mpm_{worker,prefork}: save some cycles by not copying the listener's pollfds for each pollset operation. We don't need a copy when poll()ing if those are allocated with the correct lifetime (the listener thread) at the very beginning.

mpm_{prefork,worker}: follow up to r1635521. Don't crash when there is no accept mutex (one listener => apr_proc_mutex_name(NULL)).

mpm_event(opt), mpm_worker, mpm_prefork: follow up to r1635521, r1640161. Retain num_buckets and max_buckets accross restarts so that we can determine whether new buckets were allocated and set their idle_spawn_rate at the same level as the existing ones (max). Also, adjust ap_daemons_limit and ap_daemons_to_start lower bounds at mpm_run() time, once num_buckets is available for the current generation (previously done at check_config time, hence before num_buckets is computed, and then with the previous generation's value).

mpm_prefork: follow up to r1635521. Avoid oddity on bucket_make_child_record overflow.

mpm_worker, mpm_prefork: follow up to r1635521. Use one dedicated accept mutex per listeners bucket.

MPMs, core: make duplicated listeners (SO_REUSEPORT) introduced in r1599531 less intrusive. Submitted by: Yingqi Lu <yingqi.lu@intel.com> Modified/Committed by: ylavic Add ListenCoresBucketsRatio which is a configurable ratio between the number of CPU cores (online) and the number of listeners buckets to create, defaulting to zero (so that listeners buckets become an opt-in, ie. ncpus / ratio > 1). This could also be made an opt-out by using the previous hardcoded value (8) as default. Make ap_close_listeners() act on all the listeners (including duplicated ones), since the function is also called externally (eg. mod_cgid, mod_ssl_ct and possibly any third party module) to cleanup opened descriptors when a process is forked (the duplicated listeners are kept in a scoped/static variable). Add ap_close_listeners_ex() to close a single bucket of listeners, used by the children to close unused duplicates and internally by ap_close_listeners(). Make ap_duplicate_listeners() compute the number of buckets to be used, instead of each MPM. This number is now based on the above ratio and will not change unless asked to (given *num_buckets < 1, that is when the MPM does not run in one-process mode nor after a graceful restart). Remove some global variables (mpm_listen, enable_default_listeners) previously used to communicate between MPMs and ap_listen, since ap_duplicate_listeners() API can now be used to do so. Also rename num_buckets as ap_num_listen_buckets, and prefix have_so_reuseport with ap_ (both printed by ap_log_common(), hence kept global). Detect ap_have_so_reuseport once only at startup. Restore dummy_connection() as before r1599531 since sending POD signals should not depend on the number of listeners buckets (there is still one single socket receiving the connections). For each MPM (concerned), move the bucket data (pod, listeners and eventually accept mutex) into a struct and instanciate an array of them (sized by the number of buckets), for each child to use its own data according to its bucket index, and the parent to maintain the whole.

core: ensure that MPMs return an error on runtime failure and hence that httpd's main process also exits with an error.

mpms: enforce assertion that unreachable code is not reached.

core: follow up to r1629909: ap_daemons_to_start can't be lower than 1 (not 0) for prefork either.

core: Use process scoreboard to store each child's listener bucket, and silently adjust the configured number of processes/threads to be above the computed number of listener buckets (depending on the CPU cores).

prefork: Ignore SIGINT in child. This fixes race-condition in signals handling when httpd is runnning on foreground and user hits ctrl+c. In this case, SIGINT is sent to all children followed by SIGTERM from the main process, which interrupts the SIGINT handler and leads to inconsistency (process freezes or crashes).

Fixed unused "ap_listen_rec *lr;" in prefork_run().

Mark all unused/duplicated/closed child listeners as inactive. Fix unused "ap_listen_rec *lr;" in worker_run().

-MPMs prefork & worker: avoid segfault with SAFE_ACCEPT in ONE_PROCESS mode.

fix restart issues

Break out common code to be share-able

Now allow MPMs to call ap_log_common()

Optimize w/ duplicated listeners and use of SO_REUSEPORT where available.

follow up to r1387633: use the right exit code depending on the error scenario

* server/mpm/prefork/prefork.c (child_main): Don't log errors for an apr_pollset_add() failure if a graceful-stop has been signalled.

fix child exit status in prefork after certain errors in the child so that the parent resets the spawn rate to the minimum or: mpm_prefork: Reduce spawn rate after a child process exits due to unexpected poll or accept failure.

Move away from DEFAULT_REL_RUNTIMEDIR and use ap_runtime_dir_relative() API

Add lots of unique tags to error log messages

If a child is created just before graceful restart and then exits because of a missing lock file, don't shutdown the whole server. PR: 39311 Submitted by: Shawn Michael <smichael rightnow com>

Cleanup effort in prep for GA push: Trim trailing whitespace... no func change

Install signal handlers for crashes before detaching. Previously, there was a time span where crashes would be neither visible on the console nor logged in the error log.

Reduce period during startup and restart where a successive signal may be lost PR: 43696 Submitted by: Arun Bhalla <arun shme net>

Log the deprecation warning at level info, not warn

Fix search'n'replace error: Actually warn if MaxClients is used

Rename MaxClients to MaxRequestWorkers which describes more accurately what it does.

Introduce ap_(get|set)_core_module_config() functions/macros and use them everywhere. We know that the core module has module_index 0. Therefore we can save some pointer operations in ap_get_module_config(cv, &core_module) and ap_set_module_config(cv, &core_module, val). As these are called rather often, this may actually have some (small) measurable effect.

