2a6c49cfaef5979a5a06098f3ce987cd76769409manojAPACHE 2.1 STATUS: -*-text-*-

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddardLast modified at [$Date: 2003/12/12 10:24:59 $]

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manojRelease [NOTE that only Alpha/Beta releases occur in 2.1 development]:

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

3304cbd819df02e7548e9338dc0afa8d3ba29358manoj 2.1.0 : in development

70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj

3304cbd819df02e7548e9338dc0afa8d3ba29358manojPlease consult the following STATUS files for information

2a6c49cfaef5979a5a06098f3ce987cd76769409manojon related projects:

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

f6a6245816cd866361da8c576b1f47c7a54b6610fanf * srclib/apr/STATUS

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet * srclib/apr-util/STATUS

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet * docs/STATUS

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddardContributors looking for a mission:

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard * just do an egrep on "TODO" or "XXX" in the source.

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard * Review the "PatchAvailable" bugs in the bug database.

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard Append a comment saying "Reviewed and tested".

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard * Open bugs in the bug database.

2aae6faee508221efbeaba5547ca79b7a20ef047stoddard

2aae6faee508221efbeaba5547ca79b7a20ef047stoddard

2aae6faee508221efbeaba5547ca79b7a20ef047stoddardCURRENT RELEASE NOTES:

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet

2aae6faee508221efbeaba5547ca79b7a20ef047stoddard

4065b438067f3f08d0bd98b31ac4085b581b931dstoddardRELEASE SHOWSTOPPERS:

2739add8add66e21526ce27f83c2ae133d089070rbb

2739add8add66e21526ce27f83c2ae133d089070rbb * Handling of non-trailing / config by non-default handler is broken

4065b438067f3f08d0bd98b31ac4085b581b931dstoddard http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105451701628081&w=2

211bf1d44f4653bf753a15740cd5ebbf330b6e93manoj

211bf1d44f4653bf753a15740cd5ebbf330b6e93manoj * the edge connection filter cannot be removed

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105366252619530&w=2

369edcdd0a9c5516c61e736ec2a6fc8fb0d92fe2manoj

369edcdd0a9c5516c61e736ec2a6fc8fb0d92fe2manojCURRENT VOTES:

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard * Promote mod_cache from experimental to non-experimental

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard status (keep issues noted below in EXPERIMENTAL MODULES as

85cbdc16ac57fa68ce1358a308269abcd417f4d9stoddard items to be addressed as a supported module).

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard +1: jim, bnicholes

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard -0: jerenkrantz

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard -1: stoddard

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard There are a couple of problems that need to be resolved

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard before this module is moved out of experimental.

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard 1) We need to at least review and comment on the RFC violations

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard 2) Resolve issue of how to cache page fragements (or perhaps -if- we

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard want to cache page fragements). Today, mod_cache/mod_mem_cache

d208bda4a893cc81ed5d3ed1cdd7d706e012bd42stoddard will cache #include 'virtual' requests (but not #include 'file'

75960f20f88dad6bc67892c711c429946063d133stoddard requests). This was accomplished by making CACHE_IN a

75960f20f88dad6bc67892c711c429946063d133stoddard CONTENT_SET-1 filter to force it to run before the SUBREQ_CORE

75960f20f88dad6bc67892c711c429946063d133stoddard filter. But now responses cannot be cached that include the

75960f20f88dad6bc67892c711c429946063d133stoddard effects of having been run through CONTENT_SET filters

75960f20f88dad6bc67892c711c429946063d133stoddard (mod_deflate, mod_expires, etc). We could rerun all the

75960f20f88dad6bc67892c711c429946063d133stoddard CONTENT_SET filters on the cached response, but this will not

75960f20f88dad6bc67892c711c429946063d133stoddard work in all cases. For example, mod_expires relies on installing

75960f20f88dad6bc67892c711c429946063d133stoddard the EXPIRATION filter during fixups. Contents served out of

75960f20f88dad6bc67892c711c429946063d133stoddard mod_cache (out of the quick_handler) bypass -all- the request

75960f20f88dad6bc67892c711c429946063d133stoddard line server hooks (Ryan really hated this. It is great for

75960f20f88dad6bc67892c711c429946063d133stoddard performance, but bad because of the complications listed above).

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj jerenkrantz: There are a slew of RFC compliance bugs filed in Bugzilla

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj for mod_cache (see 'RFC 2616 violations' below). I think

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj fixing them is a pre-requisite before it isn't experimental.

