RE: Preventing the use of chunked TF encoding while content-filtering

2009-11-09 Thread Anthony J. Biacco
Christoph, I had a mod_buffer module written for me by Konstantin Chuguev (konstan...@chuguev.com) which collects chunks and buffers them for transfer in one shot. You should contact him and see whether he'll give/license it to you. -Tony --- Manager, IT Operations

Re: Apache 2.2 coredumping on Solaris with Subversion 1.6

2009-11-09 Thread Nick Kew
skrishnam...@bloomberg.com wrote: You're on the wrong list: this belongs on users@ (I know you posted there, but your mailer sent a bunch of pseudo-HTML crap that made it too annoying to read). I built it with the below two flags that should point it to the same apr and apr-util that were

RE: Apache 2.2 coredumping on Solaris with Subversion 1.6

2009-11-09 Thread skrishnam...@bloomberg.com
Per my knowledge this is the apr source tar ball that was used. How do I find the 'installed' apr and use that instead? Posted here because I didn't get any response on the users list and this seemed to be a modules issue. Do let me know and Ill continue the posting there. thanks -Original

RE: TLS renegotiation attack, mod_ssl and OpenSSL

2009-11-09 Thread Boyle Owen
-Original Message- From: Dirk-Willem van Gulik [mailto:di...@webweaving.org] Sent: Saturday, November 07, 2009 12:28 AM To: dev@httpd.apache.org Subject: Re: TLS renegotiation attack, mod_ssl and OpenSSL +1 from me. (FreeBSD, Solaris). Test with and without certs (firefox,

Re: svn commit: r833738 - in /httpd/httpd/trunk: CHANGES docs/manual/mod/mod_log_config.xml modules/loggers/mod_log_config.c

2009-11-09 Thread Stefan Fritsch
On Sunday 08 November 2009, Ruediger Pluem wrote: Just a random thought: Wouldn't it be possible to simply things even further with apr_strtok? Yes. Done in r834006.

Re: TLS renegotiation attack, mod_ssl and OpenSSL

2009-11-09 Thread Ruediger Pluem
On 11/09/2009 10:39 AM, Boyle Owen wrote: -Original Message- From: Dirk-Willem van Gulik [mailto:di...@webweaving.org] Sent: Saturday, November 07, 2009 12:28 AM To: dev@httpd.apache.org Subject: Re: TLS renegotiation attack, mod_ssl and OpenSSL +1 from me. (FreeBSD, Solaris).

Re: svn commit: r834006 - /httpd/httpd/trunk/modules/loggers/mod_log_config.c

2009-11-09 Thread Ruediger Pluem
On 11/09/2009 11:00 AM, s...@apache.org wrote: Author: sf Date: Mon Nov 9 09:59:53 2009 New Revision: 834006 URL: http://svn.apache.org/viewvc?rev=834006view=rev Log: Simplify code by using apr_strtok Modified: httpd/httpd/trunk/modules/loggers/mod_log_config.c Modified:

ssl related test failures

2009-11-09 Thread Stefan Fritsch
Hi, with openssl 0.9.8k, I currently get a large number of test failures: Test Summary Report --- t/ssl/basicauth.t (Wstat: 0 Tests: 3 Failed: 2) Failed tests: 2-3 t/ssl/env.t (Wstat: 0 Tests: 30 Failed: 15) Failed tests: 16-30 t/ssl/extlookup.t

Re: ssl related test failures

2009-11-09 Thread Ruediger Pluem
On 11/09/2009 11:25 AM, Stefan Fritsch wrote: Hi, with openssl 0.9.8k, I currently get a large number of test failures: Test Summary Report --- t/ssl/basicauth.t (Wstat: 0 Tests: 3 Failed: 2) Failed tests: 2-3 t/ssl/env.t (Wstat: 0 Tests: 30

