Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Rainer Jung
On 20.02.2013 08:07, William A. Rowe Jr. wrote:
 On Wed, 20 Feb 2013 16:42:56 +1000
 Noel Butler noel.but...@ausics.net wrote:
 
 On Tue, 2013-02-19 at 23:31 -0600, William A. Rowe Jr. wrote:




 Note he mentioned SHA512, not crypt().  I don't know that this makes
 a difference on that architecture.



 But isn't it just a hand off to system crypt()  (modern crypt(), not
 the ancient 8 char one), since httpd is limited in native options,
 what it doesn't understand is passes to system crypt() to handle.

Yes.

 Which remains my point... our current 2.4 and 2.2 candidates should
 suffer the same flaw.

Indeed, that's likely. Note that Noel uses SHA512, which is supported in
apr_password_validate(), but for instance not wired in htpasswd. So it
might not be the most often used password hash in combination with
httpd. Nevertheless we need to fix.

I prepared another round of patches t check, what's wrong in
apr_password_validate. All patches can be applied in srclib/apr-util.
They are *not* cumulative:

1) Undo one change in the password validation function and check whether
it works then:

http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc.patch

2) Keep original validation code but ad some debug output to STDERR:

http://people.apache.org/~rjung/patches/apr-util-password_validate-debug.patch

3) Combination of 1) and 2):

http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc-debug.patch

All patches only change one file, so if you apply on top of your build
tree, make will only compile one file and you only need to copy over the
new .libs/libaprutil-1.so to your httpd installation lib.

Regards,

Rainer


Re: mod_socache_shmcb segfaults

2013-02-20 Thread Niklas Edmundsson


Noone familiar enough with this code to have a clue/hint on what's 
going on and what's really supposed to happen?


On Sun, 10 Feb 2013, Niklas Edmundsson wrote:


On Fri, 8 Feb 2013, Joe Orton wrote:


On Sun, Feb 03, 2013 at 08:32:11PM +0100, Niklas Edmundsson wrote:

Hi all!

Something is definitely fishy with mod_socache_shmcb as shipped with
httpd 2.4.3. I'm hacking on a module that uses 16byte indexes
(IP(v6) addresses) to store 2byte counters (16bit uint), these sizes
are given as hints in the call to the init function.

After an hour or so with production load, which means
retrieve/store/remove for each connection, it consistently crashes
in mod_socache_shmcb.c


Hi Niklas, thanks for the report and the analysis.  You are passing
specifically avg_obj_size = 2, avg_id_len = 16 in the hints?


Yup, that's the intention at least. The actual hint-struct is declared as:

static struct ap_socache_hints iplimit_cache_hints = {
16, /* average length of IDs */
sizeof(apr_uint16_t), /* avg size of objects */
3 /* interval between expiry runs */
};


It looks like something goes wrong with the sizing heuristics with small
obj/id sizes.  I can't work out exactly why but it's definitely a bug.


I'm hoping for someone familiar with that code to chime in with ideas, as the 
fix for this isn't really obvious to me either...


/Nikke




/Nikke
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 Niklas Edmundsson, Admin @ {acc,hpc2n}.umu.se  | ni...@acc.umu.se
---
 Buddhism means never having to say you're sorry.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Jim Jagielski
Should we be including/moving this discussion to dev@apr ?

On Feb 20, 2013, at 3:07 AM, Rainer Jung rainer.j...@kippdata.de wrote:

 On 20.02.2013 08:07, William A. Rowe Jr. wrote:
 On Wed, 20 Feb 2013 16:42:56 +1000
 Noel Butler noel.but...@ausics.net wrote:
 
 On Tue, 2013-02-19 at 23:31 -0600, William A. Rowe Jr. wrote:
 
 
 
 
 Note he mentioned SHA512, not crypt().  I don't know that this makes
 a difference on that architecture.
 
 
 
 But isn't it just a hand off to system crypt()  (modern crypt(), not
 the ancient 8 char one), since httpd is limited in native options,
 what it doesn't understand is passes to system crypt() to handle.
 