70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj * httpd-std.conf and friends

56ca30c968906053ae61acb218420667bb58d996rbb

56ca30c968906053ae61acb218420667bb58d996rbb a) httpd-std.conf should be tailored by install (from src or

a9e07e4f90adcc7bc768db3055431c3dcd560cd1manoj binbuild) even if user has existing httpd.conf

f6a6245816cd866361da8c576b1f47c7a54b6610fanf +1: trawick, slive, gregames, ianh, Ken, wrowe, jwoolley, jim, nd,

f6a6245816cd866361da8c576b1f47c7a54b6610fanf erikabele

a9e07e4f90adcc7bc768db3055431c3dcd560cd1manoj wrowe - prefer httpd.default.conf to avoid ambiguity with cvs

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj b) tailored httpd-std.conf should be copied by install to

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet sysconfdir/examples

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet -0: striker

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet c) tailored httpd-std.conf should be installed to

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet sysconfdir/examples or manualdir/exampleconf/

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet +1: slive, trawick, Ken, nd (prefer the latter), erikabele

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet d) Installing a set of default config files when upgrading a server

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet doesn't make ANY sense at all.

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet +1: ianh - medium/big sites don't use 'standard config' anyway, as it

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet usually needs major customizations

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet -1: Ken, wrowe, jwoolley, jim, nd, erikabele

8de99b4c89d4ed4292a7dca42dd8a96b9a7c456fdgaudet wrowe - diff is wonderful when comparing old/new default configs,

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet even for customized sites that ianh mentions

0b0a5225c5ed94b9f689839a14842ad4a24215e9dgaudet jim - ... assuming that the default configs have been updated

0b0a5225c5ed94b9f689839a14842ad4a24215e9dgaudet with the required inline docs to explain the

0b0a5225c5ed94b9f689839a14842ad4a24215e9dgaudet changes

0b0a5225c5ed94b9f689839a14842ad4a24215e9dgaudet

0b0a5225c5ed94b9f689839a14842ad4a24215e9dgaudet * If the parent process dies, should the remaining child processes

f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard "gracefully" self-terminate. Or maybe we should make it a runtime

f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard option, or have a concept of 2 parent processes (one being a

f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard "hot spare").

f824925ac58ff729289c017235eeb3bdd21ec3a2stoddard See: Message-ID: <3C58232C.FE91F19F@Golux.Com>

2aae6faee508221efbeaba5547ca79b7a20ef047stoddard

2aae6faee508221efbeaba5547ca79b7a20ef047stoddard Self-destruct: Ken, Martin, Lars

75960f20f88dad6bc67892c711c429946063d133stoddard Not self-destruct: BrianP, Ian, Cliff, BillS

75960f20f88dad6bc67892c711c429946063d133stoddard Make it runtime configurable: Aaron, jim, Justin, wrowe, rederpj, nd

75960f20f88dad6bc67892c711c429946063d133stoddard

75960f20f88dad6bc67892c711c429946063d133stoddard /* The below was a concept on *how* to handle the problem */

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard Have 2 parents: +1: jim

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard -1: Justin, wrowe, rederpj, nd

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard +0: Lars, Martin (while standing by, could it do

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard something useful?)

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet * Make the worker MPM the default MPM for threaded Unix boxes.

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet +1: Justin, Ian, Cliff, BillS, striker, wrowe, nd

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet +0: BrianP, Aaron (mutex contention is looking better with the

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard latest code, let's continue tuning and testing), rederpj, jim

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard -0: Lars

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddardRELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:

a5ed555df952c85bc1b179f5981e8a6c54ba16e6stoddard

56ca30c968906053ae61acb218420667bb58d996rbb * Patches submitted to the bug database:

56ca30c968906053ae61acb218420667bb58d996rbb http://nagoya.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&product=Apache+httpd-2.0&keywords=PatchAvailable

56ca30c968906053ae61acb218420667bb58d996rbb

56ca30c968906053ae61acb218420667bb58d996rbb * Filter stacks and subrequests, redirects and fast redirects.

70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj There's at least one PR that suffers from the current unclean behaviour

70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj (which lets the server send garbage): PR 17629

70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj nd says: Every subrequest should get its own filter stack with the

56ca30c968906053ae61acb218420667bb58d996rbb subreq_core filter as bottom-most. That filter does two things:

0bff2f28ef945280c17099c142126178a78e1e54manoj - swallow EOS buckets

0bff2f28ef945280c17099c142126178a78e1e54manoj - redirect the data stream to the upper request's (rr->main)

0bff2f28ef945280c17099c142126178a78e1e54manoj filter chain directly after the subrequest's starting

0bff2f28ef945280c17099c142126178a78e1e54manoj point.

9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard Once we have a clean solution, we can try to optimize

9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard it, so that the server won't be slow down too much.

9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard

0bff2f28ef945280c17099c142126178a78e1e54manoj * RFC 2616 violations.

0bff2f28ef945280c17099c142126178a78e1e54manoj Closed PRs: 15857.