Re: ssl related test failures

2009-11-09 Thread Stefan Fritsch
On Monday 09 November 2009, Ruediger Pluem wrote: On 11/09/2009 11:25 AM, Stefan Fritsch wrote: Hi, with openssl 0.9.8k, I currently get a large number of test failures: Test Summary Report --- t/ssl/basicauth.t (Wstat: 0 Tests: 3 Failed: 2) Failed

Re: dropping inode keyed locks in mod_dav_fs

2009-11-09 Thread Stefan Fritsch
On Friday 23 October 2009, Stefan Fritsch wrote: On Thursday 22 October 2009, Joe Orton wrote: Is the performance improvement of inode keyed locking so large that it is worth the hassle? If mod_dav_fs used filename keyed locking entirely, there would be an easy way to make file

Re: dropping inode keyed locks in mod_dav_fs

2009-11-09 Thread Greg Stein
Sorry for missing earlier messages; I don't follow httpd as closely as before. See my replies below: On Mon, Nov 9, 2009 at 06:28, Stefan Fritsch s...@sfritsch.de wrote: On Friday 23 October 2009, Stefan Fritsch wrote: On Thursday 22 October 2009, Joe Orton wrote: Is the performance

How does this Known Problem in Clients solve?

2009-11-09 Thread dreamice
Trailing CRLF on POSTs This is a legacy issue. The CERN webserver required POST data to have an extra CRLF following it. Thus many clients send an extra CRLF that is not included in the Content-Length of the request. Apache works around this problem by eating any empty lines which appear before a

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Greg Stein
On Mon, Nov 9, 2009 at 08:14, s...@apache.org wrote: Author: sf Date: Mon Nov  9 13:14:07 2009 New Revision: 834049 URL: http://svn.apache.org/viewvc?rev=834049view=rev Log: Make PUT with DAV_MODE_WRITE_TRUNC create a temporary file first and, when the transfer has been completed

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Stefan Fritsch
On Monday 09 November 2009, Greg Stein wrote: On Mon, Nov 9, 2009 at 08:14, s...@apache.org wrote: Author: sf Date: Mon Nov 9 13:14:07 2009 New Revision: 834049 URL: http://svn.apache.org/viewvc?rev=834049view=rev Log: Make PUT with DAV_MODE_WRITE_TRUNC create a temporary file

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Ruediger Pluem
On 11/09/2009 02:14 PM, s...@apache.org wrote: Author: sf Date: Mon Nov 9 13:14:07 2009 New Revision: 834049 URL: http://svn.apache.org/viewvc?rev=834049view=rev Log: Make PUT with DAV_MODE_WRITE_TRUNC create a temporary file first and, when the transfer has been completed

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Stefan Fritsch
On Monday 09 November 2009, Ruediger Pluem wrote: This causes the following warning: repos.c: In function 'dav_fs_open_stream': repos.c:900: warning: passing argument 2 of 'apr_file_mktemp' discards qualifiers from pointer target type Thanks. Fixed.

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Greg Stein
On Mon, Nov 9, 2009 at 08:42, Stefan Fritsch s...@sfritsch.de wrote: On Monday 09 November 2009, Greg Stein wrote: On Mon, Nov 9, 2009 at 08:14,  s...@apache.org wrote: Author: sf Date: Mon Nov  9 13:14:07 2009 New Revision: 834049 URL: http://svn.apache.org/viewvc?rev=834049view=rev

Re: ssl related test failures

2009-11-09 Thread Sander Temme
Hi Stefan, On Nov 9, 2009, at 2:25 AM, Stefan Fritsch wrote: Hi, with openssl 0.9.8k, I currently get a large number of test failures: These tests do not fail for me. Can you run a subset in verbose and see how they fail? Like: t/TEST ... -verbose t/ssl/basicauth.t should get you

Re: Httpd 3.0 or something else

2009-11-09 Thread Akins, Brian
On 11/9/09 12:32 AM, Brian McCallister bri...@skife.org wrote: A 3.0, a fundamental architectural shift, would be interesting to discuss, I am not sure there is a ton of value in it, though, to be honest. So I should continue to investigate nginx? ;) FWIW, nginx delivers on its performance

