httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Marc Slemko <>
Subject Re: updated Agenda for 1.2b7
Date Sat, 08 Feb 1997 03:05:21 GMT
I haven't finished going through the updates yet, but will post this
now anyway...

1.2b7 status as of Fri Feb  7 20:04:56 MST 1997:

  * Committed since 1.2b6:
	* FIN_WAIT_2 page to documentation
	* mod_info corruption bug
	* mod_rewrite sizeof() bug
	* allow keepalive on 304 responses
	* full headers on 2xx or 3xx status
	* fix extra CRLF -> buffers not flushed problem
	* output all HTTP/1.1 header fields on responses
	* mod_info bug fix for if sizeof(char) != 1, not that that can
	* fix for Rlimit* giving a SEGV when given only one argument
	* mod_rewrite update
	* suexec free()ing memory while still needed
	* httpd_monitor now understands current scoreboard format
	* tweak byteserving code to work around Netscape bug (PDF plugin)
	* autocreate Makefile in support directory
	* be sure to kill timeout in util_script
	* Bad handling of lang_index == -1 in is_variant_better()
	* handle_multi() doesn't return content_language of negotiated file (breaks old code).
	* directory redirect now returns 302  instead of 301
	* fix util_snprintf and unsigned ints on Alpha
	* fix conflicting definitions for is_proxy_available

Agenda for 1.2b7-dev

Patches ready for testing, voting:

  * update bug report page to not have email form
	Status: +1 Roy, Dean, Marc (but some changes suggested), patch
		reposted with changes.  Needs input from people handling
		current bug reports.
	New status: reposted, still need input from people handling bug
		reports via mail right now.  

  * Patch for Hitachi HI-UX/WE2
	Status: Jim posted patch, wants someone with HPUX to test; Marc
	says its broken.

  * chunked-encoding performance improvement
	Dean submitted patch +1 Randy, Chuck, Jim

  * directory_walk and relatives performance improvements
	Dean submitted patch +1 Randy, Chuck

  * mod_include is slow.  Ed posted a patch to remove feof and
    ferror from GET_CHAR.  Can we do more?  Yes--Ed posted another 
    patch, Marc posted another patch.  Pick me, pick me.  Waiting
    for Marc to respond to Ed's comments.

  * Satisfy Any can be changed if .htaccess exists
        If you give Satisfy Any in access.conf for a particular directory,
        and have a .htaccess in that directory, Satisfy mode reverts
        to Satisfy All even if the .htaccess has _no_ authentication

	Status: Ed posted patch, +1 from Paul Sutton, Dean

  * user and server get confused over what should be a virtual host
	and what is the main server, resulting in access to something
	other than the name defined in the virtualhost directive (but
	with the same IP address) failing.  
		Status: should be looked at, may not be a nice way to fix 
			since it is likely not technically a bug.

	New status: Dean posted patch, Ben +1-but-hasn't tested, may
		or may not be whole problem, Randy +1.

  * fd leaks; should use pfopen() everywhere
	status: Randy posted patch, +1 Marc, Dean

  * authentication handlers called more than once per request; patch 
    submitted [Doug MacEachern] Dean +1

Should be done or at least looked at before 1.2b7:

  * check into the patches in the FreeBSD port; the rlimit type thing
    could need to be fixed to work in 2.2 and 2.1.  I think most of the
    other patches are silly.  Randy says the rlimit stuff should be 
    done with sysconf() (I'm afraid I don't understand exactly what
    he is thinking of... -ms), but I don't think before 1.2.

  * CGI script as documentroot works in 1.1.1, not 1.2b6 []
    Message-ID: <>

  * escaping '{''s in SSI has changed.  Bug?
    Message-ID: <>

  * <!--#exec cmd="prog args\ with\ spaces"-->
    doesn't work anymore. It passes THREE arguments
    to prog ("args", "with" and "spaces), instead of
    ONE argument ("args with spaces"). []  suexec related?

  * SIGHUP causes problems; both "can't bind to port" and children
    not exiting.  Marc has some ideas for helping the second problem.

  * core dump in sub_req_lookup_file() if invalid directive in .htaccess 

  * Questionable performace of  mod_dir() with negotiation
  * invoke_handler() doesn't handle mime arguments in content-type

  * Memory hog in handle_multi()

  * Variant list in r->notes is deleted if request is comming through mod_dir()

  * handle_multi() doesn't copy request headers for negotiated request

  * If start twice, overwrites the PID file PR#152

  * CGI outputting Location: redirect not working
    This is an update to a previously submitted
    bug report (see below). What seems to be
    happening is that when the CGI returns a
    redirect (via Location:), the new CGI gets
    executed with the old "Content-Length" header
    from the original POST CGI. But the content
    has all already been read. I'm not an HTTP
    expert but it seems like the second CGI should
    not "inherit" the Content-Length header from
    the first CGI. []  

    Roy says "The problem is that the internal redirect is inheriting
    the request state, which it should not be doing.  The solution
    is to replace the hack in mod_cgi with a clean request without
    the old Content-Length/Transfer-Encoding fields of the original."

	Status: Rob posted patch, but Roy -1 on method and will try
		to write a better one.

  * some better suexec docs would be really nice, detailing some of the
    security risks and compromises discussed
	Status: I think Randy said something about doing it at one point,
		but no one can write what  I think should be there better
		than me, if I ever have time.  Randy says he thinks 
		Jason is perhaps doing them.

  * identitycheck and hostnamelookups not allowed in .htaccess but
    documentation says they are.  Update the documentation or perhaps
    make them work as documented.

  * redirect of index file causes SEGV [Marc]
	Status: have a way to stop the core dump, but that doesn't make
	it work properly.

