headers
Matt | 4 Aug 2009 16:53

FastCGI security consultants

Gday,

Just after a security consultant or security consulting company who can pour over my code and examine our
setup and make
recommendations as well as point out pitfalls to avoid. They would need to be technically proficient in:
* Linux
* Apache
* FastCGI
* C++
* PHP
* SSI
* HTML
* Javascript

Any help would be greatly appreciated.

Thanks,
Matt
Permalink | Reply | 0 comments |
headers
Will Hawes | 7 Aug 2009 12:26
Picon

Building mod_fastcgi as a DSO on Windows

Having had various issues with binary releases of mod_fastcgi.dll, I
thought I'd have a go at building my own from source to see if that
makes any difference. I'm trying to build mod_fastcgi for Apache 2.2
on Windows.

I've downloaded the mod_fastcgi sources from
http://www.fastcgi.com/dist/mod_fastcgi-SNAP-0811090952.tar.gz and am
following the instructions in the INSTALL.AP2 file under "WIN":

    To build mod_fastcgi as a project you'll need M$ VC++ 6.0 (the Makefile
    hasn't been updated for AP2 support):

    Open the mod_fastcgi project file with the VC++.

    Edit the Project for your configuration (update the Preprocessor
    and the Link paths). The default assumes a complete Apache2
    installation in /Apache2.

    Build mod_fastcgi.so.

When trying to open the project file in Visual C++ 6.0 Standard
Edition, I get the following message:

"A corresponding workspace
'C:\work\mod_fastcgi-SNAP-0811090952\Win32\mod_fastcgi-AP2.dsw' has
been found and will be opened instead of the specified project
'C:\work\mod_fastcgi-SNAP-0811090952\Win32\mod_fastcgi-AP2.dsp'.

Note: If you wish to create a workspace containing only the specified
project, you can do so by creating a blank workspace with the
(Continue reading)

Permalink | Reply | 1 comment |
headers
Will Hawes | 7 Aug 2009 12:40
Picon

Re: Building mod_fastcgi as a DSO on Windows

2009/8/7 Will Hawes <wdhawes@...>:
> Having had various issues with binary releases of mod_fastcgi.dll, I
> thought I'd have a go at building my own from source to see if that
> makes any difference. I'm trying to build mod_fastcgi for Apache 2.2
> on Windows.

Following on from my last message, I found
http://www.fastcgi.com/mod_fastcgi/INSTALL and noticed that it
mentions building mod_fastcgi from the command line.

I did the following:

1) Downloaded the Win32 source for Apache 2.2 from
http://apache.mirror.rbftpnetworks.com/httpd/httpd-2.2.12-win32-src.zip.
2) Extracted it to C:\work\httpd-2.2.12
3) Edited APACHE_SRC_DIR in Makefile.nt to point to C:\work\httpd-2.2.12.
4) Ran "nmake -f Makefile.nt CFG=release".

I got the following output:

C:\work\mod_fastcgi-SNAP-0811090952\Win32>nmake -f Makefile.nt CFG=release

Microsoft (R) Program Maintenance Utility   Version 1.50
Copyright (c) Microsoft Corp 1988-94. All rights reserved.

Makefile.nt(71) : fatal error U1088: invalid separator '::' on inference rule
Stop.

There are several instances of "::" in Makefile.nt. I tried altering
these to a single ":" instead on the offchance it would make a
(Continue reading)

Permalink | Reply | 0 comments |
headers
Eduard Bareev | 10 Aug 2009 17:29
Picon

newbie question, help heeded

Hi!
I trying to develop highspeed web-service and i have some questions, and also i am not c++ programmer and this is my first cpp project.

