des [Wed, 6 Jun 2007 11:24:06 +0000 (11:24 +0000)]
Move parts of tcp.c out into libvarnish. Rename the API from "TCP" to "VSS"
(Varnish Stream Sockets) as I intend to eventually add support for AF_UNIX
sockets.
This also moves the accept filter code out from VSS_listen() (previously
TCP_open()) and into a separate function in tcp.c
des [Fri, 1 Jun 2007 22:18:55 +0000 (22:18 +0000)]
Keep a master copy of the parameter block, to which all changes are applied,
and which is copied to the shared parameter block every time a parameter
changes as well as immediately before forking off a child. This prevents a
hypothetical compromised child from changing the parent's idea of run-time
parameters (which would, for example, allow it to trick the the parent into
starting a new, hypothetically exploitable child with the attacker's choice
of uid / gid).
While I'm here, correct the use of the "volatile" qualifier - it is the
parmeter block itself which can change unpredictably, not the pointer.
des [Thu, 31 May 2007 12:57:30 +0000 (12:57 +0000)]
Add two run-time parameters, "user" and "group", which specify an unprivileged
user and group to which the child process will switch immediately after fork()
returns, before it starts accepting connections. The default values are
"nobody" and "nogroup" (they should probably be tweakable at compile time...)
Note that this does not provide full privilege separation, as there are still
channels between the parent and child processes which need to be monitored,
but it is an improvement on the previous situation.
cecilihf [Wed, 30 May 2007 09:53:49 +0000 (09:53 +0000)]
varnishncsa is now able to produce backend logs. A couple of problems still remain: missing hostname and timestamp for backend communication. This could be solved with some extra tags serving the same purpose as ReqStart and ReqEnd does for client communication, providing this information.
des [Fri, 25 May 2007 10:00:38 +0000 (10:00 +0000)]
Add an API for synthetic objects, and use it to implement negative
caching of backend issues.
Brief summary:
- moved http_msg array from cache_response.c to cache_http.c,
introduced http_StatusMessage() lookup function
- introduced http_Put{Protocol,Status,Response} to complement
http_PrintfHeader().
- introduced SYN_ErrorPage() in a new file, cache_synthetic.c.
SYN_ErrorPage() populates the session's current object with the
specified error code and a corresponding HTML error page; it is the
caller's responsibility to ensure that the session has a suitable
object (i.e. one that doesn't already have headers or a body)
- rewrote RES_Error() to simply call SYN_ErrorPage() (with ttl = 0) and
RES_WriteObj().
- rewrote cnt_fetch() to use SYN_ErrorPage() to create a 503 page with
a TTL of 30 seconds when Fetch() fails.
- removed the call to RES_Error() in cache_backend.c; the error
trickles back up to cnt_fetch() anyway.
Comments from review:
- Memory allocation and pointer gymnastics for the header and body
are duplicated all over the place (in new and pre-existing code)
and should be centralized and hidden behind a suitable API.
- The http_*() API needs refactoring, we shouldn't need four
different functions to manipulate four different entries in the
same array.
ingvar [Thu, 17 May 2007 21:49:45 +0000 (21:49 +0000)]
Our default.vcl has a minor change: It uses localhost:80 (thus not
default anymore, but whatever, it will work with apache httpd out of
the box, and that's better for easy testing) as the backend. sysconfig
file changed to reflect this.
des [Thu, 17 May 2007 12:21:50 +0000 (12:21 +0000)]
Merged revisions 1437-1442 via svnmerge from
svn+ssh://projects.linpro.no/svn/varnish/trunk/varnish-cache
........
r1437 | ssm | 2007-05-16 17:20:47 +0200 (Wed, 16 May 2007) | 1 line
debian changelog, so far
........
r1438 | des | 2007-05-16 22:02:08 +0200 (Wed, 16 May 2007) | 7 lines
Tweak some of the defaults:
- bind to all interfaces
- use a 1 gibibyte
- remove hash setting, it's not safe
- tweak some variable names and comments
........
r1439 | des | 2007-05-16 22:03:32 +0200 (Wed, 16 May 2007) | 2 lines
Improve the descriptions of some of the options and parameters.
........
r1440 | ingvar | 2007-05-16 23:08:43 +0200 (Wed, 16 May 2007) | 6 lines
* Wed May 16 2007 Ingvar Hagelund <ingvar@linpro.no> - 1.0.svn-20070516
- Wrapping up for 1.0.4
- Changes in sysconfig and init scripts. Syncing with files in
trunk/debian
........
r1441 | des | 2007-05-17 13:48:35 +0200 (Thu, 17 May 2007) | 3 lines
Add an XML+XSLT-based change log. Unlike the change logs for previous
releases, this one was written by hand, which makes it user-readable.