 Yes.
 
 Which remains my point... our current 2.4 and 2.2 candidates should
 suffer the same flaw.
 
 Indeed, that's likely. Note that Noel uses SHA512, which is supported in
 apr_password_validate(), but for instance not wired in htpasswd. So it
 might not be the most often used password hash in combination with
 httpd. Nevertheless we need to fix.
 
 I prepared another round of patches t check, what's wrong in
 apr_password_validate. All patches can be applied in srclib/apr-util.
 They are *not* cumulative:
 
 1) Undo one change in the password validation function and check whether
 it works then:
 
 http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc.patch
 
 2) Keep original validation code but ad some debug output to STDERR:
 
 http://people.apache.org/~rjung/patches/apr-util-password_validate-debug.patch
 
 3) Combination of 1) and 2):
 
 http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc-debug.patch
 
 All patches only change one file, so if you apply on top of your build
 tree, make will only compile one file and you only need to copy over the
 new .libs/libaprutil-1.so to your httpd installation lib.
 
 Regards,
 
 Rainer
 



Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Rainer Jung
On 20.02.2013 13:06, Jim Jagielski wrote:
 Should we be including/moving this discussion to dev@apr ?

I guess so. Strong evidence that the problem sits in
apr_password_validate as part of apu 1.5.1.

Regards,

Rainer

 On Feb 20, 2013, at 3:07 AM, Rainer Jung rainer.j...@kippdata.de wrote:
 
 On 20.02.2013 08:07, William A. Rowe Jr. wrote:
 On Wed, 20 Feb 2013 16:42:56 +1000
 Noel Butler noel.but...@ausics.net wrote:

 On Tue, 2013-02-19 at 23:31 -0600, William A. Rowe Jr. wrote:




 Note he mentioned SHA512, not crypt().  I don't know that this makes
 a difference on that architecture.



 But isn't it just a hand off to system crypt()  (modern crypt(), not
 the ancient 8 char one), since httpd is limited in native options,
 what it doesn't understand is passes to system crypt() to handle.

 Yes.

 Which remains my point... our current 2.4 and 2.2 candidates should
 suffer the same flaw.

 Indeed, that's likely. Note that Noel uses SHA512, which is supported in
 apr_password_validate(), but for instance not wired in htpasswd. So it
 might not be the most often used password hash in combination with
 httpd. Nevertheless we need to fix.

 I prepared another round of patches t check, what's wrong in
 apr_password_validate. All patches can be applied in srclib/apr-util.
 They are *not* cumulative:

 1) Undo one change in the password validation function and check whether
 it works then:

 http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc.patch

 2) Keep original validation code but ad some debug output to STDERR:

 http://people.apache.org/~rjung/patches/apr-util-password_validate-debug.patch

 3) Combination of 1) and 2):

 http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc-debug.patch

 All patches only change one file, so if you apply on top of your build
 tree, make will only compile one file and you only need to copy over the
 new .libs/libaprutil-1.so to your httpd installation lib.

 Regards,

 Rainer

 
 

-- 
kippdata
informationstechnologie GmbH   Tel: 0228 98549 -0
Bornheimer Str. 33aFax: 0228 98549 -50
53111 Bonn www.kippdata.de

HRB 8018 Amtsgericht Bonn / USt.-IdNr. DE 196 457 417
Geschäftsführer: Dr. Thomas Höfer, Rainer Jung, Sven Maurmann


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Steffen
For thorough testing Windows 32 and 64  Release Candidates binaries are 
available, see www.apachelounge.com/viewtopic.php?p=23851


Running for a few days on AL, no issues seen.