0bff2f28ef945280c17099c142126178a78e1e54manoj Open PRs: 15852, 15859, 15861, 15864, 15865, 15866, 15868, 15869,

9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard 15870, 16120, 16125, 16126, 16133, 16135, 16136, 16137,

75960f20f88dad6bc67892c711c429946063d133stoddard 16138, 16139, 16140, 16142, 16518, 16520, 16521,

0bff2f28ef945280c17099c142126178a78e1e54manoj jerenkrantz says: need to decide how many we need to backport and/or

0bff2f28ef945280c17099c142126178a78e1e54manoj if these rise to showstopper status.

9c09943bad734ebd5c7cc10bd6d63b75c4c6e056stoddard wrowe suggests: it would be nice to see "MUST" v.s. "SHOULD" v.s. "MAY"

aa1faea36e4ae357bc603a2337b6adc54f5daec1manoj out of this list, without reviewing them individually.

f03d292915be9977eaf74e9be7b0404aec226f84manoj

f03d292915be9977eaf74e9be7b0404aec226f84manoj * There is a bug in how we sort some hooks, at least the pre-config

f03d292915be9977eaf74e9be7b0404aec226f84manoj hook. The first time we call the hooks, they are in the correct

3304cbd819df02e7548e9338dc0afa8d3ba29358manoj order, but the second time, we don't sort them correctly. Currently,

f03d292915be9977eaf74e9be7b0404aec226f84manoj the modules/http/config.m4 file has been renamed to

f03d292915be9977eaf74e9be7b0404aec226f84manoj modules/http/config2.m4 to work around this problem, it should moved

f03d292915be9977eaf74e9be7b0404aec226f84manoj back when this is fixed.

f03d292915be9977eaf74e9be7b0404aec226f84manoj

aa1faea36e4ae357bc603a2337b6adc54f5daec1manoj OtherBill offers that this is a SERIOUS problem. We do not sort

aa1faea36e4ae357bc603a2337b6adc54f5daec1manoj correctly by the ordering arguments passed to the register hook

aa1faea36e4ae357bc603a2337b6adc54f5daec1manoj functions. This was proven when I reordered the open_logs hook

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj to attempt to open the error logs prior to the access logs. Possibly

302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj the entire sorting code needs to be refactored.

302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj

302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj * pipes deadlock on all platforms with limited pipe buffers (e.g. both

302dc1f7b3feee23a91ad8f3cf3cb2edd95a557bmanoj Linux and Win32, as opposed to only Win32 on 1.3). The right solution

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj is either GStein's proposal for a "CGI Brigade", or OtherBill's proposal

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj for "Poll Buckets" for "Polling Filter Chains". Or maybe both :-)

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

d5defd5a0c5cdbaf74b85939484dc2b6c8317d19manoj * All handlers should always send content down even if r->header_only

d5defd5a0c5cdbaf74b85939484dc2b6c8317d19manoj is set. If not, it means that the HEAD requests don't generate the

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj same headers as a GET which is wrong.

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj * HP/UX 10.20: compile breakage in APR. Looks like it should be easy

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj to fix, probably just some extraneous #include's that are fouling

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj things up.

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj PR: 9457

0bff2f28ef945280c17099c142126178a78e1e54manoj Jeff: See my reply and patch in the PR (and previous commit to

0bff2f28ef945280c17099c142126178a78e1e54manoj stop using "pipe" as a field name). If patch is committed, we

0bff2f28ef945280c17099c142126178a78e1e54manoj should be okay. I'll wait to see if the user tests the patch.

d6b3cb141f0667101c1bca883ad15b383402c93bfielding Update by Jeff 20020722: I got an account on HP 10.20. It looks

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj like some of the APR thread detection is screwed up. If we find

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj pthread.h but we can't compile the pthread test program we still

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj think we can use threads. For that reason, the patch I posted

40a5b7189dbbb28e107bf008ee625f2f0142c2ccdgaudet to the PR won't work as-is since a failed compile of the test

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj program means nothing.

dbf0c7bef06259486cd2748a2d0e82f27e099d6efielding

dbf0c7bef06259486cd2748a2d0e82f27e099d6efielding * exec cmd and suexec arg-passing enhancements

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Status: Patches proposed

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Message-ID: <20020526041748.A29148@prodigy.Redbrick.DCU.IE>

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj (see the "proc.patch" and "suexec-shell.patch" links in this message)

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj * The 2.0.36 worker MPM graceless shutdown changes work but are

f6a6245816cd866361da8c576b1f47c7a54b6610fanf a bit clunky on some platforms; eg, on Linux, the loop to

f6a6245816cd866361da8c576b1f47c7a54b6610fanf join each worker thread seems to hang, and the parent ends up

f6a6245816cd866361da8c576b1f47c7a54b6610fanf killing off the child with SIGKILL. But at least it shuts down.

f6a6245816cd866361da8c576b1f47c7a54b6610fanf

f6a6245816cd866361da8c576b1f47c7a54b6610fanf * --enable-mods-shared="foo1 foo2" is busted on Darwin. Pier

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj posted a patch (Message-ID: <B8DBBE8D.575A%pier@betaversion.org>).

