Mike,
On Oct 25, 2005, at 10:43 AM, Kenevel wrote:
> My question is why the server couldn't do some sort of reverse-
> lookup on its
> register of SSL certificates that are in use. Surely the server
> knows which
> certificate it is using to service the request (or else it wouldn't
> be able
>
No, it doesn't. At the moment the SSL connection handshake occurs,
the server needs to present a certificate to the client. The client
has certain expectations of the Common Name (CN) field of the
Distinguished Name (DN) string embedded in the certificate, so it is
important that the server sends the correct certificate.
At this point in the handshake, the server simply doesn't know enough
of what the client wants, unless the client connects to a distinct IP
address and the server has a virtual host configured on that IP
address. Otherwise, the decision on which virtual host to send the
request to is made way too late.
> to decrypt its contents) and hence work out which virtual host uses
> that
> certificate? This approach means of course that each name-based
> virtual host
> would have to use a different certificate - but as those sites are
> more than
> likely on different domains the certificates would necessarily be
> different.
>
There is an extension to the TLS ClientHello that allows the client
to indicate which servername it is trying to connect to: see http://
www.ietf.org/rfc/rfc3546.txt paragraph 3.1. However, I don't think
mod_ssl currently supports this. mod_gnutls may be closer, you may
want to check that out. Of course, until enough of your client base
supports this extension it is perfectly useless to you.
S.
--
sander@... http://www.temme.net/sander/
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
Thanks Graham, Joost and Sander, I hadn't expected for Apache to need to
know which virtual host to use so early in the request process.
Cheers
Mike
>From: Sander Temme <sctemme@...>
>Reply-To: dev@...
>To: dev@...
>Subject: Re: NameVirtualHosts & SSL
>Date: Tue, 25 Oct 2005 11:34:40 -0700
>
>Mike,
>
>On Oct 25, 2005, at 10:43 AM, Kenevel wrote:
>
>
>>My question is why the server couldn't do some sort of reverse- lookup on
>>its
>>register of SSL certificates that are in use. Surely the server knows
>>which
>>certificate it is using to service the request (or else it wouldn't be
>>able
>>
>
>No, it doesn't. At the moment the SSL connection handshake occurs, the
>server needs to present a certificate to the client. The client has
>certain expectations of the Common Name (CN) field of the Distinguished
>Name (DN) string embedded in the certificate, so it is important that the
>server sends the correct certificate.
>
>At this point in the handshake, the server simply doesn't know enough of
>what the client wants, unless the client connects to a distinct IP address
>and the server has a virtual host configured on that IP address.
>Otherwise, the decision on which virtual host to send the request to is
>made way too late.
>
>
>>to decrypt its contents) and hence work out which virtual host uses that
>>certificate? This approach means of course that each name-based virtual
>>host
>>would have to use a different certificate - but as those sites are more
>>than
>>likely on different domains the certificates would necessarily be
>>different.
>>
>
>There is an extension to the TLS ClientHello that allows the client to
>indicate which servername it is trying to connect to: see http://
>www.ietf.org/rfc/rfc3546.txt paragraph 3.1. However, I don't think mod_ssl
>currently supports this. mod_gnutls may be closer, you may want to check
>that out. Of course, until enough of your client base supports this
>extension it is perfectly useless to you.
>
>S.
>
>--
>sander@... http://www.temme.net/sander/
>PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
>
>
><< smime.p7s >>
Hi,
In the light of the issue reported by noodl at
http://eul0000113.eu.verio.net/~noodl/apache_issues.txt I decided to
implement multiple AuthUserFile support.
The behavior is the same as for a single AuthUserFile : the first line
matching the username is used, regardless of what's coming next.
The attached patch is against current httpd trunk (r328504), compiles
without warnings and has been tested successfully on my local Apache
build (Gcc 4.0.2, apr and apr-util from trunk, too).
** Since this is security related, and since I changed a little bit
the way check_password returns, I would be very pleased if this point
could be reviewed with particular attention. **
Regards,
- Sam
--
Maxime Petazzoni (http://www.bulix.org)
-- gone crazy, back soon. leave message.
Index: modules/aaa/mod_authn_file.c
===================================================================
--- modules/aaa/mod_authn_file.c (revision 328504)
+++ modules/aaa/mod_authn_file.c (working copy)
@@ -28,33 +28,47 @@
#include "mod_auth.h"
+struct file_prefix {
+ const char *file;
+};
+
typedef struct {
- char *pwfile;
+ apr_array_header_t *pwfiles;
} authn_file_config_rec;
static void *create_authn_file_dir_config(apr_pool_t *p, char *d)
{
authn_file_config_rec *conf = apr_palloc(p, sizeof(*conf));
- conf->pwfile = NULL; /* just to illustrate the default really */
+ conf->pwfiles = apr_array_make(p, 0, sizeof(struct file_prefix));
+
return conf;
}
static const char *set_authn_file_slot(cmd_parms *cmd, void *offset,
- const char *f, const char *t)
+ const char *f, const char *t)
{
+ authn_file_config_rec *conf;
+ struct file_prefix *item;
+
if (t && strcmp(t, "standard")) {
return apr_pstrcat(cmd->pool, "Invalid auth file type: ", t, NULL);
}
- return ap_set_file_slot(cmd, offset, f);
+ conf = (authn_file_config_rec *)offset;
+
+ /* Add the file to our AuthUserFile list */
+ item = (struct file_prefix *)apr_array_push(conf->pwfiles);
+ item->file = apr_pstrdup(cmd->pool, f);
+
+ return NULL;
}
static const command_rec authn_file_cmds[] =
{
AP_INIT_TAKE12("AuthUserFile", set_authn_file_slot,
- (void *)APR_OFFSETOF(authn_file_config_rec, pwfile),
- OR_AUTHCFG, "text file containing user IDs and passwords"),
+ (void *)APR_OFFSETOF(authn_file_config_rec, pwfiles),
+ OR_AUTHCFG, "text file containing user IDs and passwords"),
{NULL}
};
@@ -68,44 +82,63 @@
ap_configfile_t *f;
char l[MAX_STRING_LEN];
apr_status_t status;
+ struct file_prefix *files;
char *file_password = NULL;
+ int i;
- status = ap_pcfg_openfile(&f, r->pool, conf->pwfile);
+ files = (struct file_prefix *)conf->pwfiles->elts;
- if (status != APR_SUCCESS) {
- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
- "Could not open password file: %s", conf->pwfile);
- return AUTH_GENERAL_ERROR;
- }
+ for (i=0; i < conf->pwfiles->nelts; i++) {
+ status = ap_pcfg_openfile(&f, r->pool, files[i].file);
- while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
- const char *rpw, *w;
+ if (status != APR_SUCCESS) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+ "Could not open password file: %s", files[i].file);
+ return AUTH_GENERAL_ERROR;
+ }
- /* Skip # or blank lines. */
- if ((l[0] == '#') || (!l[0])) {
- continue;
+ while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
+ const char *rpw, *w;
+
+ /* Skip # or blank lines. */
+ if ((l[0] == '#') || (!l[0])) {
+ continue;
+ }
+
+ rpw = l;
+ w = ap_getword(r->pool, &rpw, ':');
+
+ if (!strcmp(user, w)) {
+ file_password = ap_getword(r->pool, &rpw, ':');
+ break;
+ }
}
+ ap_cfg_closefile(f);
- rpw = l;
- w = ap_getword(r->pool, &rpw, ':');
+ /* If the user was found in this file, check his
+ authentification */
+ if (file_password) {
+ status = apr_password_validate(password, file_password);
- if (!strcmp(user, w)) {
- file_password = ap_getword(r->pool, &rpw, ':');
- break;
- }
+ /* If authentication succeeded, grant the access */
+ if (status == APR_SUCCESS) {
+ return AUTH_GRANTED;
+ }
+
+ /* Otherwise, deny the access immediately since only the
+ first entry found matching username is used */
+ else {
+ return AUTH_DENIED;
+ }
+ }
+
}
- ap_cfg_closefile(f);
if (!file_password) {
return AUTH_USER_NOT_FOUND;
}
- status = apr_password_validate(password, file_password);
- if (status != APR_SUCCESS) {
- return AUTH_DENIED;
- }
-
- return AUTH_GRANTED;
+ return AUTH_DENIED;
}
static authn_status get_realm_hash(request_rec *r, const char *user,
@@ -116,35 +149,41 @@
ap_configfile_t *f;
char l[MAX_STRING_LEN];
apr_status_t status;
+ struct file_prefix *files;
char *file_hash = NULL;
+ int i;
- status = ap_pcfg_openfile(&f, r->pool, conf->pwfile);
+ files = (struct file_prefix *)conf->pwfiles->elts;
- if (status != APR_SUCCESS) {
- ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
- "Could not open password file: %s", conf->pwfile);
- return AUTH_GENERAL_ERROR;
- }
+ for (i=0; i < conf->pwfiles->nelts; i++) {
+ status = ap_pcfg_openfile(&f, r->pool, files[i].file);
- while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
- const char *rpw, *w, *x;
-
- /* Skip # or blank lines. */
- if ((l[0] == '#') || (!l[0])) {
- continue;
+ if (status != APR_SUCCESS) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
+ "Could not open password file: %s", files[i].file);
+ return AUTH_GENERAL_ERROR;
}
- rpw = l;
- w = ap_getword(r->pool, &rpw, ':');
- x = ap_getword(r->pool, &rpw, ':');
+ while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
+ const char *rpw, *w, *x;
- if (x && w && !strcmp(user, w) && !strcmp(realm, x)) {
- /* Remember that this is a md5 hash of user:realm:password. */
- file_hash = ap_getword(r->pool, &rpw, ':');
- break;
+ /* Skip # or blank lines. */
+ if ((l[0] == '#') || (!l[0])) {
+ continue;
+ }
+
+ rpw = l;
+ w = ap_getword(r->pool, &rpw, ':');
+ x = ap_getword(r->pool, &rpw, ':');
+
+ if (x && w && !strcmp(user, w) && !strcmp(realm, x)) {
+ /* Remember that this is a md5 hash of user:realm:password. */
+ file_hash = ap_getword(r->pool, &rpw, ':');
+ break;
+ }
}
+ ap_cfg_closefile(f);
}
- ap_cfg_closefile(f);
if (!file_hash) {
return AUTH_USER_NOT_FOUND;
--On October 26, 2005 1:49:15 AM +0200 Maxime Petazzoni
<maxime.petazzoni@...> wrote:
> In the light of the issue reported by noodl at
> http://eul0000113.eu.verio.net/~noodl/apache_issues.txt I decided to
> implement multiple AuthUserFile support.
