Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-07-07 Thread Graham Leggett
On 04 Jul 2011, at 6:48 PM, Joe Orton wrote: It's incumbent on you to provide specific technical objections if vetoing code, not this hand-waving objections must exist because of X. I have already done so. If you disagree with the objection, or do not understand the objection, engage the

Re: [vote] mod_ldap

2011-07-07 Thread Graham Leggett
On 07 Jul 2011, at 10:51 PM, Jim Jagielski wrote: On Jul 7, 2011, at 2:44 PM, Nick Kew wrote: On 7 Jul 2011, at 17:55, William A. Rowe Jr. wrote: [ ] Retain ap_ldap API's in httpd 2.3 mod_ldap, as currently in trunk (binding mod_ldap to ldap libs) +1. But get it right: not a

Re: httpd ldap mess

2011-07-06 Thread Graham Leggett
On 06 Jul 2011, at 1:18 AM, Guenter Knauf wrote: can you please tell me how it is intended to make mod_authnz_ldap.c aware of AP_HAS_LDAP ? I see you added ap_ldap.h[w|nw] which should define it, but for NetWare mod_authnz_ldap.c still bails out: CC mod_authnz_ldap.c ### mwccnlm Compiler:

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-07-06 Thread Graham Leggett
On 07 Jul 2011, at 12:44 AM, Igor Galić wrote: I have already stated the basis for the veto: every single apparent flaw in the apr_ldap code that caused wrowe to remove it from APR is still present in the code that wrowe dumped into httpd. If it's not It is, fortunately, not in httpd's core.

Re: httpdl.conf: Load mimal list of modules only

2011-07-06 Thread Graham Leggett
On 07 Jul 2011, at 1:17 AM, Igor Galić wrote: I agree with Jeff: It would be really good to have only the minimum list of modules enabled that enable us to support the config we ship A big +1. One of the biggest performance enhancing things we've done across our estate is switch almost all

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-07-04 Thread Graham Leggett
On 04 Jul 2011, at 11:11 AM, Joe Orton wrote: mod_ldap - An LDAP shared memory cache mod_authnz_ldap - A user of the LDAP shared memory cache The LDAP API exposes way more functionality than mod_ldap exposes, so while you may have fixed the problem for the special case that is mod_authnz_ldap,

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-07-03 Thread Graham Leggett
On 27 Jun 2011, at 4:04 PM, William A. Rowe Jr. wrote: And I'd nix your definition of mod_ldap... if it an ldap shared cache provider then it should have been suitably named. One can omit such a feature and still use mod_authnz_ldap. Of course, that was not possible because

Re: load order dependency between mod_proxy and mod_proxy_express

2011-07-03 Thread Graham Leggett
On 02 Jul 2011, at 9:52 PM, Jim Jagielski wrote: Currently mod_proxy needs to be loaded first because mod_proxy_express references the proxy_module symbol. What is the easiest way to fix this? Why is this considered broken?? We have always got away with this in the past because the

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-06-30 Thread Graham Leggett
On 27 Jun 2011, at 8:29 PM, Stefan Fritsch wrote: This is fixed by calling the ldap_get_option() function described in section 9.2 of http://www-archive.mozilla.org/directory/ietf-docs/draft-ietf-ldap ext-ldap-c-api-05.txt . There is no need to move the code to support this, this can be

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-06-27 Thread Graham Leggett
On 27 Jun 2011, at 12:28 PM, Joe Orton wrote: This is not so, to fix this, you would need to wrap every single LDAP API function call[1] in an optional function, and if you did that, you would solve the problem that caused you to want to remove apr_ldap from APR in the first place, making the

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-06-26 Thread Graham Leggett
On 26 Jun 2011, at 3:16 PM, Stefan Fritsch wrote: Nobody said that this would be magically fixed by moving the stuff to HTTPD. But it means that the apr libraries are no longer involved in the mess, which is already very helpful for distributions like Debian. With the apr 1.x situation, an

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-06-25 Thread Graham Leggett
On 06 Jun 2011, at 11:53 PM, William A. Rowe Jr. wrote: Since the move from apr-util-ldap to ap_ldap, mod_ldap needs to be loaded before mod_authnz_ldap. This is somewhat annoying because the default httpd.conf tries to load mod_authnz_ldap first. Any ideas how to fix this or do we just change

Re: load order dependency between mod_ldap and mod_authnz_ldap

2011-06-25 Thread Graham Leggett
On 25 Jun 2011, at 11:24 PM, Stefan Fritsch wrote: This is not so, to fix this, you would need to wrap every single LDAP API function call[1] in an optional function, and if you did that, you would solve the problem that caused you to want to remove apr_ldap from APR in the first place, making

Re: svn commit: r916377 - in /httpd/httpd/trunk: CHANGES docs/manual/programs/rotatelogs.xml support/rotatelogs.c

2011-06-20 Thread Graham Leggett
On 20 Jun 2011, at 12:58 PM, Plüm, Rüdiger, VF-Group wrote: more general -p mode just added - is it worth keeping? I think it is worth keeping for those people that only need the link. Creating a post rotation script that does this seems to be a little bit of overkill in this case. +1.