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj * We do not properly substitute the prefix-variables in the configuration

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj scripts or generated-configs. (i.e. if sysconfdir is etc,

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj httpd-std.conf points to conf.)

d6b3cb141f0667101c1bca883ad15b383402c93bfielding

d6b3cb141f0667101c1bca883ad15b383402c93bfielding * If any request gets through ap_process_request_internal() and is

d6b3cb141f0667101c1bca883ad15b383402c93bfielding scheduled to be served by the core handler, without a flag that this

d6b3cb141f0667101c1bca883ad15b383402c93bfielding r->filename was tested by dir/file_walk, we need to 500 at the very

d6b3cb141f0667101c1bca883ad15b383402c93bfielding end of the ap_process_request_internal() processing so sub_req-esters

d6b3cb141f0667101c1bca883ad15b383402c93bfielding know this request cannot be run. This provides authors of older

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj modules better compatibility, while still improving the security and

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj robustness of 2.0.

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Status: still need to decide where this goes, OtherBill comments...

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj Message-ID: <065701c14526$495203b0$96c0b0d0@roweclan.net>

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj [Deleted comments regarding the ap_run_handler phase, as irrelevant

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj as BillS points out that "common case will be caught in

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj default_handler already (with the r->finfo.filetype == 0 check)"

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj and the issue is detecting this -before- we try to run the req.]

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj gregames says: can this happen somehow without a broken module

2a6c49cfaef5979a5a06098f3ce987cd76769409manoj being involved? If not, why waste cycles trying to defend against

d6b3cb141f0667101c1bca883ad15b383402c93bfielding potential broken modules? It seems futile.

d6b3cb141f0667101c1bca883ad15b383402c93bfielding wrowe counters: no, it shouldn't happen unless the module is broken.

d6b3cb141f0667101c1bca883ad15b383402c93bfielding But the right answer is to fail the request up-front in dir/file

walk if the path was entirely invalid; and we can't do that either

UNTIL 2.1 or we break modules that haven't hooked map_to_storage.

* With AP_MODE_EXHAUSTIVE in the core, it is finally clear to me

how the Perchild MPM should be re-written. It hasn't worked

correctly since filters were added because it wasn't possible to

get the content that had already been written and the socket at

the same time. This mode lets us do that, so the MPM can be

fixed.

* Can a static httpd be built reliably?

Message-ID: <20020207142751.T31582@clove.org>

* [Ken] Test suite failures:

o worker is also failing some of the 'cgi' subtests

(see <URL:http://Source-Zone.Org/Apache/regression/>):

Justin says: "Worker should be fine and passes httpd-test here.

I think it's a perl or a httpd-test problem."

* Usage of APR_BRIGADE_NORMALIZE in core_input_filter should be

removed if possible.

Message-ID: <Pine.LNX.4.33.0201202232430.318-100000@deepthought.cs.virginia.edu>

Jeff wonders if we still care about this. It is no longer an

API issue but simply an extra trip through the brigade.

* The Add...Filter and Set...Filter directives do not allow the

administrator to order filters, beyond the order of filename (mime)

extensions. It isn't clear if Set...Filter(s) should be inserted

before or after the Add...Filter(s) which are ordered by sequence of

filename extensions. At minimum, some sort of +-[0-10] syntax seems

like a nice solution. See ROADMAP.

* Get perchild to work on platforms other than Linux. This

will require a portable mechanism to pass data and file/socket

descriptors between vhost child groups. An API was proposed

on dev@apr:

Message-ID: <20020111115006.K1529@clove.org>

* Try to get libtool inter-library dependency code working on AIX.

Message-ID: <cm3n10lx555.fsf@rdu163-40-092.nc.rr.com>

Justin says: If we get it working on AIX, we can enable this

on all platforms and clean up our build system

somewhat.

Jeff says: I thought I tested a patch for you sometime in

January that you were going to commit within a few

days.

* Handling of %2f in URIs. Currently both 1.3 and 2.0

completely disallow %2f in the request URI path (see

ap_unescape_url() in util.c). It's permitted and passed

through in the query string, however. Roy says the

original reason for disallowing it, from five years ago,

was to protect CGI scripts that applied PATH_INFO to

a filesystem location and which might be tricked by

..%2f..%2f(...). We *should* allow path-info of the

form 'http://foo.com/index.cgi/path/to/path%2finfo'.

