You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Marc Slemko <ma...@znep.com> on 1997/02/07 08:31:33 UTC
updated Agenda for 1.2b7
As always, I have missed things. Please send me any updates,
even if you have sent them before and I ignored you. <sigh>
1.2b7 status as of Fri Feb 7 00:31:07 MST 1997:
* Committed since 1.2b6:
* FIN_WAIT_2 page to documentation
* mod_info corruption bug
* mod_rewrite sizeof() bug
* allow keepalive on 304 responses
* full headers on 2xx or 3xx status
* fix extra CRLF -> buffers not flushed problem
* output all HTTP/1.1 header fields on responses
* mod_info bug fix for if sizeof(char) != 1, not that that can
happen.
* fix for Rlimit* giving a SEGV when given only one argument
* mod_rewrite update
* suexec free()ing memory while still needed
* httpd_monitor now understands current scoreboard format
* tweak byteserving code to work around Netscape bug (PDF plugin)
* autocreate Makefile in support directory
* be sure to kill timeout in util_script
* Bad handling of lang_index == -1 in is_variant_better()
* handle_multi() doesn't return content_language of negotiated file (breaks old code).
Agenda for 1.2b7-dev
====================
Patches ready for testing, voting:
* directory redirect returns 302 not 301, see PR 77
Status: Marc ready to commit, +1 Dean, Ed, Marc
* update bug report page to not have email form
Status: +1 Roy, Dean, Marc (but some changes suggested), patch
reposted with changes. Needs input from people handling
current bug reports.
New status: reposted, still need input from people handling bug
reports via mail right now.
* Patch for Hitachi HI-UX/WE2
Status: Jim posted patch, wants someone with HPUX to test
* chunked-encoding performance improvement
Dean submitted patch +1 Randy,
* directory_walk and relatives performance improvements
<Pi...@twinlark.arctic.org>
Dean submitted patch +1 Randy, Chuck
* mod_include is slow. Ed posted a patch to remove feof and
ferror from GET_CHAR. Can we do more? Yes--Ed posted another
patch, Marc posted another patch. Pick me, pick me.
* Satisfy Any can be changed if .htaccess exists
If you give Satisfy Any in access.conf for a particular directory,
and have a .htaccess in that directory, Satisfy mode reverts
to Satisfy All even if the .htaccess has _no_ authentication
directives.
Status: Ed posted patch, +1 from Paul Sutton, Dean
* user and server get confused over what should be a virtual host
and what is the main server, resulting in access to something
other than the name defined in the virtualhost directive (but
with the same IP address) failing.
Status: should be looked at, may not be a nice way to fix
since it is likely not technically a bug.
New status: Dean posted patch, Ben +1-but-hasn't tested, may
or may not be whole problem.
* conflicting definitions for is_proxy_available
status: Marc posted patch
Should be done or at least looked at before 1.2b7:
* check into the patches in the FreeBSD port; the rlimit type thing
could need to be fixed to work in 2.2 and 2.1. I think most of the
other patches are silly.
* CGI script as documentroot works in 1.1.1, not 1.2b6 [geddis@tesserae.com]
Message-ID: <Pi...@localhost.imdb.com>
* escaping '{''s in SSI has changed. Bug?
Message-ID: <Pi...@localhost.imdb.com>
* authentication handlers called more than once per request; patch
submitted [Doug MacEachern]
* fd leaks; should use pfopen() everywhere
* <!--#exec cmd="prog args\ with\ spaces"-->
doesn't work anymore. It passes THREE arguments
to prog ("args", "with" and "spaces), instead of
ONE argument ("args with spaces"). [eb@via.ecp.fr] suexec related?
* SIGHUP causes problems; both "can't bind to port" and children
not exiting. Marc has some ideas for helping the second problem.
* core dump in sub_req_lookup_file() if invalid directive in .htaccess
PR#162
* Questionable performace of mod_dir() with negotiation
PR#161
* invoke_handler() doesn't handle mime arguments in content-type
PR#160
* Memory hog in handle_multi()
PR#159
* Variant list in r->notes is deleted if request is comming through mod_dir()
PR#158
* handle_multi() doesn't copy request headers for negotiated request
PR#157
* If start twice, overwrites the PID file PR#152
* CGI outputting Location: redirect not working
This is an update to a previously submitted
bug report (see below). What seems to be
happening is that when the CGI returns a
redirect (via Location:), the new CGI gets
executed with the old "Content-Length" header
from the original POST CGI. But the content
has all already been read. I'm not an HTTP
expert but it seems like the second CGI should
not "inherit" the Content-Length header from
the first CGI. [archie@whistle.com]
Roy says "The problem is that the internal redirect is inheriting
the request state, which it should not be doing. The solution
is to replace the hack in mod_cgi with a clean request without
the old Content-Length/Transfer-Encoding fields of the original."
