Mailing List Archive

Re: svn commit: r1885605 - in /httpd/httpd/branches/2.4.x: ./ include/ modules/proxy/
Le 17/01/2021 à 17:21, minfrin@apache.org a écrit :
> Author: minfrin
> Date: Sun Jan 17 16:21:35 2021
> New Revision: 1885605
>
> URL: http://svn.apache.org/viewvc?rev=1885605&view=rev
> Log:
> Backport to v2.4:
>
> *) mod_proxy_http: handle upgrade/tunneling protocols. BZ 61616 is about
> mod_proxy_connect but there has been wstunnel reports
> on dev@ about that too lately.
> trunk patch: https://svn.apache.org/r1678771
> https://svn.apache.org/r1832348
> https://svn.apache.org/r1869338
> https://svn.apache.org/r1869420
> https://svn.apache.org/r1878367
> https://svn.apache.org/r1877557
> https://svn.apache.org/r1877558

Here

> https://svn.apache.org/r1877646
> https://svn.apache.org/r1877695
> https://svn.apache.org/r1879401
> https://svn.apache.org/r1879402
> https://svn.apache.org/r1880200
> https://svn.apache.org/r1885239
> https://svn.apache.org/r1885240
> https://svn.apache.org/r1885244
> 2.4.x patch: http://people.apache.org/~ylavic/patches/2.4.x-mod_proxy_http-upgrade-4on5-v2.patch
> https://github.com/apache/httpd/pull/158
> +1: ylavic, covener, minfrin
> ylavic: All the corresponding trunk changes to mod_proxy_wstunnel (but
> r1885239) have been dropped for this backport proposal, the goal
> being to handle upgrade in mod_proxy_http from now, while r1885239
> allows to benefit from the Upgrade improvements done in proxy_http
> with existing wstunnel configurations (provided mod_proxy_http
> module is loaded).
>
>
> Modified:
> httpd/httpd/branches/2.4.x/CHANGES
> httpd/httpd/branches/2.4.x/STATUS
> httpd/httpd/branches/2.4.x/include/ap_mmn.h
> httpd/httpd/branches/2.4.x/modules/proxy/mod_proxy.c
> httpd/httpd/branches/2.4.x/modules/proxy/mod_proxy.h
> httpd/httpd/branches/2.4.x/modules/proxy/mod_proxy_connect.c
> httpd/httpd/branches/2.4.x/modules/proxy/mod_proxy_http.c
> httpd/httpd/branches/2.4.x/modules/proxy/mod_proxy_wstunnel.c
> httpd/httpd/branches/2.4.x/modules/proxy/proxy_util.c
>

[...]

The last hunk of r1877558 seems to be missing in this backport.

@@ -2180,6 +2165,9 @@ static int proxy_http_handler(request_re

/* Step Five: Receive the Response... Fall thru to cleanup */
status = ap_proxy_http_process_response(req);
+ if (req->backend) {
+ proxy_run_detach_backend(r, req->backend);
+ }

break;
}

I guess that it is not intentional and should go to 2.4.x as well.
Anyone to confirm my supposition?

CJ
Re: svn commit: r1885605 - in /httpd/httpd/branches/2.4.x: ./ include/ modules/proxy/ [ In reply to ]
> The last hunk of r1877558 seems to be missing in this backport.
>
> @@ -2180,6 +2165,9 @@ static int proxy_http_handler(request_re
>
> /* Step Five: Receive the Response... Fall thru to cleanup */
> status = ap_proxy_http_process_response(req);
> + if (req->backend) {
> + proxy_run_detach_backend(r, req->backend);
> + }
>
> break;
> }
>
> I guess that it is not intentional and should go to 2.4.x as well.
> Anyone to confirm my supposition?