Re: 3.0, the 2011 thread.

2011-06-17 Thread Graham Leggett
On 16 Jun 2011, at 10:27 AM, Stefan Fritsch wrote: I mostly agree with Graham. I propose a hybrid approach. Make the MPM and the network/connection filters (this includes ssl) event driven and keep the request handling based on threads and workers. We used openssl to make our non blocking

Re: 3.0, the 2011 thread.

2011-06-17 Thread Graham Leggett
On 17 Jun 2011, at 6:14 PM, Paul Querna wrote: - Existing APIs in unix and windows really really suck at non blocking behaviour. Standard APR file handling couldn't do it, so we couldn't use it properly. DNS libraries are really terrible at it. The vast majority of async DNS libraries are

Re: 3.0, the 2011 thread.

2011-06-15 Thread Graham Leggett
On 16 Jun 2011, at 12:01 AM, Paul Querna wrote: I think we have all joked on and off about 3.0 for... well about 8 years now. I think we are nearing the point we might actually need to be serious about it. The web is changed. SPDY is coming down the pipe pretty quickly. WebSockets

Re: svn commit: r1133582 - in /httpd/httpd/trunk: CHANGES docs/manual/filter.xml docs/manual/mod/mod_data.xml docs/manual/mod/mod_data.xml.meta docs/manual/new_features_2_4.xml modules/filters/config.

2011-06-13 Thread Graham Leggett
On 13 Jun 2011, at 1:11 PM, Paul Querna wrote: Why is this in the core? The example in the documentation doesn't make sense, this data encoded this way is inline, not the whole response. This was covered in the original thread, which contains links explaining what rfc2397 is and what it

Re: svn commit: r1133582 - in /httpd/httpd/trunk: CHANGES docs/manual/filter.xml docs/manual/mod/mod_data.xml docs/manual/mod/mod_data.xml.meta docs/manual/new_features_2_4.xml modules/filters/config.

2011-06-09 Thread Graham Leggett
On 09 Jun 2011, at 9:16 AM, Ruediger Pluem wrote: +/* make sure we don't read more than 6000 bytes at a time */ +apr_brigade_partition(bb, (APR_BUCKET_BUFF_SIZE / 4 * 3), e); Shouldn't we move this below the the checking for the metadata bucket? Why partitioning again, when

Re: Possible unintiialized variable usage in mod_data.c

2011-06-09 Thread Graham Leggett
On 09 Jun 2011, at 4:06 PM, Chris Wilson wrote: We recently started using Sentry (static analysis tool) to analyze apache httpd on a nightly basis. Sentry found a potential unintialized variable in mod_data.c added in commit 1133582. Indeed it is - not sure why -Wall didn't catch this. Fixed

Re: An rfc2397 filter for httpd (data URI scheme)

2011-06-06 Thread Graham Leggett
On 04 Jun 2011, at 7:55 PM, Stefan Fritsch wrote: Would anyone object to adding a simple filter able to encode rfc2397 to httpd? http://tools.ietf.org/html/rfc2397 http://en.wikipedia.org/wiki/Data_URI_scheme I think this would be nice for mod_include. Did you have any other consumers in

Re: Per request DocumentRoot

2011-06-06 Thread Graham Leggett
On 06 Jun 2011, at 10:59 PM, Stefan Fritsch wrote: These should not be changed for now. The core only translates relative to the real document root. Everything else is done by modules. If we ever allow to set the DocumentRoot inside Location blocks, this may need to be re-evaluated. That

Re: mod_filter and adding to the Vary header in 2.2.x

2011-05-31 Thread Graham Leggett
On 31 May 2011, at 2:19 PM, Stefan Fritsch wrote: if I use mod_filter to configure mod_deflate like this: BrowserMatch ^Mozilla/4 no-gzip BrowserMatch \bMSIE [7-9] !no-gzip Header append Vary User-Agent env=!dont-vary FilterDeclare compress-response FilterProvider compress-response DEFLATE

An rfc2397 filter for httpd (data URI scheme)

2011-05-26 Thread Graham Leggett
Hi all, Would anyone object to adding a simple filter able to encode rfc2397 to httpd? http://tools.ietf.org/html/rfc2397 http://en.wikipedia.org/wiki/Data_URI_scheme Regards, Graham --

Re: [PR #51256] Memory consumption by parent process at sort_hook function

2011-05-24 Thread Graham Leggett
On 24 May 2011, at 2:20 PM, Yehezkel Horowitz wrote: I have noticed that sort_hook function (in apr_hooks.c) doesn't destroy temporary pool. This leads to a memory consumption of ~500K (=68 hooks * 8K) per PROCESS! Since the sorted hooks are memcpy'ed to another pool anyway, no one