I have this following code:
---------------------------------------------------------

#include <string>
#include "fcgi_stdio.h"
#include <stdlib.h>
#include <iostream>

void handle(FCGX_Request request){
        FCGX_FPrintF(request.out, "Content-type: text/html\r\n\r\n<TITLE>fastcgi</TITLE>\n<H1>Fastcgi: Hello world!</H1>\n");
}

int main(int argc, char* const argv[] )
{
    std::string port=":9001";       
    int listenQueueBacklog = 400;   
    FCGX_Stream *in, *out, *err;
    FCGX_ParamArray envp;
   
    if(FCGX_Init())    exit(1);

    int listen_socket = FCGX_OpenSocket(port.c_str(), listenQueueBacklog);
    if(listen_socket < 0)    exit(1);

    FCGX_Request request;
    if(FCGX_InitRequest(&request,  listen_socket, 0)) exit(1);

    int reqCounter = 0;
    while(FCGX_Accept_r(&request) == 0)
    {
        handle(request);
        reqCounter++;
        FCGX_FPrintF(request.out, "\n\r\n\r counter: %d", reqCounter);
        FCGX_Finish_r(&request);
    }
    return 0;
}
---------------------------------------------------------

It works good listening 9001 port and serving resquests from nginx http server. I choose fcgi_stdio beacuse it can listen on tcp socket and it is more simple to integrate all this stuff with nginx web server.

But how can i read post fields?
Anyone, please point to an example of accessing and parsing post data, setting cookies, and other web stuff! I can't find any tutorials or examples on the internet!

Thanks!

--
Eduard Bareev
eduard-ftHL0UKbBOSHXe+LvDLADg@public.gmane.org
_______________________________________________
FastCGI-developers mailing list
FastCGI-developers@...
http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
Permalink | Reply | 1 comment |
headers
Aron Szabo | 11 Aug 2009 18:12

Re: newbie question, help heeded

Hi!

There is a patch that implements post parsing, but was not added yet(?)

Check this out:

http://www.fastcgi.com/archives/fastcgi-developers/2009-March/000200.html

    if( !strcmp(request_method, "POST")
    && content_length_i > 0
    && !strcmp(content_type, "application/x-www-form-urlencoded")
    ) {
    buffer = Malloc(content_length_i + 1);
    if (buffer) {
        while (readed < content_length_i) {
            readed += FCGX_GetStr(buffer + readed, 10000, request->in);
        };
        *(buffer + content_length_i) = 0;
            request->postParamsPtr = 
GenerateParamFromWebEscapedString(buffer);
        free(buffer); buffer = NULL;
        if (request->postParamsPtr) request->postp = 
request->postParamsPtr->vec;
    } else {
        return ENOMEM;
        };
    };

Good luck,
Aron

Eduard Bareev wrote:
> Hi!
> I trying to develop highspeed web-service and i have some questions, 
> and also i am not c++ programmer and this is my first cpp project.
>
> I have this following code:
> ---------------------------------------------------------
> #include <string>
> #include "fcgi_stdio.h"
> #include <stdlib.h>
> #include <iostream>
>
> void handle(FCGX_Request request){
>         FCGX_FPrintF(request.out, "Content-type: 
> text/html\r\n\r\n<TITLE>fastcgi</TITLE>\n<H1>Fastcgi: Hello 
> world!</H1>\n");
> }
>
> int main(int argc, char* const argv[] )
> {
>     std::string port=":9001";       
>     int listenQueueBacklog = 400;   
>     FCGX_Stream *in, *out, *err;
>     FCGX_ParamArray envp;
>    
>     if(FCGX_Init())    exit(1);
>
>     int listen_socket = FCGX_OpenSocket(port.c_str(), 
> listenQueueBacklog);
>     if(listen_socket < 0)    exit(1);
>
>     FCGX_Request request;
>     if(FCGX_InitRequest(&request,  listen_socket, 0)) exit(1);
>
>     int reqCounter = 0;
>     while(FCGX_Accept_r(&request) == 0)
>     {
>         handle(request);
>         reqCounter++;
>         FCGX_FPrintF(request.out, "\n\r\n\r counter: %d", reqCounter);
>         FCGX_Finish_r(&request);
>     }
>     return 0;
> }
> ---------------------------------------------------------
>
> It works good listening 9001 port and serving resquests from nginx 
> http server. I choose fcgi_stdio beacuse it can listen on tcp socket 
> and it is more simple to integrate all this stuff with nginx web server.
>
> But how can i read post fields?
> Anyone, please point to an example of accessing and parsing post data, 
> setting cookies, and other web stuff! I can't find any tutorials or 
> examples on the internet!
>
> Thanks!
>
> -- 
> Eduard Bareev
> eduard@... <mailto:eduard@...>
> ------------------------------------------------------------------------
>
> _______________________________________________
> FastCGI-developers mailing list
> FastCGI-developers@...
> http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
>
Permalink | Reply | 0 comments |
headers
Mike C | 12 Aug 2009 05:39

Protocol: Scope of requestID


I have a question about how a FastCGI record's requestID is assigned to guarantee uniqueness over multiple
TCP connections to the same responder.

