Discussion mod_jk and mod_dir interaction

[Rainer Jung <ra...@kippdata.de>]

Hi,

I want to find out how to correctly fix BZ 41430 and 36121. They have to 
do with the way mod_dir and mod_jk interact. Before fixing the code I 
find it necessary to define the correct behaviour, which seems to be 
non-trivial.

The behaviour needs to be described depending on DirectoryIndex and 
"JkOptions ForwardDirectories".

I try to answer via two general rules, that I suggest:

A) The first entry in DirectoryIndex that exists either locally or 
matches a JkMount stops the procedure. If it exists locally it gets 
served by Apache, if it matches a JkMount and does not exist locally it 
gets forwarded to Tomcat.

B) If no entry in DirectoryIndex exists locally or matches a JkMount, 
the Option ForwardDirectories decides: Off=Apache, On=Tomcat. The 
forwarded request is the original request without any DirectoryIndex files.

I haven't checked, if this can be implemented easily. I first want to 
know, if this seems like a reasonable behaviour?

The downside is: If you have "JkMount /*.jsp w" and "DirectoryIndex 
index.jsp", Apache will send all dirs with index.jsp to Tomcat.

Here are some cases:

Assume we have DirectoryIndex file1 file2 and we process a request 
/test/ which points to /path/test/.

1) Non of the files /path/test/file1 and /path/test/file2 exist, non of 
them matches any JkMount.

a) ForwardDirectories is not set: Apache tries to serve the directory 
/path/test/

b) ForwardDirectories is set: We forward the original request to Tomcat 
(/test/) without file1 or file2.

2) Non of the files /path/test/file1 and /path/test/file2 exist, but one 
of them (assume file1) matches a JkMount.

We forward /test/file1.

3) At least one of the files exists (assume file2), non of them matches 
any JkMount.

a) ForwardDirectories is not set: Apache tries to serve /path/test/file2

b) ForwardDirectories is set: Again Apache tries to serve /path/test/file2.

4) At least one of the files exists (assume file2), and file1 matches a 
JkMount.

Apache serves /path/test/file2, or forward /test/file1, whichever comes 
first in the DirectoryIndex list.

5) The same file file1 that exists, also matches a JkMount.

Apache serves locally /path/test/file1.

Thanks

Rainer

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: Discussion mod_jk and mod_dir interaction

[Mladen Turk <mt...@apache.org>]

Rainer Jung wrote:
> Hi Mladen,
>>
>> Things like DirectoryIndex are completely
>> useless and further more breaks the security,
>> because the Tomcat must serve the default content.
> 
> I simply don't understand, what this means functionally, i.e. how 
> DirectoryIndex and ForwardDirectories should work with mod_jk.
>

The shouldn't ;)


>> So, although some hacks can be done, I'll veto
>> any option that will allow serving as default
>> some content that wouldn't be served by Tomcat
>> using his configure.
> 
> If I try to interprete this, it would disallow to forward a request 
> /test/ as /test/file to tomcat, if file is a DirectoryIndex
> 

Yes. It works only when they are on the same box at the
first place. However the Tomcat might have different
welcome file list order, and that's the problem.

> - even if "/test/file" would match a JkMount
> - and even if "/test/file" can be matched to a file system entry by Apache.
> 
> Correct? This is different from current behaviour. So you suggest to 
> completely ignore DirectoryIndex for mod_jk and only forward directory 
> requests to tomcat, if
> 
> - they don't get served by apache
> - they match a JkMount
> - and ForwardDirectories is set.
> 
> Correct?
> 

Basically, the entire point is that Tomcat *must* decide
what should be served for a directory request by welcome file.
Forcing that via foreign application is a clear breakage
of the specs.

The entire concept originates back from the days when
most of the deployments were on the same box (having a cluster
decade ago was a privilege only for few companies in the world).


Regards,
Mladen.




---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: Discussion mod_jk and mod_dir interaction

[Rainer Jung <ra...@kippdata.de>]

Hi Mladen,

Mladen Turk wrote:
> Rainer Jung wrote:
>> Hi,
>>
>> I want to find out how to correctly fix BZ 41430 and 36121. They have 
>> to do with the way mod_dir and mod_jk interact. Before fixing the code 
>> I find it necessary to define the correct behaviour, which seems to be 
>> non-trivial.
>>
> 
> It is very trivial.
> The mod_jk is proxy to Tomcat, and nothing more.
> Things like mapping web app to the Apache vhost
> that BTW works only when both Httpd and Tomcat are
> on the same host is usable only for delivering static
> content directly by Httpd.
> 
> Things like DirectoryIndex are completely
> useless and further more breaks the security,
> because the Tomcat must serve the default content.

I simply don't understand, what this means functionally, i.e. how 
DirectoryIndex and ForwardDirectories should work with mod_jk.

> So, although some hacks can be done, I'll veto
> any option that will allow serving as default
> some content that wouldn't be served by Tomcat
> using his configure.

If I try to interprete this, it would disallow to forward a request 
/test/ as /test/file to tomcat, if file is a DirectoryIndex

- even if "/test/file" would match a JkMount
- and even if "/test/file" can be matched to a file system entry by Apache.

Correct? This is different from current behaviour. So you suggest to 
completely ignore DirectoryIndex for mod_jk and only forward directory 
requests to tomcat, if

- they don't get served by apache
- they match a JkMount
- and ForwardDirectories is set.

Correct?

> 
> Regards,
> Mladen.

Regards,

Rainer

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: Discussion mod_jk and mod_dir interaction

[Mladen Turk <mt...@apache.org>]

Rainer Jung wrote:
> Hi,
> 
> I want to find out how to correctly fix BZ 41430 and 36121. They have to 
> do with the way mod_dir and mod_jk interact. Before fixing the code I 
> find it necessary to define the correct behaviour, which seems to be 
> non-trivial.
>

It is very trivial.
The mod_jk is proxy to Tomcat, and nothing more.
Things like mapping web app to the Apache vhost
that BTW works only when both Httpd and Tomcat are
on the same host is usable only for delivering static
content directly by Httpd.

Things like DirectoryIndex are completely
useless and further more breaks the security,
because the Tomcat must serve the default content.

So, although some hacks can be done, I'll veto
any option that will allow serving as default
some content that wouldn't be served by Tomcat
using his configure.

Regards,
Mladen.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org