Re: svn commit: r1103315 - /httpd/httpd/trunk/modules/filters/mod_deflate.c

2011-05-23 Thread Graham Leggett
On 23 May 2011, at 5:57 PM, Justin Erenkrantz wrote: mod_dav uses r-output_filters - but, the pointer never gets updated when it is the first one in the chain. Hence, we call mod_deflate all the time even on a request that can't support it - so we have to avoid repeated memory allocations in

Re: ap_regexec API for buffers (not NULL terminated strings)

2011-05-19 Thread Graham Leggett
On 19 May 2011, at 1:06 PM, Yehezkel Horowitz wrote: Can anyone explain why ap_regexec can take only NULL terminated string? I’m working in filter context and want to run regular expression on bucket content (so I have the buffer length). Currently I had to copy the bucket content and

Re: ap_regexec API for buffers (not NULL terminated strings)

2011-05-19 Thread Graham Leggett
On 19 May 2011, at 1:24 PM, Yehezkel Horowitz wrote: I have a patch (based on 2.2.17) to where should I submit it? Add it to bugzilla so it doesn't get lost, and then ping here, so someone can pick it up. Ideally, the patch should apply to httpd-trunk first, but having a v2.2 patch also

Re: mod_include and ap_expr

2011-05-15 Thread Graham Leggett
On 15 May 2011, at 12:51 PM, Stefan Fritsch wrote: The mod_include expression parser tries hard to limit what can be done. For example, the subrequest operator -A can be switched of with a config option. If it makes your life easier to remove this config option please do - it was only

Re: mod_include and ap_expr

2011-05-15 Thread Graham Leggett
On 15 May 2011, at 1:22 PM, Stefan Fritsch wrote: So you implemented it more as a safeguard against confusion with - A strings in existing expressions than as a security measure? Yes. Do you think that untrusted shmtl files are not a common use case? In that case I would tend to the people

Re: mod_include and ap_expr

2011-05-15 Thread Graham Leggett
On 15 May 2011, at 3:18 PM, Stefan Fritsch wrote: Maybe the -A option was a bad example, then, because it allows only access to resources that can be viewed directly, too. But ap_expr would allow things like !--#if expr=file('/etc/passwd') =~ /.../ This only allows to leak one bit of the

Re: add chkdigest.pl to download.xml

2011-05-15 Thread Graham Leggett
On 15 May 2011, at 10:26 PM, Guenter Knauf wrote: I'd like to add: http://people.apache.org/~fuankg/chkdigest/ as a cross-platform tool for verifying checksums to the last section on download.xml - any thoughts? The simplest way to check the checksum is to, using the operating system of

Re: [VOTE] Release httpd 2.3.12 as beta

2011-05-14 Thread Graham Leggett
On 14 May 2011, at 12:54 PM, William A. Rowe Jr. wrote: We should /not/ be halting a *beta* when one platform, one feature, or any other single documented issue has an issue. Versions and releases are cheap, release it and get on with the next beta :) The windows issue is a non-issue (cruft

Re: svn commit: r1103015 - /httpd/httpd/trunk/STATUS

2011-05-14 Thread Graham Leggett
On 15 May 2011, at 1:46 AM, William A. Rowe Jr. wrote: No argument, but there are 1) minor quibbles with the apr-2 interface, and 2) some significant work to replace the original with the new interface, and not sure who has cycles to attack this in the near term. If it is fixed, re-adding

Re: svn commit: r1098105 - /httpd/httpd/branches/2.2.x/STATUS

2011-05-07 Thread Graham Leggett
On 30 Apr 2011, at 2:22 PM, traw...@apache.org wrote: * mod_cache: Realign the cache_quick_handler() to behave identically to the default_handler() when reacting to errors when writing to the @@ -132,6 +132,8 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: Trunk patches:

Re: How to do a sub-request from input filter?

2011-04-27 Thread Graham Leggett
On 27 Apr 2011, at 7:07 PM, Micha Lenk wrote: I am using Apache as a reverse proxy to forward requests to a backend web server protected by some self-written Apache modules. Now I would like to do a sub-request to a different location from within an input filter. What is the easiest way to

Re: blocking Upgrade

2011-03-30 Thread Graham Leggett
On 30 Mar 2011, at 10:49 AM, Roy T. Fielding wrote: On Mar 29, 2011, at 11:16 PM, Greg Stein wrote: Do you have an internet draft spec for some context here? Is there a proposal for HTTP/2.0? websockets In theory, over and above natively supporting websockets, it may be useful to teach

Re: A timestamp for mod_log_forensic (?)

2011-03-30 Thread Graham Leggett
On 30 Mar 2011, at 3:23 PM, Christian Folini wrote: Mod_log_forensic is saving my day while debugging a crashing apache. But matching the right request with the crash and its corefile is difficult. Have you taken a look at Jeff's mod_whatkilledus?

Re: blocking Upgrade

2011-03-30 Thread Graham Leggett
On 30 Mar 2011, at 3:53 PM, Roy T. Fielding wrote: No, websockets is not designed to work with intermediaries. There is no standard behavior beyond opening the connection, so connections through proxies should use CONNECT. Does a websocket client have a way of knowing it should use CONNECT?

