You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ic...@apache.org on 2017/08/10 13:58:26 UTC
svn commit: r1804671 - /httpd/httpd/trunk/modules/md/mod_md_config.c
Author: icing
Date: Thu Aug 10 13:58:26 2017
New Revision: 1804671
URL: http://svn.apache.org/viewvc?rev=1804671&view=rev
Log:
fix for <ManagedDomain sections with inner <If or other sections
Modified:
httpd/httpd/trunk/modules/md/mod_md_config.c
Modified: httpd/httpd/trunk/modules/md/mod_md_config.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/md/mod_md_config.c?rev=1804671&r1=1804670&r2=1804671&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/md/mod_md_config.c (original)
+++ httpd/httpd/trunk/modules/md/mod_md_config.c Thu Aug 10 13:58:26 2017
@@ -121,17 +121,20 @@ void *md_config_merge_dir(apr_pool_t *po
return n;
}
-static int inside_section(cmd_parms *cmd) {
- return (cmd->directive->parent
- && !ap_cstr_casecmp(cmd->directive->parent->directive, "<ManagedDomain"));
+static int inside_section(cmd_parms *cmd, const char *section) {
+ ap_directive_t *d;
+ for (d = cmd->directive->parent; d; d = d->parent) {
+ if (!ap_cstr_casecmp(d->directive, section)) {
+ return 1;
+ }
+ }
+ return 0;
}
-static const char *md_section_check(cmd_parms *cmd) {
- if (!inside_section(cmd)) {
- return apr_pstrcat(cmd->pool, cmd->cmd->name,
- " is only valid inside a <ManagedDomain context, not ",
- cmd->directive->parent? cmd->directive->parent->directive : "root",
- NULL);
+static const char *md_section_check(cmd_parms *cmd, const char *section) {
+ if (!inside_section(cmd, section)) {
+ return apr_pstrcat(cmd->pool, cmd->cmd->name, " is only valid inside a '",
+ section, "' context, not here", NULL);
}
return NULL;
}
@@ -215,7 +218,7 @@ static const char *md_config_sec_add_mem
const char *err;
int i;
- if (NULL != (err = md_section_check(cmd))) {
+ if (NULL != (err = md_section_check(cmd, "<ManagedDomain"))) {
if (argc == 1) {
/* only allowed value outside a section */
return set_transitive(&config->transitive, argv[0]);
@@ -275,7 +278,7 @@ static const char *md_config_set_ca(cmd_
md_config_t *config = (md_config_t *)md_config_get(cmd->server);
const char *err;
- if (inside_section(cmd)) {
+ if (inside_section(cmd, "<ManagedDomain")) {
md_config_dir_t *dconf = dc;
dconf->md->ca_url = value;
}
@@ -293,7 +296,7 @@ static const char *md_config_set_ca_prot
md_config_t *config = (md_config_t *)md_config_get(cmd->server);
const char *err;
- if (inside_section(cmd)) {
+ if (inside_section(cmd, "<ManagedDomain")) {
md_config_dir_t *dconf = dc;
dconf->md->ca_proto = value;
}
@@ -311,7 +314,7 @@ static const char *md_config_set_agreeme
md_config_t *config = (md_config_t *)md_config_get(cmd->server);
const char *err;
- if (inside_section(cmd)) {
+ if (inside_section(cmd, "<ManagedDomain")) {
md_config_dir_t *dconf = dc;
dconf->md->ca_agreement = value;
}
@@ -343,7 +346,7 @@ static const char *md_config_set_drive_m
return apr_pstrcat(cmd->pool, "unknown MDDriveMode ", value, NULL);
}
- if (inside_section(cmd)) {
+ if (inside_section(cmd, "<ManagedDomain")) {
md_config_dir_t *dconf = dc;
dconf->md->drive_mode = drive_mode;
}
@@ -399,7 +402,7 @@ static const char *md_config_set_renew_w
return "MDRenewWindow has wrong format";
}
- if (inside_section(cmd)) {
+ if (inside_section(cmd, "<ManagedDomain")) {
md_config_dir_t *dconf = dc;
dconf->md->renew_window = timeout;
}
@@ -487,7 +490,7 @@ static const char *md_config_set_cha_tye
const char *err;
int i;
- if (inside_section(cmd)) {
+ if (inside_section(cmd, "<ManagedDomain")) {
md_config_dir_t *dconf = dc;
pcha = &dconf->md->ca_challenges;
}
Re: svn commit: r1804671 - /httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Greg Stein <gs...@gmail.com>.