I don't get it.
mod_authn_alias is the solution here. Like so:
---
<AuthnProviderAlias file foo>
AuthUserFile conf/foo-user
</AuthnProviderAlias>
<AuthnProviderAlias file foo1>
AuthUserFile conf/foo1-user
</AuthnProviderAlias>
AuthBasicProvider foo foo1
---
So, I don't think extending AuthUserFile doesn't make sense; and the
mod_authn_alias approach already works today... -- justin
* Justin Erenkrantz <justin@...> [2005-10-25 17:05:57]:
> --On October 26, 2005 1:49:15 AM +0200 Maxime Petazzoni
> <maxime.petazzoni@...> wrote:
>
> >In the light of the issue reported by noodl at
> >http://eul0000113.eu.verio.net/~noodl/apache_issues.txt I decided to
> >implement multiple AuthUserFile support.
>
> I don't get it.
>
> mod_authn_alias is the solution here. Like so:
>
> ---
> <AuthnProviderAlias file foo>
> AuthUserFile conf/foo-user
> </AuthnProviderAlias>
>
> <AuthnProviderAlias file foo1>
> AuthUserFile conf/foo1-user
> </AuthnProviderAlias>
>
> AuthBasicProvider foo foo1
> ---
>
> So, I don't think extending AuthUserFile doesn't make sense; and the
> mod_authn_alias approach already works today... -- justin
You're right. But I don't think everybody as such an extensive
knowledge of the authentication configuration. The example you gave
may look simple to you, but I believe adding multiple AuthUserFile
lines to a "classic" Basic Auth configuration schema is a lot more
intuitive :
AuthType Basic
AuthName "Developpement HTTPd server"
AuthUserFile /home/sam/.local/access.user
AuthUserFile /home/sam/.local/access.user2
Require valid-user
Just my 2 ¢,
- Sam
--
Maxime Petazzoni (http://www.bulix.org)
-- gone crazy, back soon. leave message.
On Oct 25, 2005, at 2:33 AM, Joe Orton wrote:
> httpd-test runs against the trunk are failing all over the place
> today,
> I guess caused by one of these changes...
>
> prefork is failing like:
>
> Failed Test Stat Wstat Total Fail Failed List of
> Failed
> ----------------------------------------------------------------------
> ---------
> t/modules/proxy.t 13 11 84.62% 1-9 12-13
> t/modules/proxy_balancer.t 1 1 100.00% 1
> t/modules/rewrite.t 22 5 22.73% 17-18 20-22
> t/protocol/echo.t 255 65280 8 8 100.00% 1-8
> t/security/CAN-2005-2700.t 2 1 50.00% 1
> ... plus almost all of t/ssl/* fail
Sorry about that. I didn't have proxy and ssl compiled in when I
regression-tested with httpd-test. I'll get started on a fix later this
evening.
Brian
Mike,
On Oct 25, 2005, at 10:43 AM, Kenevel wrote:
> My question is why the server couldn't do some sort of reverse-
> lookup on its
> register of SSL certificates that are in use. Surely the server
> knows which
> certificate it is using to service the request (or else it wouldn't
> be able
No, it doesn't. At the moment the SSL connection handshake occurs,
the server needs to present a certificate to the client. The client
has certain expectations of the Common Name (CN) field of the
Distinguished Name (DN) string embedded in the certificate, so it is
important that the server sends the correct certificate.
At this point in the handshake, the server simply doesn't know enough
of what the client wants, unless the client connects to a distinct IP
address and the server has a virtual host configured on that IP
address. Otherwise, the decision on which virtual host to send the
request to is made way too late.
> to decrypt its contents) and hence work out which virtual host uses
> that
> certificate? This approach means of course that each name-based
> virtual host
> would have to use a different certificate - but as those sites are
> more than
> likely on different domains the certificates would necessarily be
> different.
There is an extension to the TLS ClientHello that allows the client
to indicate which servername it is trying to connect to: see http://
www.ietf.org/rfc/rfc3546.txt paragraph 3.1. However, I don't think
mod_ssl currently supports this. mod_gnutls may be closer, you may
want to check that out. Of course, until enough of your client base
supports this extension it is perfectly useless to you.
S.
--
sander@... http://www.temme.net/sander/
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
Hello,
I've been working on this patch to make apr and httpd work with SCTP
streams.
Stream Control Transmission Protocol (SCTP - RFC2960) is a transport
layer
protocol capable of providing reliable (in-order, no loss, no duplicates,
no error) message oriented service to application.
Other interesting features of SCTP include multistreaming (many logical
pipes
in 1 SCTP association to transfer independent data like web objects
without
head of line blocking problem) and multihoming (ability to support more
than
1 interface/IP address at a SCTP endpoint).
The idea was to enable httpd to receive HTTP request on a particular SCTP
stream
and send the HTTP response on the same stream. Using different SCTP
streams
for independent objects might improve performance (preventing HOL as
mentioned
above).
To give an outline of the implementation with the files involved:
o I created apr_socket_send_sctp and apr_socket_recv_sctp which take an
extra
parameter - SCTP stream id. The recv function uses recvmsg function call
and gets the SCTP stream id on which the request came in. Similarly,
sendmsg
call is used in apr_socket_send_sctp (sendrecv.c in network_io/unix).
o I didnt want to change the signature of any other function so I decided
to
use buckets to pass the stream id info to and fro. The socket bucket read
puts the stream id (from recv) in a heap bucket and the caller takes
the responsibility of retrieving this. (apr_buckets_socket.c,
apr_brigade.c,
core_input_filter - core.c).
o core_input_filter stores the stream id in a field in the core_net_rec,
which is used by core_output_filter while sending response.
o Also, I changed Listen directive to take the transport layer protocol
as an extra argument so that web admin can choose SCTP or TCP.
Currently, I have this patch working for httpd-2.0.55/apr-0.9.6.
Would appreciate any feedback,
Preethi
I think I know what the problem with proxy is. When reading the
response
header from the origin server, it falls out of ap_rgetline_core() at
this point:
/* Something horribly wrong happened. Someone didn't block! */
if (APR_BRIGADE_EMPTY(bb)) {
return APR_EGENERAL;
}
It looks like the new core output filter is messing up the blocking mode
when it's called during the sending of the request to the origin server.
I'll continue tracking this down tomorrow.
Brian
On Oct 25, 2005, at 7:06 PM, Brian Pane wrote:
> On Oct 25, 2005, at 2:33 AM, Joe Orton wrote:
>
>
>> httpd-test runs against the trunk are failing all over the place
>> today,
>> I guess caused by one of these changes...
>>
>> prefork is failing like:
>>
>> Failed Test Stat Wstat Total Fail Failed List of
>> Failed
>> ---------------------------------------------------------------------
>> ----------
>> t/modules/proxy.t 13 11 84.62% 1-9 12-13
>> t/modules/proxy_balancer.t 1 1 100.00% 1
>> t/modules/rewrite.t 22 5 22.73% 17-18 20-22
>> t/protocol/echo.t 255 65280 8 8 100.00% 1-8
>> t/security/CAN-2005-2700.t 2 1 50.00% 1
>> ... plus almost all of t/ssl/* fail
>>
>
> Sorry about that. I didn't have proxy and ssl compiled in when I
> regression-tested with httpd-test. I'll get started on a fix later
> this
> evening.
>
> Brian
>
>
Brian Pane wrote:
>
> It looks like the new core output filter is messing up the blocking mode
> when it's called during the sending of the request to the origin server.
> I'll continue tracking this down tomorrow.
Messing it up? Or failing to set it up?
proxy_util.c invokes create_connection (which has some double-close socket
issues, if you follow the hook providers and then observe that we close the
socket locally in the proxy_util.c ap_proxy_connection_create). When it
then runs the pre_connection hook, the initial blocking/timeout state is
set up correctly.
However, proxy_http (and possibly proxy_connect) fails to include the following
code fragment after invoking ap_proxy_connection_create();
bb = apr_brigade_create(cdata->pool, cdata->bucket_alloc);
rv = ap_get_brigade(cdata->input_filters, bb, AP_MODE_INIT,
APR_BLOCK_READ, 0);
apr_brigade_destroy(bb);
if (rv != APR_SUCCESS) {
ap_log_error(APLOG_MARK, APLOG_ERR, rv, cdata->base_server,
"Failed to initialize the proxy ssl data stream");
goto cleanup;
}
so if the backend proxy connection is SSL, and we attempt to write before
we read (at least, that's http:) then the handshake isn't properly invoked.
I have to study proxy_connect to determine that we do a speculative read before
we attempt to write, such that we would always handshake SSL/TLS.
Bill
William A. Rowe, Jr. wrote:
>
> However, proxy_http (and possibly proxy_connect) fails to include the
> following code fragment after invoking ap_proxy_connection_create();
>
> bb = apr_brigade_create(cdata->pool, cdata->bucket_alloc);
> rv = ap_get_brigade(cdata->input_filters, bb, AP_MODE_INIT,
> APR_BLOCK_READ, 0);
> apr_brigade_destroy(bb);
>
> if (rv != APR_SUCCESS) {
> ap_log_error(APLOG_MARK, APLOG_ERR, rv, cdata->base_server,
> "Failed to initialize the proxy ssl data stream");
> goto cleanup;
> }
Footnote; if you want to inject this snippet in the if (!connection) block
after ap_proxy_connection_create() - be sure to use 'status' in place of 'rv'.
Maxime Petazzoni wrote:
> You're right. But I don't think everybody as such an extensive
> knowledge of the authentication configuration. The example you gave
> may look simple to you, but I believe adding multiple AuthUserFile
> lines to a "classic" Basic Auth configuration schema is a lot more
> intuitive :
>
> AuthType Basic
> AuthName "Developpement HTTPd server"
> AuthUserFile /home/sam/.local/access.user
> AuthUserFile /home/sam/.local/access.user2
> Require valid-user
>
> Just my 2 ¢,
+1.
Regards,
Graham
--
APACHE 2.0 STATUS: -*-text-*-
Last modified at [$Date: 2005-10-24 15:02:33 -0400 (Mon, 24 Oct 2005) $]
The current version of this file can be found at:
* http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS
Documentation status is maintained seperately and can be found at:
* docs/STATUS in this source tree, or
* http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/docs/STATUS
Consult the following STATUS files for information on related projects:
* http://svn.apache.org/repos/asf/apr/apr/branches/0.9.x/STATUS
* http://svn.apache.org/repos/asf/apr/apr-util/branches/0.9.x/STATUS
Consult the trunk/ for all new development and documentation efforts:
* http://svn.apache.org/repos/asf/httpd/httpd/trunk/STATUS
* http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS
Release history:
2.0.56 : in development
2.0.55 : tagged October 9, 2005
2.0.54 : released April 17, 2005 as GA.
2.0.53 : released February 7, 2005 as GA.
2.0.52 : released September 28, 2004 as GA.
2.0.51 : released September 15, 2004 as GA.