Re: blocking Upgrade

2011-03-30 Thread Graham Leggett
On 30 Mar 2011, at 4:41 PM, Roy T. Fielding wrote: My guess is that it would if it were told to use a proxy for ws. Keep in mind that when I say proxy, I do not mean to include reverse proxy. A reverse proxy of websockets is just an implementation of websockets or a tunnel. I consider

Re: blocking Upgrade

2011-03-30 Thread Graham Leggett
On 30 Mar 2011, at 5:48 PM, Greg Stein wrote: I think that Roy's point is simply that httpd would be nothing more than a socket-listener and tunnel. There is very little that it can bring to the table at that point, so it doesn't make a lot of sense to lump in websockets capabilities. In

Re: new ProxyPass/ProxyPassReverse feature for 2.4??

2011-03-28 Thread Graham Leggett
On 29 Mar 2011, at 12:10 AM, Jim Jagielski wrote: I *think* we're talking the same thing here... you seem to be focusing on how ProxyPassReverse is currently implemented, which is horribly slow, but but making ProxyPass automatically handle the default PPR case means we don't need to use that

Re: ldap unreleasable

2011-03-28 Thread Graham Leggett
On 29 Mar 2011, at 12:13 AM, William A. Rowe Jr. wrote: /* LDAP cache state information */ typedef struct util_ldap_state_t { ... int connectionPoolTTL; } util_ldap_state_t; I'm continue to grow more worried that the state of ldap in httpd and in apr enjoys very little granularity,

Re: new ProxyPass/ProxyPassReverse feature for 2.4??

2011-03-28 Thread Graham Leggett
On 29 Mar 2011, at 1:08 AM, William A. Rowe Jr. wrote: My suggestion isn't per-dir. It's a r-notes which is even more efficient. One further thing - it would need to work sanely from within a LocationMatch too. Regards, Graham --

Re: mod_fcgid in httpd tarball?

2011-03-23 Thread Graham Leggett
On 19 Mar 2011, at 12:07 AM, William A. Rowe Jr. wrote: It seems like mod_fcgid has made huge progress and is now in a much more stable bugfix epoch of it's life, similar to how mod_proxy had progressed when development was kicked out of core for major http/1.1 rework, and brought back in when

Re: ap_read_config() from remote resource

2011-03-01 Thread Graham Leggett
On 28 Feb 2011, at 10:32 PM, Igor Galić wrote: I think we discussed such possibilities last year at the retreat but didn't really follow up on it, so lets assume it's a fresh new idea which I just thought of :) ap_read_config() passes the config file it gets more or less directly to

Re: Bug #30865 -- mod_disk_cache leaves many temporary files slowing file system

2011-02-27 Thread Graham Leggett
On 27 Feb 2011, at 1:21 PM, Dirk-Willem van Gulik wrote: Reudiger, Why is: https://issues.apache.org/bugzilla/show_bug.cgi?id=30865 still open ? You are not sure it was fixed ? Or we just forgot about it ? This is fixed in httpd-trunk, I suspect it can be closed at this point.

Re: Time to start planning for httpd 2.3.11-BETA ?

2011-02-22 Thread Graham Leggett
On 22 Feb 2011, at 17:13, Jim Jagielski j...@jagunet.com wrote: I think we're about ready... My plan is to TR 2.3.11-beta the start of next week, allowing this week for some final touches... Remind me, at what point does the API freeze? Regards, Graham --

Re: svn commit: r1070075 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_util.c

2011-02-14 Thread Graham Leggett
On 14 Feb 2011, at 9:22 AM, Ruediger Pluem wrote: What happens if str is supplied as a, b? I mean why token + 1 and not token? I guess it's because we know *token isn't a separator, so there is no point checking if it is one a second time. *token might not be a separator, but it might be .

Re: svn commit: r1070179 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_cache.xml modules/cache/cache_storage.c modules/cache/cache_storage.h modules/cache/mod_cache.c modules/cache/mod_cache.h

2011-02-13 Thread Graham Leggett
On 13 Feb 2011, at 9:59 AM, Roy T. Fielding wrote: URL: http://svn.apache.org/viewvc?rev=1070179view=rev Log: mod_cache: When a request other than GET or HEAD arrives, we must invalidate existing cache entities as per RFC2616 13.10. PR 15868. Cache entries should not be invalidated unless the

Re: svn commit: r1070075 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_util.c

2011-02-13 Thread Graham Leggett
On 13 Feb 2011, at 5:22 PM, Ruediger Pluem wrote: +/* skip characters in sep (will terminate at '\0') */ +while (*str strchr(sep, *str)) { +++str; +} + +if (!*str) {/* no more tokens */ +return NULL; +} + +token = str; + +/* skip valid token

Re: svn commit: r1070179 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_cache.xml modules/cache/cache_storage.c modules/cache/cache_storage.h modules/cache/mod_cache.c modules/cache/mod_cache.h