The hook does not exist in 2.4.x so I think it's OK.
The only reference to it is guarded with an MMN check to keep proxy_h2 common.
Re: svn commit: r1885605 - in /httpd/httpd/branches/2.4.x: ./ include/ modules/proxy/ [ In reply to ]
Le 18/04/2021 à 19:45, Eric Covener a écrit :
>> The last hunk of r1877558 seems to be missing in this backport.
>>
>> @@ -2180,6 +2165,9 @@ static int proxy_http_handler(request_re
>>
>> /* Step Five: Receive the Response... Fall thru to cleanup */
>> status = ap_proxy_http_process_response(req);
>> + if (req->backend) {
>> + proxy_run_detach_backend(r, req->backend);
>> + }
>>
>> break;
>> }
>>
>> I guess that it is not intentional and should go to 2.4.x as well.
>> Anyone to confirm my supposition?
>
> The hook does not exist in 2.4.x so I think it's OK.
> The only reference to it is guarded with an MMN check to keep proxy_h2 common.
>

+1.
Thanks for the clarification. (and sorry for the noise)

CJ
Re: svn commit: r1885605 - in /httpd/httpd/branches/2.4.x: ./ include/ modules/proxy/ [ In reply to ]
On 4/18/21 10:00 PM, Yann Ylavic wrote:

>
>> The last comment from Rüdiger seems to have been left un-answered.
>
> Ah yes, sorry Rüdiger, somehow I missed that one.
> First for 2.4.x it's true, if !ap_filter_should_yield() then
> ap_filter_output_pending() will always be DECLINED.
> But ap_filter_should_yield() and ap_filter_output_pending() in 2.4.x
> are just some helpers in proxy_util to keep trunk and 2.4.x code
> aligned, not the real util_filter functions.
>
> For trunk though, there is the ssl_io_filter_coalesce() case where
> !ap_filter_should_yield() does not mean that
> ap_filter_output_pending() has nothing to do. That's because
> ssl_io_filter_coalesce() does not play the
> ap_filter_{setaside,reinstate}_brigade() game for now, even though it
> potentially retains data.
> So in r1879416 I made a band aid such that ssl_io_filter_coalesce()
> releases its data when it's called from ap_filter_output_pending(),

Why should ap_filter_output_pending() call ssl_io_filter_coalesce?
As far as I see ssl_io_filter_coalesce does not get added to
the pending_output_filters ring and its private filter brigade would need
to be non empty to get called. Or is it called indirectly?

Regards

Rüdiger
Re: svn commit: r1885605 - in /httpd/httpd/branches/2.4.x: ./ include/ modules/proxy/ [ In reply to ]
On Tue, Apr 20, 2021 at 12:40 PM Ruediger Pluem <rpluem@apache.org> wrote:
>
> On 4/18/21 10:00 PM, Yann Ylavic wrote:
>
> >
> > For trunk though, there is the ssl_io_filter_coalesce() case where
> > !ap_filter_should_yield() does not mean that
> > ap_filter_output_pending() has nothing to do. That's because
> > ssl_io_filter_coalesce() does not play the
> > ap_filter_{setaside,reinstate}_brigade() game for now, even though it
> > potentially retains data.
> > So in r1879416 I made a band aid such that ssl_io_filter_coalesce()
> > releases its data when it's called from ap_filter_output_pending(),
>
> Why should ap_filter_output_pending() call ssl_io_filter_coalesce?
> As far as I see ssl_io_filter_coalesce does not get added to
> the pending_output_filters ring and its private filter brigade would need
> to be non empty to get called. Or is it called indirectly?

So I made ssl_io_filter_coalesce() enter the pending_output_filters
ring in r1889938 but it's still not enough because when it's called
with an empty brigade (like ap_filter_output_pending() does),
ssl_io_filter_coalesce() still retains its data.
I could special-case the empty brigade so that
ssl_io_filter_coalesce() releases everything, but this does not
address the tunneling loop case in mod_proxy where we shouldn't call
ap_filter_output_pending() if ap_filter_should_yield() already (or we
risk blocking).

So my plan now is to define a new bucket type (WC, for Write
Completion) and use it for both ap_filter_output_pending() (instead of
the empty brigade) and ap_proxy_transfer_between_connections(), to
tell coalescing/buffering filters that they should pass their data.
Any metadata bucket will do for ssl_io_filter_coalesce(), but the
FLUSH bucket is a bit too much (could make the core output filter
block) so there is no existing one to (ab)use AFAICT.

This is the attached patch, WDYT?

The WC bucket could also help reintroduce THRESHOLD_MIN_WRITE
(FlushMinThreshold) which was removed from the core output filter in
trunk because (I think) it defeated the write completion
(setaside/reinstate) mechanism. Not in this patch, but if the WC
bucket sounds like a good plan, it could be a follow up..

Regards;
Yann.