Add child_status hook for tracking creation/termination of MPM child processes. Add end_generation hook for notification when the last MPM child of a generation exits. end_generation is implemented completely by core using the child_status hook run by the MPM. simple and mpmt_os2 MPMs don't currently run the child_status hook, so neither hook is invoked with those MPMs.

Simplify the interface to ap_reclaim_child_processes() and ap_relieve_child_processes(): instead of requiring the MPM to implement an otherwise-useless hook, just use a callback function. As I don't expect third-party MPM devs are following our day to day progress, the API changes are considered part of yesterday's MMN change.

mpm_common.c implements a handful of config directives; the related state has to be re-initialized to the default values at pre-config time, but that was handled inconsistently by the MPMs, resulting in unexpected behavior when some of the directives were removed across restart move that necessary initialization from the MPMs to common code run from core's pre-config; MPMs that need to override defaults can do so by running after core's pre-config (the NetWare MPM now does that) the DEFAULT_MAX_REQUESTS_PER_CHILD compile setting wasn't useful enough to keep the simple MPM wasn't consistent in which of these directives were respected and which weren't, and that hasn't changed (see procmgr.max_requests_per_child vs. ap_max_requests_per_child)

consolidate logic to remove the pidfile in a new API, ap_remove_pid(), related to existing ap_log_pid() and ap_read_pid() presumably this is useful to third-party MPMs as well

* server/mpm/prefork/prefork.c (set_signals): Ignore SIGXFSZ; have a write() beyond 2GB fail with E2BIG rather than killing the process in the now hopefully rare case of non-LFS file usage on LFS systems. * server/mpm/worker/worker.c (set_signals): Likewise. * server/mpm/event/event.c (set_signals): Likewise.

worker, event, prefork: Correct several issues when built as DSOs; most notably, the scoreboard was reinitialized during graceful restart, such that processes of the previous generation were not observable. Other noticeable ones: * the generation number did not increment properly * worker's check-config hook didn't detect startup properly, so messages about inconsistent directives could have been sent to the wrong place max_daemons_limit wasn't tracked across restart, but as the scoreboard was always cleared this was a non-issue. Reinitialization of idle_spawn_rate, hold_off_on_exponential_spawning, and maxclients-message-reported may or may not have been features, but the big picture is that the behaviour shouldn't have differed. These changes should have been part of r758185.

zap needless reinitialization of is_graceful on the 2nd call of the open-logs hook

sanity check use of volatile in prefork, worker, and event

prefork in ONE_PROCESS mode: child_main() called clean_child_exit() in almost all paths, and returned to the caller in one infrequent path; just call clean_child_exit() always

prefork: store pid in scoreboard for ONE_PROCESS mode

fix some logging calls to include the server_rec (and even the conn_rec in a couple of places)

* server/mpm/prefork/prefork.c (stop_listening, sig_term, restart): Update mpm_state in the signal handlers such that it is correct in children during a graceful stop/restart too. PR: 41743 Submitted by: Andrew Punch <andrew.punch 247realmedia.com>

Fix ap_mpm_query results: AP_MPMQ_MAX_THREADS: Single threaded means one thread per child, not zero AP_MPMQ_MAX_DAEMONS: Max # daemons by config is determined by MaxClients, not ServerLimit

fix description of the change for PR43857; it is a work-around for a reslist problem that isn't fixed in apr-util 1.3.x Suggested by: jorton

remove more unused variables revove some obsolete comments netware file is untested

Use the new APLOG_USE_MODULE/AP_DECLARE_MODULE macros everywhere to take advantage of per-module loglevels

replace r942897 with the original submitted patch prefork MPM: Run cleanups for final request when process exits gracefully. PR: 43857 Submitted by: Tom Donovan

revert the PR 43857 fix in r942897 based on a potential memory leak pointed out by jorton (original patch to be committed shortly)

prefork MPM: Run cleanups for final request when process exits gracefully. PR: 43857 Submitted by: Tom Donovan, simplified slightly by me

Catch up with ap_[proc|global]_mutex_create api change

all signs indicate that status value is always -1 on error

reduce the warning level in the bindprocessor() call used to make sure child processes aren't bound to the CPU the parent is running on. In recent levels of AIX, the parent isn't implicitly bound to a CPU (so the children don't inherit it), and when the AIX WPAR feature is enabled this call can return EPERM, even though the child process is already unbound.

Log command line on startup, so there's a record of command line arguments like -f. Suggested by Shaya Potter. [Dan Poirier] PR: 48752

change the preprocessor define ap_accept_mutex_type to upper case

Replace AcceptMutex, LockFile, RewriteLock, SSLMutex, SSLStaplingMutex, and WatchdogMutexPath with a single Mutex directive. Add APIs to simplify setup and user customization of APR proc and global mutexes. (See util_mutex.h.) Build-time setting DEFAULT_LOCKFILE is no longer respected; set DEFAULT_REL_RUNTIMEDIR instead. Some existing modules, such as mod_ldap and mod_auth_digest gain configurability for their mutexes.

Enhance ap_hook_monitor to pass along a server_rec (in general the ap_server_conf) and tuck away some storage in there which may be useful as an opaque data pointer.