2011-02-13 Thread Graham Leggett
On 13 Feb 2011, at 5:08 PM, Ruediger Pluem wrote: +/* + * invalidate a specific URL entity in all caches + * + * All cached entities for this URL are removed, usually in + * response to a POST/PUT or DELETE. + * + * This function returns OK if at least one entity was found and + * removed, and

Re: svn commit: r1070179 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_cache.xml modules/cache/cache_storage.c modules/cache/cache_storage.h modules/cache/mod_cache.c modules/cache/mod_cache.h

2011-02-13 Thread Graham Leggett
On 14 Feb 2011, at 1:56 AM, Paul Querna wrote: Additionally, this should be a configurable behavior. Lets say you run a popular website that depends on mod_cache to protect backend systems from complete overload. All you need to do now as an attacker is POST / DELETE to / or another important

Re: svn commit: r1070179 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_cache.xml modules/cache/cache_storage.c modules/cache/cache_storage.h modules/cache/mod_cache.c modules/cache/mod_cache.h

2011-02-13 Thread Graham Leggett
On 14 Feb 2011, at 2:15 AM, Paul Querna wrote: It does a single request to the backend, but doesn't _invalidate_ the existing cache, which would cause a flood of other, non-attacker clients to come in. I think that would be the origin of Roy saying that we should only invalidate if the

Re: svn commit: r1069942 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_util.c

2011-02-11 Thread Graham Leggett
s-maxage as described by RFC2616 14.9.3, which must + take precedence if present. PR 35247. [Graham Leggett] *) mod_socache_dc: Make module compile by fixing some typos. PR 50735 [Mark Montague mark catseye.org] Why the removal of the mod_ssl entry? Eek, how did that happen. Fixed

Bug 50199 - ap_cache_liststr fails to parse quoted strings

2011-02-11 Thread Graham Leggett
Hi all, The current parser for the Cache-Control header doesn't take into account quoted-string extensions to the header. To fix this, I have created a modified implementation of apr_strtok() called cache_strqtok(), that tokenises strings, but ignores the quoted part of the strings,

Re: svn commit: r1067178 - /httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c

2011-02-04 Thread Graham Leggett
On 04 Feb 2011, at 3:50 PM, j...@apache.org wrote: URL: http://svn.apache.org/viewvc?rev=1067178view=rev Log: And yet more balancer params that can be changed at runtime via the b-m application... next up, of course, is adding new workers ;) If it became possible to add workers on the fly in

Re: svn commit: r1067178 - /httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c

2011-02-04 Thread Graham Leggett
On 04 Feb 2011, at 6:14 PM, Jim Jagielski wrote: Right now, the idea is for Apache to respond to simple GET requests, ala balancer-manager, to add workers. Of course, anything authorized could send those GET requests ;) ;) We've finished zeroconf-ing one inhouse application we use, and

Re: svn commit: r1059910 - in /httpd/httpd/trunk: CHANGES modules/ssl/ssl_engine_io.c

2011-01-17 Thread Graham Leggett
On 17 Jan 2011, at 3:14 PM, jor...@apache.org wrote: Author: jorton Date: Mon Jan 17 13:14:21 2011 New Revision: 1059910 URL: http://svn.apache.org/viewvc?rev=1059910view=rev Log: * modules/ssl/ssl_engine_io.c: Revamp output buffering: add a coalesce filter which buffers the plaintext, and

Re: svn commit: r1059910 - in /httpd/httpd/trunk: CHANGES modules/ssl/ssl_engine_io.c

2011-01-17 Thread Graham Leggett
On 17 Jan 2011, at 4:35 PM, Joe Orton wrote: Is this not a duplicate of the BUFFER filter in mod_buffer? Ah, I forgot that was in the tree. It is similar, but that's a content filter which requires manual user configuration, this is a connection-level filter which does not. Yes, it would

Re: svn commit: r1056448 - /httpd/httpd/trunk/docs/manual/mod/mod_log_config.xml

2011-01-08 Thread Graham Leggett
On 07 Jan 2011, at 9:05 PM, William A. Rowe Jr. wrote: If caution is to be exercised for other reasons, such as losing data in the event of a crash, that's a separate issue, and should be handled separately. It should be used with caution. Instead of arguing, replace the caution. Or I'm

Re: svn commit: r1056448 - /httpd/httpd/trunk/docs/manual/mod/mod_log_config.xml

2011-01-07 Thread Graham Leggett
On 07 Jan 2011, at 8:44 PM, William A. Rowe Jr. wrote: On 1/7/2011 12:37 PM, minf...@apache.org wrote: --- httpd/httpd/trunk/docs/manual/mod/mod_log_config.xml (original) +++ httpd/httpd/trunk/docs/manual/mod/mod_log_config.xml Fri Jan 7 18:37:25 2011 @@ -345,9 +345,6 @@ efficient disk

Re: svn commit: r1055250 - in /httpd/httpd/trunk: CHANGES modules/proxy/mod_proxy_http.c modules/proxy/proxy_util.c

2011-01-05 Thread Graham Leggett
On 05 Jan 2011, at 9:43 AM, Ruediger Pluem wrote: What about the comment in mod_proxy.h about the r element of proxy_conn_rec? /* Request record of the frontend request * which the backend currently answers. */ Doesn't this comment need to be adjusted now? It does - I've fixed it in

Re: SetVirtualDocumentRoot / per request document root / context root?