2.0.50 : released June 30, 2004 as GA.
2.0.49 : released March 19, 2004 as GA.
2.0.48 : released October 29, 2003 as GA.
2.0.47 : released July 09, 2003 as GA.
2.0.46 : released May 28, 2003 as GA.
2.0.45 : released April 1, 2003 as GA.
2.0.44 : released January 20, 2003 as GA.
2.0.43 : released October 3, 2002 as GA.
2.0.42 : released September 24, 2002 as GA.
2.0.41 : rolled September 16, 2002. not released.
2.0.40 : released August 9, 2002 as GA.
2.0.39 : released June 17, 2002 as GA.
2.0.38 : rolled June 16, 2002. not released.
2.0.37 : rolled June 11, 2002. not released.
2.0.36 : released May 6, 2002 as GA.
2.0.35 : released April 5, 2002 as GA.
2.0.34 : tagged March 26, 2002.
2.0.33 : tagged March 6, 2002. not released.
2.0.32 : released Feburary 16, 2002 as beta.
2.0.31 : rolled Feburary 1, 2002. not released.
2.0.30 : tagged January 8, 2002. not rolled.
2.0.29 : tagged November 27, 2001. not rolled.
2.0.28 : released November 13, 2001 as beta.
2.0.27 : rolled November 6, 2001
2.0.26 : tagged October 16, 2001. not rolled.
2.0.25 : rolled August 29, 2001
2.0.24 : rolled August 18, 2001
2.0.23 : rolled August 9, 2001
2.0.22 : rolled July 29, 2001
2.0.21 : rolled July 20, 2001
2.0.20 : rolled July 8, 2001
2.0.19 : rolled June 27, 2001
2.0.18 : rolled May 18, 2001
2.0.17 : rolled April 17, 2001
2.0.16 : rolled April 4, 2001
2.0.15 : rolled March 21, 2001
2.0.14 : rolled March 7, 2001
2.0a9 : released December 12, 2000
2.0a8 : released November 20, 2000
2.0a7 : released October 8, 2000
2.0a6 : released August 18, 2000
2.0a5 : released August 4, 2000
2.0a4 : released June 7, 2000
2.0a3 : released April 28, 2000
2.0a2 : released March 31, 2000
2.0a1 : released March 10, 2000
Contributors looking for a mission:
* Just do an egrep on "TODO" or "XXX" in the source.
* Review the bug database at: http://issues.apache.org/bugzilla/
* Review the "PatchAvailable" bugs in the bug database:
http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED\
&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable
After testing, you can append a comment saying "Reviewed and tested".
* Open bugs in the bug database.
CURRENT RELEASE NOTES:
* Forward binary compatibility is expected of Apache 2.0.x releases, such
that no MMN major number changes will occur. Such changes can only be
made in the trunk.
* All commits to branches/2.0.x must be reflected in SVN trunk,
as well, if they apply. Logical progression is commit to trunk,
get feedback and votes on list or in STATUS, then merge into
branches/2.2.x, and finally merge into branches/2.0.x, as applicable.
RELEASE SHOWSTOPPERS:
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
*) mod_actions: Regression from 1.3: the file referred to must exist.
Solve this by introducing the "virtual" modifier to the Action
directive. PR 28553.
modules/mappers/mod_actions.c: r1.32, r1.34
jerenkrantz: Icky side-effect of the *t == '0' check.
+1: nd, jerenkrantz, wrowe, jim
-0: by rbb (inconsistent to 1.3, discussion on dev@)
nd: I'm going to reverse the default
jerenkrantz, striker: I'm confused as to the status of this backport.
*) support/check_forensic: Fix tempfile usage
svn rev 125495, 126224
jerenkrantz says: r126224 fixes brokenness with r125495 on Solaris.
+1: thommay, jerenkrantz, trawick
trawick: "which" isn't portable; I've suggested a work-around on dev@
(not standing in way of backport)
jorton said: NetBSD's which isn't sufficient either.
jerenkrantz: Since it's not in the critical path (and depends on
mod_log_forensic), I think it's still worth it to backport
it as-is. For the one or two platforms that don't like
which, they can write their own version of the script.
(jorton agrees)
*) Win32: Move call to mpm_service_install to the rewrite_args hook
from the post_config hook.
http://svn.apache.org/viewcvs?view=rev&rev=154319
+1: stoddard, striker, wrowe (as corrected in subsequent patches)
*) Add httxt2dbm for creating RewriteMap DBM Files.
http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev
+1: pquerna, jorton, trawick
*) Remove the base href tag from mod_proxy_ftp, as it breaks relative
links for clients not using an Authorization header.
modules/proxy/mod_proxy_ftp.c: r231044
+1: minfrin, jim, nd
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
[ please place SVN revisions from trunk here, so it is easy to
identify exactly what the proposed changes are! Add all new
proposals to the end of this list. ]
*) mod_headers: Support {...}s tag for SSL variable lookup.
http://www.apache.org/~jorton/mod_headers-2.0-ssl.diff
+1: jorton, trawick
nd: two comments:
(1) is the use of APR_ASCII_* ebcdic-safe? I.e. shouldn't we use the
native chars here and it will be converted later? (I'm not sure)
jorton: I have no idea, let an EBCDIC-er complain if it breaks?
trawick: seems that '\r' and '\n' are the better chars to check
for; this is not raw data read from the network (or directly
from SSL) but instead it is either protocol data that has
already been converted to the native charset or it is other
data which was created inside the server in the native charset
(2) I'd put out (null) only if val is NULL, not if it's empty.
jorton: ssl_var_lookup() returns "" in place of NULL, that was really
a deliberate choice... but maybe you're right.
*) mod_log_config: Cleanup log_header_out function to allow multiple headers
like Set-Cookie to be logged properly. PR 27787 (2.0 + 1.3)
modules/loggers/mod_log_config.c: r1.116
jerenkrantz asks: Isn't this what apr_table_merge is for?
nd replies: yep. But cookies won't be merged, because browsers don't
support it.
jerenkrantz: Couldn't we copy the table and merge the values somehow?
This just seems like a lot of code to duplicate what we
have already. *shrug* Regardless, patch looks okay...
+1: nd, jerenkrantz
*) Provide TLS/SSL upgrade functionality in mod_ssl allowing an unsecure
connection to be upgraded to a secure connection upon request by the
client. The full patch is available at http://www.apache.org/~bnicholes/
as well as a test client tlsupgrade.c. This functionality is mainly used
by IPP clients today.
modules/ssl/mod_ssl.c: r1.75, r1.97, r1.100
modules/ssl/mod_ssl.h: r1.123
modules/ssl/ssl_engine_config.c: r1.71, r1.90
modules/ssl/ssl_engine_init.c: r1.107, r1.126
modules/ssl/ssl_engine_io.c: r1.102, r1.124
modules/ssl/ssl_engine_kernel.c: r1.83, r1.105, r1.108
modules/ssl/ssl_util.c: r1.36
modules/ssl/ssl_private.h: r1.2
+1: bnicholes, wrowe
-0: jerenkrantz (should wait for 2.2)
-0: pquerna (2.2)
-0: jorton (msgid <20040305083540.GA24529@...>)
*) mod_ssl: Fix issues picking up ssl-unclean-shutdown setting
for e.g. a reverse proxy config, breaking interop with MSIE
in some cases.
http://svn.apache.org/viewcvs?view=rev&rev=161958
rediffed for 2.0.x as:
http://issues.apache.org/bugzilla/attachment.cgi?id=14804
PR: 34452
+1: jorton, trawick
*) mod_mime_magic: Handle CRLF-format^H^H^H^H^H^H^H magic files
with any trailing whitespace so that it works with the
default installation on Windows.
http://svn.apache.org/viewcvs?rev=179622&view=revhttp://svn.apache.org/viewcvs?rev=280114&view=rev
+1: trawick, wrowe
backported 280114 to 2.2.x branch already
*) mod_cache: Fix handling of 'Vary: *". PR 16125.
Trunk: r180341
2.0.x Patch: http://issues.apache.org/bugzilla/attachment.cgi?id=15297
+1: pquerna, jerenkrantz, colm
jerenkrantz notes: I do prefer the version from r190033 (own if check).
*) Reverse Proxy fixes: <Location> bug and Cookie support
Patch is at
http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=112365629308138&q=p4
and is in production with Clients.
+1: niq, nd
niq: I'm seeing *a lot* of demand for this.
jerenkrantz: Didn't a variant of this get committed to trunk?
If so, what revision? And, is there a clean patch for
2.0? (The patch in that message isn't clean.)
*) Block mod_cgid usage on Solaris 10 due to OS bugs. PR 34264.
http://svn.apache.org/viewcvs?view=rev&rev=264866
+1: jerenkrantz, colm
rpluem: Now that patches for this bug are available I would prefer
Justins patch:
http://svn.apache.org/viewcvs?rev=326018&view=rev
which checks the patchlevel of the machine.
Maybe it should spit out a BIG warning about the
patches in any case as sometimes build machine and
install machine are different.
*) mod_cgid: Fix PR 36410. Invoke the set_suexec_identity hook from
the non-cgid side of the handler, where the full per-server/dir/etc
configuration is available instead of using two mod_suexec and
mod_userdir specific hacks. See mod_vhost_ldap for an example
third-party get_suexec_identity implementation.
http://people.apache.org/~colm/2.0.x-suexec-cgid.patch
+1: colm
*) Add ReceiveBufferSize directive to control the TCP receive buffer.
code: http://svn.apache.org/viewcvs?view=rev&rev=157583http://svn.apache.org/viewcvs?rev=280401&view=rev
docs: http://svn.apache.org/viewcvs?rev=280384&view=rev
+1: stas, trawick
-0: colm
colm: It's a useful feature, but TCP window size selection
algorithims can be pretty "interesting", probably more
2.2.
trawick: It is nevertheless true that POST performance can
sometimes improve dramatically by tweaking the receive
buffer size, and this relatively simple patch lets that
be controlled in a portable manner just for the web
server. (old way: use system-specific configuration
knobs that affect all applications.)
*) Fix all non-http protocol modules that were modeled after the
broken mod_echo.c example; remove the -initial- timeout setting
from NET_TIME (never inserted by non-request based protocols)
and move it to the core pre_connection logic, so every core
connection can read with timeout on Linux, Solaris, instead of
read (untimed) blocking on Linux, and failing read non-block on
Solaris. Leaves NET_TIME intact until after the 2.0.x branch.
http://people.apache.org/~wrowe/httpd-2.0-proto-timeout.patch
+1: wrowe
*) Add missing va_end call
http://svn.apache.org/viewcvs?rev=321500&view=rev
+1: nd, trawick, colm
*) mod_proxy: Fix PR37145
(data loss with httpd-2.0.55 reverse proxy method=post).
