Significant Changes
This page documents changes to the WASD VMS Hypertext Services Package that
have some effect on configuration or behaviour. It lists changes from version
3.1 onwards, the first to be made available as freeware.
Updating?
Beware!
Version 7.2.1
(November 2001)
- A minor, basically bugfix release.
- One notable functionality item, persona scripting support (non-server
account) for VAX VMS versions that do not support the $PERSONA services (i.e.
6.0 and 6.1). The PERSONA.MAR module performs a similar function by
explicitly manipulating the process structures in kernel mode, operating in a
well accepted but basically unsupported fashion! Check the build and
scripting documentation for further details.
Version 7.2
(July 2001)
- X.509 certificate authorization for SSL transactions. This allows
authorization credentials to be established via client certificate without the
use of username/password dialogs.
- For SSL servers it is now possible to use private keys without embedded
passwords. As the SSL service is started the server prompts via HTTPDMON and
OPCOM (if enabled) for the private key password. It can be supplied using a
/DO=SSL=KEY=PASSWORD directive.
- Authorization via the RFC1413 "identification protocol".
- Remote user to local SYSUAF user "proxy" access.
- Control of request processing, known as
"throttling", sets limits on the number of concurrent requests being
processed before new requests are queued. Can be used to limit instances of
resource intensive processing as in the case of some scripts, etc.
- CGIplus/RTE has a lower overhead, higher efficiency and throughput
(50% to 100% increase) CGI variable transfer mode. Historically CGI
variables have been transfered one per record, now termed "record"
mode. It is also possible to transfer variables as a single I/O, or in
"struct" mode. CGILIB now enables this by default. Just relink as
necessary.
- Scripts are no longer automatically run-down if a client disconnects
while processing. The [DclBitBucketTimeout] period must expire first. This
results in most scripts and/or the associated process continuing to be
available for use with another request, a significant efficiency improvement.
- Improved script run-down handling. Scripts executing images are
$FORCEXed before processes are deleted, allowing exit handlers to gain control
for more elegant releasing of resources, etc.
- It is now possible to specify a maximum CPU time limit on a per-script
basis using the SET SCRIPT=CPU=hh:mm:ss mapping rule. This may be
particularly useful in allowing for run-away user scripts.
- Only selected HTTP status code reports need to be customized using the
[ErrorReportPath] directive, those remaining still being handled internally.
- The EXEC rule now allows not only directories to be specified as script
repositories but also file types. This allows files with a particular
extension to be designated as executable scripts no matter where that occur in
the specified path (and can be used to map ex-Purveyor scripts for example).
- "Monitor" data and "control" directives (/DO=) now
communicate via shared memory in a global section. This is significantly more
efficient and versatile. (Note that images must be installed with PRMGBL,
SHMEM (VAX only) and SHRGBL).
Version 7.1.1
(January 2001)
- A minor release corresponding to the closing of OpenVMS Freeware CD V5
submissions.
- The usual bugfixes :^)
- CGILIB has been updated for the new CGI interface requirements
of Compaq Secure Web Server (CSWS) V1.0-1 (based on Apache 1.3.12).
- A "standard" area for script scratch space ... with the
server cleaning up behind those that fail to. See the Scripting
Environment, Introduction.
- QDLOGSTATS can now be used as a script and will provide an HTML
form-based interface page.
Version 7.1
(November 2000)
- Scripting process creation has been moved from LIB$SPAWN() to
SYS$CREPRC(). This allows some interesting new features including detached
processes and scripts executing under non-server accounts (on VMS versions 6.2
and later), including user accounts. Subprocess scripting is still the
default (i.e. it is backward compatible). Check the "Scripting
Overview, Introduction" for the details.
- Selected server administration menu and command-line /DO= directives
can now be simultaneously applied to all servers on a node or across a cluster.
To see this in action, even with only one existing server on a single node, do
a $ @HT_ROOT:[000000]FREEWARE_DEMO and then
access the system's server Administration Menu.
- The server administration menu now provides specific functionality for
maintaining service and message configuration.
- Proxy cache maintenance scans are now cluster-aware. A server
undertaking a scan locks the cache, preventing other servers from
simultaneously attempting to perform maintenance activities on the cache.
- Run-Time Environments are a persistant scripting mechanism designed to
support interpreters like Perl and Java, with the objective of reducing
response latency, increasing throughput and reducing system impact. This
version includes an example Perl RTE, which can give a performance
improvement of some twenty-five times on standard CGI Perl scripts! For
Perl distribution considerations this Perl RTE must be fully compiled and
linked locally.
