You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Ul...@elektrobit.com on 2011/03/24 16:12:17 UTC
Unexpected behaviour with SVNPath/SVNParentPath mixture
Hi,
we're trying to set up the following config:
http://svnserver/svn/parentpathtest
|- repo1
|- repo2
\- repo3
The internal users of the project are supposed to be able to access all three repositories, while a bunch of external users are supposed to be able to access only repo2. We've been trying to achieve this with the following config:
<Location /svn/parentpathtest>
DAV svn
SVNParentPath /subversion/parentpathtest
AuthType Basic
AuthName "Repository /svn/parentpathtest"
Require ldap-group CN=pr_parent,OU=Groups,DC=sub,DC=example,DC=com
</Location>
<Location /svn/parentpathtest/repo2>
DAV svn
SVNPath /subversion/parentpathtest/repo2
AuthType Basic
AuthName "Repository /svn/parentpathtest/repo2"
Require ldap-group CN=pr_parent_ext,OU=Groups,DC=sub,DC=example,DC=com
</Location>
According to http://httpd.apache.org/docs/current/sections.html#mergin , this should be possible, with the latter <Location> overwriting the former. The intended config is much larger, with about 100 repos under parentpathtest and about 20 location-Tags with extended permissions and the project having permission to add new repositories on their own, so just going the route with fully specifying all locations with just SVNPath would be inconvenient.
Unfortunately, this seems to cause some weird doubling of a path component:
ulja2852@er00483p:~/tmp/parentpathtest/repo2$ svn co http://svn/svn/parentpathtest/repo2/module_template/trunk/
Authentication realm: <http://svn:80> Repository /svn/parentpathtest/repo2
Password for 'xxxx':
svn: '/svn/parentpathtest/repo2/repo2/!svn/vcc/default' path not found
This happens in various combinations of trailing slashes in URL or config (some cause to match the main Location instead).
I tried to find out what happened with Wireshark (follow tcp stream, cleaned up/anonymized the output with <xxx>):
-----------------------------------------------------
OPTIONS /svn/parentpathtest/repo2/module_template/trunk HTTP/1.1
User-Agent: SVN/1.6.12 (r955767) neon/0.29.3
Keep-Alive:
Connection: TE, Keep-Alive
TE: trailers
Host: svn
Content-Type: text/xml
Accept-Encoding: gzip
DAV: http://subversion.tigris.org/xmlns/dav/svn/depth
DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo
DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops
Content-Length: 104
Accept-Encoding: gzip
Authorization: Basic <xxx>=
<?xml version="1.0" encoding="utf-8"?><D:options xmlns:D="DAV:"><D:activity-collection-set/></D:options>
HTTP/1.1 200 OK
Date: Thu, 24 Mar 2011 14:50:14 GMT
Server: Apache/2.2.15 (Linux/SUSE)
DAV: 1,2
DAV: version-control,checkout,working-resource
DAV: merge,baseline,activity,version-controlled-collection
DAV: http://subversion.tigris.org/xmlns/dav/svn/depth
DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops
DAV: http://subversion.tigris.org/xmlns/dav/svn/partial-replay
DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo
DAV: <http://apache.org/dav/propset/fs/1>
MS-Author-Via: DAV
Allow: OPTIONS,GET,HEAD,POST,DELETE,TRACE,PROPFIND,PROPPATCH,COPY,MOVE,LOCK,UNLOCK,CHECKOUT
Content-Length: 210
Keep-Alive: timeout=150, max=99
Connection: Keep-Alive