Trunk version of patch:
http://svn.apache.org/viewcvs.cgi?rev=327590&view=rev
Backport version for 2.0.x of patch:
http://issues.apache.org/bugzilla/attachment.cgi?id=16744
+1: rpluem, trawick
PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON:
*) Replace some of the mutex locking in the worker MPM with
atomic operations for higher concurrency.
server/mpm/worker/fdqueue.c 1.24, 1.25
+1: brianp, ianh, jjclar
trawick: Doesn't this make Apache 2.0.next slower except
when the right atomic operations are available/
implemented? (Due to under-the-covers mutex
operations when the dummy atomics are used?)
pquerna: Has anyone tested the performance differences
for different platforms? At this point I would
favour waiting for 2.2.
-0: stoddard (at least until the performance implications are clarified)
*) Allow mod_dav to do weak entity comparison functions.
modules/dav/main/util.c: r1.45
[ This one is under review. Don't merge. ]
+1:
*) mod_negotiation: parse quality values independent from
the current locale and level values as integers. PR 17564.
(essentially: get a rid of atof()) (2.0 + 1.3)
modules/mappers/mod_negotiation.c: r1.114
+1: nd
We need to decide what happens with unparsable qvalues. RFC 2616
states that q defaults to 1. (see 14.1 - 14.4). So should wrong
qvalues be returned as 1.0 or 0.0 (as atof() did)?
1.0: nd
0.0: jim (a default != an "errored" value)
*) Keep the same SSLMutex for the lifetime of the parent process
(instead of having children using different mutexes and failing
to lock the session cache across restarts.)
New patch forthcoming - JimJag's changes make the merge ugly.
+1: wrowe
+1 (concept): jim (final vote when the patch is available)
*) Fix the SSLMutex config parser so that all 'mechanisms' can take
a filename, even if ignored, and they are rooted to the full path
to the server (except for posixsem locks). This allows a very
cross-platform default:logs/ssl_mutex to be used everywhere. Also
eliminates the '.pid' suffix so that the name given is the name.
Allows Win32 and other non-unicies to use named locks.
New patch forthcoming - JimJag's changes make the merge ugly.
+1: wrowe
+1 (concept): jim (final vote when the patch is available)
*) mod_ssl: Drop SSL_EXPERIMENTAL_ENGINE test in favor of testing for the
ENGINE_init() function in config.m4, and use HAVE_ENGINE_INIT instead.
wrowe notes that this feature is a noop until configured with SSLEngine.
http://www.apache.org/~wrowe/have_engine_init.patch for a clean 2.0
patch.
modules/ssl/README 1.40
modules/ssl/config.m4 1.14
modules/ssl/mod_ssl.c 1.79
modules/ssl/mod_ssl.h 1.135
modules/ssl/ssl_engine_config.c 1.78
modules/ssl/ssl_engine_init.c 1.113
modules/ssl/ssl_toolkit_compat.c 1.33
+0: wrowe {Pending research into how to get AC to use -lsockets et. al.,
shows breakage on Solaris which can't -lcrypto -lssl without
the extra pkgconfig/openssl.pc Libs: * foo }
*) mod_ssl: fix a link failure when the openssl-engine libraries are
present but the engine headers are missing.
modules/ssl/mod_ssl.c: r1.87
modules/ssl/mod_ssl.h: r1.139
modules/ssl/ssl_engine_config.c: r1.82
PREREQ: Blow away of SSL_EXPERIMENTAL_ENGINE (see above)
+1: jwoolley, trawick, jim, jerenkrantz
*) When UseCanonicalName is set to OFF, allow ap_get_server_port to
check r->connection->local_addr->port before defaulting to
server->port or ap_default_port()
server/core.c r1.247
+1: bnicholes, jim, wrowe
0: nd, jerenkrantz
nd: can the local_addr->port ever be 0?
bnicholes response: I couldn't tell you for sure if local_addr->port
could be 0. But it makes sense that if it were then Apache
wouldn't be listening on any port so it wouldn't matter anyway.
nd replies: But if it can't be 0 the alternatives thereafter make no
sense anymore, right?
jim proposes: UseCanonicalName Client directive
which implements this, keeping UseCanonicalName Off
"as is".
*) ThreadStackSize for Win32 and threaded MPMs
trawick will eventually put together a patch for httpd 2.0.next
+1 concept: trawick, nd, stoddard, wrowe
*) don't propagate input headers describing a body to a GET subrequest
with no body
http://svn.apache.org/viewcvs?view=rev&rev=158798http://svn.apache.org/viewcvs?view=rev&rev=159410http://svn.apache.org/viewcvs?view=rev&rev=160573
+1: gregames, wrowe (provided this is applied to ALL subreq types!)
-1: jerenkrantz (read_length isn't a sufficient check to see if a body
is present in the request; presence of T-E and C-L in
the headers is the correct flag.)
gregames: addressed jerenkrantz' objection in rev 160573
wrowe: this has a negative impact on modules who wish to 'inspect'
the headers, e.g. an xml transformation affected by the query
string or request POST args. The right solution is adopt apreq,
providing an API for filters to participate in POST bodies.
gregames: this does not affect POSTs. the affected function helps
create a GET subrequest with no body and is unprepared to deal with
subrequest bodies. any modules or applications wishing to
inspect headers will in fact work better because the headers will
reflect reality.
wrowe: I've reconsidered - the simple fact is that subrequests
don't have a good mechanism to 'share' the input body with the
main request, and it's gotta be up to the main request to handle
the input body. If the module wants to use apreq-provided data,
then it's going to have to ask apreq for the data instead of
looking at the headers. For that matter, why are subreq's even
propogating POST or other non-GET types? It seems that almost
any subreq should be handled as a GET in 2.0.
CURRENT VOTES:
*) httpd-std.conf and friends;
a) httpd-std.conf should be tailored by install (from src or
binbuild) even if user has existing httpd.conf
+1: trawick, slive, gregames, ianh, Ken, wrowe, jwoolley, jim, nd,
erikabele
wrowe - prefer httpd.default.conf to avoid ambiguity with cvs,
note that win32 installer creates just that file
(.default.conf rather than .conf.default so that win32
can recognize .conf files as text configuration files.)
c) tailored httpd-std.conf should be installed to
sysconfdir/examples or manualdir/exampleconf/
+1: slive, trawick, Ken, nd (prefer the latter), erikabele
*) If the parent process dies, should the remaining child processes
"gracefully" self-terminate. Or maybe we should make it a runtime
option, or have a concept of 2 parent processes (one being a
"hot spare").
See: Message-ID: <3C58232C.FE91F19F@...>
Self-destruct: Ken, Martin
Not self-destruct: BrianP, Ian, Cliff, BillS
Make it runtime configurable: Aaron, Justin, wrowe, rederpj, jim, nd
/* The below was a concept on *how* to handle the problem */
Have 2 parents: +1: jim
-1: Justin, wrowe, rederpj, nd
+0: Martin (while standing by, could it do
something useful?)
*) Make the worker MPM the default MPM for threaded Unix boxes.
+1: Justin, Ian, Cliff, BillS, striker
+0: BrianP, Aaron (mutex contention is looking better with the
latest code, let's continue tuning and testing), rederpj, jim
-0: Lars, wrowe (let's make this defacto for the 2.2 release.),
nd (for 2.0)
RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:
* There is a bug in how we sort some hooks, at least the pre-config
hook. The first time we call the hooks, they are in the correct
order, but the second time, we don't sort them correctly. Currently,
the modules/http/config.m4 file has been renamed to
modules/http/config2.m4 to work around this problem, it should moved
back when this is fixed.
OtherBill offers that this is a SERIOUS problem. We do not sort
correctly by the ordering arguments passed to the register hook
functions. This was proven when I reordered the open_logs hook
to attempt to open the error logs prior to the access logs. Possibly
the entire sorting code needs to be refactored.
* pipes deadlock on all platforms with limited pipe buffers (e.g. both
Linux and Win32, as opposed to only Win32 on 1.3). The right solution
is either GStein's proposal for a "CGI Brigade", or OtherBill's proposal
for "Poll Buckets" for "Polling Filter Chains". Or perhaps both :-)
* All handlers should always send content down even if r->header_only
is set. If not, it means that the HEAD requests don't generate the
same headers as a GET which is wrong.
* HP/UX 10.20: compile breakage in APR. Looks like it should be easy
to fix, probably just some extraneous #include's that are fouling
things up.
PR: 9457
Jeff: See my reply and patch in the PR (and previous commit to
stop using "pipe" as a field name). If patch is committed, we
should be okay. I'll wait to see if the user tests the patch.
Update by Jeff 20020722: I got an account on HP 10.20. It looks
like some of the APR thread detection is screwed up. If we find
pthread.h but we can't compile the pthread test program we still
think we can use threads. For that reason, the patch I posted
to the PR won't work as-is since a failed compile of the test
program means nothing.
* exec cmd and suexec arg-passing enhancements
Status: Patches proposed
Message-ID: <20020526041748.A29148@...>
(see the "proc.patch" and "suexec-shell.patch" links in this message)
* The 2.0.36 worker MPM graceless shutdown changes work but are
a bit clunky on some platforms; eg, on Linux, the loop to
join each worker thread seems to hang, and the parent ends up
killing off the child with SIGKILL. But at least it shuts down.
* --enable-mods-shared="foo1 foo2" is busted on Darwin. Pier
posted a patch (Message-ID: <B8DBBE8D.575A%pier@...>).
* We do not properly substitute the prefix-variables in the configuration
scripts or generated-configs. (i.e. if sysconfdir is etc,
httpd-std.conf points to conf.)
* If any request gets through ap_process_request_internal() and is
scheduled to be served by the core handler, without a flag that this
r->filename was tested by dir/file_walk, we need to 500 at the very
end of the ap_process_request_internal() processing so sub_req-esters
know this request cannot be run. This provides authors of older
modules better compatibility, while still improving the security and
robustness of 2.0.
Status: still need to decide where this goes, OtherBill comments...
Message-ID: <065701c14526$495203b0$96c0b0d0@...>
[Deleted comments regarding the ap_run_handler phase, as irrelevant
as BillS points out that "common case will be caught in
default_handler already (with the r->finfo.filetype == 0 check)"
and the issue is detecting this -before- we try to run the req.]
gregames says: can this happen somehow without a broken module
being involved? If not, why waste cycles trying to defend against
potential broken modules? It seems futile.
wrowe counters: no, it shouldn't happen unless the module is broken.
But the right answer is to fail the request up-front in dir/file
walk if the path was entirely invalid; and we can't do that either
UNTIL 2.1 or we break modules that haven't hooked map_to_storage.
