Joshua Slive [Wed, 17 Oct 2001 15:57:04 +0000 (15:57 +0000)]
I certainly see the advantage of having SSL split out into another file.
And indeed, that is the way that I would do it for my own server. But
the default config file is really there for beginners, not for advanced
users. Having multiple config files is bad for beginners because it
makes it difficult to answer questions like "where do I put this config
directive?" It also makes it more difficult to move a specific configuration
from one server to another. Finally, it is just overall more intimidating
to be faced with a bunch of files to edit, rather than one file that
controls everything.
Having said that, it does look like the overall feeling is that at least
SSL should be split out, and I won't object (strongly).
Bill Stoddard [Wed, 17 Oct 2001 15:51:22 +0000 (15:51 +0000)]
Win32: Deprecate ap_start_shutdown/ap_start_restart in favor of ap_signal_parent(enum).
This simplifies the code a bit for some more MPM cleanup work forthcoming.
Jim Jagielski [Wed, 17 Oct 2001 15:32:22 +0000 (15:32 +0000)]
Not sure if the number of directives in a normal proxy setup would
warrant needing a whole separate config file. I see such break outs
as pretty much dependent on the number of lines it adds to
httpd.conf... with SSL it makes sense. With proxy, well, I'm not
sure. To be honest, though, breaking out both won't trouble me
a bit, but this is my pref.
PR:
Obtained from:
Submitted by:
Reviewed by:
Ken Coar [Wed, 17 Oct 2001 14:50:48 +0000 (14:50 +0000)]
The argument that this is a reversion to the httpd/access/srm
multifile scenario is bogus, IMHO; the problem with those
was that their purposes were not clear, nor were the orders
of invocation. Putting massive (or tiny but uncommon) chunks
of easily self-contained special-function directives into
separate files simplifies the basic configuration and doesn't
revert to either of the trinity-file complaints, since these
would need to be explicitly invoked with an Include directive.
Aaron Bannert [Wed, 17 Oct 2001 00:59:18 +0000 (00:59 +0000)]
First pass at converting worker MPM to APR's new lock API. This converts
the APR_INTRAPROCESS locks into lightweight, non-nested apr_thread_mutex_t
locks.
It is absolutely invalid practice to test 'prot' bits to determine if a
file is readable. The only acceptable means of testing readability is to
open it for reading, due to discrepancies between permissions, DACLs and
SACLS. Even Linux hackers are gonna need to learn that lesson if they
plan to do any DOD or Gov work once DACL-enhanced Linux is adopted.
Ryan Bloom [Tue, 16 Oct 2001 21:32:41 +0000 (21:32 +0000)]
Remove all of the ldap modules. These have been moved to their own
repository, httpd-ldap, and they now form their own sub-project of the
httpd project.
LoadFile(s) required by modules before they loaded weren't executed until
server initialization. This patch assures all such loaded files occur as
they are parsed.
Submitted by: John Sterling <sterling@covalent.net>
Jeff Trawick [Tue, 16 Oct 2001 18:45:16 +0000 (18:45 +0000)]
Exit when we can't listen on any of the configured ports. This
is the same behavior as 1.3, and it avoids having the MPMs to
deal with bogus ap_listen_rec structures.
This also backs out some circumventions I and Greg Ames had added
to prefork; these are no longer necessary because of this change.
Aaron Bannert [Tue, 16 Oct 2001 17:51:11 +0000 (17:51 +0000)]
In one target we weren't always creating the $libexecdir
($prefix/modules) directory, and in another we were assuming that the
directory existed. Now we always create it in the first target, and we
check that it exists in the second.
This fixes a bug where httpd.exp would be installed as a _file_ called
$prefix/modules.
Ryan Bloom [Tue, 16 Oct 2001 05:18:39 +0000 (05:18 +0000)]
Cleanup the proxy code that creates a request to the origin
server. This change adds an optional hook, which allows modules
to gain control while the request is created if the proxy module
is loaded. The purpose of this hook is to allow modules to add
input and/or output filters to the request to the origin. While
I was at it, I made the core use this hook, so that proxy request
creation uses some of the code from the core. This can still be
greatly improved, but this is a good start.
Streamline this function, and append the trailing slash for any directories
that are resolved. Needs to be more tightly coupled to the dir_walk
optimized cache.
This will probably fix recent breakage to mod_negotation and httpd.test,
as well as the /manual/ returning docroot/index. Need to look for another
solution. I'm suspecting path_info is possibly broken.
Aaron Bannert [Tue, 16 Oct 2001 01:04:08 +0000 (01:04 +0000)]
Cautiously avoiding the scoping issue that was discussed on the list,
I thought these other changes needed to go in; Namely that we don't
need to check if the brigade is empty twice in the loop, just once.
Added a comment for good measure.
Doug MacEachern [Mon, 15 Oct 2001 23:14:11 +0000 (23:14 +0000)]
disabling mod_example ap_hook_{http_method,default_port}
breaks things such as httpd-test when http_method is "foo"
PR:
Obtained from:
Submitted by:
Reviewed by:
Clarify the new MultiviewsMatch directive. I wanted this down on 'paper',
even if it isn't proofread - please feel free to touch up.