Oh, I don't know that Infra has any specific request on the restart/update
mechanism. I'd just say: build it how you think best. What would work for
Everybody should work just fine for us.
On Mon, Aug 14, 2017 at 2:09 AM, Stefan Eissing <
stefan.eissing@greenbytes.de> wrote:
> Thanks for the feedback and the crosspost. I think it would be great to
> offer peeps
> that already link serf into their server to avoid an additional dependency.
>
> Regarding Apache infrastructure use:
>
> Would you prefer that the server gracefully restarts itself (when needed,
> at a time
> interval configured?) or is this something where you prefer outside
> control anyway and
> maybe a callable script that notifies/mails an admin?
>
> -Stefan
>
> > Am 14.08.2017 um 07:43 schrieb Greg Stein <gs...@gmail.com>:
> >
> > [cc: serf]
> >
> > On Fri, Aug 11, 2017 at 3:41 AM, Stefan Eissing <
> stefan.eissing@greenbytes.de> wrote:
> > >...
> > If you're looking at this anyway, how hard would it be for someone
> knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
> >
> > Should be pretty easy, I think. Looking at serf_get.c will give somebody
> an easy path to build the alternative:
> > http://svn.apache.org/repos/asf/serf/trunk/test/serf_get.c
> >
> > There is a lot of stuff in there that isn't applicable, so the core
> should be quite small/easy. And it uses APR pools (and whatnot), so the
> impedance should be very low.
> >
> > While I'm busy over in Infra-land, there are other Serf people here and
> happy to help. I'll certainly throw in on some reviews, if/when I see the
> commits.
> >
> > And from ASF/Infra side: we'd love to see this code hit a release soon.
> We've been very hesitant to use LE in our deployments because the httpd and
> puppet config/scripts are quite rough. It doesn't "Just Work". This would
> go a long ways towards solving numerous certificate-related issues for us.
> >
> > Thanks,
> > -g
> >
>
>
Re: svn commit: r1804671 - /httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Greg Stein <gs...@gmail.com>.
Oh, I don't know that Infra has any specific request on the restart/update
mechanism. I'd just say: build it how you think best. What would work for
Everybody should work just fine for us.
On Mon, Aug 14, 2017 at 2:09 AM, Stefan Eissing <
stefan.eissing@greenbytes.de> wrote:
> Thanks for the feedback and the crosspost. I think it would be great to
> offer peeps
> that already link serf into their server to avoid an additional dependency.
>
> Regarding Apache infrastructure use:
>
> Would you prefer that the server gracefully restarts itself (when needed,
> at a time
> interval configured?) or is this something where you prefer outside
> control anyway and
> maybe a callable script that notifies/mails an admin?
>
> -Stefan
>
> > Am 14.08.2017 um 07:43 schrieb Greg Stein <gs...@gmail.com>:
> >
> > [cc: serf]
> >
> > On Fri, Aug 11, 2017 at 3:41 AM, Stefan Eissing <
> stefan.eissing@greenbytes.de> wrote:
> > >...
> > If you're looking at this anyway, how hard would it be for someone
> knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
> >
> > Should be pretty easy, I think. Looking at serf_get.c will give somebody
> an easy path to build the alternative:
> > http://svn.apache.org/repos/asf/serf/trunk/test/serf_get.c
> >
> > There is a lot of stuff in there that isn't applicable, so the core
> should be quite small/easy. And it uses APR pools (and whatnot), so the
> impedance should be very low.
> >
> > While I'm busy over in Infra-land, there are other Serf people here and
> happy to help. I'll certainly throw in on some reviews, if/when I see the
> commits.