Steffen




-Original Message- 
From: Jim Jagielski

Sent: Monday, February 18, 2013 9:34 PM Newsgroups: gmane.comp.apache.devel
To: dev@httpd.apache.org
Subject: [VOTE] Release Apache httpd 2.4.4 as GA

The pre-release test tarballs for Apache httpd 2.4.4 can be found
at the usual place:

http://httpd.apache.org/dev/dist/

I'm calling a VOTE on releasing these as Apache httpd 2.4.4 GA.
NOTE: The -deps tarballs are included here *only* to make life
easier for the tester. They will not be, and are not, part
of the official release.

[ ] +1: Good to go
[ ] +0: meh
[ ] -1: Danger Will Robinson. And why.

Vote will last the normal 72 hrs. 


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Rainer Jung
On 19.02.2013 18:26, Jim Jagielski wrote:
 Hmmm I'm not seeing crashes, ...

Concerning the crashes using prefork on Solaris 10. I have a
reproduction scenario, but I need to load lots of modules. But then the
stacks look very similar to the problem described in

http://mail-archives.apache.org/mod_mbox/httpd-dev/200912.mbox/%3c4b16c969.60...@kippdata.de%3E

I start the web server, access one static page, gracefully restart and
access the same page. I do get the response, but the process after that
crashes.

The frame

#2  0x00045b48 in eor_bucket_cleanup (data=optimized out) at
eor_bucket.c:37

calls ap_increment_counts() in the scoreboard, and it seems the
pfn_ap_logio_get_last_bytes function pointer points to invalid memory. I
get a variety of crashes, segfault, illegal instruction etc.

It look like again after the restart it uses an old function pointer but
the load order of the modules has changed, so the function pointer
points to an invalid address.

Regards,

Rainer


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Jim Jagielski
+1: OSX 10.8.2, Fedora 16 and 18 (x86_64) and CentOS 6 (x86_64)

On Feb 18, 2013, at 3:34 PM, Jim Jagielski j...@jagunet.com wrote:

 The pre-release test tarballs for Apache httpd 2.4.4 can be found
 at the usual place:
 
   http://httpd.apache.org/dev/dist/
 
 I'm calling a VOTE on releasing these as Apache httpd 2.4.4 GA.
 NOTE: The -deps tarballs are included here *only* to make life
 easier for the tester. They will not be, and are not, part
 of the official release.
 
 [ ] +1: Good to go
 [ ] +0: meh
 [ ] -1: Danger Will Robinson. And why.
 
 Vote will last the normal 72 hrs.
 



Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread William A. Rowe Jr.
On Wed, 20 Feb 2013 12:58:07 -0500
Jim Jagielski j...@jagunet.com wrote:

 +1: OSX 10.8.2, Fedora 16 and 18 (x86_64) and CentOS 6 (x86_64)

So what is your thinking on the apr-util 1.5.1 crypt mess?

Should we re-roll 2.4.4 deps and either re-roll 2.2.24 with a
corrected roll-release script to pull in 1.4.1?  Or roll on to
2.2.25?  IMHO this doesn't warrant a new version number since
there is no delta to the svn sources.

Based on reports so far, I'm -1 to moving the current 2.4.4-deps
or 2.2.24 from /dev/dist into /dist/httpd because we would be
releasing, or endorsing 1.5.1 and it doesn't seem ready.



Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Jim Jagielski
-deps for 2.4.4 are not released, so it's a non-issue for 2.4.x.
I can't recall if we bundle apr/apu with 2.2.x but if we do, then
I say simply rerolling with apu-1.4 instead of apu-1.5 is fine.


On Feb 20, 2013, at 1:10 PM, William A. Rowe Jr. wr...@rowe-clan.net wrote:

 On Wed, 20 Feb 2013 12:58:07 -0500
 Jim Jagielski j...@jagunet.com wrote:
 
 +1: OSX 10.8.2, Fedora 16 and 18 (x86_64) and CentOS 6 (x86_64)
 
 So what is your thinking on the apr-util 1.5.1 crypt mess?
 
 Should we re-roll 2.4.4 deps and either re-roll 2.2.24 with a
 corrected roll-release script to pull in 1.4.1?  Or roll on to
 2.2.25?  IMHO this doesn't warrant a new version number since
 there is no delta to the svn sources.
 