* Do better checking of pollset operations in various places to avoid segfaults. PR: 46467 Submitted by: Stefan Fritsch <sf sfritsch.de> Reviewed by: rpluem

main() can use ap_run_mpm() directly, so axe the old ap_mpm_run() function change the mpm hooks to return OK/DONE instead of 0/1

mpm-query hook: distinguish between DECLINED and APR_ENOTIMPL so that . ap_mpm_query() can return APR_EGENERAL if called too early (for debugging a module) . some hypothetical module which implements the mpm-query hook can bypass the MPM with APR_ENOTIMPL

rename the new retained-data APIs to ap_retained_data_create()/ap_retained_data_get(), for better consistency with existing APIs (e.g., slotmem) don't bother changing the MMN, which doesn't reflect recent -dev changes anyway

the mpm_get_child_pid hook is unnecessary, as was the per-MPM MPM_CHILD_PID() macro which it replaced axe this new hook, and use ap_get_scoreboard_process() instead

Core can specify a platform-specific rewrite args hook. Use that on Unix. Windows continues to specify this in the MPM, at least until someone can separate out the MPM-specific bits.

axe ancient platform checks

Register rewrite_args hook. Now, dunno if that was intended, but at least allow to start the httpd

axe unmaintained 1.3-era code to support AUX, SunOS, IRIX, Next, Tandem, MPE, LynxOS, QNX, and UnixWare

remove TPF support

prefork, worker, event: restore expected accept mutex mechanism and allocator limit support (the related AP_MPM_WANT_foo defines no longer exist)

resurrect the old (pre-r757867) compiled-in MPM_NAME value, but via a hook for dynamically linked MPMs

The rewrite-args hook isn't available to MPM DSOs. Piggy-back on the linked-in mod_unixd.c to handle that. (The set of MPMs modified is the same set for which mod_unixd is enabled, which is approximately equivalent to the set of Unix MPMs which anybody has tried to maintain in recent memory.)

prefork, worker, and event MPMs: use retained-data API to maintain information across reconfigs, to allow these MPMs to work as DSOs

main() now sets ap_server_conf()

Introduce a new set of APIs to allow MPMs to be proper modules instead of integral parts which share global variables, functions, and macros with the rest of httpd. Converted now: prefork, worker, event, simple, WinNT* *WinNT hasn't been built or tested, and relies on a hack to include the WinNT mpm.h to disable Unixy MPM support routines in mpm_common.c

Fix a crash with r742218 by calling apr_os_thread_put() properly. (The first parameter to apr_os_thread_put() must be initialized, either to NULL or to an existing apr_thread_t.)

Add conn_rec::current_thread.

prefork: Fix child process hang during graceful restart/stop in configurations with multiple listening sockets. PR: 42829 Submitted by: Joe Orton, with some tweaking and testing from me

Release the accept mutex after receiving the shutdown signal in single-process mode. (That isn't a critical step, but neatness counts.) Submitted by: rpleum

As jorton discovered, recent Linux kernels have a new tunable setting for epoll that will trip up many prefork users. Write a log message instead of crashing. PR: 46467 As rpluem notes, some Apache doc is in order.

API Cleanup in preperation for 2.4.x, make sure all exported functions or variables contain an ap_ prefix.

Further unixd hacks to remove duplication between old-unixd and mod_unixd, and get it working with old MPMS[1] + mod_unixd. It's still an uneasy split, as some modules (mod_cgid, suexec)[2] also use unixd. More thinking+hacking due. [1] Should be prefork/worker/event, but only worker is tested. [2] cgid is OK, suexec is untested.

Switch all unix MPMs to use drop_privileges hook (mod_unixd) for startup and add a flag to prevent running without any module taking responsibility for managing system privileges!

Remove all references to CORE_PRIVATE.

Remove ap_graceful_stop_signalled from all MPMs.

* server/mpm/prefork/prefork.c (child_main): If apr_pollset_poll() fails with EINTR and die_now has been set (indicating a graceful stop/restart), terminate the child quickly rather than re-entering poll().

* server/mpm/prefork/prefork.c (child_main): Unlock the mutex before terminating in the multi-listener poll error path.

* server/mpm/prefork/prefork.c (child_main): Stop processing new connections if shutdown_pending is set, i.e. when SIGTERM is received in single-proecss mode. Submitted by: Garrett Rooney <rooneg apache.org> PR: 38848

Add alternative fixes for CVE-2007-3304: * configure.in: Check for getpgid. * include/mpm_common.h (ap_mpm_safe_kill): New prototype. * server/mpm_common.c (reclaim_one_pid): Ensure pid validity before calling apr_proc_wait(). (ap_mpm_safe_kill): New function. * server/mpm/prefork/prefork.c, server/mpm/worker/worker.c, server/mpm/experimental/event/event.c: Use ap_mpm_safe_kill() on pids from the scoreboard, throughout. * include/ap_mmn.h: Minor bump.

Revert r547987 ("svn merge -c -547987 .")

* server/mpm/prefork/prefork.c (reap_children), * server/mpm_common.c (ap_wait_or_timeout): Remove dead code; NEED_WAITPID has never been defined by the 2.x build system.

PID table impl: parent process keeps a local table store of Apache child process PIDs and uses that to check validity of what's in the scoreboard.

* server/mpm/prefork/prefork.c (prefork_check_config): Remove unused variable.

Replace ap_get_server_version with ap_get_server_banner() and ap_get_server_description(). High-level summary: The full server version information is now included in the error log at startup as well as server status reports, irrespective of the setting of the ServerTokens directive. Third-party modules must now use ap_get_server_banner() or ap_get_server_description() in place of ap_get_server_version().