> >
> > And from ASF/Infra side: we'd love to see this code hit a release soon.
> We've been very hesitant to use LE in our deployments because the httpd and
> puppet config/scripts are quite rough. It doesn't "Just Work". This would
> go a long ways towards solving numerous certificate-related issues for us.
> >
> > Thanks,
> > -g
> >
>
>
Re: svn commit: r1804671 -
/httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Stefan Eissing <st...@greenbytes.de>.
Thanks for the feedback and the crosspost. I think it would be great to offer peeps
that already link serf into their server to avoid an additional dependency.
Regarding Apache infrastructure use:
Would you prefer that the server gracefully restarts itself (when needed, at a time
interval configured?) or is this something where you prefer outside control anyway and
maybe a callable script that notifies/mails an admin?
-Stefan
> Am 14.08.2017 um 07:43 schrieb Greg Stein <gs...@gmail.com>:
>
> [cc: serf]
>
> On Fri, Aug 11, 2017 at 3:41 AM, Stefan Eissing <st...@greenbytes.de> wrote:
> >...
> If you're looking at this anyway, how hard would it be for someone knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
>
> Should be pretty easy, I think. Looking at serf_get.c will give somebody an easy path to build the alternative:
> http://svn.apache.org/repos/asf/serf/trunk/test/serf_get.c
>
> There is a lot of stuff in there that isn't applicable, so the core should be quite small/easy. And it uses APR pools (and whatnot), so the impedance should be very low.
>
> While I'm busy over in Infra-land, there are other Serf people here and happy to help. I'll certainly throw in on some reviews, if/when I see the commits.
>
> And from ASF/Infra side: we'd love to see this code hit a release soon. We've been very hesitant to use LE in our deployments because the httpd and puppet config/scripts are quite rough. It doesn't "Just Work". This would go a long ways towards solving numerous certificate-related issues for us.
>
> Thanks,
> -g
>
Re: svn commit: r1804671 -
/httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Stefan Eissing <st...@greenbytes.de>.
Thanks for the feedback and the crosspost. I think it would be great to offer peeps
that already link serf into their server to avoid an additional dependency.
Regarding Apache infrastructure use:
Would you prefer that the server gracefully restarts itself (when needed, at a time
interval configured?) or is this something where you prefer outside control anyway and
maybe a callable script that notifies/mails an admin?
-Stefan
> Am 14.08.2017 um 07:43 schrieb Greg Stein <gs...@gmail.com>:
>
> [cc: serf]
>
> On Fri, Aug 11, 2017 at 3:41 AM, Stefan Eissing <st...@greenbytes.de> wrote:
> >...
> If you're looking at this anyway, how hard would it be for someone knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
>
> Should be pretty easy, I think. Looking at serf_get.c will give somebody an easy path to build the alternative:
> http://svn.apache.org/repos/asf/serf/trunk/test/serf_get.c
>
> There is a lot of stuff in there that isn't applicable, so the core should be quite small/easy. And it uses APR pools (and whatnot), so the impedance should be very low.
>
> While I'm busy over in Infra-land, there are other Serf people here and happy to help. I'll certainly throw in on some reviews, if/when I see the commits.
>
> And from ASF/Infra side: we'd love to see this code hit a release soon. We've been very hesitant to use LE in our deployments because the httpd and puppet config/scripts are quite rough. It doesn't "Just Work". This would go a long ways towards solving numerous certificate-related issues for us.
>
> Thanks,
> -g
>
Re: svn commit: r1804671 - /httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Greg Stein <gs...@gmail.com>.
[cc: serf]
On Fri, Aug 11, 2017 at 3:41 AM, Stefan Eissing <
stefan.eissing@greenbytes.de> wrote:
>...
> If you're looking at this anyway, how hard would it be for someone
> knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
>
Should be pretty easy, I think. Looking at serf_get.c will give somebody an
easy path to build the alternative:
http://svn.apache.org/repos/asf/serf/trunk/test/serf_get.c
There is a lot of stuff in there that isn't applicable, so the core should
be quite small/easy. And it uses APR pools (and whatnot), so the impedance
should be very low.
