
> --- httpd-trunk.orig/modules/cache/cache_storage.c 2005-07-13
15:23:03.892378000 -0400
> +++ httpd-trunk.new/modules/cache/cache_storage.c 2005-08-18
08:13:30.098771299 -0400
> @@ -230,7 +230,7 @@
>                   * is this header in the request and the header in the cached
>                   * request identical? If not, we give up and do a straight
get
>                   */
> -                h1 = apr_table_get(r->headers_in, name);
> +                h1 = ap_cache_override_header(r, r->headers_in, name);
>                  h2 = apr_table_get(h->req_hdrs, name);
>                  if (h1 == h2) {
>                      /* both headers NULL, so a match - do nothing */
> diff -ru httpd-trunk.orig/modules/cache/cache_util.c
httpd-trunk.new/modules/cache/cache_util.c
> --- httpd-trunk.orig/modules/cache/cache_util.c 2005-07-13 15:23:03.869381000
-0400
> +++ httpd-trunk.new/modules/cache/cache_util.c 2005-08-18 08:15:05.349865494
-0400
> @@ -534,3 +534,49 @@
>      }
>      return headers_out;
>  }
> +
> +CACHE_DECLARE(const char* )ap_cache_override_header(request_rec *r,
> +                                                    apr_table_t *t,
> +                                                    const char* key) {
> +    const char *o;
> +    cache_server_conf *conf = ap_get_module_config(r->server->module_config,
> +                                                   &cache_module);
> +    const char *header = NULL;
> +
> +    if((o = apr_table_get(conf->override_headers, key)) != NULL) {
> +        if((header = apr_table_get(r->subprocess_env, o)) == NULL) {
> +            header = "-";
> +        }
> +    }
> +
> +    if(!header) {
> +        header = apr_table_get(t, key);
> +    }
> +
> +    return header;
> +}
> +
> +/* replace headers based on environment overrides
> + * modifies t in place
> + */
> +CACHE_DECLARE(apr_status_t )ap_cache_override_hdrs(request_rec *r,
> +                                                   apr_table_t *t)
> +{
> +    int i;
> +    apr_table_entry_t *elts;
> +    cache_server_conf *conf = ap_get_module_config(r->server->module_config,
> +                                                   &cache_module);
> +
> +    /* replace headers with environment overrides*/
> +    elts = (apr_table_entry_t *)
apr_table_elts(conf->override_headers)->elts;
> +
> +    for (i = 0; i < apr_table_elts(conf->override_headers)->nelts; ++i) {
> +        const char *val = NULL;
> +
> +        val = ap_cache_override_header(r, t, elts[i].key);
> +        apr_table_set(t, elts[i].key, val);
> +
> +    }
> +    return APR_SUCCESS;
> +}
> +
> diff -ru httpd-trunk.orig/modules/cache/mod_cache.c
httpd-trunk.new/modules/cache/mod_cache.c
> --- httpd-trunk.orig/modules/cache/mod_cache.c 2005-08-09 11:51:09.471251000
-0400
> +++ httpd-trunk.new/modules/cache/mod_cache.c 2005-08-18 08:14:39.755139238
-0400
> @@ -745,6 +745,7 @@
>      /* array of headers that should not be stored in cache */
>      ps->ignore_headers = apr_array_make(p, 10, sizeof(char *));
>      ps->ignore_headers_set = CACHE_IGNORE_HEADERS_UNSET;
> +    ps->override_headers = apr_table_make(p, 10);
>      return ps;
>  }
>
> @@ -790,6 +791,9 @@
>          (overrides->ignore_headers_set == CACHE_IGNORE_HEADERS_UNSET)
>          ? base->ignore_headers
>          : overrides->ignore_headers;
> +    ps->override_headers = apr_table_copy(p, base->override_headers);
> +    apr_table_overlap(ps->override_headers, overrides->override_headers, 0);
> +
>      return ps;
>  }
>  static const char *set_cache_ignore_no_last_mod(cmd_parms *parms, void
*dummy,
> @@ -873,6 +877,19 @@
>      return NULL;
>  }
>
> +static const char *add_override_header(cmd_parms *parms, void *dummy,
> +                                       const char *header, const char* env)
> +{
> +    cache_server_conf *conf;
> +    conf =
> +        (cache_server_conf
*)ap_get_module_config(parms->server->module_config,
> +                                                  &cache_module);
> +
> +    apr_table_set(conf->override_headers, header, env);
> +
> +    return NULL;
> +}
> +
>  static const char *add_cache_enable(cmd_parms *parms, void *dummy,
>                                      const char *type,
>                                      const char *url)
> @@ -1002,6 +1019,9 @@
>      AP_INIT_ITERATE("CacheIgnoreHeaders", add_ignore_header, NULL, RSRC_CONF,
>                      "A space separated list of headers that should not be "
>                      "stored by the cache"),