 Based on reports so far, I'm -1 to moving the current 2.4.4-deps
 or 2.2.24 from /dev/dist into /dist/httpd because we would be
 releasing, or endorsing 1.5.1 and it doesn't seem ready.
 



Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Noel Butler
On Wed, 2013-02-20 at 01:07 -0600, William A. Rowe Jr. wrote:


 
 Which remains my point... our current 2.4 and 2.2 candidates should
 suffer the same flaw.
 


Confirmed, 2.2 candidate suffers same problem




signature.asc
Description: This is a digitally signed message part


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Noel Butler
On Wed, 2013-02-20 at 15:06 -0500, Jim Jagielski wrote:

 -deps for 2.4.4 are not released, so it's a non-issue for 2.4.x.



 I can't recall if we bundle apr/apu with 2.2.x but if we do, then


I ran a test for Bill to check if it suffers same fate, yes it is
included, and yes, it does.


 I say simply rerolling with apu-1.4 instead of apu-1.5 is fine.
 
 


If that's the case Jim, and I know from previous discussions the reality
is -deps *will* soon vanish completely, you should now stop pushing
-deps onto ftp mirrors, as you can not seriously push something out for
GA that is known to be broken :)



attachment: face-smile.png

signature.asc
Description: This is a digitally signed message part


Re: [VOTE] Release Apache httpd 2.2.24 as GA

2013-02-20 Thread William A. Rowe Jr.
On Mon, 18 Feb 2013 18:02:57 -0600
William A. Rowe Jr. wr...@rowe-clan.net wrote:

 The tarball candidates for Apache httpd 2.2.24 can be found at 
 the usual place:
 
   http://httpd.apache.org/dev/dist/

Note these have been replaced 2013-02-20 21:19 on the /dev/dist
space as a package containing apr-util 1.4.1.

The contents of the svn tag *have not changed*.  This is compatible
with apr-util 1.3.x and even 1.5.x, however - Noel has determined
that there is a password api regression specific to 1.5.1 as was
initially packaged.  So continuing on...

 Please VOTE for releasing this Apache httpd 2.2.24 candidate as GA.
 
 [ ] +1 for GA: Happy Birthday, 2.2.24.
 [ ] -1: Exterminate.  (What broke?)
 
 Vote will last the normal 72 hrs.

Looking forward to feedback, thanks in advance.


apr_password_validate (was: [VOTE] Release Apache httpd 2.4.4 as GA)

2013-02-20 Thread Stefan Fritsch
[moving to dev@apr, please remove dev@httpd when replying]

On Wednesday 20 February 2013, Noel Butler wrote:
 On Wed, 2013-02-20 at 01:07 -0600, William A. Rowe Jr. wrote:
  Which remains my point... our current 2.4 and 2.2 candidates
  should suffer the same flaw.
 
 Confirmed, 2.2 candidate suffers same problem


I hope I did not miss this somewhere in the thread, but have you tried 
running the apr-util 1.5.1 test suite (i.e. make check)? It has some 
checks for apr_password_validate



Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Noel Butler
Hi Rainer,

On Wed, 2013-02-20 at 09:07 +0100, Rainer Jung wrote:


 I prepared another round of patches t check, what's wrong in
 apr_password_validate. All patches can be applied in srclib/apr-util.
 They are *not* cumulative:
 
 1) Undo one change in the password validation function and check whether
 it works then:
 
 http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc.patch
 


Still fails


 2) Keep original validation code but ad some debug output to STDERR:
 
 http://people.apache.org/~rjung/patches/apr-util-password_validate-debug.patch
 

Fails

[Thu Feb 21 07:18:27.549401 2013] [auth_basic:trace1] [pid 31295:tid
3012647792] mod_auth_basic.c(246): [client fd1d:c01d:1ce::145:58603]
Checking password for user '' using provider 'dbd', result: 3

