tbnl-devel

tbnl-devel@common-lisp.net

865 discussions

Re: [hunchentoot-devel] Using SSL
by Edi Weitz 23 Nov '06

23 Nov '06

[Please use the mailing list.] On Thu, 23 Nov 2006 13:16:49 -0800, Jeffrey Cunningham <jeffrey(a)cunningham.net> wrote: > On Thu Nov 23, 2006 at 09:27:31PM +0100, Edi Weitz wrote: >> >> Is the private key associated with a password? > > No - no password. > >> Are you sure the files are found? Did you try with absolute >> pathnames? > > I just tried with absolute pathnames with no change. Then I > deliberately misspelled the filenames and tried again, this time it > gave me "Connection reset while page loading" error in Mozilla and > the log showed this error: > > [2006-11-23 13:13:55 [ERROR]] Error while processing connection: SSL initialization error: Can't load RSA private key ~A > > So I think its finding the files. > >> Which Lisp implementation are you using? > > CMUCL 19d Hmm, I don't think I ever tested SSL with CMUCL. The code is based on CL+SSL which is supposed to work with CMUCL, though. But it's FFI code, you never know... :) Do you have a chance to try with another Lisp (SBCL, LispWorks, AllegroCL) and the same key files? Sorry, I don't have another idea ATM. Cheers, Edi.

1 0

[hunchentoot-devel] Using SSL
by Jeffrey Cunningham 23 Nov '06

23 Nov '06

Hi all; I'm trying to understand how SSL works with hunchentoot. I set up a CA for the domain 'achilles.olympus.net' following the openssl documentation which produced the public key cacert.pem and the private key private/cakey.pem. Then I started up a server as follows: (hunchentoot:start-server :port 4243 :ssl-certificate-file "ca-cert.pem" :ssl-privatekey-file "private/ca-key.pem") When I browse to the url: https://achilles.olympus.net:4243/test It times out with "Done" and a blank page (no html, no text). If I start the same server eithout the SSL certificates on port 4242 and browse the page: http://achilles.olympus.net:4242/test It works perfectly (produces my test page as I coded it). My understanding of SSL is pretty limited. Is there something obvious I'm doing wrong? The log entry is unilluminating: [2006-11-23 10:42:17] 192.168.1.13 - "GET /test HTTP/1.1" 200 680 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko /20060417" Thanks for any help. --Jeff

2 1

[hunchentoot-devel] A simple way to handle logins?
by Vamsee Kanakala 23 Nov '06

23 Nov '06

Hi, Currently I'm using a simple method to handle logins in Hunchentoot - set the user object when the user logs in, and check for it at the beginning of a function whichever needs to have the credentials, or redirect to login page. However, most of my functions would require the login-check method to be run before they display the page. I'm guessing there should be a way to define a handler which takes all the requests, runs login function and then sends the request to the appropriate handler. Perhaps I should read the documentation more thoroughly, though I'd appreciate any tips which would make it easier. Thanks, Vamsee.

3 2

[hunchentoot-devel] Re: Missing functions in Hunchentoot 0.4.10?
by Edi Weitz 21 Nov '06

21 Nov '06

Hi Dominic! Please use the mailing list. On Sun, 19 Nov 2006 22:40:43 +0000, "lisp" <lisp(a)spikeisland.com> wrote: > I've just downloaded the latest Hunchentoot 0.4.10 but noticed that > there seem to be a couple of functions missing: > > The following functions are undefined: HUNCHENTOOT::OCTETS-TO-STRING > which is referenced by HUNCHENTOOT:URL-DECODE > HUNCHENTOOT::STRING-TO-OCTETS which is referenced by > HUNCHENTOOT::COMPUTE-LENGTH and HUNCHENTOOT:URL-ENCODE > > As a result of this (or something else) the test samples aren't > working. Looks like you're using an old version of FLEXI-STREAMS. See the note about library versions here: http://weitz.de/hunchentoot/#install > As an aside, do you know if anyone is looking at whether UCW can be > run on top of Hunchentoot? Don't know. Have you asked on their mailing list? Cheers, Edi.