* With AP_MODE_EXHAUSTIVE in the core, it is finally clear to me
how the Perchild MPM should be re-written. It hasn't worked
correctly since filters were added because it wasn't possible to
get the content that had already been written and the socket at
the same time. This mode lets us do that, so the MPM can be
fixed.
* htpasswd blindly processes the file you give it, and does no
sanity checking before totally corrupting whatever file it was
you thought you had. It should check the input file and bail
if it finds non-comment lines that do not contain exactly 1
':' character.
Message-ID: <20020217150457.A31632@...>
* Can a static httpd be built reliably?
Message-ID: <20020207142751.T31582@...>
* [Ken] Test suite failures:
o worker is also failing some of the 'cgi' subtests
(see <URL:http://Source-Zone.Org/Apache/regression/>):
Justin says: "Worker should be fine and passes httpd-test here.
I think it's a perl or a httpd-test problem."
* Usage of APR_BRIGADE_NORMALIZE in core_input_filter should be
removed if possible.
Message-ID:
<Pine.LNX.4.33.0201202232430.318-100000@...>
Jeff wonders if we still care about this. It is no longer an
API issue but simply an extra trip through the brigade.
* The Add...Filter and Set...Filter directives do not allow the
administrator to order filters, beyond the order of filename (mime)
extensions. It isn't clear if Set...Filter(s) should be inserted
before or after the Add...Filter(s) which are ordered by sequence of
filename extensions. At minimum, some sort of +-[0-10] syntax seems
like a nice solution. See ROADMAP.
* Get perchild to work on platforms other than Linux. This
will require a portable mechanism to pass data and file/socket
descriptors between vhost child groups. An API was proposed
on dev@apr:
Message-ID: <20020111115006.K1529@...>
* Try to get libtool inter-library dependency code working on AIX.
Message-ID: <cm3n10lx555.fsf@...>
Justin says: If we get it working on AIX, we can enable this
on all platforms and clean up our build system
somewhat.
Jeff says: I thought I tested a patch for you sometime in
January that you were going to commit within a few
days.
* Handling of %2f in URIs. Currently both 1.3 and 2.0
completely disallow %2f in the request URI path (see
ap_unescape_url() in util.c). It's permitted and passed
through in the query string, however. Roy says the
original reason for disallowing it, from five years ago,
was to protect CGI scripts that applied PATH_INFO to
a filesystem location and which might be tricked by
..%2f..%2f(...). We *should* allow path-info of the
form 'http://foo.com/index.cgi/path/to/path%2finfo'.
Since we've revamped a lot of our processing of path
segments, it would be nice to allow this, or at least
allow it conditionally with a directive.
OtherBill adds that %2f as the SECOND character of a multibyte
sequence causes the request to fail! This happens notably in
the ja-jis encoding.
OtherBill is -0.5 for even considering this until 2.2 because
it removes some protection we provided to third party modules
that would mysteriously 'evaporate', exposing potential holes
in security. Putting this change into 2.1 development now (with
strong warnings!) will give authors a chance to vet their code.
* There is increasing demand from module writers for an API
that will allow them to control the server à la apachectl.
Reasons include sole-function servers that need to die if
an external dependency (e.g., a database) fails, et cetera.
Perhaps something in the (ever more abused) scoreboard?
On the other hand, we already have a pipe that goes between parent
and child for graceful shutdown events, along with an API that
can be used to send a message down that pipe. In threaded MPMs,
it is easy enough to make that one pipe be used for graceful
and graceless events, and it is also easy to open that pipe
to both parent and child for writing. Then we just need to
figure out how to do graceless on non-threaded MPMs.
* Win32: Rotatelogs sometimes is not terminated when Apache
goes down hard. FirstBill was looking at possibly tracking the
child's-child processes in the parent process.
stoddard: Shared scoreboard might offer a good way for the parent
to keep track of 'other child' processes and whack them if the child
goes down.
Other thoughts on walking the process chain using the NT kernel
have also been proposed on APR.
* Eliminate unnecessary creation of pipes in mod_cgid
* Combine log_child and piped_log_spawn. Clean up http_log.c.
Common logging API.
* There are still a number of places in the code where we are
losing error status (i.e. throwing away the error returned by a
system call and replacing it with a generic error code)
* Mass vhosting version of suEXEC.
* All DBMs suffer from confusion in support/dbmmanage (perl script) since
the dbmmanage employs the first-matched dbm format. This is not
necessarily the library that Apache was built with. Aught to
rewrite dbmmanage upon installation to bin/ with the proper library
for predictable mod_auth_dbm administration.
Questions; htdbm exists, time to kill dbmmanage, or does it remain
useful as a perl dbm management example? If we keep it,
do we address the issue above?
March discussion summary; we are missing group support. With that
added to trunk, this script will go away. It will remain
in 2.0 based on our versioning approach.
* Integrate mod_dav.
Some additional items remaining:
- case_preserved_filename stuff
(use the new canonical name stuff?)
- find a new home for ap_text(_header)
- is it possible to remove the DAV: namespace stuff from util_xml?
* ap_core_translate() and its use by mod_mmap_static and mod_file_cache
are a bit wonky. The function should probably be exposed as a utility
function (such as ap_translate_url2fs() or ap_validate_fs_url() or
something). Another approach would be a new hook phase after
"translate" which would allow the module to munge what the
translation has decided to do.
Status: Greg +1 (volunteers)
* Explore use of a post-config hook for the code in http_main.c which
calls ap_fixup_virutal_hosts(), ap_fini_vhost_config(), and
ap_sort_hooks() [to reduce the logic in main()]
* read the config tree just once, and process N times (as necessary)
OtherBill adds that the 'good' solution of three passes against the
config tree within one read is the better solution, but breaks many
modules. Best left for 2.2?
-0.5: OtherBill
* (possibly) use UUIDs in mod_unique_id and/or mod_usertrack
* (possibly) port the bug fix for PR 6942 (segv when LoadModule is put
into a VirtualHost container) to 2.0.
* shift stuff to mod_core.h
* callers of ap_run_create_request() should check the return value
for failure (Doug volunteers)
* Win32: Get Apache working on Windows 95/98. The following work
(at least) needs to be done:
- Document warning that OSR2 is required (for Crypt functions, in
rand.c, at least.) This could be resolved with an SSL library, or
randomization in APR itself.
- Bring the Win9xConHook.dll from 1.3 into 2.0 (no sense till it
actually works) and add in a splash of Win9x service code.
* Fix the worker MPM to use POD to kill child processes instead
of ap_os_killpg, regardless of how they should die.
* Scoreboard structures could be changed in the future such that
proper alignment is not maintained, leading to segfaults on
some systems. Cliff posted a patch to deal with this issue but
later recanted. See this message to dev@...:
Message-ID: <Pine.LNX.4.44.0203011354090.16457-200000@deepthought
.cs.virginia.edu>
* ap_discard_request should be converted to use the bucket API
directly rather than waste cycles copying buffers with the old API.
* SIGSEGV on Linux (glibc 2.1.2) isn't caught properly by a
sigwaiting thread. We need to work around this, perhaps unless
there is hope soon for a fixed glibc.
EXPERIMENTAL MODULES:
mod_auth_ldap/util_ldap:
* General stabilization and testing
* Fix the shared memory cache
APACHE 2.1 STATUS: -*-text-*-
Last modified at [$Date: 2005-10-16 14:05:27 -0400 (Sun, 16 Oct 2005) $]
The current version of this file can be found at:
* http://svn.apache.org/repos/asf/httpd/httpd/trunk/STATUS
Documentation status is maintained seperately and can be found at:
* docs/STATUS in this source tree, or
* http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS
Consult the following STATUS files for information on related projects:
* http://svn.apache.org/repos/asf/apr/apr/trunk/STATUS
* http://svn.apache.org/repos/asf/apr/apr-util/trunk/STATUS
Patches considered for backport are noted in their branches' STATUS:
* http://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x/STATUS
* http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS
Release history:
[NOTE that only Alpha/Beta releases occur in 2.1 development]
2.1.9 : in development
2.1.8 : Released on 1/10/2005 as beta.
2.1.7 : Released on 12/09/2005 as beta.
2.1.6 : Released on 6/27/2005 as alpha.
2.1.5 : Tagged on 6/17/2005.
2.1.4 : not released.
2.1.3 : Released on 2/22/2005 as alpha.
2.1.2 : Released on 12/08/2004 as alpha.
2.1.1 : Released on 11/19/2004 as alpha.
2.1.0 : not released.
Contributors looking for a mission:
* Just do an egrep on "TODO" or "XXX" in the source.
* Review the bug database at: http://issues.apache.org/bugzilla/
* Review the "PatchAvailable" bugs in the bug database:
http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED\
&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable
After testing, you can append a comment saying "Reviewed and tested".
* Open bugs in the bug database.
CURRENT RELEASE NOTES:
RELEASE SHOWSTOPPERS:
* Handling of non-trailing / config by non-default handler is broken
http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105451701628081&w=2
jerenkrantz asks: Why should this block a release?
wsanchez agrees: this may be a change in behavior, but isn't
clearly wrong, and even if so, it doesn't seem like a
showstopper.
* the edge connection filter cannot be removed
http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105366252619530&w=2
jerenkrantz asks: Why should this block a release?
stas replies: because it requires a rewrite of the filters stack
implementation (you have suggested that) and once 2.2 is
released you can't do that anymore.
CURRENT VOTES:
* httpd-std.conf and friends
a) httpd-std.conf should be tailored by install (from src or
binbuild) even if user has existing httpd.conf
+1: trawick, slive, gregames, ianh, Ken, wrowe, jwoolley, jim, nd,
erikabele
wrowe - prefer httpd.default.conf to avoid ambiguity with cvs
b) tailored httpd-std.conf should be copied by install to
sysconfdir/examples
-0: striker
c) tailored httpd-std.conf should be installed to
sysconfdir/examples or manualdir/exampleconf/
+1: slive, trawick, Ken, nd (prefer the latter), erikabele
+1: wsanchez (propose sysconfdir/examples/<version> for diffiness)
d) Installing a set of default config files when upgrading a server
doesn't make ANY sense at all.
+1: ianh - medium/big sites don't use 'standard config' anyway, as it
usually needs major customizations
-1: Ken, wrowe, jwoolley, jim, nd, erikabele
wrowe - diff is wonderful when comparing old/new default configs,
even for customized sites that ianh mentions
jim - ... assuming that the default configs have been updated
with the required inline docs to explain the
changes
* If the parent process dies, should the remaining child processes
"gracefully" self-terminate. Or maybe we should make it a runtime
option, or have a concept of 2 parent processes (one being a
"hot spare").