[Thu Feb 21 07:18:27.549593 2013] [auth_basic:error] [pid 31295:tid
3012647792] [client fd1d:c01d:1ce::145:58603] AH01618: user  not
found: /

[Thu Feb 21 07:18:29.308367 2013] [authn_dbd:trace2] [pid 31295:tid
3004259184] mod_authn_dbd.c(178): [client fd1d:c01d:1ce::145:58603] Got
hashed password '$6$x' for user 'noel'

[Thu Feb 21 07:18:29.308437 2013] [authn_dbd:debug] [pid 31295:tid
3004259184] mod_authn_dbd.c(199): (70024)passwords do not match: [client
fd1d:c01d:1ce::145:58603] Call to apr_password_validate for user 'noel'
and hashed password '$6$' validate returned an error

[Thu Feb 21 07:18:29.308471 2013] [auth_basic:trace1] [pid 31295:tid
3004259184] mod_auth_basic.c(246): [client fd1d:c01d:1ce::145:58603]
Checking password for user 'noel' using provider 'dbd', result: 0

[Thu Feb 21 07:18:29.308505 2013] [auth_basic:error] [pid 31295:tid
3004259184] [client fd1d:c01d:1ce::145:58603] AH01617: user noel:
authentication failure for /: Password Mismatch




 3) Combination of 1) and 2):
 
 http://people.apache.org/~rjung/patches/apr-util-password_validate-glibc-debug.patch
 


Fails with:

[Thu Feb 21 07:27:26.761557 2013] [authn_dbd:trace2] [pid 14586:tid
3038497648] mod_authn_dbd.c(178): [client fd1d:c01d:1ce::145:58640] Got
hashed password '$6xxx' for user 'noel'
[Thu Feb 21 07:27:26.761737 2013] [authn_dbd:debug] [pid 14586:tid
3038497648] mod_authn_dbd.c(199): (70024)passwords do not match: [client
fd1d:c01d:1ce::145:58640] Call to apr_password_validate for user 'noel'
and hashed password '$6$' validate returned an error
[Thu Feb 21 07:27:26.761804 2013] [auth_basic:trace1] [pid 14586:tid
3038497648] mod_auth_basic.c(246): [client fd1d:c01d:1ce::145:58640]
Checking password for user 'noel' using provider 'dbd', result: 0
[Thu Feb 21 07:27:26.761848 2013] [auth_basic:error] [pid 14586:tid
3038497648] [client fd1d:c01d:1ce::145:58640] AH01617: user noel:
authentication failure for /: Password Mismatch



Cheers
N



signature.asc
Description: This is a digitally signed message part


Re: apr_password_validate (was: [VOTE] Release Apache httpd 2.4.4 as GA)

2013-02-20 Thread Noel Butler
On Wed, 2013-02-20 at 22:28 +0100, Stefan Fritsch wrote:

 [moving to dev@apr, please remove dev@httpd when replying]
 
 On Wednesday 20 February 2013, Noel Butler wrote:
  On Wed, 2013-02-20 at 01:07 -0600, William A. Rowe Jr. wrote:
   Which remains my point... our current 2.4 and 2.2 candidates
   should suffer the same flaw.
  
  Confirmed, 2.2 candidate suffers same problem
 
 
 I hope I did not miss this somewhere in the thread, but have you tried 
 running the apr-util 1.5.1 test suite (i.e. make check)? It has some 
 checks for apr_password_validate
 

it reports success but...

snip
crypt_r returned 'nHZA1rViSldQk'
SUCCESS
testmd4 : SUCCESS
testmd5 : SUCCESS
testcrypto  : SUCCESS
testdbd : SUCCESS
testdate: SUCCESS
testmemcache: SUCCESS
testxml : SUCCESS
testxlate   : SUCCESS
testrmm : SUCCESS
testdbm : SUCCESS
testqueue   : SUCCESS
testreslist : SUCCESS
All tests passed.