2 2

[hunchentoot-devel] serve-event support for SBCL and CLISP
by Luís Oliveira 20 Nov '06

20 Nov '06

Hello, I've added a new keyword argument :MODE to START-SERVER that can be one of :THREADED or :SERVE-EVENT and implemented serve-event support for SBCL and CLISP. This is a preliminary patch. No real-world testing or documentation yet. It might however already be useful for people doing development on, e.g., SBCL/OSX. In CLISP's case, you have to run (hunchentoot:clisp-serve-events) to for the server(s) to actually run and handle requests. By the way, should anyone deploy a server using serve-event, make sure to run it behind a reverse proxy such as Apache's mod_proxy or Pound otherwise a client with a slow connection will stall all the other clients. Also, regarding CLISP, it complains about WRITE-SEQUENCEing a sequence of (unsigned-byte 8) to a flexi-stream with a character element-type. See the START-OUTPUT function in headers.lisp towards the end. Not sure if that was the best fix or whether it should be conditionalized for CLISP. Comments welcome. -- Luís Oliveira http://student.dei.uc.pt/~lmoliv/

2 4

Re: [hunchentoot-devel] *http-error-handler* behaviour
by Edi Weitz 19 Nov '06

19 Nov '06

On Fri, 17 Nov 2006 07:56:02 +0100, "Marijn Haverbeke" <marijnh(a)gmail.com> wrote: [Please use the mailing list.] > I hadn't seen aux-request-value yet -- that would definitely be > better than a dynamic variable. But I'm still not crazy about the > way the *http-error-handler* just kicks in when the headers are > being sent. All the other stuff in my app neatly fetches an output > stream, and then writes its body to it, but for non-200 pages the > library just refuses to let me do this. (Which means I can't use my > very nice function for filling and writing a template in this case.) > Seems a bit arbitrary. It was intended as a simple solution at a time when there was no customized error handling at all: http://common-lisp.net/pipermail/tbnl-devel/2005-March/000197.html I still think it is OK as far as it is in line with the way "normal" content is handled in Hunchentoot. The only real difference I can see is that you can't write directly to a stream. Why you can't use your nice function escapes me, though. You could capture its output in a string stream, couldn't you? If you come up with a solution that obviously improves the current situation, I'd be happy to include your patches. Bonus points if the new stuff is compatible with the old code. And note that a patch which changes user-visible behaviour should include documentation as well - I might otherwise reject it. Cheers, Edi.

2 4

[hunchentoot-devel] Socket timeout issues
by Toby 18 Nov '06

18 Nov '06

Hi all I'm having some trouble with connection timeouts. I'm writing an AJAX application where I need to push values from the server to the client at random times (it's a chat application.) To avoid polling the server every second, I wrote it like this, to exploit hanging connections: - the client opens a connection with XMLHttpRequest - the server doesn't respond (the handler waits on a condition variable), keeping the connection hanging - when the server has data to send (new lines of chat) it does so, and: - the client receives the data, closes the connection and starts over - if the connection timeouts (on either end), the client starts over This method worked beautifully on SBCL + TBNL + mod_lisp2 + Apache2, on any browser. It gave me the lowest possible lag (equal to the network latency) with very little network overhead. Now on SBCL 0.9.17 + Hunchentoot 0.4.9 I'm having trouble with the Opera browser (and possibly others: I've only tested it on Opera and Firefox.) By the way, Firefox doesn't seem to have any connection timeout: I've seen it receive a response after a (sleep 1800), without any packet sent by either side in half an hour! Anyway I've used a sniffer to understand what's going on. Usually, when the connection times out client-side, these packets are exchanged: C -> S ACK FIN ( C <- S ACK ) C <- S ACK FIN C -> S ACK This way both sides agree that the connection is over. But on SBCL + Hunchentoot vs. Opera, after 2 minutes the client times out and I see the following exchange: C -> S ACK FIN C <- S ACK I can't make sense of it: why does the server acknowledge the FIN packet but fail to send its own? As a result the client thinks it's almost over... enough not to accept any data from the same connection again, but not enough to stop spinning and fire the XMLHttpRequest callback (which would open a new connection.) Even worse, the server thinks it's still open, so it will send any new data on that wire. But the data won't be accepted by the client, which will send a RST as soon as it sees stuff coming from a 'dead' connection. Help! Toby PS: All these tests were done with :read-timeout nil Maybe I should set it to 119 and forget about it :-)

2 2

[hunchentoot-devel] *http-error-handler* behaviour
by Marijn Haverbeke 16 Nov '06

16 Nov '06

Hi, The way in which reply bodies are currently made when a non-200 response code is set seems a little inconvenient. When no *http-error-handler* is set, a standard body is given, and when a handler is set it is expected to generate a body. I was creating a system where bad requests can be signalled with conditions, which contain an error message that should be given to the user, and which I was going to render by first calling send-headers and then writing an html-templates template to the resulting stream... but my efforts were frustrated by the fact that send-headers calls start-output, which dumbly generates a body when an error code is set, and the *http-error-handler* is a rather clumsy way to hook into this -- it doesn't know anything about the context of the error, and communicating to it by using a dynamic variable is rather ugly. Maybe an extra argument to (setf return-code) which suppresses the generating of a standard body would be a nicer way to allow people to customize their error messages. (Or maybe having an accessors setf form take different arguments from its normal form is very bad style. -- Another way could be to leave response-code the way it is, default to not replacing the body in case of non-200 code, and add another function which sets the response-code and also enables the body-replacing functionality for that request.) Regards, Marijn Haverbeke

