6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsyncAPACHE 2.3 STATUS: -*-text-*-

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsyncLast modified at [$Date$]

365b40dec2ed01d9983d29e276e7431c5a4a9c18vboxsync

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsyncThe current version of this file can be found at:

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync * http://svn.apache.org/repos/asf/httpd/httpd/trunk/STATUS

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsyncDocumentation status is maintained seperately and can be found at:

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync * docs/STATUS in this source tree, or

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync * http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsync

9eb499828dd875d229531b50d05f016b8a1f1dd9vboxsyncConsult the following STATUS files for information on related projects:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * http://svn.apache.org/repos/asf/apr/apr/trunk/STATUS

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * http://svn.apache.org/repos/asf/apr/apr-util/trunk/STATUS

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsyncPatches considered for backport are noted in their branches' STATUS:

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * http://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x/STATUS

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/STATUS

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsyncRelease history:

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync [NOTE that x.{odd}.z versions are strictly Alpha/Beta releases,

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync while x.{even}.z versions are Stable/GA releases.]

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.12 : In development.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.11 : Released as Beta on March 7, 2011.

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync 2.3.10 : Tagged on December 13, 2010. Released Dec 21, 2010.

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync 2.3.9 : Tagged on November 23, 2010, not released.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.8 : Tagged on August 24, 2010.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.7 : Tagged on August 19, 2010, not released.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.6 : Released on June 21, 2010.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.5 : Released on January 26, 2010.

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync 2.3.4 : Released on December 8, 2009.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.3 : Tagged on November 11, 2009, not released.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 2.3.2 : Tagged on March 23, 2009, not released.

46e6cceda24bf6c589e4cb151afefe4fffecca7bvboxsync 2.3.1 : Tagged on January 2, 2009, not released.

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync 2.3.0 : Tagged on December 6, 2008, not released.

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsyncContributors looking for a mission:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Just do an egrep on "TODO" or "XXX" in the source.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync * Review the bug database at: http://issues.apache.org/bugzilla/

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Review the "PatchAvailable" bugs in the bug database:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync https://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&product=Apache+httpd-2&keywords=PatchAvailable

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync After testing, you can append a comment saying "Reviewed and tested".

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Open bugs in the bug database.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * See also the STATUS file in the docs/ directory, which lists documentation-specific TODO items.

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsyncCURRENT RELEASE NOTES:

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsyncGA PLAN:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync Jim proposes another beta release the end of March, another in

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync April with a goal towards GA in May (at the latest). Jim volunteers

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync to RM these.

0a724db1030736c131a45392c0ebb6bb25362917vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsyncRELEASE SHOWSTOPPERS:

13c94cb9d95cf4865646e86b944c09e1af2fe48cvboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync FOR GA:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Modules that are not ready for production use should be marked as

c33cfcef143f5dc2148c35d7b1dd1a32183f1926vboxsync experimental or be removed. The same for modules without documentation.

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync Candidates:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync - MPM simple

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync - mod_serf

13c94cb9d95cf4865646e86b944c09e1af2fe48cvboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Review the example configuration. It should be based on current best

ad34209dccf31d54e2277d732a90ce6ea4374362vboxsync practices and not use deprecated features.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Not all MPMs are updated to set conn_rec::current_thread correctly.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync (Prefork, Worker, Event, Simple are updated).

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync jim sez: Then we just ship with those... mark any others as

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync experimental, pgollucci +1 jim

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * The mod_session* modules need to be checked that their hooks respect

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync the returning of int (HTTP status codes) and apr_status_t as appropriate,

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync and any anomolies fixed.

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync jim sez: from what I can see, mod_session* is no worse that other

27efd9329f6a90f7cacf840031e5305f98975960vboxsync modules that mix these 2 types... clean up is

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync forthcoming but should not be considered a blocker, imo

ad34209dccf31d54e2277d732a90ce6ea4374362vboxsync pgollucci: +1 jim

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync * mod_ssl's proxy support only allows one proxy client certificate per

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync frontend virtual host. Lift this restriction.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync jim sez: Why a blocker?, pgollucci +1 jim

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync FOR BETA:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync OLD ISSUES THAT WERE THOUGHT TO BE SHOWSTOPPERS FOR 2.2 BUT OBVIOUSLY WEREN'T:

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Handling of non-trailing / config by non-default handler is broken

27efd9329f6a90f7cacf840031e5305f98975960vboxsync http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105451701628081&w=2

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync jerenkrantz asks: Why should this block a release?

ad34209dccf31d54e2277d732a90ce6ea4374362vboxsync wsanchez agrees: this may be a change in behavior, but isn't

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync clearly wrong, and even if so, it doesn't seem like a

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync showstopper.

27efd9329f6a90f7cacf840031e5305f98975960vboxsync

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync * the edge connection filter cannot be removed

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=105366252619530&w=2

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync jerenkrantz asks: Why should this block a release?

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync stas replies: because it requires a rewrite of the filters stack

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync implementation (you have suggested that) and once 2.2 is

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync released you can't do that anymore.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync pgollucci: this affects mod_perl I'm pretty sure.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

27efd9329f6a90f7cacf840031e5305f98975960vboxsyncCURRENT VOTES:

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync * Name the Server (version 2.4 or 3.0, depending on the final call)

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync Recent discussion indicates we should designate a (short name).

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync This is not yet a [Vote] - Your nominations please:

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync * Apache HTTP Server (httpd)

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync +1: sctemme (why mess with it?), pgollucci

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync

27efd9329f6a90f7cacf840031e5305f98975960vboxsyncRELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync * Clean up all the kruft and *extremely* outdated stuff below...

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync * Maybe remove Limit/LimitExcept or at least make it log warnings when

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync mis-used.

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync

27efd9329f6a90f7cacf840031e5305f98975960vboxsync * Sort out modules selections for most/all/reallyall. Maybe rename

27efd9329f6a90f7cacf840031e5305f98975960vboxsync all -> most, reallyall -> all, and remove the old 'most'.

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync * Patches submitted to the bug database:

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync http://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&product=Apache+httpd-2&keywords=PatchAvailable

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * Filter stacks and subrequests, redirects and fast redirects.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync There's at least one PR that suffers from the current unclean behaviour

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync (which lets the server send garbage): PR 17629

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync nd says: Every subrequest should get its own filter stack with the

03e380b03da26ad4a2309190f35ba86843d3d824vboxsync subreq_core filter as bottom-most. That filter does two things:

c38d5dda76cee141ae524ccce2c513178be1b87cvboxsync - swallow EOS buckets

69f57565f5243a46f1df060b63d0fd830de3be04vboxsync - redirect the data stream to the upper request's (rr->main)

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync filter chain directly after the subrequest's starting

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync point.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync Once we have a clean solution, we can try to optimize

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync it, so that the server won't be slow down too much.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * RFC 2616 violations.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync Closed PRs: 15852, 15857, 15859, 15861, 15864, 15869, 15870, 16120,

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync 16125, 16135, 16136, 16137, 16138, 16139, 16140, 16518,

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync 16520, 49825

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync Open PRs: 15865, 15866, 15868, 16126, 16133, 16142, 16521, 42978

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync jerenkrantz says: need to decide how many we need to backport and/or

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync if these rise to showstopper status.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync wrowe suggests: it would be nice to see "MUST" v.s. "SHOULD" v.s. "MAY"

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync out of this list, without reviewing them individually.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

4726db8b47db329039ce8f8e13ecd2c1f696fa60vboxsync * pipes deadlock on all platforms with limited pipe buffers (e.g. both

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync Linux and Win32, as opposed to only Win32 on 1.3). The right solution

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync is either GStein's proposal for a "CGI Brigade", or OtherBill's proposal

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync for "Poll Buckets" for "Polling Filter Chains". Or maybe both :-)

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync * All handlers should always send content down even if r->header_only

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync is set. If not, it means that the HEAD requests don't generate the

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync same headers as a GET which is wrong.

097b3079a919c94052ca642306232b856949c755vboxsync

097b3079a919c94052ca642306232b856949c755vboxsync * exec cmd and suexec arg-passing enhancements

097b3079a919c94052ca642306232b856949c755vboxsync Status: Patches proposed

097b3079a919c94052ca642306232b856949c755vboxsync Message-ID: <20020526041748.A29148@prodigy.Redbrick.DCU.IE>

097b3079a919c94052ca642306232b856949c755vboxsync (see the "proc.patch" and "suexec-shell.patch" links in this message)

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * The 2.0.36 worker MPM graceless shutdown changes work but are

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync a bit clunky on some platforms; eg, on Linux, the loop to

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync join each worker thread seems to hang, and the parent ends up

6e2490fe643cb292ee8e37f9e1d7171e9315129cvboxsync killing off the child with SIGKILL. But at least it shuts down.

917d66601860f75830cb684385ba7b4d73458bcavboxsync

917d66601860f75830cb684385ba7b4d73458bcavboxsync chrisd: Has this been fixed by the changes for PR 38737?

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync * We do not properly substitute the prefix-variables in the configuration

1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync scripts or generated-configs. (i.e. if sysconfdir is etc,

1c2c968fd241148110002d75b2c0fdeddc211e14vboxsync httpd-std.conf points to conf.)

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync * If any request gets through ap_process_request_internal() and is

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync scheduled to be served by the core handler, without a flag that this

9d473abea9a9b6597b2b20bedc950ba33a2e73a5vboxsync r->filename was tested by dir/file_walk, we need to 500 at the very

7e958a4329e4f9d83f597e26c72121969091e87bvboxsync end of the ap_process_request_internal() processing so sub_req-esters

f3f687b00a9f7c98dc0b81899090bc5f659ae7bdvboxsync know this request cannot be run. This provides authors of older

13c94cb9d95cf4865646e86b944c09e1af2fe48cvboxsync modules better compatibility, while still improving the security and

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync robustness of 2.0.

80b853528b74d686eebf9331ee762891d0038f06vboxsync

80b853528b74d686eebf9331ee762891d0038f06vboxsync Status: still need to decide where this goes, OtherBill comments...

80b853528b74d686eebf9331ee762891d0038f06vboxsync Message-ID: <065701c14526$495203b0$96c0b0d0@roweclan.net>

80b853528b74d686eebf9331ee762891d0038f06vboxsync [Deleted comments regarding the ap_run_handler phase, as irrelevant

80b853528b74d686eebf9331ee762891d0038f06vboxsync as BillS points out that "common case will be caught in

80b853528b74d686eebf9331ee762891d0038f06vboxsync default_handler already (with the r->finfo.filetype == 0 check)"

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync and the issue is detecting this -before- we try to run the req.]

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync gregames says: can this happen somehow without a broken module

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync being involved? If not, why waste cycles trying to defend against

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync potential broken modules? It seems futile.

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync wrowe counters: no, it shouldn't happen unless the module is broken.

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync But the right answer is to fail the request up-front in dir/file

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync walk if the path was entirely invalid; and we can't do that either

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync UNTIL 2.1 or we break modules that haven't hooked map_to_storage.

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync * Can a static httpd be built reliably?

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync Message-ID: <20020207142751.T31582@clove.org>

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync * Usage of APR_BRIGADE_NORMALIZE in core_input_filter should be

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync removed if possible.

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync Message-ID:

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync <Pine.LNX.4.33.0201202232430.318-100000@deepthought.cs.virginia.edu>

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync Jeff wonders if we still care about this. It is no longer an

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync API issue but simply an extra trip through the brigade.

ad34209dccf31d54e2277d732a90ce6ea4374362vboxsync

ad34209dccf31d54e2277d732a90ce6ea4374362vboxsync * Try to get libtool inter-library dependency code working on AIX.

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync Message-ID: <cm3n10lx555.fsf@rdu163-40-092.nc.rr.com>

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync

9d473abea9a9b6597b2b20bedc950ba33a2e73a5vboxsync Justin says: If we get it working on AIX, we can enable this

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync on all platforms and clean up our build system somewhat.

bffb24521128f5183aafbef6542e7dacf20b5132vboxsync Jeff says: I thought I tested a patch for you sometime in

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync January that you were going to commit within a few days.

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync * Handling of %2f in URIs. Currently both 1.3 and 2.0

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync completely disallow %2f in the request URI path (see

5c7a628b8077efd9a3049538f6e7f470d8afb9b3vboxsync ap_unescape_url() in util.c). It's permitted and passed

a0a9f39e8864357c2e1e61106958411240f5bf6bvboxsync through in the query string, however. Roy says the

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync original reason for disallowing it, from five years ago,

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync was to protect CGI scripts that applied PATH_INFO to

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync a filesystem location and which might be tricked by

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync ..%2f..%2f(...). We *should* allow path-info of the

8eb4989e815c8f374b965265ccf184d6ce17d9e8vboxsync form 'http://foo.com/index.cgi/path/to/path%2finfo'.

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync Since we've revamped a lot of our processing of path

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync segments, it would be nice to allow this, or at least

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync allow it conditionally with a directive.

5b802b5e11fed6e163afca32e9118d2599d312fbvboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync OtherBill adds that %2f as the SECOND character of a multibyte

bcc2356dccf06ea3fdd1f3e4d4e62b04e95673d0vboxsync sequence causes the request to fail! This happens notably in

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync the ja-jis encoding.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync * There is increasing demand from module writers for an API

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync that will allow them to control the server à la apachectl.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync Reasons include sole-function servers that need to die if

7529922bd11d7d1c38fbdc7bad6aec83eb2ec0advboxsync an external dependency (e.g., a database) fails, et cetera.

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync Perhaps something in the (ever more abused) scoreboard?

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync On the other hand, we already have a pipe that goes between parent

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync and child for graceful shutdown events, along with an API that

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync can be used to send a message down that pipe. In threaded MPMs,

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync it is easy enough to make that one pipe be used for graceful

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync and graceless events, and it is also easy to open that pipe

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync to both parent and child for writing. Then we just need to

bbfc28b1a00ce00001b2ead074d47254bec3e5cfvboxsync figure out how to do graceless on non-threaded MPMs.

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync

da6747c2419b9cea8b5e2c576a30a5de999a8ab3vboxsync * Allow the DocumentRoot directive within <Location > scopes? This

ad34209dccf31d54e2277d732a90ce6ea4374362vboxsync allows the beloved (crusty) Alias /foo/ /somepath/foo/ followed

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync by a <Directory /somepath/foo> to become simply

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync <Location /foo/> DocumentRoot /somefile/foo (IMHO a bit more legible

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync and in-your-face.) DocumentRoot unset would be accepted [and would

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync not permit content to be served, only virtual resources such as

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync server-info or server-status.

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync This proposed change would _not_ depricate Alias.

20b950300ed7ebcdf78f414c3d98b20d010ff74fvboxsync striker: See the thread starting with Message-ID:

702250abf86d6252cfbbff216d848d2c799548a4vboxsync JLEGKKNELMHCJPNMOKHOGEEJFBAA.striker@apache.org.

27efd9329f6a90f7cacf840031e5305f98975960vboxsync

2b66a097b19f31e00af3abc508a3ff8c74ca1f8avboxsync * Win32: Rotatelogs sometimes is not terminated when Apache

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync goes down hard. FirstBill was looking at possibly tracking the

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync child's-child processes in the parent process.

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync stoddard: Shared scoreboard might offer a good way for the parent

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync to keep track of 'other child' processes and whack them if the child

6be66de4257f4f564e35f7b8ee57a282e3cf3e96vboxsync goes down.

Other thoughts on walking the process chain using the NT kernel

have also been proposed on APR.

* Eliminate unnecessary creation of pipes in mod_cgid

* Combine log_child and piped_log_spawn. Clean up http_log.c.

Common logging API.

* Platforms that do not support fork (primarily Win32 and AS/400)

Architect start-up code that avoids initializing all the modules

in the parent process on platforms that do not support fork.

* There are still a number of places in the code where we are

losing error status (i.e. throwing away the error returned by a

system call and replacing it with a generic error code)

* Mass vhosting version of suEXEC.

* All DBMs suffer from confusion in support/dbmmanage (perl script) since

the dbmmanage employs the first-matched dbm format. This is not

necessarily the library that Apache was built with. Aught to

rewrite dbmmanage upon installation to bin/ with the proper library

for predictable mod_auth_dbm administration.

Questions; htdbm exists, time to kill dbmmanage, or does it remain

useful as a perl dbm management example? If we keep it,

do we address the issue above?

* Integrate mod_dav.

Some additional items remaining:

- case_preserved_filename stuff

(use the new canonical name stuff?)

- find a new home for ap_text(_header)

- is it possible to remove the DAV: namespace stuff from util_xml?

* ap_core_translate() and its use by mod_mmap_static and mod_file_cache

are a bit wonky. The function should probably be exposed as a utility

function (such as ap_translate_url2fs() or ap_validate_fs_url() or

something). Another approach would be a new hook phase after

"translate" which would allow the module to munge what the

translation has decided to do.

Status: Greg +1 (volunteers)

* Explore use of a post-config hook for the code in http_main.c which

calls ap_fixup_virutal_hosts(), ap_fini_vhost_config(), and

ap_sort_hooks() [to reduce the logic in main()]

* read the config tree just once, and process N times (as necessary)

* (possibly) use UUIDs in mod_unique_id and/or mod_usertrack

* (possibly) port the bug fix for PR 6942 (segv when LoadModule is put

into a VirtualHost container) to 2.0.

* shift stuff to mod_core.h

* callers of ap_run_create_request() should check the return value

for failure (Doug volunteers)

* Fix the worker MPM to use POD to kill child processes instead

of ap_os_killpg, regardless of how they should die.

chrisd: Is this done, by any chance? See r92598 and r93358.

* Scoreboard structures could be changed in the future such that

proper alignment is not maintained, leading to segfaults on

some systems. Cliff posted a patch to deal with this issue but

later recanted. See this message to dev@apr.apache.org:

Message-ID:

<Pine.LNX.4.44.0203011354090.16457-200000@deepthought.cs.virginia.edu>

* APXS either needs to be fixed completely for use when apr is out of tree,

or it should drop query mode altogether, and we just grow an

httpd-config or similar arrangement.

To quote a discussion in STATUS earlier:

thommay: this doesn't fix all the problems with apxs and out of

tree apr/apr-util, but it's a good start. There's still the

query cases; but I'm beginning to think that in these cases

the app should be querying ap{r,u}-config directly

deprecate -q: add htpd-config: gstein, pquerna, minfrin, pgollucci

other:

TODO ISSUES REMAINING IN MOD_SSL:

* Do we need SSL_set_read_ahead()?

* SSLRequire directive (parsing of) leaks memory

* Diffie-Hellman-Parameters for temporary keys are hardcoded in

ssl_engine_dh.c, while the comment in ssl_engine_kernel.c says:

"it is suggested that keys be changed daily or every 500

transactions, and more often if possible."

* ssl_var_lookup could be rewritten to be MUCH faster

* CRL callback should be pluggable

* session cache store should be pluggable

* init functions should return status code rather than ssl_die()

* ssl_engine_pphrase.c needs to be reworked so it is generic enough

to also decrypt proxy keys

* output warning when allowing SSL v2.0 ? its so old

WISH LIST

* mod_proxy: Ability to run SSL over proxy gateway connections,

encrypting (or reencrypting) at the proxy.

* mod_cache: Handle ESI tags.

* mod_cache: Resolve issue of how to cache page fragments (or perhaps

-if- we want to cache page fragments). Today, mod_cache/mod_mem_cache

will cache #include 'virtual' requests (but not #include 'file'

requests). This was accomplished by making CACHE_IN a

CONTENT_SET-1 filter to force it to run before the SUBREQ_CORE

filter. But now responses cannot be cached that include the

effects of having been run through CONTENT_SET filters

(mod_deflate, mod_expires, etc). We could rerun all the

CONTENT_SET filters on the cached response, but this will not

work in all cases. For example, mod_expires relies on installing

the EXPIRATION filter during fixups. Contents served out of

mod_cache (out of the quick_handler) bypass -all- the request

line server hooks (Ryan really hated this. It is great for

performance, but bad because of the complications listed above).

mod_cache/mod_mem_cache/mod_cache_disk:

* mod_mem_cache: Consider adding a RevalidateTimeout directive to

specify time at which local cached content is to be revalidated

(ie, underlying file stat'ed to see if it has changed).

* mod_cache: CacheEnable/CacheDisable should accept regular expressions.

jerenkrantz says: Too slow. Get regexs away from speedy caches by

default. Introduce a new CacheEnableRegex if you want.

* mod_mem_cache/mod_cache_disk: Need to be able to query cache

status (num of entries, cache object properties, etc.).

mod_status could be extended to query optional hooks defined

by modules for the purpose of reporting module status.

mod_cache (et. al.) could define optional hooks that are called

to collect status. Status should be queryable by

HTTP or SNMP?

jerenkrantz says: Yawn. Who cares.

* Regex containers don't work in an intutive way

Status: No one has come up with an efficient way to fix this

behavior. Dean has suggested getting rid of regex containers

completely.

OtherBill suggests: We at least seem to agree on eliminating

the <Container ~ foo> forms, and using only

<ContainerMatch foo> semantics.

* orig_ct in the byterange/multipart handling may not be

needed. Apache 1.3 just never stashed "multipart" into

r->content_type. We should probably follow suit since the

byterange stuff doesn't want the rest of the code to see the

multipart content-type; the other code should still think it is

dealing with the <orig_ct> stuff.

Status: Greg volunteers to investigate (esp. since he was most

likely the one to break it :-)

EXPERIMENTAL MODULES:

Experimental modules should eventually be be promoted to fully supported

status or removed from the repository entirely (ie, the

'experiment' failed). This section tracks what needs to happen to

get the modules promoted to fully supported status.