* some better suexec docs would be really nice, detailing some of the
security risks and compromises discussed
Status: I think Randy said something about doing it at one point,
but no one can write what I think should be there better
than me, if I ever have time.
* identitycheck and hostnamelookups not allowed in .htaccess but
documentation says they are. Update the documentation or perhaps
make them work as documented.
* redirect of index file causes SEGV [Marc]
Status: have a way to stop the core dump, but that doesn't make
it work properly.
* 64-bit issues; general cleanup, ap_snprintf("%d", (int)-1) giving
wrong behavior on Alpha boxes.
* Randy says "seems that the processes on a Unixware machine are
eventually all dying off. Mind you, I have not seen this, but
that is what is being reported. Sounds like perhaps the server is not
respawning new children after MaxRequestsPerChild has been reached."
* mod_proxy returns incorrect results when given a 'Location:'
redirect (PR#137)
* http_request.c: directory_walk() misses some <Directory ...> directives
(PR#131). I'm not sure the way things are done is really incorrect,
but should be looked at.
* error compiling on NeXT:
In file included from http_main.c:108:
/NextDeveloper/Headers/bsd/netinet/tcp.h:57: duplicate member `th_off'
/NextDeveloper/Headers/bsd/netinet/tcp.h:58: duplicate member `th_x2'
Status: unknown, NeXT versions may be hell to figure out
* suexec sets environ to local variable, possibly to overwrite
memory by too many environ variables
status: Randy looking into it; perhaps calloc array
* infinite loop in mod_imap due to parsing bug
status: Marc found problem, wants input on which way to solve
* Marc says Apache won't compile with HAVE_SNPRINTF defined as things
are now because not everything includes conf.h.
Status: Fix it when we have a platform which has snprintf. Jim
will look at; perhaps just include conf.h everywhere
* warnings in regex
Status: Roy would like to see this fixed since it makes Apache
a mess on Solaris when using -Wall. Roy will make patch.
* warning on SunOS4, http_log.c:164, pointer from int without cast
Status: Marc analyzed
* core dump if an error in .htaccess & subrequest
Status: no patch yet
Info: <la...@fee.vutbr.cz> reports that if sub_req_lookup_uri() is
called, then per_dir_config in subrequest is not initialized
until directory_walk is done. If any error is encountered during
this time, log_reason() will core dump, since it calls
get_remote_host() with r->per_dir_config.
Solution: Initialize per_dir_config in set_sub_req_protocol()
(see initialization of regular request in read_request()!).
* Solaris 2.6 apparently has a getwd() or getcwd() prototype, see PR#89,153
Status: easy to fix, but will require testing by 2.6beta person
* suexec setuid() before directory checks for nfs mounted filesystems, PR#70
Status: no patch yet
* MAXPATHLEN undefined in suexec on some systems
Status: randy looking into it(?)
* new header_parse API hook is called too often
Status: RobH posted patch, had second thoughts. He
suggests that mod_browser be optimised by detecting if it has been
called already and returning early if it has.
* lingering_close generates the following error message
shutdown: Transport endpoint is not connected - lingering_close
using 1.2b6 (only a few a day). I think this is what
happens when a client disconnects during transmission, which
is a normal condition for web servers. I suggest not logging
an error if errno == ENOTCONN.
Marc says that this may not be "normal", it may be if the client
sends a RST to terminate the connection (as per recent discussion on
end2end-interest) and it gets here before we get to that point in
lingering_close.
Status: no patch, waiting to see if it it improves debugging.
* accept errors EPROTO and ECONNABORTED should not be logged
Status: no patch, ditto above, but will require ifdefs
* SO_DEBUG in proxy_ftp.c may not be portable, see PR 116, 104
Status: Chuck says it is a leftover, will fix
* bugs in mod_negotiation (serious)
Status: reported by lampa@fee.vutbr.cz on Jan 6 to apache-bugs.