Since we've revamped a lot of our processing of path

segments, it would be nice to allow this, or at least

allow it conditionally with a directive.

OtherBill adds that %2f as the SECOND character of a multibyte

sequence causes the request to fail! This happens notably in

the ja-jis encoding.

* FreeBSD, threads, and worker MPM. All seems to work fine

if you only have one worker process with many threads. Add

a second worker process and the accept lock seems to be

lost. This might be an APR issue with how it deals with

the child_init hook (i.e. the fcntl lock needs to be resynced).

More examination and analysis is required.

Status: This has also been reported on Cygwin.

FreeBSD 4.7 was reputed to have 'fixed' threads. Not.

FreeBSD 5.2-RC is a confirmed fix w/either libkse or libthr.

[libc_r, still the default, does not serve any pages w/worker;

so on FreeBSD 5.2, you must use libmap.conf (see man page).]

Work needs to be done to get APR to try to be knowledgable that

libkse/libthr are acceptable. Still not recommended for the

default since libc_r is still broken.

Message-ID: <3C2CC514.8EF3BED1@wapme-systems.de> (cygnus)

* There is increasing demand from module writers for an API

that will allow them to control the server � la apachectl.

Reasons include sole-function servers that need to die if

an external dependency (e.g., a database) fails, et cetera.

Perhaps something in the (ever more abused) scoreboard?

On the other hand, we already have a pipe that goes between parent

and child for graceful shutdown events, along with an API that

can be used to send a message down that pipe. In threaded MPMs,

it is easy enough to make that one pipe be used for graceful

and graceless events, and it is also easy to open that pipe

to both parent and child for writing. Then we just need to

figure out how to do graceless on non-threaded MPMs.

* Allow the DocumentRoot directive within <Location > scopes? This

allows the beloved (crusty) Alias /foo/ /somepath/foo/ followed

by a <Directory /somepath/foo> to become simply

<Location /foo/> DocumentRoot /somefile/foo (IMHO a bit more legible

and in-your-face.) DocumentRoot unset would be accepted [and would

not permit content to be served, only virtual resources such as

server-info or server-status.

This proposed change would _not_ depricate Alias.

striker: See the thread starting with Message-ID:

JLEGKKNELMHCJPNMOKHOGEEJFBAA.striker@apache.org.

* Win32: Rotatelogs sometimes is not terminated when Apache

goes down hard. FirstBill was looking at possibly tracking the

child's-child processes in the parent process.

stoddard: Shared scoreboard might offer a good way for the parent

to keep track of 'other child' processes and whack them if the child

goes down.

Other thoughts on walking the process chain using the NT kernel

have also been proposed on APR.

* Eliminate unnecessary creation of pipes in mod_cgid

* Combine log_child and piped_log_spawn. Clean up http_log.c.

Common logging API.

* Platforms that do not support fork (primarily Win32 and AS/400)

Architect start-up code that avoids initializing all the modules

in the parent process on platforms that do not support fork.

* There are still a number of places in the code where we are

losing error status (i.e. throwing away the error returned by a

system call and replacing it with a generic error code)

* Mass vhosting version of suEXEC.

* All DBMs suffer from confusion in support/dbmmanage (perl script) since

the dbmmanage employs the first-matched dbm format. This is not

necessarily the library that Apache was built with. Aught to

rewrite dbmmanage upon installation to bin/ with the proper library

for predictable mod_auth_dbm administration.

Questions; htdbm exists, time to kill dbmmanage, or does it remain

useful as a perl dbm management example? If we keep it,

do we address the issue above?

* Integrate mod_dav.

Some additional items remaining:

- case_preserved_filename stuff

(use the new canonical name stuff?)

- find a new home for ap_text(_header)

- is it possible to remove the DAV: namespace stuff from util_xml?

* ap_core_translate() and its use by mod_mmap_static and mod_file_cache

are a bit wonky. The function should probably be exposed as a utility

function (such as ap_translate_url2fs() or ap_validate_fs_url() or

something). Another approach would be a new hook phase after

"translate" which would allow the module to munge what the

translation has decided to do.

Status: Greg +1 (volunteers)

* Explore use of a post-config hook for the code in http_main.c which

calls ap_fixup_virutal_hosts(), ap_fini_vhost_config(), and

ap_sort_hooks() [to reduce the logic in main()]

* read the config tree just once, and process N times (as necessary)

* (possibly) use UUIDs in mod_unique_id and/or mod_usertrack

* (possibly) port the bug fix for PR 6942 (segv when LoadModule is put

into a VirtualHost container) to 2.0.

* shift stuff to mod_core.h

* callers of ap_run_create_request() should check the return value

for failure (Doug volunteers)

* Win32: Get Apache working on Windows 95/98. The following work

(at least) needs to be done:

- Document warning that OSR2 is required (for Crypt functions, in

rand.c, at least.) This could be resolved with an SSL library, or

randomization in APR itself.