Re: ssl related test failures

2009-11-09 Thread Stefan Fritsch
On Monday 09 November 2009, Sander Temme wrote: Hi Stefan, On Nov 9, 2009, at 2:25 AM, Stefan Fritsch wrote: Hi, with openssl 0.9.8k, I currently get a large number of test failures: These tests do not fail for me. Can you run a subset in verbose and see how they fail? Like:

Apache 2.2 coredumping on Solaris with Subversion 1.6

2009-11-09 Thread skrishnam...@bloomberg.com
Hi, I compiled subversion with apache 2.2 on solaris but when I hit the server with an svn request, the svn modules produce a core dump. Has anyone faced anything similar or have any ideas about how to fix or workaround this issue? Any help is appreciated. Running a pstack on the core file

Re: ssl related test failures

2009-11-09 Thread Jeff Trawick
On Mon, Nov 9, 2009 at 10:55 AM, Stefan Fritsch s...@sfritsch.de wrote: On Monday 09 November 2009, Sander Temme wrote: Hi Stefan, On Nov 9, 2009, at 2:25 AM, Stefan Fritsch wrote: Hi, with openssl 0.9.8k, I currently get a large number of test failures: These tests do not fail for

Re: Making a binary distribution of apache 2.2.14 on Aix 6.1

2009-11-09 Thread Michael Felt
Actually, the reason I started this thread is because I wanted to start making builds that used IBM's installp format for distribution rather than RPM - which is the format chosen for most of the AIX toolbox. Imho much of the difficulity the libtool devs have with the AIX platform (as generally

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Akins, Brian wrote: FWIW, nginx delivers on its performance promises, but is a horrible hairball of code (my opinion). We (httpd-dev type folks) could do much better - if we just would. (Easy for the guy with no time to say, I know...) I think it is entirely reasonable for the httpd v3.0

intend to roll 2.3 alpha on Wednesday

2009-11-09 Thread Paul Querna
Hello dev@, I intend to roll a 2.3 alpha release on Wednesday November 11th. I will bundle APR from the 1.4.x branch. (APR people should make a release, but this shouldn't be a blocker for our own alpha releases). I am almost 90% sure the release might fail due to various issues, but we need to

Re: Httpd 3.0 or something else

2009-11-09 Thread Akins, Brian
On 11/9/09 12:52 PM, Graham Leggett minf...@sharp.fm wrote: This gives us the option of prefork reliability, and event driven speed, as required by the admin. I think if we try to do both, we will wind up with the worst of both worlds. (Or is it worse??) Blocking/buggy modules should be ran

Re: Making a binary distribution of apache 2.2.14 on Aix 6.1

2009-11-09 Thread Graham Leggett
Michael Felt wrote: Actually, the reason I started this thread is because I wanted to start making builds that used IBM's installp format for distribution rather than RPM - which is the format chosen for most of the AIX toolbox. Imho much of the difficulity the libtool devs have with the AIX

Re: intend to roll 2.3 alpha on Wednesday

2009-11-09 Thread Graham Leggett
Paul Querna wrote: I intend to roll a 2.3 alpha release on Wednesday November 11th. I will bundle APR from the 1.4.x branch. (APR people should make a release, but this shouldn't be a blocker for our own alpha releases). I am almost 90% sure the release might fail due to various issues,

Re: [PATCH] mod_ssl: improving session caching for SNI configurations

2009-11-09 Thread Kaspar Brand
Dr Stephen Henson wrote: Yes that looks better. There is an alternative technique if it is easier to find a base SSL_CTX, you can retrieve the auto generated keys using SSL_CTX_get_tlsext_ticket_keys() and then copy to the new context as above. The loop actually iterates over all contexts,

Preventing the use of chunked TF encoding while content-filtering

2009-11-09 Thread Christoph Gröver
Hello list, I have written a module which does filtering the content. It gets those buckets and works on them and passes on the brigade of buckets. OK, works perfect for nearly all conditions. Execpt When the user runs the infamous Internet Explorer and uses a misconfigured proxy, it

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Akins, Brian wrote: This gives us the option of prefork reliability, and event driven speed, as required by the admin. I think if we try to do both, we will wind up with the worst of both worlds. (Or is it worse??) Blocking/buggy modules should be ran out of process (FactCGI/HTTP/Thrift).