2 1

[hunchentoot-devel] header(s)-out
by Robert J. Macomber 12 Nov '06

12 Nov '06

[oops, originally sent this to tbnl@... hope that's not a different list or person. Hasn't bounced in any case.] There seems to be some small bugs involving header-out. The accessor is documented to take both keywords and strings, but neither works reliably because: The reader will use string-equal if given a string and eq if given a symbol, because of the assoc shadowing in the hunchentoot package. This will find what it's looking for if it's given a string or if it's given a keyword _and_ the header entry was originally created with a keyword. The writer will do the same, so it's possible to have two different entries for any given header in the headers-out list, one for a string entry and one for a symbol. (The code _looks_ like it does the right thing, but if "name" is a symbol, it calls the symbol-specialized version of assoc which ignores its test argument). Finally, if a header-out entry is created with a symbol, response generation fails because it uses write-string (or write-line with mod-lisp) to output the header name, and they don't take string designators. Here's a patch which normalizes things so the keys of this alist are always strings and the lookup is always done with strings. It uses string-capitalize to convert keywords when storing in order to make them have conventional HTTP header capitalization. --- hunchentoot-0.4.8.orig/reply.lisp 2006-11-05 15:55:06.000000000 -0700 +++ hunchentoot-0.4.8/reply.lisp 2006-11-08 15:40:15.000000000 -0700 @@ -115,7 +115,7 @@ (defun header-out (name &optional (reply *reply*)) "Returns the current value of the outgoing http header named NAME. NAME should be a keyword or a string." - (cdr (assoc name (headers-out reply)))) + (cdr (assoc (string name) (headers-out reply)))) (defun cookie-out (name &optional (reply *reply*)) "Returns the current value of the outgoing cookie named @@ -129,7 +129,8 @@ created." (with-rebinding (name reply) (with-unique-names (place) - `(let ((,place (assoc ,name (headers-out ,reply) :test #'string-equal))) + `(let* ((,name (if (stringp ,name) ,name (string-capitalize ,name))) + (,place (assoc ,name (headers-out ,reply)))) (cond (,place (setf (cdr ,place) ,new-value)) -- Robert Macomber tbnl(a)rojoma.com

2 1

[hunchentoot-devel] real-remote-addr and proxy chains
by Robert J. Macomber 07 Nov '06

07 Nov '06

The real-remote-addr function currently returns the value of the x-forwarded-for header if it's set, or remote-addr if it's not. In the case of chains of proxies, this gives unexpected results as each proxy appends the address it's proxying for onto the end of the list. Since I imagine this function is intended to be used in situations where Hunchentoot is sitting behind proxies of its own, I've written a function to split things up to give a particular entry in this chain. Most of the time, I imagine you'd just want the address added by the closest proxy but if (for example) you're behind mod_proxy behind squid, this function can tell you the address of the agent that hit the squid server. I'm not actually quite sure what to call this function. Originally at my local site I'd called it "real-remote-addr", replacing Hunchentoot's own function, but the name's not sitting easily with me. For one thing, it's got a different API since it takes the number of hops along the proxy chain to look, and for another it returns NIL if you fall off the end of the chain (I'm not quite sure that's correct, but it seems to me to fail better than DWIMly returning the last available address, since values supplied by the user's original request are useless anyway). Anyway, here it is, still with the name real-remote-addr. (defvar *proxy-count* 0 "The length of the chain of server-side proxies in front of Hunchentoot.") (defun real-remote-addr (&optional (nth *proxy-count*) (request *request*)) "Returns the address of the NTH host in the chain of proxies that set the X-Forwarded-For header. 0 is the address of the last proxy (or the client, if there are no proxies), 1 the address of the second proxy (or client if there is only one), and so forth." (if (zerop nth) (remote-addr request) (let* ((proxies (loop with xff = (header-in :x-forwarded-for request) for pos = 0 then (1+ comma) for comma = (position #\, xff :start pos) collect (string-trim " " (subseq xff pos comma)) while comma)) (position (- (length proxies) nth))) (if (minusp position) nil (nth position proxies))))) -- Robert Macomber tbnl(a)rojoma.com

3 7

← Newer
1
...
61
62
63
64
65
66
67
...
87
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

tbnl-devel