See: Message-ID: <3C58232C.FE91F19F@...>
Self-destruct: Ken, Martin, Lars
Not self-destruct: BrianP, Ian, Cliff, BillS
Make it runtime configurable: Aaron, jim, Justin, wrowe, rederpj, nd
/* The below was a concept on *how* to handle the problem */
Have 2 parents: +1: jim
-1: Justin, wrowe, rederpj, nd
+0: Lars, Martin (while standing by, could it do
something useful?)
* Make the worker MPM the default MPM for threaded Unix boxes.
+1: Justin, Ian, Cliff, BillS, striker, wrowe, nd
+0: BrianP, Aaron (mutex contention is looking better with the
latest code, let's continue tuning and testing), rederpj, jim
-0: Lars
pquerna: Do we want to change this for 2.2?
RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:
* Patches submitted to the bug database:
http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED\
&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable
* Filter stacks and subrequests, redirects and fast redirects.
There's at least one PR that suffers from the current unclean behaviour
(which lets the server send garbage): PR 17629
nd says: Every subrequest should get its own filter stack with the
subreq_core filter as bottom-most. That filter does two things:
- swallow EOS buckets
- redirect the data stream to the upper request's (rr->main)
filter chain directly after the subrequest's starting
point.
Once we have a clean solution, we can try to optimize
it, so that the server won't be slow down too much.
* RFC 2616 violations.
Closed PRs: 15857.
Open PRs: 15852, 15859, 15861, 15864, 15865, 15866, 15868, 15869,
15870, 16120, 16125, 16126, 16133, 16135, 16136, 16137,
16138, 16139, 16140, 16142, 16518, 16520, 16521,
jerenkrantz says: need to decide how many we need to backport and/or
if these rise to showstopper status.
wrowe suggests: it would be nice to see "MUST" v.s. "SHOULD" v.s. "MAY"
out of this list, without reviewing them individually.
* There is a bug in how we sort some hooks, at least the pre-config
hook. The first time we call the hooks, they are in the correct
order, but the second time, we don't sort them correctly. Currently,
the modules/http/config.m4 file has been renamed to
modules/http/config2.m4 to work around this problem, it should moved
back when this is fixed.
OtherBill offers that this is a SERIOUS problem. We do not sort
correctly by the ordering arguments passed to the register hook
functions. This was proven when I reordered the open_logs hook
to attempt to open the error logs prior to the access logs. Possibly
the entire sorting code needs to be refactored.
* pipes deadlock on all platforms with limited pipe buffers (e.g. both
Linux and Win32, as opposed to only Win32 on 1.3). The right solution
is either GStein's proposal for a "CGI Brigade", or OtherBill's proposal
for "Poll Buckets" for "Polling Filter Chains". Or maybe both :-)
* All handlers should always send content down even if r->header_only
is set. If not, it means that the HEAD requests don't generate the
same headers as a GET which is wrong.
* exec cmd and suexec arg-passing enhancements
Status: Patches proposed
Message-ID: <20020526041748.A29148@...>
(see the "proc.patch" and "suexec-shell.patch" links in this message)
* The 2.0.36 worker MPM graceless shutdown changes work but are
a bit clunky on some platforms; eg, on Linux, the loop to
join each worker thread seems to hang, and the parent ends up
killing off the child with SIGKILL. But at least it shuts down.
* --enable-mods-shared="foo1 foo2" is busted on Darwin. Pier
posted a patch (Message-ID: <B8DBBE8D.575A%pier@...>).
* We do not properly substitute the prefix-variables in the configuration
scripts or generated-configs. (i.e. if sysconfdir is etc,
httpd-std.conf points to conf.)
* If any request gets through ap_process_request_internal() and is
scheduled to be served by the core handler, without a flag that this
r->filename was tested by dir/file_walk, we need to 500 at the very
end of the ap_process_request_internal() processing so sub_req-esters
know this request cannot be run. This provides authors of older
modules better compatibility, while still improving the security and
robustness of 2.0.
Status: still need to decide where this goes, OtherBill comments...
Message-ID: <065701c14526$495203b0$96c0b0d0@...>
[Deleted comments regarding the ap_run_handler phase, as irrelevant
as BillS points out that "common case will be caught in
default_handler already (with the r->finfo.filetype == 0 check)"
and the issue is detecting this -before- we try to run the req.]
gregames says: can this happen somehow without a broken module
being involved? If not, why waste cycles trying to defend against
potential broken modules? It seems futile.
wrowe counters: no, it shouldn't happen unless the module is broken.
But the right answer is to fail the request up-front in dir/file
walk if the path was entirely invalid; and we can't do that either
UNTIL 2.1 or we break modules that haven't hooked map_to_storage.
* With AP_MODE_EXHAUSTIVE in the core, it is finally clear to me
how the Perchild MPM should be re-written. It hasn't worked
correctly since filters were added because it wasn't possible to
get the content that had already been written and the socket at
the same time. This mode lets us do that, so the MPM can be
fixed.
* Can a static httpd be built reliably?
Message-ID: <20020207142751.T31582@...>
* Usage of APR_BRIGADE_NORMALIZE in core_input_filter should be
removed if possible.
Message-ID:
<Pine.LNX.4.33.0201202232430.318-100000@...>
Jeff wonders if we still care about this. It is no longer an
API issue but simply an extra trip through the brigade.
* Get perchild to work on platforms other than Linux. This
will require a portable mechanism to pass data and file/socket
descriptors between vhost child groups. An API was proposed
on dev@apr:
Message-ID: <20020111115006.K1529@...>
* Try to get libtool inter-library dependency code working on AIX.
Message-ID: <cm3n10lx555.fsf@...>
Justin says: If we get it working on AIX, we can enable this
on all platforms and clean up our build system
somewhat.
Jeff says: I thought I tested a patch for you sometime in
January that you were going to commit within a few
days.
* Handling of %2f in URIs. Currently both 1.3 and 2.0
completely disallow %2f in the request URI path (see
ap_unescape_url() in util.c). It's permitted and passed
through in the query string, however. Roy says the
original reason for disallowing it, from five years ago,
was to protect CGI scripts that applied PATH_INFO to
a filesystem location and which might be tricked by
..%2f..%2f(...). We *should* allow path-info of the
form 'http://foo.com/index.cgi/path/to/path%2finfo'.
Since we've revamped a lot of our processing of path
segments, it would be nice to allow this, or at least
allow it conditionally with a directive.
OtherBill adds that %2f as the SECOND character of a multibyte
sequence causes the request to fail! This happens notably in
the ja-jis encoding.
* FreeBSD, threads, and worker MPM. All seems to work fine
if you only have one worker process with many threads. Add
a second worker process and the accept lock seems to be
lost. This might be an APR issue with how it deals with
the child_init hook (i.e. the fcntl lock needs to be resynced).
More examination and analysis is required.
Status: Works with FreeBSD 5.3. Does not work in previous versions.
This has also been reported on Cygwin.
* There is increasing demand from module writers for an API
that will allow them to control the server à la apachectl.
Reasons include sole-function servers that need to die if
an external dependency (e.g., a database) fails, et cetera.
Perhaps something in the (ever more abused) scoreboard?
On the other hand, we already have a pipe that goes between parent
and child for graceful shutdown events, along with an API that
can be used to send a message down that pipe. In threaded MPMs,
it is easy enough to make that one pipe be used for graceful
and graceless events, and it is also easy to open that pipe
to both parent and child for writing. Then we just need to
figure out how to do graceless on non-threaded MPMs.
* Allow the DocumentRoot directive within <Location > scopes? This
allows the beloved (crusty) Alias /foo/ /somepath/foo/ followed
by a <Directory /somepath/foo> to become simply
<Location /foo/> DocumentRoot /somefile/foo (IMHO a bit more legible
and in-your-face.) DocumentRoot unset would be accepted [and would
not permit content to be served, only virtual resources such as
server-info or server-status.
This proposed change would _not_ depricate Alias.
striker: See the thread starting with Message-ID:
JLEGKKNELMHCJPNMOKHOGEEJFBAA.striker@....
* Win32: Rotatelogs sometimes is not terminated when Apache
goes down hard. FirstBill was looking at possibly tracking the
child's-child processes in the parent process.
stoddard: Shared scoreboard might offer a good way for the parent
to keep track of 'other child' processes and whack them if the child
goes down.
Other thoughts on walking the process chain using the NT kernel
have also been proposed on APR.
* Eliminate unnecessary creation of pipes in mod_cgid
* Combine log_child and piped_log_spawn. Clean up http_log.c.
Common logging API.
* Platforms that do not support fork (primarily Win32 and AS/400)
Architect start-up code that avoids initializing all the modules
in the parent process on platforms that do not support fork.
* There are still a number of places in the code where we are
losing error status (i.e. throwing away the error returned by a
system call and replacing it with a generic error code)
* Mass vhosting version of suEXEC.
* All DBMs suffer from confusion in support/dbmmanage (perl script) since
the dbmmanage employs the first-matched dbm format. This is not
necessarily the library that Apache was built with. Aught to
rewrite dbmmanage upon installation to bin/ with the proper library
for predictable mod_auth_dbm administration.
Questions; htdbm exists, time to kill dbmmanage, or does it remain
useful as a perl dbm management example? If we keep it,
do we address the issue above?
* Integrate mod_dav.
Some additional items remaining:
- case_preserved_filename stuff
(use the new canonical name stuff?)
- find a new home for ap_text(_header)
- is it possible to remove the DAV: namespace stuff from util_xml?
* ap_core_translate() and its use by mod_mmap_static and mod_file_cache
are a bit wonky. The function should probably be exposed as a utility
function (such as ap_translate_url2fs() or ap_validate_fs_url() or
something). Another approach would be a new hook phase after
"translate" which would allow the module to munge what the
translation has decided to do.
Status: Greg +1 (volunteers)
* Explore use of a post-config hook for the code in http_main.c which
calls ap_fixup_virutal_hosts(), ap_fini_vhost_config(), and
ap_sort_hooks() [to reduce the logic in main()]
* read the config tree just once, and process N times (as necessary)
* (possibly) use UUIDs in mod_unique_id and/or mod_usertrack
* (possibly) port the bug fix for PR 6942 (segv when LoadModule is put
into a VirtualHost container) to 2.0.
* shift stuff to mod_core.h
* callers of ap_run_create_request() should check the return value
for failure (Doug volunteers)
* Win32: Get Apache working on Windows 95/98. The following work
(at least) needs to be done:
- Document warning that OSR2 is required (for Crypt functions, in
rand.c, at least.) This could be resolved with an SSL library, or
randomization in APR itself.
- Bring the Win9xConHook.dll from 1.3 into 2.0 (no sense till it
actually works) and add in a splash of Win9x service code.
* Fix the worker MPM to use POD to kill child processes instead
of ap_os_killpg, regardless of how they should die.