Re: Httpd 3.0 or something else

2009-11-09 Thread Akins, Brian
On 11/9/09 1:18 PM, Graham Leggett minf...@sharp.fm wrote: and we know from the same period of experience from others that a pure event driven model is useful for shipping static data and not much further. It works really well for proxy. -- Brian Akins

Re: intend to roll 2.3 alpha on Wednesday

2009-11-09 Thread Sander Temme
On Nov 9, 2009, at 10:04 AM, Graham Leggett wrote: Paul Querna wrote: I intend to roll a 2.3 alpha release on Wednesday November 11th. I will bundle APR from the 1.4.x branch. (APR people should make a release, but this shouldn't be a blocker for our own alpha releases). I am almost 90%

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Akins, Brian wrote: and we know from the same period of experience from others that a pure event driven model is useful for shipping static data and not much further. It works really well for proxy. Aka static data :) The key advantage to doing both prefork and event behaviour in the same

Re: Httpd 3.0 or something else

2009-11-09 Thread Akins, Brian
On 11/9/09 1:36 PM, Graham Leggett minf...@sharp.fm wrote: It works really well for proxy. Aka static data :) Nah, we proxy to fastcgi php stuff, http java stuff, some horrid HTTP perl stuff, etc (Full disclosure, I wrote the horrid perl stuff.) -- Brian Akins

Re: intend to roll 2.3 alpha on Wednesday

2009-11-09 Thread Lars Eilebrecht
Paul Querna wrote: I intend to roll a 2.3 alpha release on Wednesday November 11th. +1 ciao... -- Lars Eilebrecht l...@eilebrecht.net

Re: intend to roll 2.3 alpha on Wednesday

2009-11-09 Thread Paul Querna
On Mon, Nov 9, 2009 at 10:23 AM, Sander Temme scte...@apache.org wrote: On Nov 9, 2009, at 10:04 AM, Graham Leggett wrote: Paul Querna wrote: I intend to roll a 2.3 alpha release on Wednesday November 11th. I will bundle APR from the 1.4.x branch. (APR people should make a release, but

Re: Httpd 3.0 or something else

2009-11-09 Thread Akins, Brian
On 11/9/09 1:40 PM, Brian Akins brian.ak...@turner.com wrote: On 11/9/09 1:36 PM, Graham Leggett minf...@sharp.fm wrote: It works really well for proxy. Aka static data :) Nah, we proxy to fastcgi php stuff, http java stuff, some horrid HTTP perl stuff, etc (Full disclosure, I wrote

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Akins, Brian wrote: It works really well for proxy. Aka static data :) Nah, we proxy to fastcgi php stuff, http java stuff, some horrid HTTP perl stuff, etc (Full disclosure, I wrote the horrid perl stuff.) Doesn't matter, once httpd proxy gets hold of it, it's just shifting static bits.