it doesn't seem to test for salted md5, let alone shaxxx

NOTE: replying here since I'm not on dev@apr  I'll fix that in a minute
though.



signature.asc
Description: This is a digitally signed message part


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Daniel Gruno
On 02/18/2013 09:34 PM, Jim Jagielski wrote:
 The pre-release test tarballs for Apache httpd 2.4.4 can be found
 at the usual place:
 
   http://httpd.apache.org/dev/dist/
 
 I'm calling a VOTE on releasing these as Apache httpd 2.4.4 GA.
 NOTE: The -deps tarballs are included here *only* to make life
 easier for the tester. They will not be, and are not, part
 of the official release.
 
 [ ] +1: Good to go
 [ ] +0: meh
 [ ] -1: Danger Will Robinson. And why.
 
 Vote will last the normal 72 hrs.
 
+1 on FreeBSD 9.0 with maintainer mode and Lua enabled.

configured fine, built fine, worked out of the box.
I have also been running 2.4.4 on modules.apache.org for some time now
(albeit a few revisions short of the hopefully official 2.4.4), and so
far no problems have arisen.

I got a few failures with the test framework, but that seems to mostly
be failures with the framework itself, notably IP expression/access
tests failed because I apparently wasn't connecting from 127.0.0.1 in
the tests.

With regards,
Daniel.


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Rainer Jung
On 20.02.2013 22:33, Noel Butler wrote:
 On Wed, 2013-02-20 at 09:07 +0100, Rainer Jung wrote:
 2) Keep original validation code but ad some debug output to STDERR:

 http://people.apache.org/~rjung/patches/apr-util-password_validate-debug.patch
  
 http://people.apache.org/%7Erjung/patches/apr-util-password_validate-debug.patch

 Fails
 
 [Thu Feb 21 07:18:27.549401 2013] [auth_basic:trace1] [pid 31295:tid
 3012647792] mod_auth_basic.c(246): [client fd1d:c01d:1ce::145:58603]
 Checking password for user '' using provider 'dbd', result: 3
 
 [Thu Feb 21 07:18:27.549593 2013] [auth_basic:error] [pid 31295:tid
 3012647792] [client fd1d:c01d:1ce::145:58603] AH01618: user  not found: /
 
 [Thu Feb 21 07:18:29.308367 2013] [authn_dbd:trace2] [pid 31295:tid
 3004259184] mod_authn_dbd.c(178): [client fd1d:c01d:1ce::145:58603] Got
 hashed password '$6$x' for user 'noel'
 
 [Thu Feb 21 07:18:29.308437 2013] [authn_dbd:debug] [pid 31295:tid
 3004259184] mod_authn_dbd.c(199): (70024)passwords do not match: [client
 fd1d:c01d:1ce::145:58603] Call to apr_password_validate for user 'noel'
 and hashed password '$6$' validate returned an error
 
 [Thu Feb 21 07:18:29.308471 2013] [auth_basic:trace1] [pid 31295:tid
 3004259184] mod_auth_basic.c(246): [client fd1d:c01d:1ce::145:58603]
 Checking password for user 'noel' using provider 'dbd', result: 0
 
 [Thu Feb 21 07:18:29.308505 2013] [auth_basic:error] [pid 31295:tid
 3004259184] [client fd1d:c01d:1ce::145:58603] AH01617: user noel:
 authentication failure for /: Password Mismatch

That's strange, the additional stderr output

crypt_r returned NULL

or

crypt_r returned '%s'

is not shown here.

As an alternative one could use strace to check the call to crypt_r and
the return value.

Rainer


Re: [VOTE] Release Apache httpd 2.4.4 as GA

2013-02-20 Thread Noel Butler
On Wed, 2013-02-20 at 23:56 +0100, Rainer Jung wrote:


 
 That's strange, the additional stderr output
 
 crypt_r returned NULL
 
 or
 
 crypt_r returned '%s'
 
 is not shown here.
 


