Subject: http servers

From: Ges <[email-masked]>
Date: Mon, 11 Nov 2002 04:09:01 -0800 (PST)

Hi,

 I need to implement a web server for my project. I need help on httpd implementation. I would like to add http and ftp to my web server.

Regards

Ges

---------------------------------
Do you Yahoo!?
U2 on LAUNCH - Exclusive medley & videos from Greatest Hits CD

---

From: "Julian Reschke" <[email-masked]>
Date: Thu, 14 Nov 2002 13:26:31 +0100

Hi.

In section 3.11 [1], RFC2616 states:

"A "weak entity tag," indicated by the "W/" prefix, MAY be shared by two
entities of a resource only if the entities are equivalent and could be
substituted for each other with no significant change in semantics. A weak
entity tag can only be used for weak comparison."

In 13.3.3 [2], it gives the following example:

"An entity's modification time, if represented with one-second resolution,
could be a weak validator, since it is possible that the resource might be
modified twice during a single second."

Apache moddav indeed returns weak entity tags based on a filesystem
timestamp. However, as far as I understand there's no guarantee whatsoever
that two entities written within one second indeed can "be substituted for
each other with no significant change in semantics". So is this a bug or am
I missing something important?

Julian

[1] <http://greenbytes.de/tech/webdav/rfc2616.html#rfc.section.3.11>
[2] <http://greenbytes.de/tech/webdav/rfc2616.html#rfc.section.13.3.3>

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

---

From: Alex Rousskov <[email-masked]>
Date: Thu, 14 Nov 2002 09:09:27 -0700 (MST)

> I missing something important?

I guess you can call it a violation of the section 3.11 requirement.
Whether that violation is a bug depends on what Apache authors
intended to implement. I bet the code works as they intended.  Webdav
does not know about semantics so, ideally, it needs to generate strong
tags. However, there is a trade-off between code simplicity and tag
strength and it seems like Apache folks resolved this trade-off by
declaring a simple-to-implement tag "weak". I do not know whether they
knew about the requirement you cite; you may want to check source code
for insightful comments.

Please note that HTTP is designed in such a way that the above
violation is unlikely to cause problems with compliant implementations
because weak tag comparison is not used for potentially "dangerous"
operations such as merging of ranged responses. In other words, under
normal conditions, Apache users will not suffer from the deficiencies
of the code, provided webdav explicitly marks the tag as weak.

One can always come up with a corner case, of course. If the Web site
owner does not think that one second precision is good enough, it
should be relatively simple to patch the code to generate strong tags
instead (e.g., by appending a sufficiently long and sufficiently
random number to the timestamp). Using MD5 checksums would be even
better, but also more expensive.

This is my interpretation of the situation. I am neither an RFC editor
nor Apache developer.

HTH,

Alex.

-- 
                            | HTTP performance - Web Polygraph benchmark
www.measurement-factory.com | HTTP compliance+ - Co-Advisor test suite
                            | all of the above - PolyBox appliance

---

From: "Roy T. Fielding" <[email-masked]>
Date: Wed, 27 Nov 2002 15:40:46 -0800

> I missing something important?

No, it is just over-specification.  It is impossible for an HTTP server
to know the semantics of a representation.  However, if one representation
overwrites another such that both are valid responses to GET on the
same resource, then both are clearly intended to represent that resource.

What the spec is trying to say is that a weak etag cannot be used to
test for byte equivalence of the representation, unlike a strong etag.
The HTTP components don't need to know why.

Apache etags are configurable, so the resource owner can determine what
is sufficient for differentiation based on the resource implementation.
We used to include the system inode by default, but that proved harmful
for server farms using rsync or raid mirrors.

....Roy

---

From: "Julian Reschke" <[email-masked]>
Date: Thu, 28 Nov 2002 13:46:41 +0100

> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Roy T. Fielding
> Sent: Thursday, November 28, 2002 12:41 AM
> To: Julian Reschke
> Cc: [email-masked]
> Subject: Re: weak entity tags vs Apache moddav
> ..

Roy, thanks for the feedback...

> > that two entities written within one second indeed can be substituted
for
> > each other with no significant change in semantics". So is this a bug or
> > am I missing something important?
>

Yes.

> same resource, then both are clearly intended to represent that resource.

Sure. They are the same resource. But if the resource is modified multiple
times within a clock interval, the server (Apache) will return the same weak
entity tag, so user agents may not get the latest modification if they do a
conditional GET. I'd say that in the case where another client actually did
succeed to modifiy the resource twice (in the same clock interval) using
PUT, this is wrong.

> The HTTP components don't need to know why.

OK. So I conclude that a generic authoring client (one that has no concept
of semantically equivalent entities) MUST NOT use weak entitty tags to
protect itself from lost updates upon PUT. Correct?

> for server farms using rsync or raid mirrors.

Interesting.