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Akins, Brian wrote: FWIW, nginx buffers backend stuff to a file, then sendfiles it out - I think this is what perlbal does as well. Same can be done outside apache using X-sendfile like methods. Seems like we could move this inside apache fairly easy. May can do it with a filter. I tried

Re: Httpd 3.0 or something else

2009-11-09 Thread Akins, Brian
On 11/9/09 2:06 PM, Greg Stein gst...@gmail.com wrote: These issues are already solved by moving to a Serf core. It is fully asynchronous. Okay that's one convert, any others? ;) That's what Paul and I discussed a lot last week. My ideal httpd 3.0 is: Libev + serf + lua -- Brian Akins

Re: Httpd 3.0 or something else

2009-11-09 Thread Paul Querna
On Mon, Nov 9, 2009 at 11:06 AM, Greg Stein gst...@gmail.com wrote: On Mon, Nov 9, 2009 at 13:59, Graham Leggett minf...@sharp.fm wrote: Akins, Brian wrote: It works really well for proxy. Aka static data :) Nah, we proxy to fastcgi php stuff, http java stuff, some horrid HTTP perl stuff,

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Stefan Fritsch
On Monday 09 November 2009, Greg Stein wrote: Why did you go with a format change of the DAVLockDB? It is quite possible that people will miss that step during an upgrade. You could just leave DAV_TYPE_FNAME in there. That wouldn't help because it would still break with DAV_TYPE_INODE

Re: ssl related test failures

2009-11-09 Thread Ruediger Pluem
On 11/09/2009 08:34 PM, Stefan Fritsch wrote: On Monday 09 November 2009, Jeff Trawick wrote: and see how they fail? Like: t/TEST ... -verbose t/ssl/basicauth.t should get you some more insight. Also, which platform? This is Debian unstable with the Debian openssl. It seems to

Re: Httpd 3.0 or something else

2009-11-09 Thread Greg Stein
On Mon, Nov 9, 2009 at 14:21, Paul Querna p...@querna.org wrote: ... I agree in general, a serf-based core does give us a good start. But Serf Buckets and the event loop definitely do need some more work -- simple things, like if the backend bucket is a socket, how do you tell the event loop,

Re: intend to roll 2.3 alpha on Wednesday

2009-11-09 Thread Nick Kew
Graham Leggett wrote: Is there a need to bundle APR at all? Yep, let's draw a line under that. APR is a dependency, not a component. Otherwise +1. MeToo. -- Nick Kew

Re: svn commit: r834049 - in /httpd/httpd/trunk: CHANGES modules/dav/fs/lock.c modules/dav/fs/repos.c

2009-11-09 Thread Greg Stein
On Mon, Nov 9, 2009 at 15:21, Greg Stein gst...@gmail.com wrote: On Mon, Nov 9, 2009 at 14:46, Stefan Fritsch s...@sfritsch.de wrote: On Monday 09 November 2009, Greg Stein wrote: Why did you go with a format change of the DAVLockDB? It is quite possible that people will miss that step

Re: ssl related test failures

2009-11-09 Thread Sander Temme
On Nov 9, 2009, at 11:49 AM, Ruediger Pluem wrote: Thanks, that was the right hint. With a new svn checkout of the framework, all tests pass and t/TEST -clean or make clean cleans the certs. For some reason, the cleaning of the certs does not work with the old tree. I don't think I am

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Greg Stein wrote: These issues are already solved by moving to a Serf core. It is fully asynchronous. Backend handlers will no longer push bits towards the network. The core will pull them from a bucket. *Which* bucket is defined by a {URL,Headers}-Bucket mapping system. How is pull

Re: Httpd 3.0 or something else

2009-11-09 Thread Greg Stein
On Mon, Nov 9, 2009 at 16:19, Graham Leggett minf...@sharp.fm wrote: Greg Stein wrote: These issues are already solved by moving to a Serf core. It is fully asynchronous. Backend handlers will no longer push bits towards the network. The core will pull them from a bucket. *Which* bucket is

mod_fcgid: different instances of the same program

2009-11-09 Thread Danny Sadinoff
Here are two details of mod_fcgid process management that I've just learned after a long debug session and squinting at the mod_fcgid code. 1) symlinks you. It seems that mod_fcgid identifies fcgid programs by inode and device, not by filename. So two fcgid programs invoked by the webserver