In short, is the requestID chosen by the webserver server then issued to the FastCGI process unique to the
TCP connection or is it unique to the FastCGI process?

As an example, if there is a FastCGI responder running on 127.0.0.1:10000 and there are two TCP connections
currently open, is it possible that in each connection there could be two identical requestIDs being used
for different http requests?

My intuition would be that no web server should issue two identical requestIDs at the same time regardless
of TCP connection or FastCGI process, but I can't find this documented explicitly.

-Mike

_________________________________________________________________
More storage. Better anti-spam and antivirus protection. Hotmail makes it simple.
http://go.microsoft.com/?linkid=9671357
Permalink | Reply | 1 comment |
headers
Bo Lindbergh | 12 Aug 2009 08:27

Re: Protocol: Scope of requestID

2009-08-12 kl. 05.39 skrev Mike C:
>
> I have a question about how a FastCGI record's requestID is  
> assigned to guarantee uniqueness over multiple TCP connections to  
> the same responder.
>
> In short, is the requestID chosen by the webserver server then  
> issued to the FastCGI process unique to the TCP connection or is it  
> unique to the FastCGI process?
>
> As an example, if there is a FastCGI responder running on  
> 127.0.0.1:10000 and there are two TCP connections currently open,  
> is it possible that in each connection there could be two identical  
> requestIDs being used for different http requests?
>
> My intuition would be that no web server should issue two identical  
> requestIDs at the same time regardless of TCP connection or FastCGI  
> process, but I can't find this documented explicitly.

The specification says "the application keeps track of the current state
of each request ID on a given transport connection", which I interpret
as request ids being per connection.

/Bo Lindbergh
Permalink | Reply | 0 comments |
headers
Farcet Jerome | 6 Aug 2009 14:53
Picon

mod_fcgi on HP-Ux

Hello,

We would like to use mod_fcgi with  apache server on HP-UX 11iv2 on itanium 64b platform. I did not found any testimony of the availability or previous experience  on this kind platform.

Hp support was not able to say if it was possible.

Do you know if that will be possible to do that ?

Thanks in advance for your reply,

Bests regards,

Jerome FARCET

_______________________________________________
FastCGI-developers mailing list
FastCGI-developers@...
http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
Permalink | Reply | 1 comment |
headers
Ricardo Sal | 10 Aug 2009 19:15
Picon

Re: FastCGI-developers Digest, Vol 13, Issue 3

Hi,

I think you just won the lottery because i have implemented this recently and had the same problem.
Lucky for you, you get an answer with what you need.

1º read this page
http://www.fastcgi.com/devkit/doc/fcgi-spec.html#S2.3

These are some sniff and screen shots in attach with the data been transferred between a test web server with fastcgi enabled and php-cgi.exe in listening mode.

Feel free to ask whatever you need since i have implement all the protocol with my hands :)
The implementation isn't hard, and with this data you will be able to start.

regards


On Mon, Aug 10, 2009 at 5:00 PM, <fastcgi-developers-request-xGejAJT2w6xVgU18Zptdi8XXUOn6P5/W@public.gmane.orgom> wrote:
Send FastCGI-developers mailing list submissions to
       fastcgi-developers-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org

To subscribe or unsubscribe via the World Wide Web, visit
       http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
or, via email, send a message with subject or body 'help' to
       fastcgi-developers-request-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org

You can reach the person managing the list at
       fastcgi-developers-owner-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of FastCGI-developers digest..."


Today's Topics:

  1. newbie question, help heeded (Eduard Bareev)


----------------------------------------------------------------------

Message: 1
Date: Mon, 10 Aug 2009 19:29:48 +0400
From: Eduard Bareev <eduard <at> bareev.ru>
Subject: [FASTCGI] newbie question, help heeded
To: fastcgi-developers-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org
Message-ID:
       <ba3c638b0908100829y662316bdpe68b9f5b8aea1d40 <at> mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"

Hi!
I trying to develop highspeed web-service and i have some questions, and
also i am not c++ programmer and this is my first cpp project.

