Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Content-Type: text/plain;
  charset="iso-8859-1"
From: Ryan Bloom <rbb@covalent.net>
Reply-To: rbb@covalent.net
Organization: Covalent Technologies
To: dev@httpd.apache.org, Michael Douglass <mikedoug@staff.texas.net>
Subject: Re: [2.0] lstat's in spite of AllowOverride None
Date: Fri, 9 Nov 2001 12:28:21 -0800
References: <20011107101143.B70423@deejai2.mch.fsc.net>
 <E161TSk-0006IV-00@mauve.csi.cam.ac.uk>
 <20011109141142.A96243@staff.texas.net>
In-Reply-To: <20011109141142.A96243@staff.texas.net>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <20011109202822.9287646DFD@koj.rkbloom.net>

On Friday 09 November 2001 12:11 pm, Michael Douglass wrote:
> > > As FirstBill suggests, there are other means for caching the (l)stat
> > > results, at least for the request duration, which need to be deployed. 
> > > But dropping the path_info walk-backwards logic was step one.  Any
> > > optimization patches are entertianed to speed up the server, if we
> > > don't lose stability.
> >
> > Caching the lstat() results should help, but reducing to a single stat()
> > as I suggest would seem better still?
>
> I'd be weary of caching the lstat() information for more than the current
> connection; you don't want someone to abuse that cache by creating a
> symlink AFTER letting apache cache the information.
>
> Anyone think about using resolvepath() as an initial check?  resolvepath()
> is a single system call to take a path to a file and convert it to the
> resultant path after following all symlinks.  Thus you could have a single
> call to resolvepath() and strcmp() to see if there were any symlinks in
> the path--if there were then you either "deny" it if symlinks are not
> allowed at all; or you proceed with the lstat() scheme otherwise.
>
> This would seem to circumvent alot of lstat() calls on the (hopefully)
> normal case that there are no symlinks involved anywhere. :)

The problem is that you can deny SymLinks at any point in the path.  We
could use resolvepath(), but then we would need to walk the path anyway to
make sure that Symlinks are allowed all the way down.

Ryan

______________________________________________________________
Ryan Bloom				rbb@apache.org
Covalent Technologies			rbb@covalent.net
--------------------------------------------------------------