Re: svn commit: r834013 - /httpd/httpd/trunk/modules/loggers/mod_log_config.c

2009-11-09 Thread Jeff Trawick
On Mon, Nov 9, 2009 at 5:43 AM, s...@apache.org wrote: Author: sf Date: Mon Nov  9 10:43:16 2009 New Revision: 834013 URL: http://svn.apache.org/viewvc?rev=834013view=rev Log: Also remove trailing whitespace in the value Modified:    httpd/httpd/trunk/modules/loggers/mod_log_config.c

Backport proposal for CVE-2009-3555

2009-11-09 Thread Rainer Jung
I did a first try on backporting the CVE-2009-3555 patch to 2.0: http://people.apache.org/~rjung/patches/cve-2009-3555_httpd_2_0_x.patch I hadn't yet time for intensive testing, but first tests looked OK. I noticed I couldn't log the SSL_SESSION_ID, but maybe that was a Windows thing. Hadn't yet

Re: mod_fcgid: different instances of the same program

2009-11-09 Thread Jeff Trawick
On Mon, Nov 9, 2009 at 5:16 PM, Danny Sadinoff danny.sadin...@gmail.com wrote: Here are two details of mod_fcgid process management that I've just learned after a long debug session and squinting at the mod_fcgid code. 1) symlinks you. It seems that mod_fcgid identifies fcgid programs by

Re: mod_fcgid: different instances of the same program

2009-11-09 Thread Graham Dumpleton
2009/11/10 Jeff Trawick traw...@gmail.com: On Mon, Nov 9, 2009 at 5:16 PM, Danny Sadinoff danny.sadin...@gmail.com wrote: Here are two details of mod_fcgid process management that I've just learned after a long debug session and squinting at the mod_fcgid code. 1) symlinks you. It seems

Re: mod_fcgid: different instances of the same program

2009-11-09 Thread Danny Sadinoff
On Tue, Nov 10, 2009 at 12:53 AM, Jeff Trawick traw...@gmail.com wrote: On Mon, Nov 9, 2009 at 5:16 PM, Danny Sadinoff danny.sadin...@gmail.com wrote: ... 1) symlinks you. It seems that mod_fcgid identifies fcgid programs by inode and device, not by filename. So two fcgid programs

Re: Httpd 3.0 or something else

2009-11-09 Thread Graham Leggett
Greg Stein wrote: How is pull different from push[1]? The network loop pulls data from the content-generator. Apache 1.x and 2.x had a handler that pushed data at the network. There is no loop, of course, since each worker had direct control of the socket to push data into. As I said in

Re: mod_fcgid: different instances of the same program

2009-11-09 Thread Jeff Trawick
On Mon, Nov 9, 2009 at 6:47 PM, Danny Sadinoff da...@sadinoff.com wrote: On Tue, Nov 10, 2009 at 12:53 AM, Jeff Trawick traw...@gmail.com wrote: On Mon, Nov 9, 2009 at 5:16 PM, Danny Sadinoff danny.sadin...@gmail.com wrote: ... 1) symlinks you. It seems that mod_fcgid identifies fcgid

Re: mod_fcgid: different instances of the same program

2009-11-09 Thread pqf
Hi, Yes, mod_fcgid search process node base on file's inode and deviceid(plus share_group_id, virtual host name). The goal is to create as less process as possible. Some administrators like the idea that all virtual hosts share one PHP process pool. (But some other don't, they can turn that

mod_fcgid: add mod_status support?

2009-11-09 Thread pqf
Hi, all I am new to this community, I am think to add mod_status support to mod_fcgid, which provide more internal information to administrators. Is it a good idea? I am working on it now, but if someone think it's not a good idea, please let me know. BTW, I did test spin lock on share

Re: mod_fcgid: add mod_status support?

2009-11-09 Thread Sander Temme
On Nov 9, 2009, at 5:51 PM, pqf wrote: Hi, all I am new to this community, I am think to add mod_status support to mod_fcgid, which provide more internal information to administrators. Is it a good idea? I am working on it now, but if someone think it's not a good idea, please let me