Content-Type: text/xml; charset="utf-8"
<?xml version="1.0" encoding="utf-8"?>
<D:options-response xmlns:D="DAV:">
<D:activity-collection-set><D:href>/svn/parentpathtest/repo2/repo2/!svn/act/</D:href></D:activity-collection-set></D:options-response>
PROPFIND /svn/parentpathtest/repo2/module_template/trunk HTTP/1.1
User-Agent: SVN/1.6.12 (r955767) neon/0.29.3
Connection: TE
TE: trailers
Host: svn
Content-Type: text/xml
Accept-Encoding: gzip
Depth: 0
DAV: http://subversion.tigris.org/xmlns/dav/svn/depth
DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo
DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops
Content-Length: 300
Accept-Encoding: gzip
Authorization: Basic <xxx>=
<?xml version="1.0" encoding="utf-8"?><propfind xmlns="DAV:"><prop><version-controlled-configuration xmlns="DAV:"/><resourcetype xmlns="DAV:"/><baseline-relative-path xmlns="http://subversion.tigris.org/xmlns/dav/"/><repository-uuid xmlns="http://subversion.tigris.org/xmlns/dav/"/></prop></propfind>
HTTP/1.1 207 Multi-Status
Date: Thu, 24 Mar 2011 14:50:14 GMT
Server: Apache/2.2.15 (Linux/SUSE)
Content-Length: 756
Content-Type: text/xml; charset="utf-8"
<?xml version="1.0" encoding="utf-8"?>
<D:multistatus xmlns:D="DAV:" xmlns:ns1="http://subversion.tigris.org/xmlns/dav/" xmlns:ns0="DAV:">
<D:response xmlns:lp1="DAV:" xmlns:lp3="http://subversion.tigris.org/xmlns/dav/">
<D:href>/svn/parentpathtest/repo2/module_template/trunk/</D:href>
<D:propstat>
<D:prop>
<lp1:version-controlled-configuration><D:href>/svn/parentpathtest/repo2/repo2/!svn/vcc/default</D:href></lp1:version-controlled-configuration>
<lp1:resourcetype><D:collection/></lp1:resourcetype>
<lp3:baseline-relative-path>module_template/trunk</lp3:baseline-relative-path>
<lp3:repository-uuid>85958a0a-5186-11e0-b1cd-c1c5333de36d</lp3:repository-uuid>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
</D:multistatus>
PROPFIND /svn/parentpathtest/repo2/repo2/!svn/vcc/default HTTP/1.1
User-Agent: SVN/1.6.12 (r955767) neon/0.29.3
Connection: TE
TE: trailers
Host: svn
Content-Type: text/xml
Accept-Encoding: gzip
Depth: 0
DAV: http://subversion.tigris.org/xmlns/dav/svn/depth
DAV: http://subversion.tigris.org/xmlns/dav/svn/mergeinfo
DAV: http://subversion.tigris.org/xmlns/dav/svn/log-revprops
Content-Length: 111
Accept-Encoding: gzip
Authorization: Basic <xxx>=
<?xml version="1.0" encoding="utf-8"?><propfind xmlns="DAV:"><prop><checked-in xmlns="DAV:"/></prop></propfind>
HTTP/1.1 404 Not Found
Date: Thu, 24 Mar 2011 14:50:14 GMT
Server: Apache/2.2.15 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
1e
<?xml version="1.0" encoding="
af
ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="
e
en" xml:lang="
13
en">
<head>
<title>
38
Object not found!</title>
<link rev="made" href="mailto:
11f
<xxxx>" />
<style type="text/css"><!--/*--><![CDATA[/*><!--*/
body { color: #000000; background-color: #FFFFFF; }
a:link { color: #0000CC; }
p, address {margin-left: 3em;}
span {font-size: smaller;}
/*]]>*/--></style>
</head>
<body>
<h1>
1b
Object not found!</h1>
<p>
39
The requested URL was not found on this server.
57
If you entered the URL manually please check your
spelling and try again.
2
9
</p>
<p>
48
If you think this is a server error, please contact
the <a href="mailto:
37
<xxxx>">webmaster</a>.
