You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Erwin Hogeweg <er...@me.com> on 2013/11/02 05:20:13 UTC
Segmentation fault in webdav after upgrading to 1.7 on CentOS - Need
new ideas
Hi,
We upgraded subversion from 1.6 to 1.7, but can't get the WebDAV online anymore. As far as we can see everything appears to be set up correctly. Would appreciate if somebody could give a pointer or two on how to debug this further.
OS: CENTOS 6.4 x86_64
SVN: subversion 1.7.13
svn is build with:
./configure --with-apxs=/usr/local/apache/bin/apxs --with-apr=/usr/local/apache --with-apr-util=/usr/local/apache --with-ssl && make && make install
This is included from httpd.conf:
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module modules/mod_authz_svn.so
<Location /svn>
DAV svn
SVNParentPath /var/svn/repos
AuthzSVNAccessFile /etc/svn-acl-conf
AuthType Basic
AuthName "My repository"
AuthUserFile /etc/svn-auth-conf
Require valid-user
</Location>
Apache error_log
[Fri Nov 01 19:26:09 2013] [notice] SSL FIPS mode disabled
[Fri Nov 01 19:26:09 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/local/apache/bin/suexec)
[Fri Nov 01 19:26:09 2013] [notice] ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/) configured.
[Fri Nov 01 19:26:09 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.4.6"
[Fri Nov 01 19:26:09 2013] [notice] ModSecurity: PCRE compiled version="8.21 "; loaded version="8.21 2011-12-12"
[Fri Nov 01 19:26:09 2013] [notice] ModSecurity: LIBXML compiled version="2.9.0"
[Fri Nov 01 19:26:10 2013] [notice] SSL FIPS mode disabled
[Fri Nov 01 19:26:10 2013] [notice] Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 SVN/1.7.13 configured -- resuming normal operations
[Fri Nov 01 19:26:27 2013] [notice] child pid 1473 exit signal Segmentation fault (11)
[Fri Nov 01 19:26:29 2013] [notice] child pid 1548 exit signal Segmentation fault (11)
[Fri Nov 01 19:26:31 2013] [notice] child pid 1615 exit signal Segmentation fault (11)
[Fri Nov 01 19:26:33 2013] [notice] child pid 1683 exit signal Segmentation fault (11)
I am lost. Any suggestions are greatly appreciated.
Kind Regards,
Erwin
Re: Segmentation fault in webdav after upgrading to 1.7 on CentOS -
Need new ideas
Posted by Nico Kadel-Garcia <nk...@gmail.com>.
RHEL and thus CentOS don't publish Subversion 1.7 RPM's, so I see that
you're using a locally compiled package. You could try the Repoforge RPM's,
from the Repoforge "extras" repository: Unfortunately, that package is a
bit out of date and doesn't look like it will get updated soon. I urge you
to go look at https://github.com/nkadel/subversion-1.7.x-srpm. and my tools
there, for building RHEL 6 or CentOS compatible RPM's. If nothing else, it
lists all the dependencies, so that you can be sure all the dependencies
are in place at compile time. And installing the RPM's will replace the
packages from older Subversion installations: getting them out of the way
is pretty important.
Cleaning up from the previous manual installations of Subversion and httpd
is left as an exercise for the admin.
I also conclude from your use of "-with-apxs=/usr/local/apache/bin/apxs"
that you're working from a locally built Apache. *DON'T DO THIS*. Building
core utilities out of sync with the libraries and dependencies that come
with the operating system itself is begging for serious maintenance pain.
If you have to build an updated httpd, *build an RPM* if possible, so that
the testable integration and layout of other components such as Subversion
don't have to be tweaked for incompatible local installations.
If you have other services that require an out-of-band built httpd, and you
have to run Subversion on the same server, and you have to maintain your
own versions of all these components, then maybe it's time to rethink the
architecture of your setup.
Nico Kadel-Garcia
On Sat, Nov 2, 2013 at 12:20 AM, Erwin Hogeweg <er...@me.com> wrote:
> Hi,
>
> We upgraded subversion from 1.6 to 1.7, but can't get the WebDAV online
> anymore. As far as we can see everything appears to be set up correctly.
> Would appreciate if somebody could give a pointer or two on how to debug
> this further.
>
> OS: CENTOS 6.4 x86_64
> SVN: subversion 1.7.13
>
> svn is build with:
> ./configure --with-apxs=/usr/local/apache/bin/apxs
> --with-apr=/usr/local/apache --with-apr-util=/usr/local/apache --with-ssl
> && make && make install
>
> This is included from httpd.conf:
> LoadModule dav_svn_module modules/mod_dav_svn.so
> LoadModule authz_svn_module modules/mod_authz_svn.so
>
> <Location /svn>
> DAV svn
> SVNParentPath /var/svn/repos
> AuthzSVNAccessFile /etc/svn-acl-conf
> AuthType Basic
> AuthName "My repository"
> AuthUserFile /etc/svn-auth-conf
> Require valid-user
> </Location>
>
> Apache error_log
> [Fri Nov 01 19:26:09 2013] [notice] SSL FIPS mode disabled
> [Fri Nov 01 19:26:09 2013] [notice] suEXEC mechanism enabled (wrapper:
> /usr/local/apache/bin/suexec)
> [Fri Nov 01 19:26:09 2013] [notice] ModSecurity for Apache/2.7.3 (
> http://www.modsecurity.org/) configured.