- Bring the Win9xConHook.dll from 1.3 into 2.0 (no sense till it

actually works) and add in a splash of Win9x service code.

* Fix the worker MPM to use POD to kill child processes instead

of ap_os_killpg, regardless of how they should die.

* Scoreboard structures could be changed in the future such that

proper alignment is not maintained, leading to segfaults on

some systems. Cliff posted a patch to deal with this issue but

later recanted. See this message to dev@apr.apache.org:

Message-ID: <Pine.LNX.4.44.0203011354090.16457-200000@deepthought

.cs.virginia.edu>

* When sufficiently tested, the AllowEncodedSlashes/%2f patch

needs to be backported to 2.0 and 1.3.

* APXS either needs to be fixed completely for use when apr is out of tree,

or it should drop query mode altogether, and we just grow an

httpd-config or similar arrangement.

To quote a discussion in STATUS earlier:

thommay: this doesn't fix all the problems with apxs and out of

tree apr/apr-util, but it's a good start. There's still the

query cases; but I'm beginning to think that in these cases

the app should be querying ap{r,u}-config directly

gstein: agreed. apxs should deprecate the -q flag

TODO ISSUES REMAINING IN MOD_SSL:

* In order to use a DSO version of mod_ssl we have to link with

-lssl and -lcrypto. A workaround is in place right now where the

entire EXTRA_LIBS macro is being appended to the objects list, but

this is a hack. We should either revamp the APACHE_CHECK_SSL_TOOLKIT

autoconf function or come up with some other autoconf checks to

search for libssl and libcrypto and properly add them to mod_ssl's

link flags.

* SSL renegotiations in combination with POST request

* Port or dispose all code inside #if 0...#endif blocks that remain

from the porting effort.

* Do we need SSL_set_read_ahead()?

* the ssl_expr api is NOT THREAD SAFE. race conditions exist:

-in ssl_expr_comp() if SSLRequire is used in .htaccess

(ssl_expr_info is global)

-is ssl_expr_eval() if there is an error

(ssl_expr_error is global)

* SSLRequire directive (parsing of) leaks memory

* Diffie-Hellman-Parameters for temporary keys are hardcoded in

ssl_engine_dh.c, while the comment in ssl_engine_kernel.c says:

"it is suggested that keys be changed daily or every 500

transactions, and more often if possible."

* ssl_var_lookup could be rewritten to be MUCH faster

* CRL callback should be pluggable

* session cache store should be pluggable

* init functions should return status code rather than ssl_die()

* ssl_engine_pphrase.c needs to be reworked so it is generic enough

to also decrypt proxy keys

* the shmcb code should just align its memory segment rather than

jumping through all the "safe" memcpy and memset hoops

WISH LIST

* mod_proxy performance: when mod_proxy is configured to do proxy

gateway (aka reverse proxy), it would be nice to be able to reuse

connections to the backend servers. Now, connections to the

backend servers are taken down when the corresponding frontend

connection is taken down.

* mod_proxy: Ability to run SSL over proxy gateway connections,

encrypting (or reencrypting) at the proxy.

* mod_proxy: Add capability of mod_proxy to load balance across

a farm of backend servers.

* mod_cache: Handle ESI tags.

EXPERIMENTAL MODULES:

Experimental modules should eventually be be promoted to fully supported

status or removed from the repository entirely (ie, the

'experiment' failed). This section tracks what needs to happen to

get the modules promoted to fully supported status.

mod_cache/mod_mem_cache/mod_disk_cache:

* mod_cache: handle cache_control: no_cache "field_name" to enable

cacheing the response w/o header "field_name"

See RFC2616 section 14.9.1

* mod_mem_cache: Consider adding a RevalidateTimeout directive to

specify time at which local cached content is to be revalidated

(ie, underlying file stat'ed to see if it has changed).

* mod_cache: CacheEnable/CacheDisable should accept regular expressions.

* mod_cache: Fix dependency on ATOMIC operators. Need

APR_HAS_ATOMIC_* feature macros.

* mod_disk_cache: Implement garbage collection

* mod_mem_cache/mod_disk_cache: Need to be able to query cache

status (num of entries, cache object properties, etc.).

mod_status could be extended to query optional hooks defined

by modules for the purpose of reporting module status.

mod_cache (et. al.) could define optional hooks that are called

to collect status. Status should be queryable by

HTTP or SNMP?