* Scoreboard structures could be changed in the future such that
proper alignment is not maintained, leading to segfaults on
some systems. Cliff posted a patch to deal with this issue but
later recanted. See this message to dev@...:
Message-ID: <Pine.LNX.4.44.0203011354090.16457-200000@deepthought
.cs.virginia.edu>
* APXS either needs to be fixed completely for use when apr is out of tree,
or it should drop query mode altogether, and we just grow an
httpd-config or similar arrangement.
To quote a discussion in STATUS earlier:
thommay: this doesn't fix all the problems with apxs and out of
tree apr/apr-util, but it's a good start. There's still the
query cases; but I'm beginning to think that in these cases
the app should be querying ap{r,u}-config directly
gstein: agreed. apxs should deprecate the -q flag
pquerna: I vote for a httpd-config, and to deprecate the -q flag.
minfrin: +1 for httpd-config, and to deprecate -q.
TODO ISSUES REMAINING IN MOD_SSL:
* In order to use a DSO version of mod_ssl we have to link with
-lssl and -lcrypto. A workaround is in place right now where the
entire EXTRA_LIBS macro is being appended to the objects list, but
this is a hack. We should either revamp the APACHE_CHECK_SSL_TOOLKIT
autoconf function or come up with some other autoconf checks to
search for libssl and libcrypto and properly add them to mod_ssl's
link flags.
* SSL renegotiations in combination with POST request
* Port or dispose all code inside #if 0...#endif blocks that remain
from the porting effort.
* Do we need SSL_set_read_ahead()?
* the ssl_expr api is NOT THREAD SAFE. race conditions exist:
-in ssl_expr_comp() if SSLRequire is used in .htaccess
(ssl_expr_info is global)
-is ssl_expr_eval() if there is an error
(ssl_expr_error is global)
* SSLRequire directive (parsing of) leaks memory
* Diffie-Hellman-Parameters for temporary keys are hardcoded in
ssl_engine_dh.c, while the comment in ssl_engine_kernel.c says:
"it is suggested that keys be changed daily or every 500
transactions, and more often if possible."
* ssl_var_lookup could be rewritten to be MUCH faster
* CRL callback should be pluggable
* session cache store should be pluggable
* init functions should return status code rather than ssl_die()
* ssl_engine_pphrase.c needs to be reworked so it is generic enough
to also decrypt proxy keys
* the shmcb code should just align its memory segment rather than
jumping through all the "safe" memcpy and memset hoops
WISH LIST
* mod_proxy: Ability to run SSL over proxy gateway connections,
encrypting (or reencrypting) at the proxy.
* mod_cache: Handle ESI tags.
* mod_cache: Resolve issue of how to cache page fragements (or perhaps
-if- we want to cache page fragements). Today, mod_cache/mod_mem_cache
will cache #include 'virtual' requests (but not #include 'file'
requests). This was accomplished by making CACHE_IN a
CONTENT_SET-1 filter to force it to run before the SUBREQ_CORE
filter. But now responses cannot be cached that include the
effects of having been run through CONTENT_SET filters
(mod_deflate, mod_expires, etc). We could rerun all the
CONTENT_SET filters on the cached response, but this will not
work in all cases. For example, mod_expires relies on installing
the EXPIRATION filter during fixups. Contents served out of
mod_cache (out of the quick_handler) bypass -all- the request
line server hooks (Ryan really hated this. It is great for
performance, but bad because of the complications listed above).
mod_cache/mod_mem_cache/mod_disk_cache:
* mod_mem_cache: Consider adding a RevalidateTimeout directive to
specify time at which local cached content is to be revalidated
(ie, underlying file stat'ed to see if it has changed).
* mod_cache: CacheEnable/CacheDisable should accept regular expressions.
jerenkrantz says: Too slow. Get regexs away from speedy caches by
default. Introduce a new CacheEnableRegex if you want.
* mod_mem_cache/mod_disk_cache: Need to be able to query cache
status (num of entries, cache object properties, etc.).
mod_status could be extended to query optional hooks defined
by modules for the purpose of reporting module status.
mod_cache (et. al.) could define optional hooks that are called
to collect status. Status should be queryable by
HTTP or SNMP?
jerenkrantz says: Yawn. Who cares.
* MaxRequestsPerChild measures connections, not requests.
Until someone has a better way, we'll probably just rename it
"MaxConnectionsPerChild".
* Regex containers don't work in an intutive way
Status: No one has come up with an efficient way to fix this
behavior. Dean has suggested getting rid of regex containers
completely.
OtherBill suggests: We at least seem to agree on eliminating
the <Container ~ foo> forms, and using only
<ContainerMatch foo> semantics.
* orig_ct in the byterange/multipart handling may not be
needed. Apache 1.3 just never stashed "multipart" into
r->content_type. We should probably follow suit since the
byterange stuff doesn't want the rest of the code to see the
multipart content-type; the other code should still think it is
dealing with the <orig_ct> stuff.
Status: Greg volunteers to investigate (esp. since he was most
likely the one to break it :-)
EXPERIMENTAL MODULES:
Experimental modules should eventually be be promoted to fully supported
status or removed from the repository entirely (ie, the
'experiment' failed). This section tracks what needs to happen to
get the modules promoted to fully supported status.
Justin Erenkrantz wrote:
> --On August 11, 2005 10:21:37 AM +0100 Colm MacCarthaigh
> <colm@...> wrote:
>
>> On Wed, Aug 10, 2005 at 03:38:17PM -0700, Justin Erenkrantz wrote:
>>> --On August 8, 2005 1:25:46 PM +0100 Colm MacCarthaigh <colm@...>
>>> wrote:
>>>
>>> > O.k., I've merged our two patches, but I've changed a few things, tell
>>> > me if there's anothing you think is wrong;
>>>
>>> Would you mind writing up a log message for this patch?
>>
>> No problem;
>>
>> Fix incorrectly served 304 responses when expired cache entity
>> is valid, but cache is unwritable and headers cannot be updated.
>> Submitted by colm stdlib.net
>>
>> Remove entities from the cache when re-validation receives a
>> 404 or other content-no-longer-present error.
>> Submitted by ruediger.pluem vodafone.com
>
> Thanks! I've committed this in r231486, r231487, and r231488. I
> re-split them up to make it easier for people to review the commits.
>
> However, there remains an issue in mod_disk_cache's remove_url: I don't
> think it properly handles removing the Vary condition files. I went
> ahead and committed it because it gets us closer to the desired solution.
>
> The code will remove the header file and the disk file; but it also
> likely needs to go up a 'level' and remove all variants. Because if we
> get a 404 on a varied entity, it also means that all variants should be
> removed, no?
>
> I think what this means is that we need to recompute the hash - verify
> that it either meets the 'base' URL (we're done then), or we need to
> then go through and wack all of the varied headers/bodies and such.
> Now, I *think* it's possible after Paul's latest rewrite to just wack
> some subdirectories - but I'm fuzzy on this. (Paul??)
No need to recompute the hash. Just rm -rf <hash>.vary, which is a
directory. Inside that directory is another layer of hashes, but thats
only based on the varied headers...
Anyways, best path would be to atomically rename the .vary to a tempdir,
and then recursively delete it.
-Paul
Hi!
I developed an extended version of the auth_ldap module and use it currently
in Apache 1.3. Now I want to port this to Apache 2.
I got everything ported except the follwing 2 problems:
1) It seems the functions ap_mm_malloc, ap_mm_strdup and ap_mm_free from
"ap_mm.h" aren't there anymore? How do I port them to Apache 2?
2) When I include the module in Apache 2 (2.0.52) and request a Directory
per Webbrowser that is auth_ldap-protected, I get a segfault in the
authenticate user function because this line returns NULL :
auth_ldap_config_rec *sec =
(auth_ldap_config_rec *)ap_get_module_config(r->per_dir_config,
&ep_auth_module);
This line always gives me a NULL-pointer, but it did not in the 1.3 version.
I investigated a bit and found, that the function
ap_get_module_config just does a vector lookup:
r->per_dir_config[ep_auth_module.module_index]
I echoed the array r->per_dir_config to stderr and I got the following
output:
ep_auth_module.module_index = 21
(although it is the ONY module I load in my configuration; it gets
initialized using STANDARD_20MODULE_STUFF with the value of -1)
Now the list of the pointers in r->per_dir_config :
ptr[0]=0x816e720
ptr[1]=(nil)
ptr[2]=(nil)
ptr[3]=(nil)
ptr[4]=(nil)
ptr[5]=(nil)
ptr[6]=0x809e2de
ptr[7]=(nil)
ptr[8]=(nil)
ptr[9]=(nil)
ptr[10]=(nil)
ptr[11]=(nil)
ptr[12]=(nil)
ptr[13]=(nil)
ptr[14]=(nil)
ptr[15]=(nil)
ptr[16]=(nil)
ptr[17]=(nil)
ptr[18]=(nil)
ptr[19]=(nil)
ptr[20]=(nil)
ptr[21]=(nil)
ptr[22]=(nil)
ptr[23]=(nil)
ptr[24]=(nil)
ptr[25]=(nil)
ptr[26]=(nil)
As you can see, index 21 is NULL.
I even tried to force the not-NULL indices by writing:
auth_ldap_config_rec *sec = r->per_dir_config[6];
and
auth_ldap_config_rec *sec = r->per_dir_config[0];
But this gave me a segfault at another location ...
I don't know whether I'm doing something wrong in the Module source, or in
the way I build it...
I compile it using:
CFLAGS=-c -g -march=i586 -mcpu=i686 -fmessage-length=0 -Wall -DEAPI_MM
-fPIC -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DHARD_SERVER_LIMIT=2048
-DDYNAMIC_MODULE_LIMIT=128 -DSSL_EXPERIMENTAL_PERDIRCA_IGNORE
-DSSL_EXPERIMENTAL_PROXY_IGNORE -DLINUX=22 -DMOD_SSL=208115 -DEAPI
-DWITH_SHARED_LDAP_CACHE -DWITH_OPENLDAP -fPIC -Wall -DSHARED_MODULE
LIB=-lmm -lldap -lcrypt -lpq
And Linking is done as shared object: $(LD) $(LIB) -o $@ -shared $^
Does somebody have a clue what's wrong here? If you need more info, just let
me know.
Thanks in advance!
Stefan
--
Stefan Gaffga, Systementwickler _____ _____
EP:ElectronicPartner GmbH / ___/ / _ / __
Mündelheimer Weg 40, 40472 Düsseldorf / __/ / ___/ /_/
Tel:0211/4156-223 Fax:0211/4156-308 /____/ /_/ /_/
On Thursday 27 October 2005 09:32, Gaffga, Stefan wrote:
> Hi!
>
> I developed an extended version of the auth_ldap module and use it
> currently in Apache 1.3. Now I want to port this to Apache 2.
> I got everything ported except the follwing 2 problems:
For future reference, you'd be more on-topic on the apache-modules list.