> [Fri Nov 01 19:26:09 2013] [notice] ModSecurity: APR compiled
> version="1.4.6"; loaded version="1.4.6"
> [Fri Nov 01 19:26:09 2013] [notice] ModSecurity: PCRE compiled
> version="8.21 "; loaded version="8.21 2011-12-12"
> [Fri Nov 01 19:26:09 2013] [notice] ModSecurity: LIBXML compiled
> version="2.9.0"
> [Fri Nov 01 19:26:10 2013] [notice] SSL FIPS mode disabled
> [Fri Nov 01 19:26:10 2013] [notice] Apache/2.2.24 (Unix) mod_ssl/2.2.24
> OpenSSL/1.0.0-fips DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4
> FrontPage/5.0.2.2635 SVN/1.7.13 configured -- resuming normal operations
> [Fri Nov 01 19:26:27 2013] [notice] child pid 1473 exit signal
> Segmentation fault (11)
> [Fri Nov 01 19:26:29 2013] [notice] child pid 1548 exit signal
> Segmentation fault (11)
> [Fri Nov 01 19:26:31 2013] [notice] child pid 1615 exit signal
> Segmentation fault (11)
> [Fri Nov 01 19:26:33 2013] [notice] child pid 1683 exit signal
> Segmentation fault (11)
>
> I am lost. Any suggestions are greatly appreciated.
>
> Kind Regards,
>
> Erwin
>
Re: Segmentation fault in webdav after upgrading to 1.7 on CentOS
- Need new ideas
Posted by Branko Čibej <br...@wandisco.com>.
On 04.11.2013 01:02, Erwin Hogeweg wrote:
> Hi Ben,
>
> Thanks for the response. It looks like applying the patch solved the
> problem. I am able to connect to the repo again. Pfew.
>
> I had to disable this mod_sec rule in order to make it work though:
>
> # allow request methods
> #SecRule REQUEST_METHOD "!^((?:(?:POS|GE)T|OPTIONS|HEAD))$" \
> # "phase:2,t:none,log,auditlog,status:501,msg:'Method is not
> allowed by policy',
> severity:'2',id:'960032',tag:'POLICY/METHOD_NOT_ALLOWED'"
>
> Do you have any thoughts (good/bad/ugly) on that?
Subversion will most definitely not work against an (HTTP) server that
only allows POST, GET, OPTIONS and HEAD request methods. This is
documented in our FAQ:
http://subversion.apache.org/faq.html#http-methods
-- Brane
--
Branko Čibej | Director of Subversion
WANdisco // Non-Stop Data
e. brane@wandisco.com
Re: Segmentation fault in webdav after upgrading to 1.7 on CentOS
- Need new ideas
Posted by Ben Reser <be...@reser.org>.
On 11/3/13 4:02 PM, Erwin Hogeweg wrote:
> Thanks for the response. It looks like applying the patch solved the problem. I
> am able to connect to the repo again. Pfew.
Glad to help. Something roughly equivalent to that patch will be included in
the next release. So you shouldn't need that patch forever.
> I had to disable this mod_sec rule in order to make it work though:
>
> # allow request methods
> #SecRule REQUEST_METHOD "!^((?:(?:POS|GE)T|OPTIONS|HEAD))$" \
> # "phase:2,t:none,log,auditlog,status:501,msg:'Method is not allowed by
> policy', severity:'2',id:'960032',tag:'POLICY/METHOD_NOT_ALLOWED'"
>
> Do you have any thoughts (good/bad/ugly) on that?
I've personally never used mod_security with Subversion so I can't make a very
definitive statement regarding it.
Subversion 1.8 clients use chunked http requests and older versions of
mod_security didn't allow chunked http requests. So I'd at least recommend
that you make sure you have a recent version of it.
Other than that I don't have anything additional to add other than what Branko
already told you.
Re: Segmentation fault in webdav after upgrading to 1.7 on CentOS -
Need new ideas
Posted by Erwin Hogeweg <er...@me.com>.
Hi Ben,
Thanks for the response. It looks like applying the patch solved the problem. I am able to connect to the repo again. Pfew.
I had to disable this mod_sec rule in order to make it work though:
# allow request methods
#SecRule REQUEST_METHOD "!^((?:(?:POS|GE)T|OPTIONS|HEAD))$" \
# "phase:2,t:none,log,auditlog,status:501,msg:'Method is not allowed by policy', severity:'2',id:'960032',tag:'POLICY/METHOD_NOT_ALLOWED'"
Do you have any thoughts (good/bad/ugly) on that?
Thanks,
Erwin
On Nov 2, 2013, at 1:04 AM, Ben Reser <be...@reser.org> wrote:
> On 11/1/13 9:20 PM, Erwin Hogeweg wrote:
>> We upgraded subversion from 1.6 to 1.7, but can't get the WebDAV online
>> anymore. As far as we can see everything appears to be set up correctly. Would
>> appreciate if somebody could give a pointer or two on how to debug this further.
>
> Give the patch here a try:
> https://mail-archives.apache.org/mod_mbox/subversion-users/201310.mbox/%3C5271AB05.5050802%40reser.org%3E
>
>
Re: Segmentation fault in webdav after upgrading to 1.7 on CentOS
- Need new ideas
Posted by Ben Reser <be...@reser.org>.
On 11/1/13 9:20 PM, Erwin Hogeweg wrote:
> We upgraded subversion from 1.6 to 1.7, but can't get the WebDAV online
> anymore. As far as we can see everything appears to be set up correctly. Would
> appreciate if somebody could give a pointer or two on how to debug this further.
Give the patch here a try:
https://mail-archives.apache.org/mod_mbox/subversion-users/201310.mbox/%3C5271AB05.5050802%40reser.org%3E