* Enable mod_cache/mod_mem_cache/mod_disk_cache to handle

multiviews

* mod_mem_cache/mod_disk_cache: Complete implementing config

directives (mod_disk_cache: CacheExpiryCheck and GC directives

including CacheGc*, CacheSize, and, CacheTimeMargin)

(mod_mem_cache: MCacheMaxObjectCount) and

(mod_cache: CacheForceCompletion).

mod_auth_ldap/util_ldap:

* General stabilization and testing

PRs that have been suspended forever waiting for someone to

put them into 'the next release':

* documentation and Q&A

PR#2221: Make online documentation search link back to my installation

Status:

PR#2906: Propose that Apache recommend $UNIQUE_ID for all "session id"

algorithms

Status:

PR#2793: When will Apache support P3P? Any Plans?

Status:

* build

PR#2113: HTTP Server Rebuild Line Needs Changing for the better

Status:

PR#2421: problem specifying ndbm library for build ?with autoconfigure

Status:

* config

PR#76: missing call to "setlocale();"

Status:

PR#628: Request of "Options SymLinksIfGroupMatch"

Status:

PR#793: RLimitCPU and RLimitMEM don't apply to all children like they should

Status:

PR#922: it is useful to allow specifiction that root-owned symlinks

should always be followed

Status:

PR#1028: DoS attacks involving memory consumption

Status:

PR#1191: setlogin() is not called, causing problems with e.g. identd

Status:

PR#1204: regerror() exists, use it

Status:

PR#2284: Can not POST to ErrorDocument - Apache/1.3b6

Status:

PR#2396: Proposal for TimeZone directive

Status:

PR#2446: AllowOverride FileInfo is too coarse

Status:

PR#2760: [PATCH] User/Group for <Directory> and <Location> i.e. not only

in global and <Virtual>.

Status:

PR#2907: suggestion: power up your Include directive :)

Status:

PR#3018: cannot limit some HTTP methods

Status:

PR#3677: New ErrorDocumentMatch directive

Status:

PR#4244: "Files" and "FilesMatch" regexp does not recognize bang as

negation operator

Status:

PR#5993: AllowOverride should have a 'CheckNone' and 'AllowNone' argument

instead of only 'None'

Status:

* mod_access

PR#537: mod_access syntax allows hosts that should be restricted

Status:

PR#1287: add allow,deny/deny,allow warning to mod_access

Status:

PR#2512: <IfDenied> directive wanted

Status:

* mod_auth-any

PR#557: ~UserHome directories are not honored in absolute pathname

requests (.htaccess)

Status:

PR#1117: Using NIS passwd.byname dbm files with AuthDBMUserFile

Status:

PR#1809: Suggestion for improving authentication modules and core source

code, problem with 401 and ErrorDocument

Status:

* mod_autoindex

PR#1263: Add frame-safe anchor attribute to mod_autoindex links

Status:

* mod_cgi (and suexec)

PR#921: suexec Uses cwd before filling it in, doesn't use syslog

Status:

PR#1176: Apache cannot handle continuation line in headers

Status:

PR#1120: suexec does not parse arguments to #exec cmd

Status:

PR#1268: CGI scripts running as Apache user: security (suexec etc.)

Status:

PR#1285: Error messages could be easier to spot in cgi.log file for suexec.c

Status:

PR#1905: suexec - Allow modules to set user:group for execution.

Status:

PR#2360: suexec for general access of user content?

Status:

PR#2460: TimeOut applies to output of CGI scripts

Status:

PR#2573: CGI's for general use still have to be run as another user

with suExec

Status:

PR#4241: Need to be able to override shebang line to make CGI scripts

more portable.

Status:

PR#4490: mod_cgi prevents handling of OPTIONS requests

Status:

* mod_env

PR#370: Modified PATH environemnt variable is not passed, instead

system's is used

Status:

* mod_headers

PR#1383: I make mod_headers to modify request headers as well as

response ones.

Status:

PR#1677: mod_headers should allow mod_log_config-style formats in

header values

Status:

* mod_imap

PR#759: imap should read <MAP><AREA>*</MAP> too!

Status:

* mod_include

PR#78: Additional status for XBitHack directive

Status:

PR#623: A smarter "Last Modified" value for SSI documents (see PR number 600)

Status:

PR#1145: mod_include

Allow for Last-Modified: without resorting to XBitHack

Status:

PR#1803: patches to mod_include to allow for file tests

Status:

PR#4459: Suggestion for better handling of Last-modified headers

Status:

* mod_info

PR#2415: /server-info doesn't check for the virtual host to list the info

Status:

* mod_log-any

PR#1050: Logging of virtual server to error_log as well

Status:

PR#1358: Selective url-encode of log fields (or maybe a pseudo

log_rewrite module?)