It is a very good, detailed report with patches.
* 3 seconds delay in CGI execution on SunOS 4.x, see PR 122
Status: no patch.
Info: Pages containing script output show up with a delay of 3
seconds (there was no such delay in Apache 1.1.1).
[rindfuss@medea.wz-berlin.de] tracked the problem down to
source file alloc.c, function free_proc_chain. This function
contains a conditional call to sleep(3), which causes the delay.
for (p = procs; p; p = p->next) {
if (p->kill_how == kill_after_timeout) {
/* Subprocess may be dead already. Only need the timeout if not. */
if (kill (p->pid, SIGTERM) != -1)
need_timeout = 1;
} else if (p->kill_how == kill_always) {
kill (p->pid, SIGKILL);
}
}
/* Sleep only if we have to... */
if (need_timeout) sleep (3);
[RobH: So CGI included as SSI hangs around for longer and needs
to be SIGTERM'ed. Why?]
[Roy: note also that a call to sleep will blow-out any other timeout]
Planning/design items:
* Should we change the default timeout of 1200?
Status: discussion ongoing, +1 concept Jim, Randy, Marc
* do we want a half-hearted attempt at fixing logfile opening security
holes?
Status: Jim & Randy say no How about check to be sure directory
is owned by the user that started httpd and not group
or world writable?
* should the bug report page be in CVS? Should it be in the htdocs
tree or a seperate place? Should it be distributed with Apache?
The same holds for everything on the Apache web site. Marc would
like to see it all in CVS, but not necessarily distributed
with Apache.
* should perhaps start to think about exactly how we want to
handle contrib patches/programs in 1.2. Directory on the web site?
Include in distribution?
Contrib stuff / future:
* Chris Adams <ca...@ro.com> patch to mod_log_config to add %m
and %c.
* "Large groups cause authentication errors" on FreeBSD
[salari@cs.ubc.ca]; problem looks to be MAX_STRING_LEN buffer
in groups_for_user.
* mod_log_config patch for conditional logging
Status: contrib, not in server
* Jim has patch for time taken to handle a request in status module
* Ed has an updated patch for limiting connections per IP
* mod_include is still slow.
* Some mirrors are out-of-date, Brian will investigate
Re: updated Agenda for 1.2b7
Posted by Ed Korthof <ed...@organic.com>.
On Feb 7, 12:31am, Marc Slemko wrote:
> Subject: updated Agenda for 1.2b7
> As always, I have missed things. Please send me any updates,
> even if you have sent them before and I ignored you. <sigh>
>
> * new header_parse API hook is called too often
> Status: RobH posted patch, had second thoughts. He
> suggests that mod_browser be optimised by detecting if it has been
> called already and returning early if it has.
I'm working on this one; I'd like to make a more generalized way that modules
can figure out if they've been called already for a given request.
> * accept errors EPROTO and ECONNABORTED should not be logged
> Status: no patch, ditto above, but will require ifdefs
See attached patch. Should we ignore the same error codes for 'select' as
well?
> * do we want a half-hearted attempt at fixing logfile opening security
> holes?
> Status: Jim & Randy say no How about check to be sure directory
> is owned by the user that started httpd and not group
> or world writable?
That check would be fine with me, so long as it was configurable (and well
documented; the server should probably die with an appropriate error message
(including how to turn this off) if the check fails).
>-- End of excerpt from Marc Slemko
--
-- Ed Korthof | Web Server Engineer --
-- ed@organic.com | Organic Online, Inc --
-- (415) 278-5676 | Fax: (415) 284-6891 --
Re: updated Agenda for 1.2b7
Posted by Dean Gaudet <dg...@arctic.org>.
On Fri, 7 Feb 1997, Marc Slemko wrote:
> As always, I have missed things. Please send me any updates,
> even if you have sent them before and I ignored you. <sigh>
Happy to oblige :)
> * chunked-encoding performance improvement
> Dean submitted patch +1 Randy,
+1 from Chuck too.
> * user and server get confused over what should be a virtual host
> and what is the main server, resulting in access to something
> other than the name defined in the virtualhost directive (but
> with the same IP address) failing.
> Status: should be looked at, may not be a nice way to fix
> since it is likely not technically a bug.