  * 64-bit issues; general cleanup, ap_snprintf("%d", (int)-1) giving
    wrong behavior on Alpha boxes.

  * Randy says "seems that the processes on a Unixware machine are
    eventually all dying off. Mind you, I have not seen this, but
    that is what is being reported.  Sounds like perhaps the server is not 
    respawning new children after MaxRequestsPerChild has been reached."

  * mod_proxy returns incorrect results when given a 'Location:'
    redirect (PR#137)

  * http_request.c: directory_walk() misses some <Directory ...> directives
    (PR#131).  I'm not sure the way things are done is really incorrect, 
    but should be looked at.

  * error compiling on NeXT:
	In file included from http_main.c:108:
	/NextDeveloper/Headers/bsd/netinet/tcp.h:57: duplicate member `th_off'
	/NextDeveloper/Headers/bsd/netinet/tcp.h:58: duplicate member `th_x2'

	Status: unknown, NeXT versions may be hell to figure out

  * suexec sets environ to local variable, possibly to overwrite
    memory by too many environ variables

	status: Randy testing patch

  * infinite loop in mod_imap due to parsing bug
		status: Marc found problem, wants input on which way to solve

  * Marc says Apache won't compile with HAVE_SNPRINTF defined as things
    are now because not everything includes conf.h.
       Status: Fix it when we have a platform which has snprintf.  Jim
	will look at; perhaps just include conf.h everywhere

  * warnings in regex
       Status: Roy would like to see this fixed since it makes Apache
               a mess on Solaris when using -Wall.  Roy will make patch.

  * warning on SunOS4, http_log.c:164, pointer from int without cast
       Status: Marc analyzed

  * core dump if an error in .htaccess & subrequest
       Status: no patch yet
       Info: <> reports that if sub_req_lookup_uri() is
             called, then per_dir_config in subrequest is not initialized
             until directory_walk is done. If any error is encountered during
             this time, log_reason() will core dump, since it calls
             get_remote_host() with r->per_dir_config. 
       Solution: Initialize per_dir_config in set_sub_req_protocol()
             (see initialization of regular request in read_request()!).

  * Solaris 2.6 apparently has a getwd() or getcwd() prototype, see PR#89,153
       Status: easy to fix, but will require testing by 2.6beta person

  * suexec setuid() before directory checks for nfs mounted filesystems, PR#70
       Status: Randy testing patch

  * MAXPATHLEN undefined in suexec on some systems
	Status: randy looking into it(?)

  * new header_parse API hook is called too often
       Status: RobH posted patch, had second thoughts.  He
       suggests that mod_browser be optimised by detecting if it has been
       called already and returning early if it has.

  * lingering_close generates the following error message
      shutdown: Transport endpoint is not connected - lingering_close
    using 1.2b6 (only a few a day).  I think this is what 
    happens when a client disconnects during transmission, which
    is a normal condition for web servers.  I suggest not logging
    an error if errno == ENOTCONN.
      Marc says that this may not be "normal", it may be if the client
    sends a RST to terminate the connection (as per recent discussion on
    end2end-interest) and it gets here before we get to that point in
       Status: no patch, waiting to see if it it improves debugging.

  * accept errors EPROTO and ECONNABORTED should not be logged
       Status: no patch, ditto above, but will require ifdefs

  * SO_DEBUG in proxy_ftp.c may not be portable, see PR 116, 104
       Status: Chuck says it is a leftover, will fix

  * bugs in mod_negotiation (serious)
       Status: reported by on Jan 6 to apache-bugs.
               It is a very good, detailed report with patches.

  * 3 seconds delay in CGI execution on SunOS 4.x, see PR 122
       Status: no patch.
       Info: Pages containing script output show up with a delay of 3
             seconds (there was no such delay in Apache 1.1.1). 
             [] tracked the problem down to
             source file alloc.c, function free_proc_chain. This function
             contains a conditional call to sleep(3), which causes the delay.

       for (p = procs; p; p = p->next) {
          if (p->kill_how == kill_after_timeout) {
            /* Subprocess may be dead already.  Only need the timeout if not. */
            if (kill (p->pid, SIGTERM) != -1)  
              need_timeout = 1;
          } else if (p->kill_how == kill_always) {
            kill (p->pid, SIGKILL);
        /* Sleep only if we have to... */
        if (need_timeout) sleep (3);

        [RobH: So CGI included as SSI hangs around for longer and needs
               to be SIGTERM'ed.  Why?]

        [Roy: note also that a call to sleep will blow-out any other timeout]

Planning/design items:

    * Should we change the default timeout of 1200?
	Status: discussion ongoing, +1 concept Jim, Randy, Marc

    * do we want a half-hearted attempt at fixing logfile opening security
	Status: Jim & Randy say no  How about check to be sure directory
		is owned by the user that started httpd and not group
		or world writable?

    * should the bug report page be in CVS?  Should it be in the htdocs
      tree or a seperate place?  Should it be distributed with Apache?
      The same holds for everything on the Apache web site.  Marc would
      like to see it all in CVS, but not necessarily distributed
      with Apache.

    * should perhaps start to think about exactly how we want to 
      handle contrib patches/programs in 1.2.  Directory on the web site?  
      Include in distribution?

Contrib stuff / future:

    * Chris Adams <> patch to mod_log_config to add %m
      and %c.

    * "Large groups cause authentication errors" on FreeBSD
      []; problem looks to be MAX_STRING_LEN buffer
      in groups_for_user.  

  * mod_log_config patch for conditional logging
	Status: contrib, not in server

    * Jim has patch for time taken to handle a request in status module

  * Ed has an updated patch for limiting connections per IP

  * mod_include is still slow.

  * Some mirrors are out-of-date, Brian will investigate

View raw message