Introduce a check_config phase between pre_config and open_logs, to allow modules to review interdependent configuration directive values and adjust them while messages can still be logged to the console. The open_logs phase is already used somewhat for this purpose by certain MPMs (winnt, prefork, worker, and event) but only by forcing their functions ahead of the core ap_open_logs() function, and since this phase runs after the ap_signal_server function during startup, it can not be used to generate messages on the console when restarting. Add the check_config phase to mod_info and mod_example. Handle relevant MPM directives during this phase and format messages for both the console and the error log, as appropriate. Bounds and sanity checks on the values of the MPM directives are handled in sequence in this phase instead of in the various directive handling functions, since those functions (e.g., set_max_clients()) may not be called at all if their directives do not appear in the configuration files, and even if they are called, there is no guarantee that this will occur in any particular order. Remove from the worker and event MPMs the code in the pre_config phase that alters the configuration node tree by re-ordering ThreadsPerChild ahead of MaxClients. This code is effective but insufficient; for example, if ServerLimit follows MaxClients, the test against server_limit in set_max_clients() is invalid. (In practice, this only results in incorrect or absent warnings on the console, because server_limit is set to its configured value when the main loop re-runs the configuration process.) Prevent ap_threads_per_child from exceeding thread_limit in the winnt, worker, and event MPMs. This situation could occur if ThreadsPerChild was not specified in the configuration files and ThreadLimit was set to a value smaller than DEFAULT_THREADS_PER_CHILD, because set_threads_per_child() would never be called and therefore its bounds check against thread_limit would not be performed. Remove from the winnt, prefork, worker, and event MPMs the changed_limit_at_restart flag. Set the first_server_limit and first_thread_limit values during the first execution of the check_config function, and use them to detect changes to ServerLimit and ThreadLimit across restarts and issue appropriately formatted warnings. Remove the comments about the error log being a "bit bucket"; this was true when the code was originally committed in r92530 but that was due to a bug fixed in r92769. Be consistent about setting all MPM configuration directive values in the pre_config phase. Rephrase and reformat the console and log file messages relating to MPM configuration directives to be consistent across all MPMs. Use briefer messages when logging to the error log than to the console. Update miscellaneous stale comments and messages (e.g., reference to daemons_min_free in worker and event MPMs, "prefork open_logs" in winnt MPM, and StartServers in netware MPM). The winnt, netware, beos, and mpmt_os2 MPMs should be tested by developers with access to those platforms, especially the winnt MPM, which has unique logic with respect to distinguishing between parent and child processes during the configuration phases. Update the English documentation for the worker MPM's ThreadsPerChild directive, which no longer needs to precede other MPM directives in the configuration files if it has a non-default value. The German (.de) and Japanese (.ja) translations should be updated by developers fluent in those languages.

update license header text

* server/mpm/prefork/prefork.c (child_main): Tag pchild.

Update the copyright year in all .c, .h and .xml files

No functional Change: Removing trailing whitespace. This also means that "blank" lines consisting of just spaces or tabs are now really blank lines

Remove some trailing spaces. Syncs with 2.2.x.

* server/mpm/prefork/prefork.c: Add volatile qualifier to die_now since it is changed by a signal handler.

Initiliase all of the first_*_limit variables to zero, so that we can actually raise limits beyond their defaults reliably.

Add ap_append_pid(); This is performed enough to warrant a function I think, especially with the fact that the mapping of getpid() to APR_PID_T_FMT isn't consistant in some areas.

Move the "GracefulShutdownTimeout" command definition into mpm_common

Re-add a simple, obvious, speed-up.

Remove as many ghastly scoreboard loops from the graceful-shutdown code, and replace with the new ap_relieve_child_processes() call. Add a sleep() call now, as we lost the timeout inherent in ap_wait_or_timeout(). 1 second seems a sane choice.

Move the "GracefulShutdownTimeout" directive into mpm_common, for re-use with other MPM's.

Implement a "graceful-stop" for the prefork MPM (might aswell do the hard one first). General approach is to send SIGUSR1 to all children (which will de-listen, and exit when finished), and to gather all children as they exit. We don't use a sleep(timeout) for the timeout implementation, because this would lead to a rut of defunct children until the timeout had expired. set_graceful_shutdown stolen from Ken Coar. See <3E84B1EC.3050007@Golux.Com> (28 Mar 2003).

Implement "de-listening" for graceful restarts with the prefork MPM. With this change; 1.) httpd -k graceful sends SIGUSR1 to the parent pid, which in turn sends SIGUSR1 to all of the active children, 2.) Active children each close their copy of listener fd's. This means that the listening sockets are freed for re-use. In the ordinary case, this makes no difference. However if for example admin changes "Listen 80" to "Listen 81" in the config, this rev makes port 80 immediately available (no waiting for the graceful children to die).

Update copyright year to 2005 and standardize on current copyright owner line.

* modules/ssl/ssl_engine_kernel.c (ssl_callback_SSLVerify_CRL), * server/log.c (ap_log_pid), * server/mpm/prefork/prefork.c (accept_mutex_on, accept_mutex_off), * support/htdbm.c (htdbm_list): Fix some non-literal format strings (warnings from gcc -Wformat-security). PR: 30585 Submitted by: Ulf Harnhammar (SITIC), Joe Orton

the eight space tabs are harassing me. :set tabstop=8 :retab (no code changes)

Improve helpfulness of error messages when accept mutex has a problem.

fix name of The Apache Software Foundation

fix copyright dates according to the first check in

apply Apache License, Version 2.0

bump MAX_SERVER_LIMIT by 10x (hoping to stay ahead of Moore's Law for a little while) since the current limit is too small for at least one high end site. Submitted by: Colm MacCarthaigh [colm stdlib.net]

update license to 2004.

fix the name of the failing API call in a log message

add new MPM query -- AP_MPMQ_MPM_STATE -- to find out what the MPM is doing work-in-progress; not so useful until other MPMs support it

build with latest other-child API changes

Switch the prefork MPM over to the new pollset interface. * server/mpm/prefork/prefork.c: (listensocks[]): removed. not required. (child_main): stop using listensocks[] in favor of an apr_pollset_t. if there is just one listener, then always refer to that listener's listen_rec for further processing, otherwise poll and pick up the listen_rec pointer from the polling structure's client_data. tweaked the round-robin for the new pollset API (and documented). cleaning: removed 'offset' which is obviated by the use of a pointer to a listen_rec. tighten the block-scope of several variables. switch to use a 'status' variable name rather than three separately named variables. rename n->numdesc to be more obvious.