While I'm busy over in Infra-land, there are other Serf people here and
happy to help. I'll certainly throw in on some reviews, if/when I see the
commits.
And from ASF/Infra side: we'd love to see this code hit a release soon.
We've been very hesitant to use LE in our deployments because the httpd and
puppet config/scripts are quite rough. It doesn't "Just Work". This would
go a long ways towards solving numerous certificate-related issues for us.
Thanks,
-g
Re: svn commit: r1804671 - /httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Greg Stein <gs...@gmail.com>.
[cc: serf]
On Fri, Aug 11, 2017 at 3:41 AM, Stefan Eissing <
stefan.eissing@greenbytes.de> wrote:
>...
> If you're looking at this anyway, how hard would it be for someone
> knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
>
Should be pretty easy, I think. Looking at serf_get.c will give somebody an
easy path to build the alternative:
http://svn.apache.org/repos/asf/serf/trunk/test/serf_get.c
There is a lot of stuff in there that isn't applicable, so the core should
be quite small/easy. And it uses APR pools (and whatnot), so the impedance
should be very low.
While I'm busy over in Infra-land, there are other Serf people here and
happy to help. I'll certainly throw in on some reviews, if/when I see the
commits.
And from ASF/Infra side: we'd love to see this code hit a release soon.
We've been very hesitant to use LE in our deployments because the httpd and
puppet config/scripts are quite rough. It doesn't "Just Work". This would
go a long ways towards solving numerous certificate-related issues for us.
Thanks,
-g
Re: svn commit: r1804671 -
/httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Stefan Eissing <st...@greenbytes.de>.
Correct, changed in r1804759.
If you're looking at this anyway, how hard would it be for someone knowledgeable to make a md_serf.c as alternative to md_curl.c? ^^
Cheers,
-Stefan
> Am 11.08.2017 um 01:18 schrieb Greg Stein <gs...@gmail.com>:
>
> On Thu, Aug 10, 2017 at 8:58 AM, <ic...@apache.org> wrote:
> Author: icing
> Date: Thu Aug 10 13:58:26 2017
> New Revision: 1804671
>
> URL: http://svn.apache.org/viewvc?rev=1804671&view=rev
> Log:
> fix for <ManagedDomain sections with inner <If or other sections
> >...
> +++ httpd/httpd/trunk/modules/md/mod_md_config.c Thu Aug 10 13:58:26 2017
> >...
> @@ -215,7 +218,7 @@ static const char *md_config_sec_add_mem
> const char *err;
> int i;
>
> - if (NULL != (err = md_section_check(cmd))) {
> + if (NULL != (err = md_section_check(cmd, "<ManagedDomain"))) {
>
> Seems you should be using a symbolic constant for the dozen occurrences of this string, in order to avoid typos.
>
> >...
>
> Cheers,
> -g
>
Re: svn commit: r1804671 - /httpd/httpd/trunk/modules/md/mod_md_config.c
Posted by Greg Stein <gs...@gmail.com>.
On Thu, Aug 10, 2017 at 8:58 AM, <ic...@apache.org> wrote:
> Author: icing
> Date: Thu Aug 10 13:58:26 2017
> New Revision: 1804671
>
> URL: http://svn.apache.org/viewvc?rev=1804671&view=rev
> Log:
> fix for <ManagedDomain sections with inner <If or other sections
>
>...
> +++ httpd/httpd/trunk/modules/md/mod_md_config.c Thu Aug 10 13:58:26 2017
>
>...
> @@ -215,7 +218,7 @@ static const char *md_config_sec_add_mem
> const char *err;
> int i;
>
> - if (NULL != (err = md_section_check(cmd))) {
> + if (NULL != (err = md_section_check(cmd, "<ManagedDomain"))) {
>
Seems you should be using a symbolic constant for the dozen occurrences of
this string, in order to avoid typos.
>...
Cheers,
-g