November 2006 - tbnl-devel@common-lisp.net

[hunchentoot-devel] hunchentoot file upload performance
by Mac Chan 27 Dec '06

27 Dec '06

Hi all, I've been using tbnl behind mod_lisp2 for quite a while. After Edi merged tbnl with hunchentoot I wanted to get rid of apache and run hunchentoot in standalone mode for easier deployment (not to mention the coolness factor of running everything in lisp). However, I've found that the file upload performance of hunchentoot is 4-10 times slower than tbnl (standalone or behind mod_lisp). I tested this by uploading a 30mb file in the test upload page. I'm guessing that Chunga might be the reason, since this is the only new component introduced. [ Chunga is currently not optimized towards performance - it is rather intended to be easy to use and (if possible) to behave correctly.] On a side note, while the file is being uploaded the cpu will go up to 90-100% (This happens to both tbnl and hunchentoot). This is not the case when I upload the same file to a php script w/ apache. Again, my guess is that rfc2388 repeatedly call read-char instead of grabbing a buffer with read-sequence and decode it as a chunk. These two issues make migrating to hunchentoot particular painful because if one of the users uploads a huge file the whole site will become very unresponsive (in tbnl the cpu spike goes away a lot faster, but improving the i/o routine is still a big win). I don't want to blindly guess, but I don't know how to use lispworks' profiler to profile a multi-threaded server app. The lispworks profiler requires you to run (profile <forms>) and it will return the profiling data after running the <form>. Is there a way to profile hunchentoot without writing individual test case that simulates uploading a 30 mb file? What about people using sbcl? How do you go about profiling apps like hunchentoot? Thanks.

2 5

[hunchentoot-devel] Expired sessions
by Nico de Jager 01 Dec '06

01 Dec '06

Hi How do I get rid of expired sessions in hunchentoot without deleting valid sessions ("reset-sessions" invalidates and destroys all sessions)? When looking at the sessions returned by "do-sessions", it seems that expired sessions are only removed once a user tries to reuse the expired session. But what if the user never revisits the site, will his/her expired session remain in the session list? (Or remain at least until the next call to "reset-sessions", which will also delete active sessions). How do I identify expired sessions when traversing the sessions with "do-session", or do I have to manually keep track of this? Thanks. Nico

2 6

[hunchentoot-devel] Progress with SSL
by Jeffrey Cunningham 01 Dec '06

01 Dec '06

I've made some progress with my stand-alone server using SSL but still can't quite get it to work. I'm hoping someone will have an new idea. I finally figured out how to correctly generate the CA files without passwords. I start the server like this: (hunchentoot:start-server :port 4000 :ssl-certificate-file "CA3/ca-cert.pem" :ssl-privatekey-file "CA3/private/ca-key.pem") When I point a browser at the url https://achilles.olympus.net:4000/test it brings up a dialog box asking if I want to accept this unrecognized certificate. I say "yes" and it then times out after about fifteen seconds without producing any html. I know it is going through the test html generator because I added a log-messages statement in it and it writes my message to the log. And I know the html generator works alright because if I run the same server without SSL it generates the test page as it should. Any ideas? Regards, --Jeff

2 3

[hunchentoot-devel] How to enable directory browsing?
by vedm 26 Nov '06

26 Nov '06

When I point the browser to a directory, I want to see a list of the files in that directory - how can I do this with hunchentoot? -- vedm

4 3

[hunchentoot-devel] How do I run a standalone server on port 80?
by Jeffrey Cunningham 25 Nov '06

25 Nov '06

I've been bothering Edi in a private email thread that really should have been directed to the list (sorry Edi). Here's the thread: > On Fri, 24 Nov 2006 08:36:33 -0800, Jeffrey Cunningham <jeffrey(a)cunningham.net> wrote: > > > You say something in your comments about SETUID and SETGID on the > > process to something other than root, but I don't know how to do > > that other than write a little C-code. Is there another way? If I > > understand you correctly, the idea would be to launch the server as > > root, then change the UID and GID for the running process. > > http://weitz.de/hunchentoot/#start-server > Yes, those were the comments I was referring to : "On Unix you can use setuid and setgid to change the UID and GID of the process directly after the server has been started. (You might want to do this if you're using a privileged port like 80.) setuid and setgid can be integers (the actual IDs) or strings (for the user and group name respectively)." Forgive me if this is obvious, but I don't understand. In order to start the server from lisp running as a regular user, I have to specify a port. If I specify :port 80, it fails with an error message that the port is priviliged. So, I don't see how I could change setuid and setgid "after the server has been started". I see that in the UNIX package there are two functions: 'setuidexec and 'setgidexec. Would it work to call these *before* starting the server? I apologize for taking so much of your time. Regards, -Jeff I think maybe I figured it out. I should start the server from lisp running as root, but using setuid and setgid values for a non-privileged user. I was looking at your code and it appears you switch them after the server has started. One of the things I really like about your server is the ability to hack the handler code on the fly while the server is operating. Wouldn't this be a little dangerous if I have to run from lisp as root? --Jeff

2 2

[hunchentoot-devel] Re: setuid/setgid
by Edi Weitz 25 Nov '06

25 Nov '06

On Fri, 24 Nov 2006 11:28:27 -0800, Jeffrey Cunningham <jeffrey(a)cunningham.net> wrote: > I think maybe I figured it out. I should start the server from lisp > running as root, but using setuid and setgid values for a > non-privileged user. I was looking at your code and it appears you > switch them after the server has started. > > One of the things I really like about your server is the ability to > hack the handler code on the fly while the server is > operating. Wouldn't this be a little dangerous if I have to run from > lisp as root? [Please use the mailing list.] Once you've called START-SERVER with setuid/setgid, you're no longer root, so to say.