I have this following code:
---------------------------------------------------------
#include <string>
#include "fcgi_stdio.h"
#include <stdlib.h>
#include <iostream>

void handle(FCGX_Request request){
       FCGX_FPrintF(request.out, "Content-type:
text/html\r\n\r\n<TITLE>fastcgi</TITLE>\n<H1>Fastcgi: Hello world!</H1>\n");
}

int main(int argc, char* const argv[] )
{
   std::string port=":9001";
   int listenQueueBacklog = 400;
   FCGX_Stream *in, *out, *err;
   FCGX_ParamArray envp;

   if(FCGX_Init())    exit(1);

   int listen_socket = FCGX_OpenSocket(port.c_str(), listenQueueBacklog);
   if(listen_socket < 0)    exit(1);

   FCGX_Request request;
   if(FCGX_InitRequest(&request,  listen_socket, 0)) exit(1);

   int reqCounter = 0;
   while(FCGX_Accept_r(&request) == 0)
   {
       handle(request);
       reqCounter++;
       FCGX_FPrintF(request.out, "\n\r\n\r counter: %d", reqCounter);
       FCGX_Finish_r(&request);
   }
   return 0;
}
---------------------------------------------------------

It works good listening 9001 port and serving resquests from nginx http
server. I choose fcgi_stdio beacuse it can listen on tcp socket and it is
more simple to integrate all this stuff with nginx web server.

But how can i read post fields?
Anyone, please point to an example of accessing and parsing post data,
setting cookies, and other web stuff! I can't find any tutorials or examples
on the internet!

Thanks!

--
Eduard Bareev
eduard-ftHL0UKbBOSHXe+LvDLADg@public.gmane.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.pins.net/mailman/private.cgi/fastcgi-developers/attachments/20090810/99d4f519/attachment-0001.html>

------------------------------

_______________________________________________
FastCGI-developers mailing list
FastCGI-developers <at> mailman.fastcgi.com
http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers


End of FastCGI-developers Digest, Vol 13, Issue 3
*************************************************

Attachment (Upload php.rar): application/octet-stream, 304 KiB
_______________________________________________
FastCGI-developers mailing list
FastCGI-developers@...
http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
Permalink | Reply | 6 comments |
headers
Matt | 12 Aug 2009 22:41

Re: mod_fcgi on HP-Ux

Hello there,
 
I'm succesfully running FastCGI on a 64bit environment:
[root <at> stagingarea ~]# uname -s -r -v -m -p -i -o
Linux 2.6.18-128.1.16.el5 #1 SMP Tue Jun 30 06:07:26 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
[root <at> stagingarea ~]# cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 26
model name      : Intel(R) Xeon(R) CPU           E5520  <at> 2.27GHz
stepping        : 5
cpu MHz         : 2259.864
cache size      : 8192 KB
fpu             : yes
fpu_exception   : yes
cpuid level     : 11
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss syscall nx rdtscp lm constant_tsc up ida nonstop_tsc pni cx16 popcnt lahf_lm
bogomips        : 4525.89
clflush size    : 64
cache_alignment : 64
address sizes   : 40 bits physical, 48 bits virtual
power management: [8]
 
[root <at> stagingarea ~]#
 
If you search the archives or subscribe to the newsgroup to access earlier postings(2/7/2009) there was a Japanese group who were running FastCGI on Windows 64bit and had contributed a patch as well.
 
Regards,
Matt
 
----- Original Message -----
Sent: Thursday, August 06, 2009 10:53 PM
Subject: [FASTCGI] mod_fcgi on HP-Ux

Hello,

We would like to use mod_fcgi with  apache server on HP-UX 11iv2 on itanium 64b platform. I did not found any testimony of the availability or previous experience  on this kind platform.

Hp support was not able to say if it was possible.

Do you know if that will be possible to do that ?

Thanks in advance for your reply,

Bests regards,

Jerome FARCET

_______________________________________________
FastCGI-developers mailing list
FastCGI-developers-xGejAJT2w6xVgU18Zptdi0EOCMrvLtNR@public.gmane.org
http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
_______________________________________________
FastCGI-developers mailing list
FastCGI-developers@...
http://mailman.pins.net/mailman/listinfo.cgi/fastcgi-developers
Permalink | Reply | 0 comments |

Gmane