........
r1442 | des | 2007-05-17 13:51:46 +0200 (Thu, 17 May 2007) | 2 lines
ingvar [Wed, 16 May 2007 21:08:43 +0000 (21:08 +0000)]
* Wed May 16 2007 Ingvar Hagelund <ingvar@linpro.no> - 1.0.svn-20070516
- Wrapping up for 1.0.4
- Changes in sysconfig and init scripts. Syncing with files in
trunk/debian
des [Tue, 15 May 2007 11:35:44 +0000 (11:35 +0000)]
Attempt to fix the bind-to-any problem:
- Introduce a "struct tcp_addr" which is a lightweight form of struct
addrinfo for our own internal use.
- Add a TCP_resolve() function which takes the output from TCP_parse()
and fills in a list of pointers to struct tcp_addr, one for each
address returned by getaddrinfo().
- Modify all TCP_open() callers to use TCP_resolve() and call TCP_open()
once for every address returned.
After compilation of a VCL program, do a test-load into the management
process to catch any implementation-discrepancies between symbols used
by the compiler and those implemented in the runtime.
The situation will happen from time to time and there is no need to
issue a panic when we can test sensibly for it.
........
r1403 | ingvar | 2007-05-11 09:51:11 +0200 (Fri, 11 May 2007) | 5 lines
* Fri May 11 2007 Ingvar Hagelund <ingvar@linpro.no> - 1.0.svn-20070511
- Threw latest changes into svn trunk
- Removed the conversion of manpages into utf8. They are all utf8 in trunk
........
r1404 | ingvar | 2007-05-11 10:13:03 +0200 (Fri, 11 May 2007) | 1 line
........
r1406 | des | 2007-05-11 13:06:03 +0200 (Fri, 11 May 2007) | 2 lines
Comment out comparisons which are always true (unsigned >= 0)
........
r1407 | des | 2007-05-11 13:06:38 +0200 (Fri, 11 May 2007) | 2 lines
Tweak DEVELOPER_CFLAGS.
........
r1408 | des | 2007-05-11 13:14:32 +0200 (Fri, 11 May 2007) | 2 lines
Pull flopen() and pidfile_*() (renamed to vpf_*()) from FreeBSD.
........
r1409 | des | 2007-05-11 13:15:46 +0200 (Fri, 11 May 2007) | 2 lines
Expand tags.
........
r1410 | des | 2007-05-11 13:17:09 +0200 (Fri, 11 May 2007) | 2 lines
No use expanding tags unless there *are* tags...
........
r1411 | des | 2007-05-11 13:34:42 +0200 (Fri, 11 May 2007) | 2 lines
Add -D (daemonize) and -P (pid file) options.
........
r1412 | des | 2007-05-11 13:35:59 +0200 (Fri, 11 May 2007) | 2 lines
Remove unused header.
........
r1413 | des | 2007-05-11 14:01:47 +0200 (Fri, 11 May 2007) | 2 lines
Avoid gcc4-specific compiler options.
........
r1414 | des | 2007-05-11 14:05:02 +0200 (Fri, 11 May 2007) | 2 lines
Forgotten commit: check for <vis.h> and daemon(3) availability.
........
r1415 | des | 2007-05-11 14:17:26 +0200 (Fri, 11 May 2007) | 2 lines
Add -P (pid file) option.
........
r1416 | des | 2007-05-11 14:19:48 +0200 (Fri, 11 May 2007) | 2 lines
Minor style issues.
........
r1417 | phk | 2007-05-11 15:15:16 +0200 (Fri, 11 May 2007) | 7 lines
Make the sendfile threshold inifinity for now, we have evidence of
sendfile not doing it's job in a number of operating system (-versions ?)
This change is unlikely to cause a performance hit anywhere, because
writev() is pretty effective in the first place.
........
r1418 | des | 2007-05-14 11:02:23 +0200 (Mon, 14 May 2007) | 2 lines
Document the inadvisability of enabling sendfile.
........
ingvar [Fri, 11 May 2007 07:51:11 +0000 (07:51 +0000)]
* Fri May 11 2007 Ingvar Hagelund <ingvar@linpro.no> - 1.0.svn-20070511
- Threw latest changes into svn trunk
- Removed the conversion of manpages into utf8. They are all utf8 in trunk
phk [Wed, 9 May 2007 10:55:33 +0000 (10:55 +0000)]
After compilation of a VCL program, do a test-load into the management
process to catch any implementation-discrepancies between symbols used
by the compiler and those implemented in the runtime.
The situation will happen from time to time and there is no need to
issue a panic when we can test sensibly for it.
projects / varnish / log