- A new configuration directive [CgiStrictOutput] introduced in WASD 7.0
directs the server to report script responses that are neither CGI or NPH (i.e.
have none or a faulty response header). This is enabled in the 7.n
example configuration files. Site administrators that do completely new
installations may find their old scripts are now being reported as "ERROR
502 - External agent did not respond (or not acceptably)." Either
modify the script to supply an appropriate header (preferable) or disable the
configuration directive.
- There have been some other refinements to the scripting environment and
more detailed information provided in the Scripting Overview. It is
recommended site administrators and script authors review this.
- CGILIB has been modified to become an object module/library. Compared
to the code #include this is a more elegant method for delivering it's
functionality. More significant WASD scripts have been modified to support
this version (e.g. Conan, HyperShelf/Reader, WASDquery and others). The
#includable functionality is still available.
- Changes in VMS Apache BETA behaviour between 1.3.9 (T1.3-9AG)
and 1.3.12 (1.3-12) make some WASD Server and CGILIB code ineffective. As
far as the author can tell there is no way to send a binary stream from a
script via T1.3-12. Whether or not future changes to VMS Apache restores this
functionality cannot be determined at the current time.
- The CGIUTL scripting utility has been enhanced so that POSTed request
fields containing multiple lines (e.g. <TEXTAREA>s) can be processed into
DCL symbols one line per symbol.
- HyperShelf now allows a URL item type. This allows a URL to be
added to an ODL or BookShelf shelf file, providing a direct link to HTML/Web
resources external to the local host or Bookreader environment.
- The FETCH utility FTP processing has undergone a major revision and now
should present far fewer issues with some sites.
- A new utility QDLOGSTATS allows elementary server log statistics to be
generated on an ad hoc basis.
- Built and verified against OpenSSL 0.9.6
Version 7.0
(June 2000)
- A major release version number change due to more significant changes
to some server processing than could be justified as a minor version update.
- Extended file specification support. Under Alpha VMS V7.2ff the server
and relevant scripts are ODS-5 volume compliant. This has a number of
implications for server management and user activity. Please read the
relevant section of the Technical and Environment Overviews.
- Built and verified against OpenSSL 0.9.5
- Some VMS Apache-like CGI scripting compatibility characteristics
(based on the 1.3.9 BETA). These are intended to ease (or even remove
completely) script portability issues between the WASD and Apache environments.
CGILIB has also been modified to support VMS Apache (meaning WASD scripts using
CGILIB run unmodified under Apache CGI).
- The server will now generate OPCOM messages against various categories
of events, e.g. server startup/exit, authorization failure, server
administration (e.g. mapping reloads, etc.), configured using the [Opcom...]
configuration directives.
- Server error (and success) response page format improved (or at least
changed). More Apache-like, consistent, informative and (in the
author's opinion) aesthetically pleasing. There is now a simple mechanism
(based on per-server configuration or request path SETting) for providing basic
or detailed error responses.
- Three [...BodyTag] directives allow the <BODY> tags of server
generated pages (such as error reports, directory listings, etc.) to be
specified. This can provide a site with a significantly consistent
"look-and-feel". In addition the actual format and contents of
server error and success response pages may be specified using the HTTPD$MSG
configuration file.
- The [LogPerService] configuration directive used to generate a log file
using only the host name of a service (which can be problematic when virtual
services share the same name, e.g. WWW.domain.com). It now generates a unique
name based on as much of the full service IP name string as can be accomodated
by VMS syntax constraints. Previous behaviours can be retained by enabling
[LogPerServiceHostOnly] directive.
- Cookie-based session tracking is available using the [Track...]
directives.
- The [SearchScriptExclude] directive allows specified file types
(extensions) from being processed as implied keyword searches when a query
string is present.
- The directive [AuthRevalidateLoginCookie] activates a
cookie-based solution to consecutive authorization dialogs sometimes
occuring when [AuthRevalidateUserMinutes] is active.
- .HTA and .HTL authentication databases require renaming to .$HTA
and .$HTL (see Updating? Beware).
- The update facility has had slight aesthetic improvements (or at least
changes) and slightly simplified capabilities.
- Proxy services may now have proxy authentication applied to
them. This controls access to a proxy service using a separate and distinct
proxy authentication dialog supported by modern browsers.
- A new tool, ApacheBench © The Apache Group, as used in the
Apache Distribution, is included with this package (within licence conditions).
It allows ad hoc server benchmarking and stress-testing (requires VMS
7.n or greater).