2010-12-13 Thread Graham Leggett
On 13 Dec 2010, at 5:11 AM, William A. Rowe Jr. wrote: An idea from left field. Is there a reason that DocumentRoot is a virtual host wide setting? Yes, root describes /, there is only one Location /. I can understand why such a setting would be required, but I still don't see why that

Crash inside worker mpm's ap_mpm_pod_check()

2010-12-13 Thread Graham Leggett
Hi all, I am currently trying to get to the bottom of a crash that is occurring under load (during an Avalanche load test, most specifically) inside the worker mpm, with the stacktrace as below. Most specifically, it segfaults inside the read() below: AP_DECLARE(int)

Re: SetVirtualDocumentRoot / per request document root / context root?

2010-12-12 Thread Graham Leggett
On 13 Dec 2010, at 12:23 AM, Stefan Fritsch wrote: I have looked at the patch and it looks reasonable. The fact that two known modules (mod_vhost_ldap and mod_ftp) copy the whole server_rec just to change the document root means that this feature is needed. An idea from left field. Is there

rotatelogs: support for echoing to stdout

2010-12-03 Thread Graham Leggett
Hi all, When processing logs in real time by more than one tool, it is useful for rotatelogs to optionally pass logs through to stdout for further processing by the next tool in the chain using reliable piped logs. This patch makes this possible. Regards, Graham --

Re: disk cache file rename errors on Windows

2010-12-02 Thread Graham Leggett
On 23 Nov 2010, at 8:21 PM, Dan Poirier wrote: We're seeing errors like this from mod_disk_cache on Windows only: (OS 5)Access is denied. : disk_cache: rename tempfile to datafile failed: c:/temp/HTTPServer7/aptmpV0JKJ8 - c:/temp/HTTPServer7/wHY/FhW/b...@muvttlk@V4w.data under moderate to

Re: create a pool associated with the MPM generation?

2010-11-22 Thread Graham Leggett
On 22 Nov 2010, at 2:45 PM, Jeff Trawick wrote: The purpose of the pool would be the allocation in the parent of resources which must live as long as any child processes from a certain generation are still running. It helps bridge the gap between pconf and the process pool when dealing with

Re: Proposed: PKI Authentication for secure web access

2010-11-21 Thread Graham Leggett
On 21 Nov 2010, at 6:59 AM, Sander Temme wrote: Thanks for the link Issac. If this is already in Apache, why isn't everyone using it? Because key management is just too freaking hard, and too much of a management and support burden. For God's sake, if we can't even get the Apache

Re: BufferedLogs

2010-11-21 Thread Graham Leggett
On 21 Nov 2010, at 7:49 PM, Stefan Fritsch wrote: Considering that it's so old and there don't seem to be open bug reports about it, I would remove the 'experimental'. +1. Regards, Graham --

Re: Proposed: PKI Authentication for secure web access

2010-11-20 Thread Graham Leggett
On 20 Nov 2010, at 10:27 AM, Rob Lemaster wrote: SSH allows a user to create a public/private key pair and use that for authentication. This is much more secure than simply using passwords and adds the ability to add 'something you have' for multi-factor authentication. I propose that the same

Re: mod_disk_cache - mod_cache_disk

2010-11-20 Thread Graham Leggett
On 14 Oct 2010, at 8:50 PM, Ruediger Pluem wrote: The naming of mod_disk_cache currently goes against the naming convention of other grouped modules in the server, such as mod_proxy_*, and mod_socache_*. Are there any objections to me renaming mod_disk_cache to mod_cache_disk for httpd

Re: mod_include: include virtual and error handling

2010-11-20 Thread Graham Leggett
On 02 Nov 2010, at 10:34 PM, Nick Kew wrote: The lack of this one feature is the most cited reason I've been given for why people have moved away from mod_include as a template processor to other template processors within other servers. Rather than moving to an entirely new type of server, I'd

Re: Proposed: PKI Authentication for secure web access

2010-11-20 Thread Graham Leggett
On 20 Nov 2010, at 10:19 PM, Rob Lemaster wrote: Isn't mod_ssl used solely for HTTPS (browser-server encryption)? I would like to use PKI for user authentication like you can in SSH on top of the encryption provided by HTTPS. The most secure option I see available for web authentication

Re: svn commit: r1035605 - /httpd/httpd/trunk/modules/proxy/mod_proxy_http.c

2010-11-19 Thread Graham Leggett
On 19 Nov 2010, at 8:33 AM, Ruediger Pluem wrote: Modified: httpd/httpd/trunk/modules/proxy/mod_proxy_http.c URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?rev=1035605r1=1035604r2=1035605view=diff = = = = = = = = =

mod_ssl's proxy support: make it per directory

2010-11-19 Thread Graham Leggett
Hi all, For a while, mod_ssl has been able to secure connections from mod_proxy, backwards towards some backend server. For some reason however, the directives that control this behavior SSLProxy* are all scoped virtual host only, making it possible to SSL protect just one single

mod_ssl: inserting cert parameters into headers

2010-11-19 Thread Graham Leggett
Hi all, For a while we've been relying on our load balancers to terminate SSL for us, and place details of client certs into HTTP headers before passing a connection backwards (through a further SSL protected connection). We're in a situation where we want to use httpd instead of a load