Fix uninitialized gprof directory name in prefork MPM. PR: 24450 Submitted by: Chris Knight <Christopher.D.Knight@nasa.gov> Reviewed by: Jeff Trawick

Prevent slow graceful restarts on some platforms: * prefork.c (ap_mpm_run): Only make as many dummy connections as slots used, not as many as slots are available.

Make sure that the global ap_max_mem_free is initialized along with the other MPM globals whenever HTTPD is started or restarted.

Forward port patch for CAN-2003-0253 from 2.0. SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing temporary denial of service when accept() on a rarely accessed port returns certain errors. Reported by Saheed Akhtar <S.Akhtar@talis.com>. [Jeff Trawick]

prefork MPM: Use the right permissions for the directory created for gprof support. Submitted by: Jim Carlson <jcarlson@jnous.com> Reviewed by: Jeff Trawick

the error code is in the apr_status_t, not errno

improve -DONE_PROCESS handling with prefork MPM so that it returns from ap_mpm_run() and allows core Apache code to run any required cleanups this resolves problems such as semaphore leaks and shared memory that isn't cleaned up (some necessary re-indention to be done in a separate commit; otherwise, this would be a difficult commit to review)

consolidate code related to sig_coredump a note on perchild: perchild exception handling was busted before this and is still busted the problem I noticed was that a client that exposes a segfault never gets its connection dropped and the parent never notices that the child process that segfaulted hasexited

finished that boring job: update license to 2003. Happy New Year! ;-))

fix "long lost child came home!" messages after a graceful restart with MaxClients (== ap_daemons_limit) lowered. This leaves junk at the end of the formerly used part of the scoreboard. If you then decide to raise MaxClients via graceful, the junk prevents those scoreboard slots from being used. This should not impact performance because find_child_by_pid stops its search when it sees a matching pid. If we don't have a match, something else is busted.

zap an unused variable

Get the prefork MPM using the apr_poll interface directly instead of going through the old functions which are only still available for backwards compat.

Bring Apache in line with APR's new poll implementation. This isn't optimal, because it still uses the compatibility functions to make it work, but it does work. The next step will be to take the memory for the pollsets under Apache's control.

Add a new directive: MaxMemFree. MaxMemFree makes it possible to configure the maximum amount of memory the allocators will hold on to for reuse. Anything over the MaxMemFree threshold will be free()d. This directive is usefull when uncommon large peaks occur in memory usage. It should _not_ be used to mask defective modules' memory use.

prefork MPM: Ignore mutex errors during graceful restart. For certain types of mutexes (particularly SysV semaphores), we should expect to occasionally fail to obtain or release the mutex during restart processing. These mutex failures seem to be a pretty rare occurrence, but it was fatal.

Now that we have the functionality in apr, we can now have 2.0's startup message regarding AcceptMutex (what we are using and what the default is) "fully" match what is present in 1.3. PR: Obtained from: Submitted by: Reviewed by:

Catch up with the apr_allocator_set_owner -> apr_allocator_owner_set renames in APR.

Add "-k start|startssl|restart|graceful|stop" support to httpd for the Unix MPMs. These have semantics very similar to the old apachectl commands of the same name. The use of stderr/stdout and exit status for error conditions needs to be revisited. For now it matches apachectl behavior. Justin Erenkrantz got the ball rolling with this feature. Some of his support code was used unchanged. Other code was shuffled around and modified or rewritten.

stop using APLOG_NOERRNO in calls to ap_log_?error()

Remind the admin about the User and Group directives when we are unable to set permissions on a semaphore. PR: 7812

quiet a bogus gcc warning that crops up with -O2

Remove hardcoded paths from MPMs and move them to a more central place. Expand paths in httpd-std.conf in a similar fashion as we do in our headers. Submitted by: Pier Fumagalli <pier@betaversion.org>

prefork MPM: add -DFOREGROUND option to use when you want the parent process to run in the foreground (NO_DETACH is a special mode for running under programs like daemontools) the existing flag -DDEBUG turns on FOREGROUND now instead of NO_DETACH

style change only

The old, legacy (and unused) code in which the scoreboard was totally and completely contained in a file (SCOREBOARD_FILE) has been removed. This does not affect scoreboards which are *mapped* to files using named-shared-memory at all. This implies that scoreboards must be based, at some level, on native shared memory (mmap, shm_open, shmget, whatever), but the code has assumed that for quite awhile now. Having the scoreboard be *based* on a file makes no sense today. PR: Obtained from: Submitted by: Reviewed by:

BUCKET FREELISTS Add an allocator-passing mechanism throughout the bucket brigades API. From Apache's standpoint, the apr_bucket_alloc_t* used throughout a given connection is stored in the conn_rec by the create_connection hook. That means it's the MPM's job to optimize recycling of apr_bucket_alloc_t's -- the MPM must ensure that no two threads can ever use the same one at the same time, for instance.