> +    AP_INIT_TAKE2("CacheVaryOverride", add_override_header, NULL, RSRC_CONF,
> +                    "A header that should be replaced by the value of"
> +                     " the given environment variable"),
>      AP_INIT_TAKE1("CacheLastModifiedFactor", set_cache_factor, NULL,
RSRC_CONF,
>                    "The factor used to estimate Expires date from "
>                    "LastModified date"),
> diff -ru httpd-trunk.orig/modules/cache/mod_cache.h
httpd-trunk.new/modules/cache/mod_cache.h
> --- httpd-trunk.orig/modules/cache/mod_cache.h 2005-07-13 15:23:03.882379000
-0400
> +++ httpd-trunk.new/modules/cache/mod_cache.h 2005-08-18 08:13:30.101770798
-0400
> @@ -141,6 +141,8 @@
>      int store_nostore_set;
>      /** store the headers that should not be stored in the cache */
>      apr_array_header_t *ignore_headers;
> +    /** environment header overrides **/
> +    apr_table_t *override_headers;
>      /* flag if CacheIgnoreHeader has been set */
>      #define CACHE_IGNORE_HEADERS_SET   1
>      #define CACHE_IGNORE_HEADERS_UNSET 0
> @@ -256,6 +258,11 @@
>  CACHE_DECLARE(char *) ap_cache_generate_name(apr_pool_t *p, int dirlevels,
>                                               int dirlength,
>                                               const char *name);
> +CACHE_DECLARE(const char* )ap_cache_override_header(request_rec *r,
> +                                                    apr_table_t *t,
> +                                                    const char* key);
> +CACHE_DECLARE(apr_status_t )ap_cache_override_hdrs(request_rec *r,
> +                                                   apr_table_t *t);
>  CACHE_DECLARE(cache_provider_list *)ap_cache_get_providers(request_rec *r,
cache_server_conf *conf, const char *url);
>  CACHE_DECLARE(int) ap_cache_liststr(apr_pool_t *p, const char *list,
>                                      const char *key, char **val);
> diff -ru httpd-trunk.orig/modules/cache/mod_disk_cache.c
httpd-trunk.new/modules/cache/mod_disk_cache.c
> --- httpd-trunk.orig/modules/cache/mod_disk_cache.c 2005-08-09
11:51:09.473251000 -0400
> +++ httpd-trunk.new/modules/cache/mod_disk_cache.c 2005-08-18
08:16:00.780610483 -0400
> @@ -272,7 +272,7 @@
>      return APR_SUCCESS;
>  }
>
> -static const char* regen_key(apr_pool_t *p, apr_table_t *headers,
> +static const char* regen_key(request_rec *r, apr_table_t *headers,
>                               apr_array_header_t *varray, const char *oldkey)
>  {
>      struct iovec *iov;
> @@ -280,9 +280,8 @@
>      int nvec;
>      const char *header;
>      const char **elts;
> -
>      nvec = (varray->nelts * 2) + 1;
> -    iov = apr_palloc(p, sizeof(struct iovec) * nvec);
> +    iov = apr_palloc(r->pool, sizeof(struct iovec) * nvec);
>      elts = (const char **) varray->elts;
>
>      /* TODO:
> @@ -308,9 +307,9 @@
>       *     tokens (including the 100-continue token), and is case-sensitive
for
>       *     quoted-string expectation-extensions.
>       */
> -
>      for(i=0, k=0; i < varray->nelts; i++) {
> -        header = apr_table_get(headers, elts[i]);
> +        header = ap_cache_override_header(r, headers, elts[i]);
> +
>          if (!header) {
>              header = "";
>          }
> @@ -325,7 +324,7 @@
>      iov[k].iov_len = strlen(oldkey);
>      k++;
>
> -    return apr_pstrcatv(p, iov, k, NULL);
> +    return apr_pstrcatv(r->pool, iov, k, NULL);
>  }
>
>  static int array_alphasort(const void *fn1, const void *fn2)
> @@ -445,7 +444,7 @@
>          }
>          apr_file_close(dobj->hfd);
>
> -        nkey = regen_key(r->pool, r->headers_in, varray, key);
> +        nkey = regen_key(r, r->headers_in, varray, key);
>
>          dobj->hashfile = NULL;
>          dobj->prefix = dobj->hdrsfile;
> @@ -804,7 +803,7 @@
>              }
>
>              dobj->tempfile = apr_pstrcat(r->pool, conf->cache_root,
AP_TEMPFILE, NULL);
> -            tmp = regen_key(r->pool, r->headers_in, varray, dobj->name);
> +            tmp = regen_key(r, r->headers_in, varray, dobj->name);
>              dobj->prefix = dobj->hdrsfile;
>              dobj->hashfile = NULL;
>              dobj->datafile = data_file(r->pool, conf, dobj, tmp);
> @@ -870,6 +869,8 @@
>
>          headers_in = ap_cache_cacheable_hdrs_out(r->pool, r->headers_in,
>                                                   r->server);
> +        ap_cache_override_hdrs(r, headers_in);
> +
>          rv = store_table(dobj->hfd, headers_in);
>          if (rv != APR_SUCCESS) {
>              return rv;