Status:

PR#2073: pipelined connections are not logged correctly

Status:

PR#4448: Please allow CGI env variables (QUERY_STRING, ...) to be logged

with %{}e

Status:

* mod_negotiation

PR#3191: no way to set global quality-of-source (qs) coneg values

with multiviews

Status:

* mod_proxy

PR#362: Mod_proxy doesn't allow change of error pages

Status:

PR#440: Proxy doesn't deliver documents if not connected

Status:

PR#534: proxy converts ~name to %7Ename when name starts with a dot (.)

Status:

PR#612: Proxy FTP Authentication Fails

Status:

PR#700: Proxy doesn't do links right for OpenVMS files through ftp:

Status:

PR#980: Controlling Access to Remote Proxies would be nice...

Status:

PR#994: Adding authentication "on the fly" through the proxy module

Status:

PR#1085: ProxyRemote make a dead cycle.

Status:

PR#1166: ``nph-'' not honored (no buffering) for ProxyRemote mapping

Status:

PR#1290: Need to know "hit-rate" on proxy cache

Status:

PR#1532: Proxy transfer logging

Status:

PR#1547: No HTTP_X_FORWARDED_FOR set...

Status:

PR#1567: ProxyRemote proxy requests fail authentication by firewall

Status:

PR#1702: mod_proxy to support persistent conns?

Status:

PR#1878: listing of proxy cache content

Status:

PR#2314: patterns in ProxyRemote

Status:

PR#2648: Cache file names in Proxy module

Status:

PR#3568: Accessing URL through proxy server corrupts data.

Status:

PR#3605: Some anonymous FTP URLs ask for authentication

Status:

* mod_rewrite

PR#1582: mod_rewrite forms REQUEST_URI different than mod_cgi does

Status:

PR#2074: mod_rewrite doesn't pass Proxy Throughput on internal subrequests

Status:

* mod_status

PR#2138: mod_status always displays 256 possible connection slots

Status:

PR#2343: Status module averages are for entire uptime

Status:

* apache-api

PR#1004: request_config field in request_rec is moderately bogus

Status:

PR#1158: improvements to child spawning API

Status:

PR#1233: there is no way to keep per-connection per-module state

Status:

PR#2024: adding auth_why to conn_rec

Status:

PR#2873: Feedback/Comment on APACI

Status:

PR#3143: No module specific data hook for per-connection data

Status:

* generally odds and ends

PR#2431: A small addition to rotatelogs.c to improve program functionality.

Status:

PR#2763: mailto tags and bundling bug report script

Status:

PR#2785: os-aix Support for System Resource Controller

Status:

PR#2889: Inclusion of RPM spec file in CVS/distributions

Status:

PR#5713: os-windows [PATCH] install as win32 service with domain account

Status: Cannot accept password-as-arg, we should prompt the

user when -k install/-k config with a user argument.

Other bugs that need fixing:

* ap_discard_request should be converted to use the bucket API

directly rather than waste cycles copying buffers with the old API.

* MaxRequestsPerChild measures connections, not requests.

Until someone has a better way, we'll probably just rename it

"MaxConnectionsPerChild".

* Regex containers don't work in an intutive way

Status: No one has come up with an efficient way to fix this

behavior. Dean has suggested getting rid of regex containers

completely.

OtherBill suggests: We at least seem to agree on eliminating

the <Container ~ foo> forms, and using only

<ContainerMatch foo> semantics.

* SIGSEGV on Linux (glibc 2.1.2) isn't caught properly by a

sigwaiting thread. We need to work around this, perhaps unless

there is hope soon for a fixed glibc.

* orig_ct in the byterange/multipart handling may not be

needed. Apache 1.3 just never stashed "multipart" into

r->content_type. We should probably follow suit since the

byterange stuff doesn't want the rest of the code to see the

multipart content-type; the other code should still think it is

dealing with the <orig_ct> stuff.

Status: Greg volunteers to investigate (esp. since he was most

likely the one to break it :-)

Binaries (probably not till beta):

Platform Avail. Volunteer

------------------------------------------------------------------

AIX 4.3.3 no Bill Stoddard

Mandrake 8.1 no open

FreeBSD 4.1 no open

hppa2.0w-hp-hpux11.00 no Cliff Woolley

i386-pc-solaris2.8 no Aaron Bannert

i386-unknown-freebsd4.5 no

i386-unknown-freebsd4.6 no Cliff Woolley

i686-pc-linux-gnu-slackware81 no Cliff Woolley

i686-pc-linux-gnu-rh70 no Aaron Bannert

i686-pc-linux-gnu-rh73 no Cliff Woolley

ia64-hp-hpux11.20 no

powerpc-apple-darwin5.5 no Aaron Bannert

powerpc-unknown-linux-gnu no Graham Leggett

s390-ibm-linux no Greg Ames

sparc-sun-solaris2.8 no Jim Jagielski

NetWare no Brad Nicholes

OS/2 no Brian Havard

OS/390 no Greg Ames

Win32-x86 no William Rowe