>
> New status: Dean posted patch, Ben +1-but-hasn't tested, may
> or may not be whole problem.
Randy gave it +1.
> * conflicting definitions for is_proxy_available
> status: Marc posted patch
I'll give this a +1.
> * authentication handlers called more than once per request; patch
> submitted [Doug MacEachern]
I'll give this a +1.
> * fd leaks; should use pfopen() everywhere
Ed gave Roy's patch a +1, I'll add my +1.
> * 64-bit issues; general cleanup, ap_snprintf("%d", (int)-1) giving
> wrong behavior on Alpha boxes.
I posted a patch with a goto, Jim gave it +1 complaining about the goto
:), #ken rewrote it without the goto. +1 to #ken's patch.
> * should perhaps start to think about exactly how we want to
> handle contrib patches/programs in 1.2. Directory on the web site?
> Include in distribution?
Directory on the web site.
Dean
Re: updated Agenda for 1.2b7
Posted by Rob Hartill <ro...@imdb.com>.
> * CGI outputting Location: redirect not working
> This is an update to a previously submitted
> bug report (see below). What seems to be
> happening is that when the CGI returns a
> redirect (via Location:), the new CGI gets
> executed with the old "Content-Length" header
> from the original POST CGI. But the content
> has all already been read. I'm not an HTTP
> expert but it seems like the second CGI should
> not "inherit" the Content-Length header from
> the first CGI. [archie@whistle.com]
>
> Roy says "The problem is that the internal redirect is inheriting
> the request state, which it should not be doing. The solution
> is to replace the hack in mod_cgi with a clean request without
> the old Content-Length/Transfer-Encoding fields of the original."
This appears to work fine:
Index: http_protocol.c
===================================================================
RCS file: /export/home/cvs/apache/src/http_protocol.c,v
retrieving revision 1.12
diff -u -r1.12 http_protocol.c
--- http_protocol.c 1997/01/31 22:26:42 1.12
+++ http_protocol.c 1997/02/07 01:53:58
@@ -1186,7 +1186,7 @@
int should_client_block (request_rec *r)
{
- if (is_HTTP_ERROR(r->status))
+ if (is_HTTP_ERROR(r->status) || r->method_number == M_GET)
return 0;
if (!r->read_chunked && (r->remaining <= 0))
I fear there will be unexpected side-effects
if mod_cgi is changed to use a use a new request. A cleanup can
wait for 2.0 IMO.
Re: [PATCH] multiple matches at same level
Posted by Dean Gaudet <dg...@arctic.org>.
On Sun, 16 Feb 1997, Marc Slemko wrote:
> This patch was committed in Dean's performance enhancement patches
> (97/02/10 07:17:46).
Aw shoot, sorry about that. I tried to be careful not to mix my patches.
Dean
Re: [PATCH] multiple matches at same level
Posted by Marc Slemko <ma...@znep.com>.
On Fri, 7 Feb 1997, Dean Gaudet wrote:
> On Fri, 7 Feb 1997, Marc Slemko wrote:
> > * http_request.c: directory_walk() misses some <Directory ...> directives
> > (PR#131). I'm not sure the way things are done is really incorrect,
> > but should be looked at.
>
> The complaint is that if two <Directory>s match the same dir (at the same
> level, i.e. <Directory /a/b> and later on another <Directory /a/b>) that
> it ignores the first one. I posted on this earlier saying that the patch
> supplied works but wondered if we wanted to support it this way. After
> looking at the code again I noticed that <Location> and <File> already
> behave in this manner (for obvious reasons). So I'm resubmitting the
> patch with my vote.
This patch was committed in Dean's performance enhancement patches
(97/02/10 07:17:46).
I don't recall discussion of that. Was it intentional, or did it
accidently slip in there?
If we are keeping it (the whole reason I noticed it is because I was going
to +1 the patch...) then I will close the PR and commit a spacing change
so things are indented correctly; right now it only lines up right if you
have ts=6.
If not, we should get rid of it. I would recommend keeping it.
>
> One issue I had with it was that by doing this we don't allow ourselves to
> implement a "short circuit" optimization in directory_walk(). But I'm now
> of the opinion that directory_walk() is just poorly implemented (it works,
> but it's definately the brute-force method) and that there is significant
> room for other optimization that would eliminate the benefit from such
> a short-circuit. In particular, the <Directory>/<Location>/<File>
> stuff is static once the config is read, other than .htaccess files.