Fold the compiled-in knowledge of the allowable AcceptMutex settings into its help entry. Requires the use of a extern string rather than a function call for the initialization to be valid in the macro (Thx to Jeff!). In the meantime, bump down the error logging until we deal with true default and configured setting information ala 1.3. PR: Obtained from: Submitted by: Reviewed by:

no need to kill the scoreboard cleanup anymore on graceful restart; the scoreboard is longer-lived PR: Obtained from: Submitted by: Reviewed by:

Bring 2.0 up to parity, a bit, with how much info we provide to the admin regarding valid values for AcceptMutex. Should also tell 'em what "default" actually maps to, but that can wait. PR: Obtained from: Submitted by: Reviewed by:

The pre_mpm hook creates server-lifetime objects (or at least, for the generations across graceful restarts.) They should use the process pool.

Fix a hang condition with graceful restart and prefork MPM in the situation where MaxClients is very high but much fewer servers are actually started at the time of the restart. The way we notify an entire generation to die at once is changed so that we don't have to use the pod (and deal with the ease of filling the kernel pipe buffer).

prefork and worker: after allocating a new scoreboard, make sure the right generation is stored in the global score

Simplify s/APR_OS_PROC_T_FMT/APR_PID_T_FMT/, apr_os_foo entities aren't for external consumption.

Update the mpms to call the new allocator/pools API

Update our copyright for this year.

Implement apr_proc_detach changes and allow -DNO_DETACH in the multi-process mode to not "daemonize" while detaching from the controlling terminal. This is necessary for Apache to work with process-management tools like AIX's "System Resource Controller" as well as Dan Bernstein's "daemontools". What this means is apache must _NOT_ be a process group leader if called with the -DNO_DETACH flag. Submitted from: Jos Backus <josb@cncdsl.com> Edited/Reviewed by: Aaron Bannert

expand_lock_fname() is no longer used

Restored the permission setting for the accept mutex (which was lost in my previous commit to change to the new lock API)

Converted prefork MPM's accept mutex to the new lock API

Implement new ScoreBoardFile directive logic. This affects how we create the scoreboard's shared memory segment. We now have the best of both worlds: if config specifies ScoreBoardFile create name-based shared memory, errors are fatal else /* we get to choose */ create anonymous shared memory if ENOTIMPL create name-based shared memory from DEFAULT_SCOREBOARD else errors are fatal This gives us the flexibility to have anonymous shared memory (on platforms that support it) as well as name-based shared memory when third-party programs want access to our scoreboard. The ap_scoreboard_fname static variable is now owned by the scoreboard.c file, and no longer by the MPMs. The MPMs MUST NOT set ap_scoreboard_fname to a default, since that will override the default creation logic and only allow name-based segments. Submitted by: Aaron Bannert Reviewed by: Justin Erenkrantz

if a child detects a resource shortage on accept(), limit the rate of fork()s to 1 per second until the situation clears up. Inspired by: Martin Kraemer

prefork shouldn't be killing its parent if a child runs out of resources.

Not being able to bind to a socket is a fatal error. This makes all MPMs treat it as such. We now print a message to the console, and return a non-zero status code.

This patch allows the prefork MPM to print messages to the console if it can't open a socket for some reason.

Reintroduce the create_connection hook. This hook is required to enable modules to completely take over all network i/o from the core.

Change the Windows MPM to only use the pre_mpm phase in the parent process. The child processes use the child_init phase to reattach to the shared memory. This makes Windows work like Unix, which should make it easier for module authors to write portable modules.

get prefork to build again.

Take advantage of the new pre_config return value when apr_proc_detach fails. I'll be making some changes to apr_proc_detach, and it will be nice to be able to report runtime errors. Tested on worker but the code changes are identical on other MPMs.

The pre_config hook now takes a return value. This allows modules to cause the server to bail out under error conditions.

fix the problem where a scoreboard init failure could leave mod_cgid stranded a pre_mpm hook can now return failures, so problems in ap_create_scoreboard percolate back to a place where Apache can exit cleanly

Remove the create_connection hook and put the client_socket back into the conn_rec. The create_connection_hook has a design flaw that prevents it from making decisions based on vhost information.

don't poll if there is only a single listening socket

let's play "name that pool" (debugging aid... set the tag on the transaction pool with prefork)

This patch eliminated from the _SHARED_ segment of the scoreboard all pointer math. This is required for portable scoreboards. vhost becomes the 'vhost name string' so it now survives ap_generation clicks. next was apparently never used. This patch also accounts for the changes to the apr_shm api, and gives Win32 the magic of a shared scoreboard. Breakage aplenty on non-win32 platforms, I suspect, but this radical surgery, and culling of unused functions, was really, really needed.

handle the disappearance of apr_lock_create_np() and apr_proc_mutex_create_np() and the new parameter to apr_lock_create() and apr_proc_mutex_create()

Add directives to worker and preform MPMs so that the admin can set the equivalent of HARD_SERVER_LIMIT/HARD_THREAD_LIMIT at startup.

Change core code to allow an MPM to set hard thread/server limits at startup.

Use the new pool API to eliminate pool locking in the prefork MPM

carry over from 1.3: disable profiling in the parent process #ifdef GPROF PR: Obtained from: Submitted by: Reviewed by:

fix chdir_for_gprof() to s/dir/use_dir/ for chdir()

Get mod_cgid killed when a MPM exits due to a fatal error. Presumably other such processes are affected to. Now we give main() a chance to clean up.

Pull lingering close out of the pool cleanup phase. This was causing too many bugs. Instead, it is called where it used to be called. I have abstracted some of the logic out of the lingering close so that it gets the socket from the connection using the core's conn_config vector. This is in anticipation of a change to use a hook for the lingering close, which I hope to do soon.