BTW - the new 'cleaned' formatting really stinks for hand-editing,
the indentation really needs works. Our per-directive meta-info is
the ugliest aspect. Would be good if the cleanup code could be customized
to make the html not only clean, but legible ;)
Fix the first bucket not getting chunked properly. The reason was that
we left the TE header in the output headers, so ap_set_keepalive didn't
set r->chunked to 1. So, ap_http_header_filter wouldn't insert CHUNK
filter appropriately. I have no clue how it chunked anything at all
before this patch, but hey, it looks right now.
Tested with Yahoo, Apple, apache.org, and /.
/. is interesting in that it sends both Conn: Close and TE: chunked.
Well, now I know what the bio_is_renegotiating call was for.
Place a big-ass comment there so that whomever comes next isn't stuck
at a cryptic call that they don't understand with a dinky comment.
Hopefully, this makes sense. Someone more familiar with OpenSSL should
verify the comment.
This fix also requires the normalize call to be performed before
churn_input so that we don't enter churn_input with a 0-length ctx->b
brigade.
All httpd-test tests (except for the module/negotiation test) pass now.
Ok, this formats a whole lot cleaner, and (I believe) makes a bit more
sense. Also provides a rundown of C89 common date format strings, for
those users who don't have man strftime [It still points out that add'l
format options may b available, see strftime.]
Also, I believe _most_ installations require the TransferLog "|bin/
path to rotatelogs, no? Other question - how to reformat to html?
Which utility does so?
Close the mod_mime file extension matching issue by (as Ken Coar suggests)
allowing users to continue to rely on the old 1.3 behavior of matching Any
extensions, the strict behavior of matching NegotiatedOnly arguments, or
including Handlers and Filters with the MultiviewsMatch directive for
mod_negotiation control. Unfortunately, the component matching occurs
in mod_mime, so that's where this option must reside.
Ryan Bloom [Thu, 11 Oct 2001 04:40:14 +0000 (04:40 +0000)]
Remove some warnings from the code. The buckets take a different
type for the length than the brigade functions do. This moves the
len_read variable into the correct scope for the two times that it
is used, and defines it correctly for each scope.
This is the mod_ssl input filtering rewrite. Lots of stuff here. I also
changed some of the style issues within the filtering code to conform to
the rest of the server.
Various incarnations of this patch have been posted to dev@httpd without
feedback. Now that it passes all of the httpd-test cases (with the
exception of module/negotiation test which fails without mod_ssl anyway),
it is time to check it in.
Please review and test. We are under C-T-R rules, so I'm going to take
advantage of that and commit it now. I have tested this about as much
as I can and it seems to work from everything I can give to it.
Considering that mod_ssl was broken before this commit, this is an
improvement.
We can't pass in &r->remaining because we change that value on output to
be how many bytes we read. This trounces on the r->remaining value, so
we must use a local variable and subtract that from r->remaining after we
read.
Reviewed by: Aaron Bannert
The problem here is that we are getting some zero-length buckets at the head
of our brigade - which are in isolation okay. In this situation, they
must be removed by the call to APR_BRIGADE_NORMALIZE.
The way we partition the buckets means that we will never remove the
zero-length bucket from the head - causing an infinite loop. We read only
a single bucket now - previously partition with the blocking reads would
read multiple buckets - but it forced having a defined length which we
agreed was bogus.
Therefore, if we have a zero-length bucket at the head, we would then try
to partition and split at the zero-point of the brigade. That combination
doesn't actually remove the zero-length bucket - it is still there - causing
an infinite loop because we'll never go past the zero-length bucket.
This call was originally present in core_input_filter. I think it might
be better to fix partition/split/etc to eliminate a zero-length bucket
and skip it. But, I'm not 100% sure that needs to happen.
Negotiation once allowed any file, of any filename extension, to be
served. The original patch to mod_negotation eliminated all extensions
that did not reflect filename extensions associated with negotiation
variables, unless the user expressly specified the file name with those
filename extensions.
This patch [attributed to me] was vetoed at its inception, it was provided
as an alternative for those who had to have the current behavior.
There is now another alternative patch that would introduce the
MultiviewsMatch directive to mod_mime, for consideration and discussion.
Short of removing the headers filter, this is the best asis can do.
Note that all body replies were entirely broken (thanks for helping
me notice this, Greg :)
Allow mod_so to be enabled by default even if no shared libraries from the
core are requested.
If you want to disable shared library support, pass --disable-so to
configure (as always). This will enforce that your httpd can NOT use
shared libraries - which may be a good thing for you to do.
Justin added the APR_HAS_DSO check per discussion on-list between Aaron,
Ryan, Greg, and the rest of the peanut gallery. This should allow us
to not build mod_so when it isn't supported. However, the rest of the
configure scripts need to know that shared objects aren't supported and
complain accordingly. (sharedobjs = yes, error out?)
Speed it up. While this optimization wasn't obvious for the two-pass
location_walk, it is significant for all subreq/redirects reusing the
cached walk values.