--
Brian Akins
Lead Systems Engineer
CNN Internet Technologies

Can we get a vote on this?  Jim gave it +1.  So do I.  I would like this
to be in a beta "release."  This fix is important to our environment.


r.pluem@... wrote:
>
> Jim Jagielski wrote:
>
>>Sorry :)
>
>
> Thanks. So I guess this should be fine:
>
> Index: mod_proxy.c
> ===================================================================
> --- mod_proxy.c (Revision 280422)
> +++ mod_proxy.c (Arbeitskopie)
> @@ -679,8 +679,22 @@
>          char *url = uri;
>          /* Try to obtain the most suitable worker */
>          access_status = ap_proxy_pre_request(&worker, &balancer, r, conf,
&url);
> -        if (access_status != OK)
> -            return access_status;
> +        if (access_status != OK) {
> +            /*
> +             * Only return if access_status is not HTTP_SERVICE_UNAVAILABLE
> +             * This gives other modules the chance to hook into the
> +             * request_status hook and decide what to do in this situation.
> +             */
> +            if (access_status != HTTP_SERVICE_UNAVAILABLE)
> +                return access_status;
> +            /*
> +             * Ensure that balancer is NULL if worker is NULL to prevent
> +             * potential problems in the post_request hook.
> +             */
> +            if (!worker)
> +                balancer = NULL;
> +            goto cleanup;
> +        }
>          if (balancer && balancer->max_attempts_set && !max_attempts)
>              max_attempts = balancer->max_attempts;
>          /* firstly, try a proxy, unless a NoProxy directive is active */
>
> [..cut..]
>


--
Brian Akins
Lead Systems Engineer
CNN Internet Technologies

Brian Akins wrote:
> Can we get a vote on this?  Jim gave it +1.  So do I.  I would like this
> to be in a beta "release."  This fix is important to our environment.


Never mind.  See this in trunk...


--
Brian Akins
Lead Systems Engineer
CNN Internet Technologies

On 10/28/2005 03:46 PM, Brian Akins wrote:
> Brian Akins wrote:
>
>> Can we get a vote on this?  Jim gave it +1.  So do I.  I would like
>> this to be in a beta "release."  This fix is important to our
>> environment.
>
>
>
> Never mind.  See this in trunk...

It is also backported to 2.2.x. So it will be part of 2.1.9

Regards

Rüdiger

On Tue, 25 Oct 2005, Ruediger Pluem wrote:

>
> As Joe mentioned in its bugzilla comment, these changes must be done to the
trunk
> first. So I would propose the following approach:
>
> 1. Provide your httpd part of the patch as a patch against trunk.
> 2. For the apr part of the patch I would suggest that you check if there is
>   a released version of apr which handles your requirements without further
patches.
>   If there is no such released version of apr I guess the next step depends:
>
>     If there is a version which should work (provides all features that you
need) but
>     actually does not work, I would regard this as a bug that should be fixed
in this
>     apr branch. So you should file an apr bug report including the fix patch.
>
>     If you find no apr version that contains the features you need, I guess
the apr
>     patches should be also done against the trunk. I guess this would also
require
>     further discussion on the apr dev list.
>

I discussed with APR developers list and :
1. I will patch my changes to APR against the main APR trunk.
2. Given that, I will patch changes to httpd against the trunk.

Hope this is fine. Let me know if otherwise,
Preethi