Indeed, I'm running :
LogLevel debug auth_basic:trace8 authn_dbd:trace8

Briefly ran trace8 globally, but only briefly for obvious reasons, my
eyes were starting to bleed :)


 As an alternative one could use strace to check the call to crypt_r and


strace only shows...

29311 gettimeofday({1361405772, 894610}, NULL) = 0
29311 poll([{fd=17, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
29311 write(17, *\0\0\0\26SELECT Password FROM users WHERE User
= ?..., 46) = 46
29311 read(17, \f\0\0\1\0\1\0\0\0\1\0\1\0\0\0\0\27\0\0\2\3def\0\0\0
\1?\0\f?\0\0\0\0\0\375\200\0\0\0\0\5\0\0\3\376\0\0\2\0007\0\0\4\3def
\7members\5users\5users\10Password\10Password\f\10\0\0\1\0\0\375\201\20
\0\0\0\5\0\0\5\376\0\0\2\0..., 16384) = 120
29311 poll([{fd=17, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
29311 poll([{fd=17, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
29311 write(17, \23\0\0\0\27\1\0\0\0\0\1\0\0\0\0\1\375\0\4noel..., 23)
= 23
29311 read(17, \1\0\0\1\0017\0\0\2\3def\7members\5users\5users
\10Password\10Password\f\10\0\0\1\0\0\375\201\20\0\0\0\5\0\0\3\376\0\0\2
\0m\0\0\4\0\0j$6$\5\0\0\5\376\0\0\2\0..., 16384) = 195
29311 gettimeofday({1361405772, 895721}, NULL) = 0
29311 write(8, [Thu Feb 21 10:16:12.895721 2013] [authn_dbd:trace2]
[pid 29307:tid 3046349680] mod_authn_dbd.c(178): [client
fd1d:c01d:1ce::145:59592] Got hashed password '$6$x' for
user 'noel'\n..., 281) = 281
29311 gettimeofday({1361405772, 895975}, NULL) = 0
29311 write(8, [Thu Feb 21 10:16:12.895975 2013] [authn_dbd:debug] [pid
29307:tid 3046349680] mod_authn_dbd.c(199): (70024)passwords do not
match: [client fd1d:c01d:1ce::145:59592] Call to apr_password_validate
for user 'noel' and hashed password '$6$xxx..., 368) = 368
29311 gettimeofday({1361405772, 896212}, NULL) = 0
29311 write(8, [Thu Feb 21 10:16:12.896212 2013] [auth_basic:trace1]
[pid 29307:tid 3046349680] mod_auth_basic.c(246): [client
fd1d:c01d:1ce::145:59592] Checking password for user 'noel' using
provider 'dbd', result: 0\n..., 204) = 204
29311 gettimeofday({1361405772, 896399}, NULL) = 0
29311 write(8, [Thu Feb 21 10:16:12.896399 2013] [auth_basic:error]
[pid 29307:tid 3046349680] [client fd1d:c01d:1ce::145:59592] AH01617:
user noel: authentication failure for \/\: Password Mismatch\n...,
184) = 184
29311 gettimeofday({1361405772, 896750}, NULL) = 0
29311 read(16, 0x8537248, 8000) = -1 EAGAIN (Resource
temporarily unavailable)
29311 gettimeofday({1361405772, 896880}, NULL) = 0
29311 gettimeofday({1361405772, 896933}, NULL) = 0


BTW I am now on dev@apr, I'll leave it to you Rainer if you want this
continued on both or either lists.
Cheers
Noel
attachment: face-smile.png

signature.asc
Description: This is a digitally signed message part


Re: [VOTE] Release Apache httpd 2.2.24 as GA

2013-02-20 Thread Eric Covener
 [x] +1 for GA: Happy Birthday, 2.2.24.
 [ ] -1: Exterminate.  (What broke?)

+1 -- AIX/XLC/PPC64 passed test framework after
upgrading/re-installing HTTP::Request (t/apache/server_name_port.t
failing originally)