> It might be possible to redo this using lexical scanning techniques, which
> fall back to .htaccess and brute-force only when the config requires it.
> (I know that high-end servers generally don't require it, 'cause they
> can run AllowOverrides None.) Apache 2.0.
>
> Dean
>
> Index: http_request.c
> ===================================================================
> RCS file: /export/home/cvs/apache/src/http_request.c,v
> retrieving revision 1.40
> diff -c -3 -r1.40 http_request.c
> *** http_request.c 1997/01/25 15:44:39 1.40
> --- http_request.c 1997/02/01 21:40:32
> ***************
> *** 370,384 ****
> }
> else if (!strcmp (this_dir, entry_dir))
> this_conf = entry_config;
> - }
>
> ! if (this_conf)
> ! {
> ! per_dir_defaults =
> ! merge_per_dir_configs (r->pool, per_dir_defaults, this_conf);
> ! core_dir =(core_dir_config *)get_module_config(per_dir_defaults,
> &core_module);
> }
> overrides_here = core_dir->override;
>
> /* If .htaccess files are enabled, check for one.
> --- 370,385 ----
> }
> else if (!strcmp (this_dir, entry_dir))
> this_conf = entry_config;
>
> ! if (this_conf)
> ! {
> ! per_dir_defaults =
> ! merge_per_dir_configs (r->pool, per_dir_defaults, this_conf);
> ! core_dir =(core_dir_config *)get_module_config(per_dir_defaults,
> &core_module);
> + }
> }
> +
> overrides_here = core_dir->override;
>
> /* If .htaccess files are enabled, check for one.
>
>
>
>
>
[PATCH] multiple matches at same level
Posted by Dean Gaudet <dg...@arctic.org>.
On Fri, 7 Feb 1997, Marc Slemko wrote:
> * http_request.c: directory_walk() misses some <Directory ...> directives
> (PR#131). I'm not sure the way things are done is really incorrect,
> but should be looked at.
The complaint is that if two <Directory>s match the same dir (at the same
level, i.e. <Directory /a/b> and later on another <Directory /a/b>) that
it ignores the first one. I posted on this earlier saying that the patch
supplied works but wondered if we wanted to support it this way. After
looking at the code again I noticed that <Location> and <File> already
behave in this manner (for obvious reasons). So I'm resubmitting the
patch with my vote.
One issue I had with it was that by doing this we don't allow ourselves to
implement a "short circuit" optimization in directory_walk(). But I'm now
of the opinion that directory_walk() is just poorly implemented (it works,
but it's definately the brute-force method) and that there is significant
room for other optimization that would eliminate the benefit from such
a short-circuit. In particular, the <Directory>/<Location>/<File>
stuff is static once the config is read, other than .htaccess files.
It might be possible to redo this using lexical scanning techniques, which
fall back to .htaccess and brute-force only when the config requires it.
(I know that high-end servers generally don't require it, 'cause they
can run AllowOverrides None.) Apache 2.0.
Dean
Index: http_request.c
===================================================================
RCS file: /export/home/cvs/apache/src/http_request.c,v
retrieving revision 1.40
diff -c -3 -r1.40 http_request.c
*** http_request.c 1997/01/25 15:44:39 1.40
--- http_request.c 1997/02/01 21:40:32
***************
*** 370,384 ****
}
else if (!strcmp (this_dir, entry_dir))
this_conf = entry_config;
- }
! if (this_conf)
! {
! per_dir_defaults =
! merge_per_dir_configs (r->pool, per_dir_defaults, this_conf);
! core_dir =(core_dir_config *)get_module_config(per_dir_defaults,
&core_module);
}
overrides_here = core_dir->override;
/* If .htaccess files are enabled, check for one.
--- 370,385 ----
}
else if (!strcmp (this_dir, entry_dir))
this_conf = entry_config;
! if (this_conf)
! {
! per_dir_defaults =
! merge_per_dir_configs (r->pool, per_dir_defaults, this_conf);
! core_dir =(core_dir_config *)get_module_config(per_dir_defaults,
&core_module);
+ }
}
+
overrides_here = core_dir->override;
/* If .htaccess files are enabled, check for one.