> 1) It seems the functions ap_mm_malloc, ap_mm_strdup and ap_mm_free from
> "ap_mm.h" aren't there anymore? How do I port them to Apache 2?
You use APR pools. See http://www.apachetutor.org/dev/pools
> 2) When I include the module in Apache 2 (2.0.52) and request a Directory
> per Webbrowser that is auth_ldap-protected, I get a segfault in the
> authenticate user function because this line returns NULL :
>
> auth_ldap_config_rec *sec =
> (auth_ldap_config_rec *)ap_get_module_config(r->per_dir_config,
> &ep_auth_module);
The per-dir config is whatever you set it to. If it's null then presumably it
hasn't been set in this request. See http://www.apachetutor.org/dev/config
--
Nick Kew
On Oct 25, 2005, at 2:33 AM, Joe Orton wrote:
> On Mon, Oct 24, 2005 at 03:33:17AM -0000, Brian Pane wrote:
>
>> Author: brianp
>> Date: Sun Oct 23 20:33:14 2005
>> New Revision: 327945
>>
>> URL: http://svn.apache.org/viewcvs?rev=327945&view=rev
>> Log:
>> Async write completion for Event MPM
>> (backported from async-dev branch to 2.3 trunk)
>>
>
> httpd-test runs against the trunk are failing all over the place
> today,
> I guess caused by one of these changes...
I just committed a fix. The problem was that the new
ap_core_output_filter
was leaving the socket timeout set to zero. In situations where the
output
filter runs _before_ the input filter, like the communication to the
origin
server in mod_proxy, the zero timeout was causing reads in the input
filter to fail.
Brian
I'm still working on mod_dav_userdir, so naturally I have more questions.
Its passing most of the tests in litmus, with the only exceptions being some
locking stuff that neither windows nor osx seem to care about. Now I'm testing
other stuff, namely large file uploading. I have two large files that I'm
working with, one is about 150MB and the other is just over 4GB. My test client
is OS X Tiger 10.4.2 and the server is 2.0.55 (Sempron 3000+ with 1GB of RAM).
With the 4GB file I eventually get the errors:
[Thu Oct 27 21:15:19 2005] [error] [client 192.168.0.1] Invalid Content-Length
[Thu Oct 27 21:15:19 2005] [error] [client 192.168.0.1] (34)Result too large:
Could not get next bucket brigade [500, #0]
At this point nothing has been written to the database, even though the client
has been transferring for several minutes.
I can't find any mention of the bucket brigade error in the httpd source code,
so I have no idea what to do about it. Any ideas?
I have to admit I don't really understand how to interface with the bucket
brigade stuff, I blindly followed the example in mod_dav_fs. Even though the
brigade handling appears to break large files into pieces, it looks like the
entire file is loaded before the repository handler gets it. If that's the case,
maybe the above errors are related to memory starvation?
FWIW, mod_dav_userdir, unlike catacomb, breaks the files into 64KB rows in the
database. Consequently I could easily benefit from being given the incoming bits
in chunks, but I have no idea how to accomplish that. Any suggestions?
During my travails I've noticed that the progress bars on the client machines
(osx or win2k) progress signifcantly faster than the rows are inserted into the
database. I'm not entirely sure what that means or what to do about it, but it
would be nice to keep things in sync.
BTW, if any of you feel like pounding my server for me, feel free. The test
server is at http://site46.com (that's a reverse proxy to the real test
server...let me know if it doesn't work). The real server is partially at
http://terran-bank.com. How was that for a shameless plug? :)
BTW2, if anyone cares I can make the source for mod_dav_userdir available. It's
BSD, but I haven't gotten around to posting it yet.
Thanks
> BTW2, if anyone cares I can make the source for mod_dav_userdir available.
It's BSD, but I haven't gotten around to posting it yet.
Posting Code would help us with the problems and be able to reproduce
them here too.
Brandon Fosdick wrote:
> I'm still working on mod_dav_userdir, so naturally I have more questions.
>
> Its passing most of the tests in litmus, with the only exceptions being some
locking stuff that neither windows nor osx seem to care about. Now I'm testing
other stuff, namely large file uploading. I have two large files that I'm
working with, one is about 150MB and the other is just over 4GB. My test client
is OS X Tiger 10.4.2 and the server is 2.0.55 (Sempron 3000+ with 1GB of RAM).
What OS on the server?
Can you try 2.1.8-beta? Lots of Large File Support fixes are present in
2.1.xx
-Paul
On Thu, Oct 27, 2005 at 10:18:00PM -0700, Brandon Fosdick wrote:
> I'm still working on mod_dav_userdir, so naturally I have more questions.
>
> Its passing most of the tests in litmus, with the only exceptions
> being some locking stuff that neither windows nor osx seem to care
> about. Now I'm testing other stuff, namely large file uploading. I
> have two large files that I'm working with, one is about 150MB and the
> other is just over 4GB. My test client is OS X Tiger 10.4.2 and the
> server is 2.0.55 (Sempron 3000+ with 1GB of RAM).
>
> With the 4GB file I eventually get the errors:
2.0.x doesn't support large request bodies (for some definition of
"large" depending on the platform, >2Gb for 32-bit hosts), this works
with 2.1.x as Paul says.
Regards,
joe
On Thu, Oct 27, 2005 at 09:20:49PM -0700, Brian Pane wrote:
> I just committed a fix. The problem was that the new
> ap_core_output_filter was leaving the socket timeout set to zero. In
> situations where the output filter runs _before_ the input filter,
> like the communication to the origin server in mod_proxy, the zero
> timeout was causing reads in the input filter to fail.
There are still crashes in free() for an --enable-pool-debug build
(prefork); backtraces like the below seem to show that r->pool is
getting destroyed way too early by the looks of it.
#7 0x08070ecb in eor_bucket_destroy (data=0x89e8ff8) at eor_bucket.c:55
#8 0x0807138e in remove_empty_buckets (bb=0x89f21f8) at
core_filters.c:611
#9 0x080713c6 in setaside_remaining_output (f=0x88de828, ctx=0x8a03910,
bb=0x89f21f8, make_a_copy=1, c=0x8a13770) at core_filters.c:491
#10 0x08071afd in ap_core_output_filter (f=0x88de828, new_bb=0x89f21f8)
at core_filters.c:479
#11 0x0807d33f in ap_process_async_request (r=0x89e8ff8) at
http_request.c:260
#12 0x0807d41c in ap_process_request (r=0x0) at http_request.c:279
#13 0x0807afdb in ap_process_http_connection (c=0x8a13770) at
http_core.c:166
#14 0x08077ce6 in ap_run_process_connection (c=0x8a13770) at
connection.c:43
Hi,
I already posted this as bugzilla #37287, but someone suggested I drop
this here also.
#### From bz #37287
In order to "harden" some pages on a HTTPS server, I have deployed the
"FakeBasicAuth" method from mod_ssl. This works almost OK, but has the
annoying effect that people whose CN does not match the allowed set for
a page get the login-popup in their browser. For FakeBasicAuth this
makes no sense, as:
a) this is supposed to be an automatic process
b) the user cannot legally supply valid credentials manually anyway.
I solved this by developing the attached small patch for mod_auth. If
the new keyword "AuthTolerant" is set to "off", HTTP_FORBIDDEN is sent
instead of HTTP_UNAUTHORIZED. The default is to send HTTP_UNAUTHORIZED
as usual.
Not sure whether this is a (good) solution, but I believe it is useful
for some cases.
The patch is against 2.0.55. If the proposal is welcome, I believe it
should go into the 2.1 stream.
Cheers
Martin
------------------------------------------------------
Martin Knoblauch
email: k n o b i AT knobisoft DOT de
www: http://www.knobisoft.de
Can we get a vote on this? Jim gave it +1. So do I. I would like this
to be in a beta "release." This fix is important to our environment.
r.pluem@... wrote:
>
> Jim Jagielski wrote:
>
>>Sorry :)
>
>
> Thanks. So I guess this should be fine:
>
> Index: mod_proxy.c
> ===================================================================
> --- mod_proxy.c (Revision 280422)
> +++ mod_proxy.c (Arbeitskopie)
> @@ -679,8 +679,22 @@
> char *url = uri;
> /* Try to obtain the most suitable worker */
> access_status = ap_proxy_pre_request(&worker, &balancer, r, conf,
&url);
> - if (access_status != OK)
> - return access_status;
> + if (access_status != OK) {
> + /*
> + * Only return if access_status is not HTTP_SERVICE_UNAVAILABLE
> + * This gives other modules the chance to hook into the
> + * request_status hook and decide what to do in this situation.
> + */
> + if (access_status != HTTP_SERVICE_UNAVAILABLE)
> + return access_status;
> + /*
> + * Ensure that balancer is NULL if worker is NULL to prevent
> + * potential problems in the post_request hook.
> + */
> + if (!worker)
> + balancer = NULL;
> + goto cleanup;
> + }
> if (balancer && balancer->max_attempts_set && !max_attempts)
> max_attempts = balancer->max_attempts;
> /* firstly, try a proxy, unless a NoProxy directive is active */
>
> [..cut..]
>
--
Brian Akins
Lead Systems Engineer
CNN Internet Technologies
Brian Akins wrote:
> Can we get a vote on this? Jim gave it +1. So do I. I would like this
> to be in a beta "release." This fix is important to our environment.
Never mind. See this in trunk...
--
Brian Akins
Lead Systems Engineer
CNN Internet Technologies
On 10/28/2005 03:46 PM, Brian Akins wrote:
> Brian Akins wrote:
>
>> Can we get a vote on this? Jim gave it +1. So do I. I would like
>> this to be in a beta "release." This fix is important to our
>> environment.
>
>
>
> Never mind. See this in trunk...
It is also backported to 2.2.x. So it will be part of 2.1.9
Regards
Rüdiger
On Tue, 25 Oct 2005, Ruediger Pluem wrote:
>
> As Joe mentioned in its bugzilla comment, these changes must be done to the
trunk
> first. So I would propose the following approach:
>
> 1. Provide your httpd part of the patch as a patch against trunk.
> 2. For the apr part of the patch I would suggest that you check if there is
> a released version of apr which handles your requirements without further
patches.
> If there is no such released version of apr I guess the next step depends:
>
> If there is a version which should work (provides all features that you
need) but
> actually does not work, I would regard this as a bug that should be fixed
in this
> apr branch. So you should file an apr bug report including the fix patch.
>
> If you find no apr version that contains the features you need, I guess
the apr
> patches should be also done against the trunk. I guess this would also
require
> further discussion on the apr dev list.
>
I discussed with APR developers list and :
1. I will patch my changes to APR against the main APR trunk.
2. Given that, I will patch changes to httpd against the trunk.
Hope this is fine. Let me know if otherwise,
Preethi
Send Email