11
</p>
<h2>Error
21
404</h2>
<address>
<a href="/">
10
svn</a><br />
9
<span>
21
Thu Mar 24 15:50:14 2011<br />
3d
Apache/2.2.15 (Linux/SUSE)</span>
</address>
</body>
</html>
1
0
-----------------------------------------------------
It seems something doubles the repo2 component of the path, and the something is server-side.
Client is running svn-1.6.12, server is running svn-1.6.11.
What am I doing wrong?
Best regards
Ullrich Jans
--
Ullrich Jans, Specialist, IT-A
Phone: +49 9131 7701-6627, mailto:ullrich.jans@elektrobit.com
Fax: +49 9131 7701-6333, www.elektrobit.com
Elektrobit Automotive GmbH, Am Wolfsmantel 46, 91058 Erlangen, Germany
Managing Directors: Otto Fößel, Jarkko Sairanen
Register Court Fürth HRB 4886
----------------------------------------------------------------
Please note: This e-mail may contain confidential information
intended solely for the addressee. If you have received this
e-mail in error, please do not disclose it to anyone, notify
the sender promptly, and delete the message from your system.
Thank you.
RE: Unexpected behaviour with SVNPath/SVNParentPath mixture
Posted by Ul...@elektrobit.com.
Hi,
> -----Original Message-----
> From: Cooke, Mark [mailto:mark.cooke@siemens.com]
> Sent: Friday, March 25, 2011 12:38 PM
> To: Jans Ullrich; subversion-2011a@ryandesign.com
> Cc: users@subversion.apache.org
> Subject: RE: Unexpected behaviour with SVNPath/SVNParentPath mixture
>
> > The question is, why not? According to the Apache docs, it
> > should work, so it looks like a problem in subversion. Can
> > this be considered a bug? Should I file an issue?
>
> ...because when you use the SVNParentPath directive, apache has no
> further involvement in any "child" paths, all paths that start with the
> parent root are passed to the DAV handler... You can get round this by
> specifiying separate handlers for the separate paths using multiple
> SVNPath blocks but again, anything below those paths is handled by DAV
> and not apache.
>
> This is different from nesting access restrictions to artifacts that are
> all handled by apache (i.e. uri <Location>s or local <Directory>s so
> those docs you mention do not apply in this scenario.
Thanks for the explanation. I think I get it now, just the effect with the path component suddenly doubling still puzzles me a bit. I still suspect a bug or misfeature there, since I'd have thought it should either work not at all or work as expected.
But since it looks like we have a workaround, I guess I can live with that.
> > We'd like to provide our users with the ability to create
> > repositories themselves, then possibly promote select
> > repositories to a different permission set. Restricting
> > ourselves to only using SVNPath would be inconvenient... ;-)
>
> You could consider using one (set of) parent path(s) for restricted
> repos and another (set) for less restricted ones?
I'll have to check that, but I suspect it will be hard because a lot of our build architecture is already using these paths. The modified permissions are the new part. But I think the idea is good, maybe we can have a completely different location for the SVNPath configs (like /svn/parentpathtest_ext/...) then we should have no conflict, should we?
Thanks for the idea and the explanation above!
Cheers,
Ulli
----------------------------------------------------------------
Please note: This e-mail may contain confidential information
intended solely for the addressee. If you have received this
e-mail in error, please do not disclose it to anyone, notify
the sender promptly, and delete the message from your system.
Thank you.
RE: Unexpected behaviour with SVNPath/SVNParentPath mixture
Posted by "Cooke, Mark" <ma...@siemens.com>.
> -----Original Message-----
> From: Ullrich.Jans@elektrobit.com
> [mailto:Ullrich.Jans@elektrobit.com]
> Sent: 25 March 2011 10:32
> To: subversion-2011a@ryandesign.com
> Cc: users@subversion.apache.org
> Subject: RE: Unexpected behaviour with SVNPath/SVNParentPath mixture
>
> Hi Ryan,
>
> > -----Original Message-----
> > From: Ryan Schmidt [mailto:subversion-2011a@ryandesign.com]
> > Sent: Friday, March 25, 2011 2:25 AM
> > To: Jans Ullrich
> > Cc: users@subversion.apache.org
> > Subject: Re: Unexpected behaviour with SVNPath/SVNParentPath mixture
> >
> > You will either want a single Location block containing an
> > SVNParentPath directive, or multiple Location blocks each with
> > an SVNPath directive. Not both.