Re: svn commit: r1035605 - /httpd/httpd/trunk/modules/proxy/mod_proxy_http.c

2010-11-19 Thread Graham Leggett
On 19 Nov 2010, at 3:19 PM, Igor Galić wrote: I believe to have, for the first time in months, understood what it is with mod_proxy, and why it's so heavily discussed: There are a number separate and related issues, because mod_proxy: * handles connections to the front end (To large numbers

Re: mod_ssl's proxy support: make it per directory

2010-11-19 Thread Graham Leggett
On 19 Nov 2010, at 3:15 PM, Plüm, Rüdiger, VF-Group wrote: For a while, mod_ssl has been able to secure connections from mod_proxy, backwards towards some backend server. For some reason however, the directives that control this behavior SSLProxy* are all scoped virtual host only, making it

Re: mod_ssl: inserting cert parameters into headers

2010-11-19 Thread Graham Leggett
On 19 Nov 2010, at 3:19 PM, Plüm, Rüdiger, VF-Group wrote: Does RequestHeader add some_header %{SSL_ENVIRONMENT_VARIABLE}s not work for you? It could, but it isn't very clean at all. You are adding a KV pair to one table, then manually copying it into another table. If a hook existed to

Re: mod_ssl: inserting cert parameters into headers

2010-11-19 Thread Graham Leggett
On 19 Nov 2010, at 6:24 PM, Nick Kew wrote: Most specifically, if SSLOptions +StdEnvVars is specified, the hook gets called with the data, and an implementation writes them to the subprocess environment, or headers_in, as appropriate (and as configured). A hook? That suggests you expect

Re: svn commit: r1034916 - in /httpd/httpd/trunk: CHANGES include/ap_mmn.h modules/proxy/mod_proxy.c modules/proxy/mod_proxy.h modules/proxy/proxy_util.c

2010-11-19 Thread Graham Leggett
On 16 Nov 2010, at 2:35 AM, Nick Kew wrote: Well, you *could*. You'd just (probably) sacrifice the optimisation. Much the same story as a bunch of chars. FWIW, if I'd been designing the above from scratch, those flags would be a bitfield and a set of #defines, thus occupying a fixed/known

Re: svn commit: r1035504 - in /httpd/httpd/trunk: include/ap_mmn.h modules/proxy/mod_proxy.h modules/proxy/mod_proxy_http.c modules/proxy/proxy_util.c

2010-11-16 Thread Graham Leggett
On 16 Nov 2010, at 8:56 AM, Ruediger Pluem wrote: Modified: httpd/httpd/trunk/modules/proxy/proxy_util.c URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/proxy_util.c?rev=1035504r1=1035503r2=1035504view=diff = = = = = = = = =

Re: svn commit: r1035504 - in /httpd/httpd/trunk: include/ap_mmn.h modules/proxy/mod_proxy.h modules/proxy/mod_proxy_http.c modules/proxy/proxy_util.c

2010-11-16 Thread Graham Leggett
On 16 Nov 2010, at 12:17 PM, Plüm, Rüdiger, VF-Group wrote: Sorry for having been in grumpy mode this morning, but I saw this code which is what I pointed out before to be not working :-). As you've pointed out, the code is definitely wrong, I suspect you choked on your coffee and for that

Re: Error returned on broken chunking

2010-11-13 Thread Graham Leggett
On 13 Nov 2010, at 1:22 AM, Nick Kew wrote: Any strong rationale for 503, or should I just change it to 400? 400 looks like the correct code to use, yes. Regards, Graham --

Re: Bug 29404 - Allow definition of source address of outgoing connections from mod_proxy

2010-11-13 Thread Graham Leggett
On 13 Nov 2010, at 8:11 PM, Deanna Siemaszko wrote: Allow definition of source address of outgoing connections from mod_proxy. There was a patch added to this ticket. https://issues.apache.org/bugzilla/show_bug.cgi?id=29404 What is preventing this patch from being merged into the trunk?

Re: svn commit: r1033779 - in /httpd/httpd/trunk: modules/cache/cache_common.h modules/cache/mod_cache.h modules/cache/mod_disk_cache.h support/htcacheclean.c

2010-11-11 Thread Graham Leggett
On 11 Nov 2010, at 3:35 AM, Guenter Knauf wrote: so you suggest the stuff extracted from mod_disk_cache.h should go into a separate disk_cache_common.h ? If possible, yes. htcacheclean and mod_disk_cache are tied together strongly, but are independent of mod_cache (as a provider).