Allow modules that add sockets to the ap_listeners list to define the function that should be used to accept on that socket. Each MPM can define their own function to use for the accept function with the MPM_ACCEPT_FUNC macro. This also abstracts out all of the Unix accept error handling logic, which has become out of synch across Unix MPMs. The code flow is much easier now for different transports: 1) During pre-config, post-config or while parsing the config file, add a socket to the ap_listeners list, making sure to define an accept function at the same time. 2) MPMs find the correct listener, and call the accept function that was defined in step 1. 3) That accept function returns a void pointer, which is passed to the create_connection hook. 4) create_connection adds the correct low-level filters.

Add the server_rec argument back to the create_connection hook. Submitted by: Greg Stein

don't use a variable named stat, it can cause problems on some platforms.

Back out my last patch. The logic to add sockets to pollsets is back in the MPM

This allows modules to add socket descriptors to the pollset. I have only added this to the perfork MPM, and the others work without it. Tomorrow I will add it to the other MPMs.

Remove commas from the end of the macros that define directives that are used by MPMs. Previous to this patch, you would use these macros without commans, which was unlike any other directives. Now, after the macro, you must have a comma. This makes the macros look more like the rest of the directives. I know this is cosmetic, and I was going to leave it alone, but when I found out that it bothered Cliff too, I decided to fix it after all. Submitted by: Ryan Bloom and Cliff Woolley

Remove more network logic from the MPMs. Essentially, each MPM can define AP_MPM_DISABLE_NAGLE_ACCEPTED_SOCK, which tells Apache to disable_nagle on the accepted socket.

Begin to abstract out the underlying transport layer. The first step is to remove the socket from the conn_rec, the server now lives in a context that is passed to the core's input and output filters. This forces us to be very careful when adding calls that use the socket directly, because the socket isn't available in most locations.

minor tweaks to pass a parm of the right type to apr_poll() and to use i for an iterator in both listensocks[] loops

in prefork, listensocks[0] doesn't have a pod also, fix an ap_log_error() call to use ret for the error code instead of errno

Remove ap_lingering_close from all of the MPMs. This is now done as a cleanup registered with the connection_pool. I have also turned ap_lingering_close into a static function, because it is only used in connection.c. This is the next step to consolidating all of the socket function calls. ap_lingering_close will only be added if the core is dealing with a standard socket.

Move prefork to the same API as the rest of the MPMs for setting up listeners.

Fix the spelling of the AP_MPMQ_MIN_SPARE_DAEMONS and AP_MPMQ_MAX_REQUESTS_DAEMON macros. Better to do it now rather than later. **WARNING** This will of course break the compile on any third-party MPMs you might have floating around, but it's a really quick change to make.

These comments are pretty much useless now AFAICT.

Fix the reporting for child processes that die. This removes all of the non-portable W* macros from Apache. Submitted by: Jeff Trawick and Ryan Bloom

Exit when we can't listen on any of the configured ports. This is the same behavior as 1.3, and it avoids having the MPMs to deal with bogus ap_listen_rec structures. This also backs out some circumventions I and Greg Ames had added to prefork; these are no longer necessary because of this change.

fix another seg fault.

prefork: Don't segfault when we are able to listen on some but not all of the configured ports. Other points to ponder: why no log message for the segfault? similar change would seem to be needed in other MPMs... we may be adding bogus entries to the poll set

Switch back to SIGUSR1 for graceful restarts on all platforms that support it. This defines a symbol called AP_SIG_GRACEFUL in ap_config_auto.h which will have the appropriate signal value. All direct references to SIGWINCH have been replaced with AP_SIG_GRACEFUL. On Linux 2.0, use SIGWINCH instead since SIGUSR1 is used by glibc 2.0's user-space threading library to control threads. All later versions of Linux/glibc don't have this problem. (Not to mention the security holes in older Linux versions which make it unsuitable for use as a web server.) If your platform doesn't have SIGUSR1, use the appropriate mojo in configure to define what your graceful restart signal should be. In theory, a configure switch could be added to allow the admin to specify the appropriate signal that should be used. This is left as an exercise to the reader for now. The docs need to be updated. Since the signal is now configurable, just saying SIGUSR1 for graceful restart isn't completely true. Also, the apachectl functionality needs to be moved into httpd - this is what Win32 does and it makes us consistent across platforms. Roy issued a veto against use of SIGWINCH by default, so this should resolve that veto.

Add -X functionality back to httpd. - Updates upgrading.html - Reverts Aaron's earlier docco patch (sorry...) - Adds -X to all mpms in the tree

Update the comments regarding -DONE_PROCESS and -DNO_DETACH since -X doesn't exist anymore. Submitted by: Aaron Bannert

The prefork and OS/2 MPMs are overwriting the pid file when a second copy of httpd is started and shuts down due to socket conflict. Moving the call to ap_log_pid solves the problem.

Update the Apache code to account for the XtOffset change in APR.

