Re: Metuxmpm test failed

-                                                 [email protected]
---------------------------------------------------------------------

On Mon, Oct 06, 2003 at 11:40:01AM +0400, Dmitry P. Schegolev wrote:
> -                                                 [email protected]
> ---------------------------------------------------------------------
> 
> > Yes. But it does some tricks, i.e. passing the whole socket.
> > We do not process the whole request in the multiplexer.
> 
> Who prevent us to use the same tricks in my model?
Okay, you could do it. But still both programm must speak exactly
the same protocol. It must be fitting bit-for-bit since there's no
more text encoding like http ...

Communication is not easy here: you must somehow set up the right
socket connections and prevent abuse/attacks. By having evrything in
one process tree, the sockets are simply inherited from the parent process.

<snip>
> > Yes, it is cleaner, but much slower. Your approach requires the whole
> > data to be passed over multiple process boundaries - this produces load.
> 
> From this point of view: we need to decrypt data. So it's not the same data, 
> as got from https socket. Then we need to pass it to another process. We 
> don't want to pass it through socket because of high load. Why we can't use 
> shared memory or the same tricks you mention above to do it?
You still have to do some signalling and also an shared memory buffer
management. This is still more than having evrything in the same process.

Well, if you really like, you could write an external filter module
for httpd which goes your way and the try out which one is faster ;-)

<snip>
> > > You don't want ssl? Omit ssl_handling_module in configuration!
> > > You don't want multiplexer? Omit it!
> >
> > Where's the difference from today ?
> 
> Today it is very hard to do any changes in apache because it all in one. We 
> can't insert multiplexer without breaking ssl or rewrite ssl code, as I see.
This problem cant be prevented as easy as you might think: the problem is,
we have to know/control where ssl handling is done. From an encrypted stream
you cannot see what vhost ist requested without decrypting it. So we have
to put the ssl handling into the mux. This also means, all certs must be
accessible by the mux user somehow.

Another conceptual problem we didnt really solve yet: is it possible to
use different certs on an ssl connection at all ? In other words:
is it ever possible having multiple vhosts with different certs sitting
on the same port ? Its not a question of apache or metuxmpm, its a question
of ssl (I didnt have the time yet to find it out)


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT services

 phone:     +49 36207 519931         www:       http://www.metux.de/     
 fax:       +49 36207 519932         email:     [email protected]
 cellphone: +49 174 7066481	     
---------------------------------------------------------------------
 Diese Mail wurde mit UUCP versandt.      http://www.metux.de/uucp/