Re: Proxy regressions

2010-11-10 Thread Graham Leggett
On 10 Nov 2010, at 9:02 AM, Ruediger Pluem wrote: The fix in r1030855 is wrong: ap_proxy_buckets_lifetime_transform is not copying the data but only creates transient buckets from the data in the buckets in bb. If you then destroy bb before passing pass_bb, the data where the buckets in pass_bb

Re: Proxy regressions

2010-11-10 Thread Graham Leggett
On 10 Nov 2010, at 1:09 PM, Plüm, Rüdiger, VF-Group wrote: The proxy currently creates the allocator in ap_proxy_connection_create(), and then passes the allocator to the various submodules via the ap_run_create_connection() hook, so it looks like we just passing the wrong allocator. The

Re: Proxy regressions

2010-11-10 Thread Graham Leggett
On 10 Nov 2010, at 11:49 AM, Plüm, Rüdiger, VF-Group wrote: Have we not created a pool lifetime problem for ourselves here? In theory, any attempt to read from the backend connection should create buckets allocated from the r-connection-bucket_alloc allocator, which should be removed from the

Re: Proxy regressions

2010-11-10 Thread Graham Leggett
On 10 Nov 2010, at 4:13 PM, Plüm, Rüdiger, VF-Group wrote: The core input filter in ap_core_input_filter which is used to read the response from the backend creates the socket bucket from the conn rec bucket allocator. So the used bucket allocator must live as long as the conn rec of the

Re: Proxy regressions

2010-11-10 Thread Graham Leggett
On 10 Nov 2010, at 3:54 PM, Plüm, Rüdiger, VF-Group wrote: As said this sounds doable for http backends, but not for https backends where we need to keep some data regarding the SSL state in the conn rec of the backend connection. This is entirely fine, it's only the contents of the

Re: svn commit: r1033779 - in /httpd/httpd/trunk: modules/cache/cache_common.h modules/cache/mod_cache.h modules/cache/mod_disk_cache.h support/htcacheclean.c

2010-11-10 Thread Graham Leggett
On 11 Nov 2010, at 1:43 AM, fua...@apache.org wrote: Author: fuankg Date: Wed Nov 10 23:43:06 2010 New Revision: 1033779 URL: http://svn.apache.org/viewvc?rev=1033779view=rev Log: Splitted off cache defines/structs used by htcacheclean. This makes htcacheclean again independent from httpd.h.

Re: svn commit: r1032059 - /httpd/httpd/trunk/modules/filters/mod_include.c

2010-11-07 Thread Graham Leggett
On 06 Nov 2010, at 10:32 PM, Stefan Fritsch wrote: I think I have made my intentions clear in my first mail from October 23rd. But maybe I should have mentioned it also in the later mails. The grammar and in particular the string handling in the SSI expression parser is so weird that it

Re: [RFC] Error directive to generate custom error messages from httpd.conf

2010-11-07 Thread Graham Leggett
On 08 Nov 2010, at 2:35 AM, Jeff Trawick wrote: With the Error directive: IfModule !mod_include.c Error mod_foo requires mod_include! Use the LoadModule directive to load mod_include. /IfModule $ ./httpd -t Syntax error on line 486 of /home/trawick/inst/23/conf/httpd.conf: mod_foo requires

Re: mod_rewrite: RewriteEngine off doesn't work in a directory context

2010-11-06 Thread Graham Leggett
On 06 Nov 2010, at 5:21 PM, Ruediger Pluem wrote: Does this patch make sense? Do we always have a valid dconf in hook_uri2file? And if yes, why do we need the state field in the server conf any longer? It's because of the following function, called from a post config hook, at which

Re: svn commit: r1032059 - /httpd/httpd/trunk/modules/filters/mod_include.c

2010-11-06 Thread Graham Leggett
On 06 Nov 2010, at 4:03 PM, s...@apache.org wrote: Author: sf Date: Sat Nov 6 14:03:13 2010 New Revision: 1032059 URL: http://svn.apache.org/viewvc?rev=1032059view=rev Log: Put the expression parser back into mod_include This reverts r642559 and r642978 -#include ap_expr.h I don't

Re: mod_rewrite: RewriteEngine off doesn't work in a directory context

2010-11-06 Thread Graham Leggett
On 06 Nov 2010, at 5:21 PM, Ruediger Pluem wrote: Does this patch make sense? Do we always have a valid dconf in hook_uri2file? To be safe, I have added a check for dconf being NULL. Regards, Graham -- httpd-mod_rewrite-rewriteengine-fix.patch Description: Binary data

Re: Proxy regressions

2010-11-05 Thread Graham Leggett
On 05 Nov 2010, at 10:52 PM, Jim Jagielski wrote: FWIW, I can't recreate this: [warning] setting ulimit to allow core files ulimit -c unlimited; /opt/local/bin/perl /Users/jim/src/asf/code/ stable/httpd-test/framework/t/TEST /usr/local/apache2/bin/httpd -d /Users/jim/src/asf/code/stable/

<    4   5   6   7   8   9   10   11   12   13   >