- Additional information and a Perl module for using Perl within the
CGIplus environment has been provided.
- There are now a few coloured icons in the HT_ROOT:[RUNTIME.HTTPD]
available if the b/w ones seem a bit lifeless ;^)
Version 6.1
(December 1999)
- NETLIB is no longer supported/required. The remaining TCP/IP packages
for VMS, Compaq TCP/IP (UCX), Multinet and TCPware, all support the BG driver
interface (UCX $QIOs) so this can be used exclusively.
- Authentication agents provide "easily" created,
external authentication/authorization functionality. These are essentially
CGI/CGIplus scripts (with all the attendant programming simplicity of this
environment) specially invoked by the server for authorization purposes.
Working examples, including an OSU CEL-compatible authenticator, are provided.
- CGI and CGIplus scripting support for callouts. These provide
direct script-server dialogs, allowing various capabilities.
- Virtual hosting is far more comprehensive than in the base version of
6.0 (although it was actually reworked for v6.0.2). It now supports mappings
against the request "Host:" header field, as well as for multi-homed
hosts.
- OpenSSL v0.9.4 has been built and tested against v6.0 and v6.1, with
build and update procedures modified to support it. SSLeay is no longer
supported against this version (though may continue to link and work).
- The Server Side Includes processor now supports OSU-specific directives
to provide transparent integration of OSU .HTMLX documents into the
WASD environment.
- A new USER mapping rule provides /~username/ mappings using
the default device and directory from the SYSUAF.
- As from v6.0.2 SYSUAF authentication honours NETWORK and REMOTE access
account restrictions a new mechanism was required to support nil-access
accounts. This is implemented using a new rights identifier, WASD_NIL_ACCESS.
- Administration Menu reports now allow a SHOW PROCESS
/ALL to be performed on HTTPd processes (server, subprocess and
DECnet scripts). The latter also allow individual deletion from the same report.
- The CGILIB source code has been considerably extended to support
response generation, CGI callouts, Purveyor environment.
- The server can be used to cause the browser to cancel authentication
against a particular path. Use "/what/ever/path?httpd=cancel", clear
the fields and OK it. Then go backwards and access the original path, which
should reprompt for authorization.
- Documentation now only supplied in HTML and PostScript formats.
Plain-text and Bookreader formats are no longer generated, to help reduce the
size of the distribution, and as a reflection of the diminishing importance of
these formats.
Version 6.0
(June 1999)
- Proxy HTTP and FTP serving, with local HTTP caching.
- Authentication and authorization environment extension and refinement.
- Much improved WATCH detail for DCL, SSL and authorization.
-
|
|
SSL now supported using the OpenSSL 0.9.3 toolkit (with initial backward
compatibility with previous SSLeay releases).
|
OpenSSL now has integrated VMS support (largely thanks to Richard Levitte
(levitte@lp.se)). WASD SSL packages include
only object libraries, application objects, and support procedures (i.e.
sufficient to support WASD's SSL). If a full OpenSSL toolkit is desired it
should be obtained separately from
http://www.openssl.org/ or
http://www.free.lp.se/openssl/
and built locally.
- CGILIB.C source code library for easing the production of CGI C
Language scripts.
- ISAPI scripting environment.
- New TMAILER script (WASD drop-in replacement for the OSU TMAIL script).
- New CGIUTL utility, assisting with scripting at the DCL level
(particularly processing POSTed requests).
- Improved FETCH script/utility.
- Statement concerning Year 2000 and related
issues. WASD HTTPd v6.0 has had it's directory listing dates extended to
include a four digit year component.
Version 5.3
(November 1998)
- This release has some internal modifications improving performance and
granularity of processing under high loads. CGI scripting performance has also
been improved, and CGIplus is 75% faster in response.
- The WATCH facility, accessable from the administration menu, provides
an online, real-time, in-browser-window view of request processing in the
running server. Being able to observe live processing on an ad hoc basis,
without changing server configuration or shutting-down/restarting the server
process, makes this facility a great configuration and problem resolution tool.
- While virtual service support has been possible for some time, v5.3
extends this with a specific virtual server rule syntax and server startup
procedures easing the support of virtual servers, multiple server processes on
the one system, and multiple server systems within a cluster. Check the new
STARTUP.COM and
STARTUP_SERVER.COM
functionality.
- A new SET mapping rule allows ad hoc characteristics to be set against
a particular path or file template. File caching, stream-LF conversion,
character set, content-type, expiry, invalid-RMS-character can currently be set
on a per-path basis.