>
> I noticed that. ;-)
>
> The question is, why not? According to the Apache docs, it
> should work, so it looks like a problem in subversion. Can
> this be considered a bug? Should I file an issue?
...because when you use the SVNParentPath directive, apache has no
further involvement in any "child" paths, all paths that start with the
parent root are passed to the DAV handler... You can get round this by
specifiying separate handlers for the separate paths using multiple
SVNPath blocks but again, anything below those paths is handled by DAV
and not apache.
This is different from nesting access restrictions to artifacts that are
all handled by apache (i.e. uri <Location>s or local <Directory>s so
those docs you mention do not apply in this scenario.
> We'd like to provide our users with the ability to create
> repositories themselves, then possibly promote select
> repositories to a different permission set. Restricting
> ourselves to only using SVNPath would be inconvenient... ;-)
You could consider using one (set of) parent path(s) for restricted
repos and another (set) for less restricted ones?
~ mark c
RE: Unexpected behaviour with SVNPath/SVNParentPath mixture
Posted by Ul...@elektrobit.com.
Hi Ryan,
> -----Original Message-----
> From: Ryan Schmidt [mailto:subversion-2011a@ryandesign.com]
> Sent: Friday, March 25, 2011 2:25 AM
> To: Jans Ullrich
> Cc: users@subversion.apache.org
> Subject: Re: Unexpected behaviour with SVNPath/SVNParentPath mixture
>
> You will either want a single Location block containing an SVNParentPath
> directive, or multiple Location blocks each with an SVNPath directive. Not
> both.
I noticed that. ;-)
The question is, why not? According to the Apache docs, it should work, so it looks like a problem in subversion. Can this be considered a bug? Should I file an issue?
We'd like to provide our users with the ability to create repositories themselves, then possibly promote select repositories to a different permission set. Restricting ourselves to only using SVNPath would be inconvenient... ;-)
Cheers,
Ulli
----------------------------------------------------------------
Please note: This e-mail may contain confidential information
intended solely for the addressee. If you have received this
e-mail in error, please do not disclose it to anyone, notify
the sender promptly, and delete the message from your system.
Thank you.
Re: Unexpected behaviour with SVNPath/SVNParentPath mixture
Posted by Ryan Schmidt <su...@ryandesign.com>.
On Mar 24, 2011, at 10:12, <Ul...@elektrobit.com> <Ul...@elektrobit.com> wrote:
> we're trying to set up the following config:
>
> http://svnserver/svn/parentpathtest
> |- repo1
> |- repo2
> \- repo3
>
> The internal users of the project are supposed to be able to access all three repositories, while a bunch of external users are supposed to be able to access only repo2. We've been trying to achieve this with the following config:
>
> <Location /svn/parentpathtest>
> DAV svn
> SVNParentPath /subversion/parentpathtest
> AuthType Basic
> AuthName "Repository /svn/parentpathtest"
> Require ldap-group CN=pr_parent,OU=Groups,DC=sub,DC=example,DC=com
> </Location>
>
> <Location /svn/parentpathtest/repo2>
> DAV svn
> SVNPath /subversion/parentpathtest/repo2
> AuthType Basic
> AuthName "Repository /svn/parentpathtest/repo2"
> Require ldap-group CN=pr_parent_ext,OU=Groups,DC=sub,DC=example,DC=com
> </Location>
You will either want a single Location block containing an SVNParentPath directive, or multiple Location blocks each with an SVNPath directive. Not both.