The Unix MPMs other than perchild now allow child server processes to use the accept mutex when starting as root and using SysV sems for the accept mutex. Previously, this combination would lead to fatal errors in the child server processes. perchild can't use SysV sems because of security issues. translation: steal apache 1.3 code to call semop(IPC_SET) on the semaphore to set permissions and uid/gid

namespace-protect accept_lock_mech fix a bug in the worker MPM which effectively disabled the AcceptMutex directive

Begin to sanitize the MPM configuration directives. Now, all MPMs use the same functions for all common MPM directives. This should make it easier to catch all bugs in these directives once. Everybody should check their favorite MPM to ensure that it still compiles, and that these directives work. This is a big patch, and although it looks good, and things compiled for me, that is no garauntee that it will work on all platforms. :-) Submitted by: Cody Sherr <csherr@covalent.net>

record something in the error log if the parent process seg faults Submitted by: Jeff Trawick

Make scoreboard creation a hook. This allows management modules to have access to the scoreboard at the time that it is created, and at every restart request. Submitted by: Cody Sherr <csherr@covalent.net> Reviewed by: Ryan Bloom

Changed AP_MPMQ_MAX_DAEMONS to refer to MaxClients and added an AP_MPMQ_MAX_DAEMON_USED to refer to the highest daemon index actually used in the scoreboard. I also updated the pertinent calls. Paul J. Reder

Remove a couple fields from the scoreboard that aren't currently used. If we need these, they should be added when we begin to use them.

Check the pod after processing a connection so that we'll go away if a graceful restart occurred while we were processing the connection. Otherwise, we won't wake up until a real connection comes in and we'll use the wrong config to process it and we may block in the wrong syscall (because the new generation is using a different accept mutex) and in general it is goofy.

Add additional query datum to the MPMs. Harrie Hazewinkel <harrie@covalent.net>

add the AcceptMutex directive and related processing to prefork MPM the directive syntax is as suggested by JimJag a few days ago

fix a comment describing how we kill off a single child process

fix some more signalling issues: . in ONE_PROCESS mode, bail out immediately for SIGHUP and SIGINT Note that if you send HUP or INT and have cgid then cgid won't go away. If you generate the interrupt signal from the httpd terminal then cgid will go away, [I guess] because SIGINT gets sent to the process group. Perhaps just_die() needs to have logic to send to other processes in the group for ONE_PROCES mode . the die_now flag should be static . please_die_gracefully() is no longer needed

For SIGHUP in the server processes, we attempt to go away immediately, just as for SIGTERM. If we deadlock because of some module or library issue then SIGKILL will come soon enough. Stop dorking with SIGTERM and SIGHUP in make_child(). That makes it kind of hard for the caller to set up for ONE_PROCESS mode.

fix a bad call to ap_log_error (missing the errno/apr_status_t parameter)

catch SIGWINCH in the parent process and set appropriate flags so that we write to the pod to tell the servers to go away

fix a format string used for apr_status_t

fix the bindprocessor() code selection; we need to test for the presence of the bindprocessor() function, not for sys/processor.h, which exists on some systems that don't have bindprocessor()

Make the processor unbinding/re-binding stuff on AIX work again.

check the pod in the child at a different spot so that we check it when we get a new connection; we were (essentially) never checking it before we check it when weird errors occur too but that shouldn't matter

First pass at the pipe_of_death logic for the prefork MPM. This does pass some initial testing, but it needs to be banged on more. It looks like if the server gets a lot of requests to restart all at once, there are potential problems, but other than that this does seem to solve our current restart issues.

Fix some broken logic in the prefork MPM. Basically, in the past, if we accepted a request, we didn't want to die if given a graceful restart signal. The logic I am removing stops us from dying for a graceless restart/stop signal, which is just wrong. If we are sent a graceless restart/stop, then we need to stop immediately.

Make first phase changes to the scoreboard data structures in preparation for the rewriting of the scoreboard per my posted design notes. [Paul J. Reder]

This patch puts enough of the signal processing back in so that the signals are all handled properly now. My previous patch fixed the deadlock race condition, but broke the user directed signal handling. This fixes it to work the it did before (primarily SIGTERM is now working).

Add more options to the ap_mpm_query function. This also allows MPMs to report if their threads are dynamic or static. Finally, this also implements a new API, ap_show_mpm, which returns the MPM that was required into the core. We tried to make all of the MPMs report their threading capabilities correctly, but each MPM expert should double check us. Submitted by: Harrie Hazewinkel <harrie@covalent.net>

More APR_STATUS_IS_ canonicalization

Changes required to make prefork clean up idle children properly. There was a window during which a starting worker deadlocks when an idle cleanup arrives before it completes init. Apache then keeps trying to cleanup the same deadlocked worker forever (until higher pids come along, but it still will never reduce below the deadlocked pid). Thus the number of children would not reduce to the correct idle level.

Allow modules to query the MPM about it's execution profile. This query API can and should be extended in the future, but for now, max_daemons, and threading or forking is a very good start. Non-Unix MPM's do have the MPM query function, although there is no garauntee that the information is perfect, please check. Submitted by: Jon Travis <jtravis@covalent.net>

fix the type of ap_my_pid and make it static since it is used in only one file per build (prefork.c or threaded.c) PR: 6980

remove ap_{post_config,child_init}_hook replace usage with ap_run_{post_config,child_init} PR: Obtained from: Submitted by: Reviewed by:

rename miss: s/apr_clear_pool/apr_pool_clear/g

Update copyright to 2001

doh. need a spellchekker for these rename scripts. s/apr_lock_aquire/apr_lock_acquire/g;

Begin to move the code that updates the child status out of the MPMs and into the main-line code. This ensures that all MPMs can easily forget about updating their status.

Remove some OS/2 code from the prefork MPM. Since OS/2 has it's own MPM, this is needed here.

INIT_SIGLIST() is gone; stop using it

*) include "apr_signal.h" when needed *) some other minor include tweaks

Cleanup the rest of the warnings that appear when compileing with GRPOF.

*) continued header revamping *) torch some headers (and some libs) from the autoconf stuff

Replace reinit_scoreboard with ap_create_scoreboard.

renaming various functions for consistency sake see: http://apr.apache.org/~dougm/apr_rename.pl PR: Obtained from: Submitted by: Reviewed by: