Nabble - Apache HTTP Server - Module Writers

Re: load modules at run-time without restarting httpd

2008-11-20T00:12:36Z

Sorin Manolache wrote:

>
>> They expect their initialization to occur when there is nothing but a parent
>> process present.
>
> True, but if you send SIGUSR1 to the parent apache process, the
> children will exit gracefully and the parent will remain alone. Then,
> it will unload the DSOs (the modules) and reload them. At reload, it
> will reload the new module. I tried it (but on a server with no
> load---I don't know how it behaves/how long it takes on a server that
> is processing tens of thousands of requests at the moment of the
> SIGUSR1) and it worked.

Right, you are effectively restarting the server. The difference is,
the server continues to serve out pages using the old workers until all
the outstanding requests are satisfied. Still, you cannot load a module
into the running workers.

Re: load modules at run-time without restarting httpd

2008-11-19T23:59:58Z

On Thu, Nov 20, 2008 at 03:42, William A. Rowe, Jr. <wrowe@...> wrote:
> Andrej van der Zee wrote:
>> Hi,
>>
>> I was wondering if it is possible to load modules at run-time, without
>> restarting httpd?
>
> No.

Yes.

> They expect their initialization to occur when there is nothing but a parent
> process present.

True, but if you send SIGUSR1 to the parent apache process, the
children will exit gracefully and the parent will remain alone. Then,
it will unload the DSOs (the modules) and reload them. At reload, it
will reload the new module. I tried it (but on a server with no
load---I don't know how it behaves/how long it takes on a server that
is processing tens of thousands of requests at the moment of the
SIGUSR1) and it worked.

S

Re: Howto implement a new algorithm scheduler in mod_proxy_balancer

2008-11-19T20:01:17Z

On Oct 25, 2008, at 7:57 PM, ricardo13 wrote:

> I will build a scheduler that receive a little message from cluster.
> At
> cluster, there is a process that send messages about CPU.

Like an SNMP agent? That way you wouldn't have to re-invent the wheel.

> Then the server I need to build a separate program that receives that
> message and passes to the apache.
>
> Can I use socket to communicate external process with apache ??? Or
> shared
> memory ??

You can set up a shared memory area from your Apache server and have
your monitoring process access that as well. Whether you have that be
an external program or something forked from the httpd parent doesn't
matter, as long as they (are allowed to) attach to the same shared
memory segment.

S.

--
Sander Temme
sctemme@...
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF

smime.p7s (3K) Download Attachment

Re: load modules at run-time without restarting httpd

2008-11-19T18:42:37Z

Andrej van der Zee wrote:
> Hi,
>
> I was wondering if it is possible to load modules at run-time, without
> restarting httpd?

No.

They expect their initialization to occur when there is nothing but a parent
process present.

load modules at run-time without restarting httpd

2008-11-19T18:33:41Z

Hi,

I was wondering if it is possible to load modules at run-time, without
restarting httpd?

Cheers,
Andrej

override apr_proc_create in own module

2008-11-18T14:54:46Z

Hi,

I was wondering if it is possible to override the function
"apr_proc_create" with my own version in my own module. This function
is eventually called by "ap_os_create_privilileged_process" in my own
module. I rather do not want to change the apr-source code, therefor I
am looking for a solution to override the apr-function only for my own
module. Is there a way to do this? If so, how should I do this?

Thank you,
Andrej

Re: APR, Shared Memory and extern process

2008-11-18T13:20:17Z

Sorin Manolache wrote:

On Tue, Nov 18, 2008 at 20:17, ricardo13 <ricardoogrande@gmail.com> wrote:
>
> Hi,
>
> I'm writing a apache's module that comunicate with a extern process.
>
> My extern process is built in C:
>
> char* shm_address;
> int shmid;
> key_t shmkey;
>
> shmkey = 5678;
> shmid = shmget(shmkey, SIZEOFSHMSEG, 0666);
> if (shmid == -1)
> printf("main: shmget() failed\n");
>
> shm_address = shmat(shmid, NULL, 0);
> if ( shm_address==NULL )
> printf("main: shmat() failed\n");
>
> while(1) {
> if(strcmp(shm_address, ":") == 0) {
> strcpy(shm_address, data);
> break;
> }
> }
>
> int rc = shmdt(shm_address);
> if (rc==-1)
> printf("main: shmdt() failed\n");
>
>
> Now I want to write a module that take (or get) the information in this
> segment.
> Can someone help me ??
>
> Thank You
>
> Ricardo

Use the post_config hook because it is run in the parent of all apache
children. There, you simply shmget and shmat. Also, use
apr_pool_register_cleanup in order to register a callback that will
shmdt your shared memory segment when the config pool is destroyed,
i.e. when apache is killed or the configuration reloaded.

I'm newbie Apache's module.
I'm implementing a new algorithm load balance and extern process repass the IP to module.
Then module redirect requisition to IP's machine.

I try it:

static proxy_worker *find_best_bytest(proxy_balancer *balancer, request_rec *r)

int i;
int valor;
char* shm_address;
int shmid;
key_t shmkey = 5678;
proxy_worker *mycandidate;
proxy_worker *worker;

shmid = shmget(shmkey, 50, IPC_CREAT | 0666);
shm_address = shmat(shmid, NULL, 0);

worker = (proxy_worker*) balancer->workers->elts;

for(i=0; i < balancer->workers->nelts; ++i, ++worker)
if((valor = strcmp(worker->hostname,shm_address)) == 0)
mycandidate = worker;

//ap_rprintf(r, "Memoria= %s", shm_address);

But don't correct

Thank you

Ricardo

I hope this helps. If not, I must have some code skeleton at work, I
can find it tomorrow for you.

S

Re: APR, Shared Memory and extern process

2008-11-18T12:49:51Z

On Tue, Nov 18, 2008 at 20:17, ricardo13 <ricardoogrande@...> wrote:

>
> Hi,
>
> I'm writing a apache's module that comunicate with a extern process.
>
> My extern process is built in C:
>
> char* shm_address;
> int shmid;
> key_t shmkey;
>
> shmkey = 5678;
> shmid = shmget(shmkey, SIZEOFSHMSEG, 0666);
> if (shmid == -1)
> printf("main: shmget() failed\n");
>
> shm_address = shmat(shmid, NULL, 0);
> if ( shm_address==NULL )
> printf("main: shmat() failed\n");
>
> while(1) {
> if(strcmp(shm_address, ":") == 0) {
> strcpy(shm_address, data);
> break;
> }
> }
>
> int rc = shmdt(shm_address);
> if (rc==-1)
> printf("main: shmdt() failed\n");
>
>
> Now I want to write a module that take (or get) the information in this
> segment.
> Can someone help me ??
>
> Thank You
>
> Ricardo

Use the post_config hook because it is run in the parent of all apache
children. There, you simply shmget and shmat. Also, use
apr_pool_register_cleanup in order to register a callback that will
shmdt your shared memory segment when the config pool is destroyed,
i.e. when apache is killed or the configuration reloaded.

I hope this helps. If not, I must have some code skeleton at work, I
can find it tomorrow for you.

S

APR, Shared Memory and extern process

2008-11-18T11:17:25Z

Hi,

I'm writing a apache's module that comunicate with a extern process.

My extern process is built in C:

char* shm_address;
int shmid;
key_t shmkey;

shmkey = 5678;
shmid = shmget(shmkey, SIZEOFSHMSEG, 0666);
if (shmid == -1)
printf("main: shmget() failed\n");

shm_address = shmat(shmid, NULL, 0);
if ( shm_address==NULL )
printf("main: shmat() failed\n");

while(1) {
if(strcmp(shm_address, ":") == 0) {
strcpy(shm_address, data);
break;
}
}

int rc = shmdt(shm_address);
if (rc==-1)
printf("main: shmdt() failed\n");

Now I want to write a module that take (or get) the information in this segment.
Can someone help me ??

Thank You

Ricardo

Re: config is not read correctly

2008-11-16T12:36:32Z

Ahhh found out what went wrong, I made a wrong merge. the "local" server config
contained the right config , where the one that actually made it into the final
config was the "base" config.

developing custom authentication module

2008-11-16T04:44:32Z

I am ISV developing a system that is using Apache. All the frontend's
for system I am developing are all custom desktop applications, or web
browsers controls wrapped in my own code. Thus users are not going to
be entering username and password, the username and password used will
be depended on which frontend being used.

It is time for me to implement authentication correctly. I have two
objectives with respect to authentication:

1: Protect my customers from unauthorized users.
2: Protect myself from customers hacking the authorization system to
get access to features in which they have not purchased.

#1 looks straight forward: If my impression is correct, I simply need
to implement my own custom provider to check the custom username and
password the frontends give it.

Q: Is there documentation out there somewhere on how to implementing a
new provider?

#2 looks a lot more tricky. It seems that I will need to deviate from
the normal way Apache's authentication works. For starters, NONE of
the configuration can be in the http.conf, not like it is now with
AuthType, AuthBasicProvider, etc. There is a <Location> directives in
the conf that will have a custom directive for my custom Apache
module. I would like to fully wire up this custom provider within this
directive. To add to the complexity, there are different levels of
authentication: None required, user, admin and there will be different
locations under the <Location> directive for each, again, this all
needs to be wired up in code when the custom directive for my custom
Apache module is called.

Q: Any suggestions on how I might achieve this?

Sam

P.S. I do NOT own the book on writing Apache Module in 2.0, just the
older 1.3 book. Would any of this be addressed in that book?

Re: config is not read correctly

2008-11-16T03:36:26Z

On Sun, Nov 16, 2008 at 00:51, Jos Ewert <flami@...> wrote:

> Hi,
>
> Im trying to modify mod_fcgid to suit my needs, but I have a problem with
> reading my newly added config directive.
> For some reason it sets the config in my setter right but in the getter it
> always reads the default value.
>
> Whats even stranger is that I used this with mod_fcgid 1.10 too and it works.
>
> e.g.
> set :
> &config : 7092232, &config->homedir : 7101472
> get:
> &config : 7100440, &config->homedir : 7845640
>
> to set the value I use:
>
> ##########
> const char *set_homedir(cmd_parms *cmd, void *dirconfig,
> const char *uid, const char *gid)
> {
>
> server_rec *s = cmd->server;
> fcgid_server_conf *config =
> ap_get_module_config(s->module_config, &fcgid_module);
>
> struct passwd *pw;
> if((pw = getpwuid(ap_uname2id(uid))) == NULL){
> fprintf(stderr,
> "Critical Error: You have specified an invalid user in
> SuexecUserGroup.\n");
> exit(1);
> } else {
> config->homedir = strdup(pw->pw_dir);
> return NULL;
> }
> }
> #########
>
> To get the config:
> ###########
>
> char *get_homedir(request_rec * r)
> {
> server_rec *s = r->server;
> fcgid_server_conf *config =
> ap_get_module_config(s->module_config, &fcgid_module);
> return config->homedir;
> }
>
> ###########
> I removed all the debugging stuff I added to make it more readable.
>
> if you want to take a look at the whole file + the other 2 I modified:
> http://pastebin.com/f4c834a94
>
>
> Any ideas what could have gone wrong?

r->server in get_homedir points to the server object corresponding to
the virtual host of the request. I _guess_ it is different from the
global server object. So, the ap_get_module_config in set_* and the
ap_get_module_config in get_* could give you two distinct config
objects.

S

config is not read correctly

2008-11-15T15:51:44Z

Hi,

Im trying to modify mod_fcgid to suit my needs, but I have a problem with
reading my newly added config directive.
For some reason it sets the config in my setter right but in the getter it
always reads the default value.

Whats even stranger is that I used this with mod_fcgid 1.10 too and it works.

e.g.
set :
&config : 7092232, &config->homedir : 7101472
get:
&config : 7100440, &config->homedir : 7845640

to set the value I use:

##########
const char *set_homedir(cmd_parms *cmd, void *dirconfig,
const char *uid, const char *gid)
{

server_rec *s = cmd->server;
fcgid_server_conf *config =
ap_get_module_config(s->module_config, &fcgid_module);

struct passwd *pw;
if((pw = getpwuid(ap_uname2id(uid))) == NULL){
fprintf(stderr,
"Critical Error: You have specified an invalid user in
SuexecUserGroup.\n");
exit(1);
} else {
config->homedir = strdup(pw->pw_dir);
return NULL;
}
}
#########

To get the config:
###########

char *get_homedir(request_rec * r)
{
server_rec *s = r->server;
fcgid_server_conf *config =
ap_get_module_config(s->module_config, &fcgid_module);
return config->homedir;
}

###########
I removed all the debugging stuff I added to make it more readable.

if you want to take a look at the whole file + the other 2 I modified:
http://pastebin.com/f4c834a94

Any ideas what could have gone wrong?

Greetings,
Josi

handling custom authentication

2008-11-13T09:32:04Z

I am ISV developing a system that is using Apache. All the frontend's
for system I am developing are all custom desktop applications, or web
browsers controls wrapped in my own code. Thus users are not going to
be entering username and password, the username and password used will
be depended on which frontend being used.

It is time for me to implement authentication correctly. I have two
objectives with respect to authentication:

1: Protect my customers from unauthorized users.
2: Protect myself from customers hacking the authorization system to
get access to features in which they have not purchased.

#1 looks straight forward: If my impression is correct, I simply need
to implement my own custom provider to check the custom username and
password the frontends give it.

Q: Is there documentation out there somewhere on how to implementing a
new provider?

#2 looks a lot more tricky. It seems that I will need to deviate from
the normal way Apache's authentication works. For starters, NONE of
the configuration can be in the http.conf, not like it is now with
AuthType, AuthBasicProvider, etc. There is a <Location> directives in
the conf that will have a custom directive for my custom Apache
module. I would like to fully wire up this custom provider within
this directive. To add to the complexity, there are different levels
of authentication: None required, user, admin and there will be
different locations under the <Location> directive for each, again,
this all needs to be wired up in code when the custom directive for my
custom Apache module is called.

Q: Any suggestions on how I might achieve this?

Sam

P.S. I do NOT own the book on writing Apache Module in 2.0, just the
older 1.3 book. Would any of this be addressed in that book?

Re: mod_dbd issues in worker vs prefork mpm

2008-11-09T08:03:18Z

Peter Poeml wrote:

> Hi,
>
> On Fri, Nov 07, 2008 at 03:24:00PM +0100, B. F. wrote:
>> I have recently started using the mod_dbd module for database
>> connection handling in my own module and a had slight hope that it
>> would perform better than a classic persistent connection approach.
>>
>> Basically I am using the ap_dbd_acquire(request_rec*) function in a
>> handler function (in my own module) and then uses some of the apr_dbd
>> functions to fetch data from a PostgreSQL database, all this seems
>> fine.
>>
>> When I run a performance test (using httperf) with the prefork mpm I
>> get numbers like ~100 requests/s.
>> However when I run the same test but now using the worker mpm, this
>> number drops to almost nothing...
>>
>> As I understood it, the worker (or any threaded mpm) should make
>> mod_dbd/apr_dbd perform better as it enables functionality needing
>> multi threading (like connection pooling) while prefork limits mod_dbd
>> to only use a persistent connection strategy. Despite this the prefork
>> mpm performs better...
>>
>> I have tried several different configuration setups without seeing any
>> great difference. A typical setup is however: 200 max_connections (in
>> postgresql.conf, the same for both the prefork and worker tests).
>> Having DBDMax set to 10 while setting ServerLimit to 20 should fully
>> make mod_dbd utilize all the 200 available connections in Postgres, is
>> that correct?

ThreadsPerChild affects how many threads share each DBD pool with worker mpm.

If you are running with the default value of 25 ThreadsPerChild, then each of your 20 processes will
have up to 25 threads processing requests. Each process will have a pool of 10 DBD connections
(DBDMax) to share between its 25 threads.

When one of your processes is completely busy, some of the 25 threads must wait for one of the 10
DBD connections.

This could explain why you get lower throughput with your configuration, but it really doesn't
explain why you get "almost nothing" vs. ~100 requests/s.

You might want to try this configuration if you have a hard limit of 200 database connections:
ServerLimit 8
ThreadsPerChild 25
MaxClients 200
DBDMax 25

See http://httpd.apache.org/docs/2.2/mod/worker.html for the details about how worker mpm handles
threads & processes.

-tom-

Re: Where to prepare DBD statements? post_config or child_init?

2008-11-09T07:48:52Z

On Wed, Nov 05, 2008 at 04:46:59PM +0100, Peter Poeml wrote:

> Hi,
>
> I wonder where is the best place to prepare a mod_dbd statement - I'm
> thinking about either the post_config or child_init hook.
>
> So far, I prepared the statements when a configuration directive is
> processed, like many other similar modules do, too. To decrease error
> proneness by (me) forgetting to update the configuration when I change
> my module in a way that requires a changed SQL query, I want to compile
> a default query into the module. This means that no config directive for
> this is needed in the config anymore (although it can optionally still
> be given). Therefore, I don't have the occasion any longer to use my
> config directive processing handler to prepare the statement.
>
> So this needs to be moved to another place (which is always run, after
> configuration processing).
>
> Therefore I was thinking about a post_config or child_init hook. I'm not
> exactly sure about the difference, I know that child_init is run after
> forking but before thread creation, but I am not sure which way is
> appropriate to be used with mod_dbd.
>
> Could someone who knows share their insight?
> Pointers to examples would be appreciated very much, too.
>
> I'm using Apache 2.2.10 worker, in a multi-process and multi-threaded
> configuration.
>
> Thanks,
> Peter

Hi,

I found an answer myself: doing this in a post_config hook works just
fine.

--------------------->

/* make sure that mod_dbd is loaded */
if (zrkadlo_dbd_prepare_fn == NULL) {
zrkadlo_dbd_prepare_fn = APR_RETRIEVE_OPTIONAL_FN(ap_dbd_prepare);
if (zrkadlo_dbd_prepare_fn == NULL) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
"[mod_zrkadlo] You must load mod_dbd to enable Zrkadlo functions");
return HTTP_INTERNAL_SERVER_ERROR;
}
zrkadlo_dbd_acquire_fn = APR_RETRIEVE_OPTIONAL_FN(ap_dbd_acquire);
}

/* prepare DBD SQL statements */
static unsigned int label_num = 0;
server_rec *sp;
for (sp = s; sp; sp = sp->next) {
zrkadlo_server_conf *cfg = ap_get_module_config(sp->module_config,
&zrkadlo_module);
/* make a label */
cfg->query_prep = apr_psprintf(pconf, "zrkadlo_dbd_%d", ++label_num);
zrkadlo_dbd_prepare_fn(sp, cfg->query, cfg->query_prep);
}

return OK;

<---------------------

Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

Re: mod_dbd issues in worker vs prefork mpm

2008-11-07T06:46:05Z

Hi,

On Fri, Nov 07, 2008 at 03:24:00PM +0100, B. F. wrote:

> I have recently started using the mod_dbd module for database
> connection handling in my own module and a had slight hope that it
> would perform better than a classic persistent connection approach.
>
> Basically I am using the ap_dbd_acquire(request_rec*) function in a
> handler function (in my own module) and then uses some of the apr_dbd
> functions to fetch data from a PostgreSQL database, all this seems
> fine.
>
> When I run a performance test (using httperf) with the prefork mpm I
> get numbers like ~100 requests/s.
> However when I run the same test but now using the worker mpm, this
> number drops to almost nothing...
>
> As I understood it, the worker (or any threaded mpm) should make
> mod_dbd/apr_dbd perform better as it enables functionality needing
> multi threading (like connection pooling) while prefork limits mod_dbd
> to only use a persistent connection strategy. Despite this the prefork
> mpm performs better...
>
> I have tried several different configuration setups without seeing any
> great difference. A typical setup is however: 200 max_connections (in
> postgresql.conf, the same for both the prefork and worker tests).
> Having DBDMax set to 10 while setting ServerLimit to 20 should fully
> make mod_dbd utilize all the 200 available connections in Postgres, is
> that correct?

One suggestion, you could check with netstat during the test how many
connections to the database are actually opened. Just to get a feel of
how the pool size behaves, and also to double check assumptions.

> Another thing that suggets there is something wrong is that the load
> while running the prefork test is overall high, while running the
> worker test the system load is much lower.

Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

mod_dbd issues in worker vs prefork mpm

2008-11-07T06:24:00Z

Hi all,

I have recently started using the mod_dbd module for database
connection handling in my own module and a had slight hope that it
would perform better than a classic persistent connection approach.

Basically I am using the ap_dbd_acquire(request_rec*) function in a
handler function (in my own module) and then uses some of the apr_dbd
functions to fetch data from a PostgreSQL database, all this seems
fine.

When I run a performance test (using httperf) with the prefork mpm I
get numbers like ~100 requests/s.
However when I run the same test but now using the worker mpm, this
number drops to almost nothing...

As I understood it, the worker (or any threaded mpm) should make
mod_dbd/apr_dbd perform better as it enables functionality needing
multi threading (like connection pooling) while prefork limits mod_dbd
to only use a persistent connection strategy. Despite this the prefork
mpm performs better...

I have tried several different configuration setups without seeing any
great difference. A typical setup is however: 200 max_connections (in
postgresql.conf, the same for both the prefork and worker tests).
Having DBDMax set to 10 while setting ServerLimit to 20 should fully
make mod_dbd utilize all the 200 available connections in Postgres, is
that correct?

Another thing that suggets there is something wrong is that the load
while running the prefork test is overall high, while running the
worker test the system load is much lower.

Some system details that might or might not be of interest:
- Apache 2.2.9 (from Fedora 8 package)
- APR 1.2.11
- APR-Util 1.2.10
- PostgreSQL 8.2.11
- Apache and PostgreSQL is running on the same server
- which is a virtual server with 6 available CPU cores, (only) 1GByte memory
- benchmarking utility of course run on another machine
- Linux kernel 2.6.21.7
- 64bit system

Greatly thankful for any hints as to how I could find the cause of
this and/or fix it.

--
Regards,
Bengt

ap_send_fd() don't send anything

2008-11-05T15:14:11Z

Hi, I'm writing a module for one project and for start, I'm writing a simple
one but I have problems with the ap_send_fd() function. When I call this
function after open the file with apr_file_open() I use this:

ap_send_fd (f, r, offset, r->finfo.size, &nbytes)

where offset's value is 0. I checked the file and it exists and it's opened
correctly by apr_file_open().The problem is that don't send anything. The
value of nbytes after the function is always 0. I have read some forums and I
have tried to use ap_rflush() and apr_file_close() but haven't work. In the
examples I have founded in internet works but not for me. I read something
about one timer in the http protocol .h file but I don't understand well for
what is the timer and how to use it.

I could use apr_file_read() and ap_rputs() but I prefer to use ap_send_fd() so
if anyone can give me some hint I'll be happy.

Here is the small code without the checks:

apr_file_open(&f,r->finfo.fname,APR_READ,APR_OS_DEFAULT,r->pool)
ap_send_fd (f, r, offset, r->finfo.size, &nbytes)
apr_file_close(f)
return OK;

Thank for your help.
--
Javier Vela Diago
Computer Science Student
GnuPG key ID: 52DD9977

Where to prepare DBD statements? post_config or child_init?

2008-11-05T07:46:59Z

Hi,

I wonder where is the best place to prepare a mod_dbd statement - I'm
thinking about either the post_config or child_init hook.

So far, I prepared the statements when a configuration directive is
processed, like many other similar modules do, too. To decrease error
proneness by (me) forgetting to update the configuration when I change
my module in a way that requires a changed SQL query, I want to compile
a default query into the module. This means that no config directive for
this is needed in the config anymore (although it can optionally still
be given). Therefore, I don't have the occasion any longer to use my
config directive processing handler to prepare the statement.

So this needs to be moved to another place (which is always run, after
configuration processing).

Therefore I was thinking about a post_config or child_init hook. I'm not
exactly sure about the difference, I know that child_init is run after
forking but before thread creation, but I am not sure which way is
appropriate to be used with mod_dbd.

Could someone who knows share their insight?
Pointers to examples would be appreciated very much, too.

I'm using Apache 2.2.10 worker, in a multi-process and multi-threaded
configuration.

Thanks,
Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

Re: how to get zipped post data in ap_hook_log_transaction?

2008-11-04T03:24:33Z

On Tue, Nov 4, 2008 at 11:46, Andrej van der Zee
<andrejvanderzee@...> wrote:
> Hi,
>
> I was wondering if it is possible to get a hold on the data that is actually
> sent back to the client, preferably in the hook ap_hook_log_transaction. In
> our case we sent back XML data that might be zipped by mod_deflate. If it is
> zipped, I would like to get a hold on the zipped XML data, otherwise the
> unzipped. What would be the best way to do this?

You cannot do it in the log_transaction callback. log_transaction is
called after the socket is flushed, so all filters have been already
invoked.

Have a look at modules/loggers/mod_logio.c in the apache sources. The
module adds the logio_out_filter as one of the very last filters
(after deflate, just before the filter that performs the actual
writing to the socket). You could write a similar filter that would
record all the bytes that transit your filter. It is quite tricky,
because you need to make the distinction between bytes belonging to
different requests. In order to do that, you need to set a filter
context.

You write something like
ap_register_output_filter(filter_name, filter_function, NULL,
AP_FTYPE_NETWORK - 1)
in you module register function.

In filter_function you will write something like
if (flt->ctx == NULL) {
flt->ctx = (context_type *)apr_pcalloc(request->pool, sizeof(context_type));
init_ctx(flt->ctx);
}
// record the bytes that transit. Save them somewhere in the request
pool, see apr_brigade_flatten
// next, pass the data to the next filter in the chain
return ap_pass_brigade(flt->next, bb);

Then, in log_transaction you'll recover it from where you put it aside.

You need to add SetOutputFilter filter_name in your apache config.

However, I think the best way to do this would be with network
sniffers (tcpdump, wireshark), not with apache.

--S

Re: how to get zipped post data in ap_hook_log_transaction?

2008-11-04T03:01:53Z

You likely want to consider writing an output filter and inserting it
after mod_deflate in the output filter chain

Issac

Andrej van der Zee wrote:

> Hi,
>
> I was wondering if it is possible to get a hold on the data that is actually
> sent back to the client, preferably in the hook ap_hook_log_transaction. In
> our case we sent back XML data that might be zipped by mod_deflate. If it is
> zipped, I would like to get a hold on the zipped XML data, otherwise the
> unzipped. What would be the best way to do this?
>
> Thank you,
> Andrej
>

how to get zipped post data in ap_hook_log_transaction?

2008-11-04T02:46:14Z

Hi,

I was wondering if it is possible to get a hold on the data that is actually
sent back to the client, preferably in the hook ap_hook_log_transaction. In
our case we sent back XML data that might be zipped by mod_deflate. If it is
zipped, I would like to get a hold on the zipped XML data, otherwise the
unzipped. What would be the best way to do this?

Thank you,
Andrej

Re: parsing querystring parameters

2008-11-03T14:58:03Z

Hi Jason,

On Mon, Nov 03, 2008 at 05:48:58PM -0500, Jason Fister wrote:

> is there an apr utility function that would let me extract the values of
> querystring variables by specifying the variable name. For e.g. if my
> querysting is something like
>
> ?key1=val1&key2=val2&key3=val3
>
>
> is there a function which takes in key1 as the input and returns val1?
>
> Jason

There is no direct shortcut function in apr, as far as I know, unless
you want to parse the string manually. IMO, the most convenient method
to do this is to use mod_form's form_value() function. You'll find it at
http://apache.webthing.com/mod_form/. You could look at
https://forgesvn1.novell.com/svn/opensuse/trunk/tools/download-redirector-v2/mod_zrkadlo/mod_zrkadlo.c
to see the way that I am using it. Just search for 'form' there.

HTH,
Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

parsing querystring parameters

2008-11-03T14:48:58Z

Hi,
is there an apr utility function that would let me extract the values of
querystring variables by specifying the variable name. For e.g. if my
querysting is something like

?key1=val1&key2=val2&key3=val3

is there a function which takes in key1 as the input and returns val1?

Jason

Re: How can i decrypt a cookie in a module

2008-10-28T16:50:59Z

FYI LoadFile seems to be the recommended way
so that another module added later can use the
same version. That is, so that they see it's
loaded and don't link to a different version.
--
Ray B. Morris
support@...

Strongbox - The next generation in site security:
http://www.bettercgi.com/strongbox/

Throttlebox - Intelligent Bandwidth Control
http://www.bettercgi.com/throttlebox/

Strongbox / Throttlebox affiliate program:
http://www.bettercgi.com/affiliates/user/register.php

On 10/28/2008 06:17:09 PM, Peter Poeml wrote:

> Hi Christian,
>
> On Tue, Oct 28, 2008 at 02:45:05PM +0100, Christian Klinger wrote:
> > now i have the -lssl and -lcrypt in the gcc command but i alwas get
>
> > the same error again.
>
> With the same error, you mean the same symbol is still missing when
> you
> run Apache and use the modules functionality?
>
> > make
> [...]
> > Libraries have been installed in:
> > /opt/apache/server/modules
> [...]
>
> The output of your make command looks fine anyway.
>
> >
> > I have added the LoadFile with all possibilitys of libcrypto
>
> Just to not be misunderstood: You need only one of the two means -
> either linking to all needed libraries, and letting the runtime
> linker
> do the work -- or use the LoadFile directive to take care.
>
> > I´ve included all versions of the libcrypto lib.
> >
> > LoadFile /usr/lib/libcrypto.so.0.9.8
> > LoadFile /usr/lib/libcrypto.so.0.9.7
> > LoadFile /usr/lib/libcrypto
>
> Btw, doing this with different version of a library is maybe not a
> good
> idea, because their symbols could clash.
>
> > but with no success....
> >
> > Any Ideas left....
> >
> > Christian
>
> On Tue, Oct 28, 2008 at 03:40:12PM +0100, Christian Klinger wrote:
> > Hi again,
> >
> > ldd mod_auth_tkt.so
> > linux-gate.so.1 => (0xffffe000)
> > libssl.so.0.9.8 => /usr/lib/libssl.so.0.9.8 (0xb7f6f000)
> > libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8
> (0xb7e29000)
> > libc.so.6 => /lib/libc.so.6 (0xb7cf6000)
> > libdl.so.2 => /lib/libdl.so.2 (0xb7cf2000)
> > libz.so.1 => /lib/libz.so.1 (0xb7cde000)
> > /lib/ld-linux.so.2 (0x80000000)
> >
> > is this ok? Or do I need something special for blowfish.h?
>
> You could check if your libcrypto actually contains the symbol you
> were
> missing -- after all it might be possible that your OpenSSL is
> compiled
> without blowfish support? Does
> strings /usr/lib/libcrypto.so.0.9.8 | grep BF_Decrypt
> print something?
>
> If all else fails, check if you have some kind of mess from previous
> build attempts which causes Apache to load other objects than you
> might
> think. lsof -p $pid_of_parent_apache_proxy can be a valuable tool to
> double check.
>
> Peter
> --
> Contact: admin@... (a.k.a. ftpadmin@...)
> #opensuse-mirrors on freenode.net
> Info: http://en.opensuse.org/Mirror_Infrastructure
>
> SUSE LINUX Products GmbH
> Research & Development
>

Re: How can i decrypt a cookie in a module

2008-10-28T16:17:09Z

Hi Christian,

On Tue, Oct 28, 2008 at 02:45:05PM +0100, Christian Klinger wrote:
> now i have the -lssl and -lcrypt in the gcc command but i alwas get
> the same error again.

With the same error, you mean the same symbol is still missing when you
run Apache and use the modules functionality?

> make
[...]
> Libraries have been installed in:
> /opt/apache/server/modules
[...]

The output of your make command looks fine anyway.

>
> I have added the LoadFile with all possibilitys of libcrypto

Just to not be misunderstood: You need only one of the two means -
either linking to all needed libraries, and letting the runtime linker
do the work -- or use the LoadFile directive to take care.

> I´ve included all versions of the libcrypto lib.
>
> LoadFile /usr/lib/libcrypto.so.0.9.8
> LoadFile /usr/lib/libcrypto.so.0.9.7
> LoadFile /usr/lib/libcrypto

Btw, doing this with different version of a library is maybe not a good
idea, because their symbols could clash.

> but with no success....
>
> Any Ideas left....
>
> Christian

On Tue, Oct 28, 2008 at 03:40:12PM +0100, Christian Klinger wrote:

> Hi again,
>
> ldd mod_auth_tkt.so
> linux-gate.so.1 => (0xffffe000)
> libssl.so.0.9.8 => /usr/lib/libssl.so.0.9.8 (0xb7f6f000)
> libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0xb7e29000)
> libc.so.6 => /lib/libc.so.6 (0xb7cf6000)
> libdl.so.2 => /lib/libdl.so.2 (0xb7cf2000)
> libz.so.1 => /lib/libz.so.1 (0xb7cde000)
> /lib/ld-linux.so.2 (0x80000000)
>
> is this ok? Or do I need something special for blowfish.h?

You could check if your libcrypto actually contains the symbol you were
missing -- after all it might be possible that your OpenSSL is compiled
without blowfish support? Does
strings /usr/lib/libcrypto.so.0.9.8 | grep BF_Decrypt
print something?

If all else fails, check if you have some kind of mess from previous
build attempts which causes Apache to load other objects than you might
think. lsof -p $pid_of_parent_apache_proxy can be a valuable tool to
double check.

Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

Re: How can i decrypt a cookie in a module

2008-10-28T07:40:12Z

Hi again,

ldd mod_auth_tkt.so
linux-gate.so.1 => (0xffffe000)
libssl.so.0.9.8 => /usr/lib/libssl.so.0.9.8 (0xb7f6f000)
libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8 (0xb7e29000)
libc.so.6 => /lib/libc.so.6 (0xb7cf6000)
libdl.so.2 => /lib/libdl.so.2 (0xb7cf2000)
libz.so.1 => /lib/libz.so.1 (0xb7cde000)
/lib/ld-linux.so.2 (0x80000000)

is this ok? Or do I need something special for blowfish.h?

Christian

Am 28.10.2008 um 14:45 schrieb Christian Klinger:

>
> Am 28.10.2008 um 14:30 schrieb Peter Poeml:
>
>> On Tue, Oct 28, 2008 at 02:12:26PM +0100, Christian Klinger wrote:
>>>>>
>>>>
>>>> The symbol BF_Decrypt is probably to be found in libcrypto from
>>>> OpenSSL.
>>>>
>>>> When mod_auth_tkt was compiled, it was not linked with that
>>>> library.
>>>> So
>>>> either you need to add -lcrypto to the compile command, or you can
>>>> alternatively start Apache with the "LoadFile directive", which
>>>> will
>>>> cause Apache to load the library so that the symbol can be found at
>>>> runtime.
>>>>
>>>> Peter
>>>
>>> Hello Peter,
>>>
>>> thanks for the answers, but i don´t get it.
>>>
>>> I try to add the Icrypto in my Makefile i get the error again:
>>
>> I meant -l (as in "link"), not -I (as in "include").
>>
>> Try to add this into the command:
>> -lssl -lcrypto
>>
>> This will add a reference to libssl and libcrypto (from your library
>> path) be added to the shared object that you compile with 'apxs -
>> c ...'.
>>
>
>
> Hi Peter,
>
> now i have the -lssl and -lcrypt in the gcc command but i alwas get
> the same error again.
>
> make
> cd src && make all
> make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
> /opt/apache/server/bin/apxs -c -Wc, "-Wall -ansi -g -Wall -ansi -
> pedantic -Wno-implicit-function-declaration -Wno-long-long -lssl -
> lcrypto" -lssl -lcrypto mod_auth_tkt.c
> /opt/apache/server/build/libtool --silent --mode=compile gcc -prefer-
> pic -DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT -
> D_GNU_SOURCE -g -O2 -pthread -I/opt/apache/server/include -I/opt/
> apache/server/include -I/opt/apache/server/include -c -o
> mod_auth_tkt.lo mod_auth_tkt.c && touch mod_auth_tkt.slo
> /opt/apache/server/build/libtool --silent --mode=link gcc -o
> mod_auth_tkt.la -lssl -lcrypto -rpath /opt/apache/server/modules -
> module -avoid-version mod_auth_tkt.lo
> make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
> cd doc && make all
> make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
> pod2man --section=3 --release=2.0.0rc3 mod_auth_tkt.pod mod_auth_tkt.3
> make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
> g3:/opt/apache/mod_auth_tkt-2.0.0rc3 # make install
> cd src && make install
> make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
> /opt/apache/server/bin/apxs -i mod_auth_tkt.la
> /opt/apache/server/build/instdso.sh SH_LIBTOOL='/opt/apache/server/
> build/libtool' mod_auth_tkt.la /opt/apache/server/modules
> /opt/apache/server/build/libtool --mode=install cp mod_auth_tkt.la /
> opt/apache/server/modules/
> cp .libs/mod_auth_tkt.so /opt/apache/server/modules/mod_auth_tkt.so
> cp .libs/mod_auth_tkt.lai /opt/apache/server/modules/mod_auth_tkt.la
> cp .libs/mod_auth_tkt.a /opt/apache/server/modules/mod_auth_tkt.a
> chmod 644 /opt/apache/server/modules/mod_auth_tkt.a
> ranlib /opt/apache/server/modules/mod_auth_tkt.a
> PATH="$PATH:/sbin" ldconfig -n /opt/apache/server/modules
> ----------------------------------------------------------------------
> Libraries have been installed in:
> /opt/apache/server/modules
>
> If you ever happen to want to link against installed libraries
> in a given directory, LIBDIR, you must either use libtool, and
> specify the full pathname of the library, or use the `-LLIBDIR'
> flag during linking and do at least one of the following:
> - add LIBDIR to the `LD_LIBRARY_PATH' environment variable
> during execution
> - add LIBDIR to the `LD_RUN_PATH' environment variable
> during linking
> - use the `-Wl,--rpath -Wl,LIBDIR' linker flag
> - have your system administrator add LIBDIR to `/etc/ld.so.conf'
>
> See any operating system documentation about shared libraries for
> more information, such as the ld(1) and ld.so(8) manual pages.
> ----------------------------------------------------------------------
> chmod 755 /opt/apache/server/modules/mod_auth_tkt.so
> make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
> cd doc && make install
> make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
> mkdir -p /usr/share/man/man3
> cp mod_auth_tkt.3 /usr/share/man/man3
> chmod 644 /usr/share/man/man3/mod_auth_tkt.3
> make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
> g3:/opt/apache/mod_auth_tkt-2.0.0rc3 #
>
>
>
> I have added the LoadFile with all possibilitys of libcrypto
>
> I´ve included all versions of the libcrypto lib.
>
> LoadFile /usr/lib/libcrypto.so.0.9.8
> LoadFile /usr/lib/libcrypto.so.0.9.7
> LoadFile /usr/lib/libcrypto
>
> but with no success....
>
> Any Ideas left....
>
> Christian

Re: How can i decrypt a cookie in a module

2008-10-28T06:45:05Z

Am 28.10.2008 um 14:30 schrieb Peter Poeml:

> On Tue, Oct 28, 2008 at 02:12:26PM +0100, Christian Klinger wrote:
>>>>
>>>
>>> The symbol BF_Decrypt is probably to be found in libcrypto from
>>> OpenSSL.
>>>
>>> When mod_auth_tkt was compiled, it was not linked with that library.
>>> So
>>> either you need to add -lcrypto to the compile command, or you can
>>> alternatively start Apache with the "LoadFile directive", which will
>>> cause Apache to load the library so that the symbol can be found at
>>> runtime.
>>>
>>> Peter
>>
>> Hello Peter,
>>
>> thanks for the answers, but i don´t get it.
>>
>> I try to add the Icrypto in my Makefile i get the error again:
>
> I meant -l (as in "link"), not -I (as in "include").
>
> Try to add this into the command:
> -lssl -lcrypto
>
> This will add a reference to libssl and libcrypto (from your library
> path) be added to the shared object that you compile with 'apxs -
> c ...'.
>

Hi Peter,

now i have the -lssl and -lcrypt in the gcc command but i alwas get
the same error again.

make
cd src && make all
make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
/opt/apache/server/bin/apxs -c -Wc, "-Wall -ansi -g -Wall -ansi -
pedantic -Wno-implicit-function-declaration -Wno-long-long -lssl -
lcrypto" -lssl -lcrypto mod_auth_tkt.c
/opt/apache/server/build/libtool --silent --mode=compile gcc -prefer-
pic -DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT -
D_GNU_SOURCE -g -O2 -pthread -I/opt/apache/server/include -I/opt/
apache/server/include -I/opt/apache/server/include -c -o
mod_auth_tkt.lo mod_auth_tkt.c && touch mod_auth_tkt.slo
/opt/apache/server/build/libtool --silent --mode=link gcc -o
mod_auth_tkt.la -lssl -lcrypto -rpath /opt/apache/server/modules -
module -avoid-version mod_auth_tkt.lo
make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
cd doc && make all
make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
pod2man --section=3 --release=2.0.0rc3 mod_auth_tkt.pod mod_auth_tkt.3
make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
g3:/opt/apache/mod_auth_tkt-2.0.0rc3 # make install
cd src && make install
make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
/opt/apache/server/bin/apxs -i mod_auth_tkt.la
/opt/apache/server/build/instdso.sh SH_LIBTOOL='/opt/apache/server/
build/libtool' mod_auth_tkt.la /opt/apache/server/modules
/opt/apache/server/build/libtool --mode=install cp mod_auth_tkt.la /
opt/apache/server/modules/
cp .libs/mod_auth_tkt.so /opt/apache/server/modules/mod_auth_tkt.so
cp .libs/mod_auth_tkt.lai /opt/apache/server/modules/mod_auth_tkt.la
cp .libs/mod_auth_tkt.a /opt/apache/server/modules/mod_auth_tkt.a
chmod 644 /opt/apache/server/modules/mod_auth_tkt.a
ranlib /opt/apache/server/modules/mod_auth_tkt.a
PATH="$PATH:/sbin" ldconfig -n /opt/apache/server/modules
----------------------------------------------------------------------
Libraries have been installed in:
/opt/apache/server/modules

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
- add LIBDIR to the `LD_LIBRARY_PATH' environment variable
during execution
- add LIBDIR to the `LD_RUN_PATH' environment variable
during linking
- use the `-Wl,--rpath -Wl,LIBDIR' linker flag
- have your system administrator add LIBDIR to `/etc/ld.so.conf'

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
chmod 755 /opt/apache/server/modules/mod_auth_tkt.so
make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
cd doc && make install
make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
mkdir -p /usr/share/man/man3
cp mod_auth_tkt.3 /usr/share/man/man3
chmod 644 /usr/share/man/man3/mod_auth_tkt.3
make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
g3:/opt/apache/mod_auth_tkt-2.0.0rc3 #

I have added the LoadFile with all possibilitys of libcrypto

I´ve included all versions of the libcrypto lib.

LoadFile /usr/lib/libcrypto.so.0.9.8
LoadFile /usr/lib/libcrypto.so.0.9.7
LoadFile /usr/lib/libcrypto

but with no success....

Any Ideas left....

Christian

Re: How can i decrypt a cookie in a module

2008-10-28T06:30:40Z

On Tue, Oct 28, 2008 at 02:12:26PM +0100, Christian Klinger wrote:

> >>
> >
> >The symbol BF_Decrypt is probably to be found in libcrypto from
> >OpenSSL.
> >
> >When mod_auth_tkt was compiled, it was not linked with that library.
> >So
> >either you need to add -lcrypto to the compile command, or you can
> >alternatively start Apache with the "LoadFile directive", which will
> >cause Apache to load the library so that the symbol can be found at
> >runtime.
> >
> >Peter
>
> Hello Peter,
>
> thanks for the answers, but i don´t get it.
>
> I try to add the Icrypto in my Makefile i get the error again:

I meant -l (as in "link"), not -I (as in "include").

Try to add this into the command:
-lssl -lcrypto

This will add a reference to libssl and libcrypto (from your library
path) be added to the shared object that you compile with 'apxs -c ...'.

You didn't get an error from the -I you tried, because it just adds a
search path to look for include files, and non-existing paths are
ignored.

> What file should i include to the LoadFile? Blowfish.h mod_auth_tkt.so?

You would use it as such:

LoadFile /usr/lib/libcrypto.so

To find the correct library, you could try
ldd $(which sshd) | grep crypto

> Sorry i´m a newbie in this stuff.

Everybody is at some point in time :)

Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

Re: How can i decrypt a cookie in a module

2008-10-28T06:24:11Z

Christian Klinger wrote:
> thanks for the answers, but i don´t get it.
>
> I try to add the Icrypto in my Makefile i get the error again:
>
> [snip]
That's a font issue - it's actually a lowercase L (for library) rather
than an uppercase i (for include directory).

> What file should i include to the LoadFile? Blowfish.h mod_auth_tkt.so?
I believe the LoadFile should be the path to the OpenSSL crypto library,
which would be something like /usr/lib/libcrypto.so (but you may need to
select a specific version). See the docs at
http://httpd.apache.org/docs/2.2/mod/mod_so.html

> Sorry i´m a newbie in this stuff.
Everyone starts somewhere :-)

Dave

Re: How can i decrypt a cookie in a module

2008-10-28T06:12:26Z

>>
>
> The symbol BF_Decrypt is probably to be found in libcrypto from
> OpenSSL.
>
> When mod_auth_tkt was compiled, it was not linked with that library.
> So
> either you need to add -lcrypto to the compile command, or you can
> alternatively start Apache with the "LoadFile directive", which will
> cause Apache to load the library so that the symbol can be found at
> runtime.
>
> Peter

Hello Peter,

thanks for the answers, but i don´t get it.

I try to add the Icrypto in my Makefile i get the error again:

g3:/opt/apache/mod_auth_tkt-2.0.0rc3 # make
cd src && make all
make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
/opt/apache/server/bin/apxs -c -Wc, "-Wall -ansi -g -Wall -ansi -
pedantic -Wno-implicit-function-declaration -Wno-long-long -Icrypto"
mod_auth_tkt.c
/opt/apache/server/build/libtool --silent --mode=compile gcc -prefer-
pic -DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT -
D_GNU_SOURCE -g -O2 -pthread -I/opt/apache/server/include -I/opt/
apache/server/include -I/opt/apache/server/include -c -o
mod_auth_tkt.lo mod_auth_tkt.c && touch mod_auth_tkt.slo
/opt/apache/server/build/libtool --silent --mode=link gcc -o
mod_auth_tkt.la -rpath /opt/apache/server/modules -module -avoid-
version mod_auth_tkt.lo
make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/src'
cd doc && make all
make[1]: Entering directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'
pod2man --section=3 --release=2.0.0rc3 mod_auth_tkt.pod mod_auth_tkt.3
make[1]: Leaving directory `/opt/apache/mod_auth_tkt-2.0.0rc3/doc'

What file should i include to the LoadFile? Blowfish.h mod_auth_tkt.so?

Sorry i´m a newbie in this stuff.

Christian

>
> --
> Contact: admin@... (a.k.a. ftpadmin@...)
> #opensuse-mirrors on freenode.net
> Info: http://en.opensuse.org/Mirror_Infrastructure
>
> SUSE LINUX Products GmbH
> Research & Development

Re: How can i decrypt a cookie in a module

2008-10-28T05:43:14Z

On Tue, Oct 28, 2008 at 12:35:51PM +0100, Christian Klinger wrote:

> Hello,
>
> how can i decrypt a blowfish sigend cookie in an module.
>
> I have tried to do this so far: mod_auth_tkt is the module which
> should decrypt the cookie.
>
> I have included openssl/blowfish in the mod_auth_tkt.c
> #include <openssl/blowfish.h>
>
> I try to get my key config with this command:
>
> BF_set_key(&key, 8, (unsigned char *)bf_key[1]);
> BF_Decrypt(b, &key);
>
> I hope this is correct so far?
> make && make install works so far.
>
> But if i try to start apache i get this error message:
>
> Syntax error on line 235 of /opt/apache/server/conf/httpd.conf:
>
> Cannot load /opt/apache/server/modules/mod_auth_tkt.so into server: /
> opt/apache/server/modules/mod_auth_tkt.so: undefined symbol: BF_Decrypt
>
> Any ideas where i can look for this?

The symbol BF_Decrypt is probably to be found in libcrypto from OpenSSL.

When mod_auth_tkt was compiled, it was not linked with that library. So
either you need to add -lcrypto to the compile command, or you can
alternatively start Apache with the "LoadFile directive", which will
cause Apache to load the library so that the symbol can be found at
runtime.

Peter
--
Contact: admin@... (a.k.a. ftpadmin@...)
#opensuse-mirrors on freenode.net
Info: http://en.opensuse.org/Mirror_Infrastructure

SUSE LINUX Products GmbH
Research & Development

attachment0 (196 bytes) Download Attachment

How can i decrypt a cookie in a module

2008-10-28T04:35:51Z

Hello,

how can i decrypt a blowfish sigend cookie in an module.

I have tried to do this so far: mod_auth_tkt is the module which
should decrypt the cookie.

I have included openssl/blowfish in the mod_auth_tkt.c
#include <openssl/blowfish.h>

I try to get my key config with this command:

BF_set_key(&key, 8, (unsigned char *)bf_key[1]);
BF_Decrypt(b, &key);

I hope this is correct so far?
make && make install works so far.

But if i try to start apache i get this error message:

Syntax error on line 235 of /opt/apache/server/conf/httpd.conf:

Cannot load /opt/apache/server/modules/mod_auth_tkt.so into server: /
opt/apache/server/modules/mod_auth_tkt.so: undefined symbol: BF_Decrypt

Any ideas where i can look for this?

Re: Howto implement a new algorithm scheduler in mod_proxy_balancer

2008-10-25T16:57:23Z

Hi

I will build a scheduler that receive a little message from cluster. At cluster, there is a process that send messages about CPU.
Then the server I need to build a separate program that receives that message and passes to the apache.

Can I use socket to communicate external process with apache ??? Or shared memory ??

Thank you

Ricardo