- Local-format error reporting, using CGI scripting, Server Side Include
documents, or even "flat" HTML files, can now be configured using
the [ErrorReportPath] configuration directive.
- SSL services may now use a server-common, or each a service-specific
certificate (in line with other virtual service improvements).
- The [AddType] configuration directive now allows a character set to be
specified with the content-type.
- Performance comparisons with OSU 3.3a are provided (as requested by
a few of the curious).
Version 5.2
(September 1998)
- This is really a very minor revision with two bug-fixes. It coincides
with the closing date for OpenVMS Freeware CD V4.
- DECnet scripting now supports connection reuse (as does OSU 3.3a)
improving latency and throughput of network-based CGI and OSU scripting.
The [DECnetReuseLifeTime] and [DECnetConnectListMax] configuration parameters
support this.
- The [AuthRevalidateUserMinutes] configuration parameter specifies
the maximum period between successive authenticated requests before the user is
forced to reenter the authentication information. Zero disables this
functionality.
- The [LogExcludeHosts] configuration parameter allows certain hosts
or ranges of hosts to be excluded from access logs. This can eliminate the
web-administrator's "noise" accesses, etc.
- The [StreamLFpaths] configuration parameter limits variable record
to stream-LF file conversion to specified paths.
- The [DirNoImpliedWildcard] configuration parameter allows selection of
directory listing behaviour for subdirectories with home pages.
- Improved HyperShelf/HyperReader behaviour in DECW$BOOK environments.
Version 5.1
(July 1998)
- The package's build support and distribution content has undergone a
significant overhaul. VMS V6.0, V6.1, V6.2 through to V7.1 should be supported
(almost) out-of-the box. Executables are no longer provided! All
installations and updates will require a link prior to any other activity.
To assist with this, along with installation and maintenance in
general, two procedures are provided:
- INSTALL.COM
- UPDATE.COM
- The HTTPd itself has generally undergone minimal change. A few
improvements to HTTP behaviour. A small number of bug-fixes.
- The Server Side Includes processor has been considerably extended,
providing facilities similar to Apache's XSSI. User-assignable variables
and the conditional processing of sections of a document provide the main
functionality.
- For servers providing multiple services a per-service access log may
now be generated. See configuration parameter [LogPerService].
- The server now allows a request to specify the content-type of a
returned file.
- Finer control in the use of SYSUAF authentication is now possible
using rights identifiers and the server /SYSUAF=ID qualifier.
- User CGI and OSU scripting is now supported within WASD's DECnet
scripting environment.
- SSL support is now provided using a package based on SSLeay v0.9.0b.
The server will still link and work with the 0.8.1 version.
- WASD script output has been changed to provide a more consistent
look-and-feel, including customizable colour schemes (consult the source
code for more information). Extensive use of HTML 3.2 tables provides heading
and button formatting (in the late '90s we should be expecting at least this
from our GUI browsers, and Lynx v2.8 still reproduces the pages quite
acceptably). A non-table-centric layout is also generally available. Logos and
other non-essential graphics have been eliminated improving the overall
efficiency and responsiveness.
Some scripts have had their behaviour or functionality slightly improved
(or at least changed ;^) In particular, the HyperReader script has
(arguably) better layout, robustness and non-English language document
friendliness.
Version 5.0
(March 1998)
- Secure Sockets Layer protocol (SSL), supported using SSLeay v0.8.1
(optional package).
- DECnet-based CGI and OSU-emulated scripting.
- Directory listing file size may now be configured to display in bytes,
kbytes and Mbytes. I like bytes,
try [DirLayout] I__L__R__S:b__D
- Of course new bugs have been introduced through the ongoing process of
fixing the old bugs, making refinements and introducing new capability
;^)
Version 4.5
(November 1997)
- Configurable, monitorable file data and revision time cache introduced.
- Configurable script run-time environments. Script interpreters such as
Perl may now be transparently activated to execute a particular script.
- Log files may now be configured to change according to a specified
period ... daily, weekly, or monthly, providing some automation in managing
file duration and size.
- Minor bugs fixed and minor refinements made.
-
Everybody else is powered by ... something-or-other, well now
we're
:^)
Version 4.4
(October 1997)
- Due to optimizations in critical sections of the server and the
elimination of debug code from production executables the server's
performance has significantly improved.
- The server can now support multi-homed hosts and multiple-port services
from the one process. Due to changes in connection request processing some
NETLIB supporting TCP/IP packages can no longer provide DNS lookup (it now
occurs at AST level, see the NETLIB documentation).
- Conditional rule mapping; applies rules only after certain criteria
other than the initial path match are met (e.g. client internet address,
browser-prefered language, browser-accepted content-type, browser
identification string, authenticated remote user, HTTP method).
- The server can optionally use the VMS security profile of a
SYSUAF-authenticated user name to determine whether access to a particular file
or directory is permitted.
- Configurable message database, supporting multiple, concurrent
languages.
- In addition to the common log format the server now supports the
common+server and combined pre-defined formats, as well as
user-defined formats.
- Some additional command-line server control functionality.
- Of course, the usual bugfixes (a couple of significant but not obvious
ones this time) and minor refinements.
Version 4.3
(August 1997)
- MadGoat NETLIB support. As well as native Digital TCP/IP Services
(UCX) support the server can now (potentially) support these packages:
- Cisco MultiNet for OpenVMS, any version
- PathWay from Attachmate Inc., any version
- TCPware from Process Software Corporation, any version
- CMU TCP/IP (VAX only) v6.5 or later is not supported due to too
great a variation from the other packages.
- Activity report. This provides a graphical representation of server
activity (requests and bytes transfered) for up to the previous 28 days.
- DCL scripting now has greater CGI compliance. Prior to v4.3 POSTed
scripts would read the request header then the body (i.e. the full
request). The CGI standard is body-only. This is now the default. A
configuration parameter allows the previous behaviour to be explicitly selected.
- Logging can now be enabled and disabled on an ad hoc basis from the
Server Administration Menu.
- Some minor bugfixes and refinements.
Version 4.2
(July 1997)
- Change of name from "HFRD VMS Hypertext Services" to "WASD VMS
Hypertext Services". This follows a change of role and name for the Division.
- CGI scripting redesigned to improve performance through the use of
persistant DCL subprocesses. Some additional configuration parameters support
the reworked DCL module.
- CGIplus scripting (minor extension to standard CGI scripting) to
further improve CGI performance through the use of persistant CGI applications.
- Additional server administration reports on requests (current and
history) and DCL/scripting.
Version 4.1
(April 1997)
- Documentation brought more-or-less :^)
up-to-date.
- HTTP response headers now more consistant.
- Delete-on-close for temporary files. Primarily used by the
UPDate facility for previewing documents. (Beware ... any file name comprising
a leading hyphen, sixteen digits and a trailing hyphen will be deleted on
close!)
Version 4.0
(February 1997)
- Very significant changes to internal data structures and processing.
- Changes to startup and login procedures to more easily support multiple
servers within clusters.
- On-line server administration menu providing reports, configuration and
run-time actions of server. Obsoletes some of the $ HTTPD/DO=...
functionality previously available from the command. More extensive server
reports, and much more, available via /httpd/-/admin/
(obsoletes /httpd/-/report/). These menus and dialogues generally
require an HTML-table-capable browser, such as Netscape Navigator.
- Ability to configure server characterstics requires changes to the
format of the HTTPD$CONFIG and HTTPD$AUTH files. Both are backward compatible,
but if upgrading and using the on-line configuration the format will be changed
the first time they are updated.
- HTTPd server becomes HTTP-cookie-aware.
Version 3.4
(October 1996)
- More extensive server reports (via /httpd/-/report/ ...
obsoleted by v4.0)
- Minor changes to error reporting.
Version 3.3
(August 1996)
- ``Basic'' and ``Digest'' authentication and path authorization. The
digest scheme has, to date, only been tested against NCSA X Mosaic 2.7-4b,
which seems to behave a little flakey when reloading documents, and does
not elegantly support stale nonces.
- A configurable module is provided to automatically convert variable to
stream-LF record format files. The stream format is much more efficiently
processed by the server. (VARIABLE and VFC are read record-by-record, all
others in block mode).
- To allow controlled access using authorization the server report is now
generated via a path, as in the anchor
``<A HREF=/httpd/-/report>'' (obsoleted by v4.0)
Version 3.2
(April 1996)
- The HTTPD$CONF configuration file no longer requires the encoding
directive (7bit, 8bit, binary, etc.). This must be removed before upgrading
from earlier versions. Encoding is now determined from the VMS file record
format (VARIABLE and VFC are read record-by-record, all others in block mode).
- Persistent connections (HTTP/1.0 defacto standard) are now supported
(for the majority of HTTP transactions). This significantly reduces request
network overhead.
Version 3.1
(January 1996)
- Initial GNU Licensed freeware release.