1 0

[hunchentoot-devel] setuid/setgid
by Edi Weitz 25 Nov '06

25 Nov '06

On Fri, 24 Nov 2006 11:14:51 -0800, Jeffrey Cunningham <jeffrey(a)cunningham.net> wrote: > On Fri Nov 24, 2006 at 06:41:07PM +0100, Edi Weitz wrote: >> On Fri, 24 Nov 2006 08:36:33 -0800, Jeffrey Cunningham <jeffrey(a)cunningham.net> wrote: >> >> > You say something in your comments about SETUID and SETGID on the >> > process to something other than root, but I don't know how to do >> > that other than write a little C-code. Is there another way? If I >> > understand you correctly, the idea would be to launch the server >> > as root, then change the UID and GID for the running process. >> >> http://weitz.de/hunchentoot/#start-server > > Yes, those were the comments I was referring to : > > "On Unix you can use setuid and setgid to change the UID and GID of > the process directly after the server has been started. (You might > want to do this if you're using a privileged port like 80.) setuid > and setgid can be integers (the actual IDs) or strings (for the user > and group name respectively)." > > Forgive me if this is obvious, but I don't understand. In order to > start the server from lisp running as a regular user, I have to > specify a port. If I specify :port 80, it fails with an error > message that the port is priviliged. So, I don't see how I could > change setuid and setgid "after the server has been started". I see > that in the UNIX package there are two functions: 'setuidexec and > 'setgidexec. Would it work to call these *before* starting the > server? [Please use the mailing list.] You start the Lisp image as root, load Hunchentoot, then call START-SERVER with the corresponding setuid/setgid arguments. That's basically how Apache and other apps do it as well (or AllegroServe). Cheers, Edi.

1 0

Re: [hunchentoot-devel] Using SSL
by Edi Weitz 23 Nov '06

23 Nov '06

[Please use the mailing list.] On Thu, 23 Nov 2006 13:16:49 -0800, Jeffrey Cunningham <jeffrey(a)cunningham.net> wrote: > On Thu Nov 23, 2006 at 09:27:31PM +0100, Edi Weitz wrote: >> >> Is the private key associated with a password? > > No - no password. > >> Are you sure the files are found? Did you try with absolute >> pathnames? > > I just tried with absolute pathnames with no change. Then I > deliberately misspelled the filenames and tried again, this time it > gave me "Connection reset while page loading" error in Mozilla and > the log showed this error: > > [2006-11-23 13:13:55 [ERROR]] Error while processing connection: SSL initialization error: Can't load RSA private key ~A > > So I think its finding the files. > >> Which Lisp implementation are you using? > > CMUCL 19d Hmm, I don't think I ever tested SSL with CMUCL. The code is based on CL+SSL which is supposed to work with CMUCL, though. But it's FFI code, you never know... :) Do you have a chance to try with another Lisp (SBCL, LispWorks, AllegroCL) and the same key files? Sorry, I don't have another idea ATM. Cheers, Edi.

1 0

[hunchentoot-devel] Using SSL
by Jeffrey Cunningham 23 Nov '06

23 Nov '06

Hi all; I'm trying to understand how SSL works with hunchentoot. I set up a CA for the domain 'achilles.olympus.net' following the openssl documentation which produced the public key cacert.pem and the private key private/cakey.pem. Then I started up a server as follows: (hunchentoot:start-server :port 4243 :ssl-certificate-file "ca-cert.pem" :ssl-privatekey-file "private/ca-key.pem") When I browse to the url: https://achilles.olympus.net:4243/test It times out with "Done" and a blank page (no html, no text). If I start the same server eithout the SSL certificates on port 4242 and browse the page: http://achilles.olympus.net:4242/test It works perfectly (produces my test page as I coded it). My understanding of SSL is pretty limited. Is there something obvious I'm doing wrong? The log entry is unilluminating: [2006-11-23 10:42:17] 192.168.1.13 - "GET /test HTTP/1.1" 200 680 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko /20060417" Thanks for any help. --Jeff

2 1

[hunchentoot-devel] A simple way to handle logins?
by Vamsee Kanakala 23 Nov '06

23 Nov '06

Hi, Currently I'm using a simple method to handle logins in Hunchentoot - set the user object when the user logs in, and check for it at the beginning of a function whichever needs to have the credentials, or redirect to login page. However, most of my functions would require the login-check method to be run before they display the page. I'm guessing there should be a way to define a handler which takes all the requests, runs login function and then sends the request to the appropriate handler. Perhaps I should read the documentation more thoroughly, though I'd appreciate any tips which would make it easier. Thanks, Vamsee.

3 2