apache web server on OpenVMS

[don....@gmail.com]

Although the Apache 2.0 stream contains support for running the server in a hybrid multiprocess, multithreaded mode, the SWS Version 2.1-1 kit is built on a process-based model. Wondering if the new release from VSI provide multithreaded mode?

[Robert A. Brooks]

There are VSI implementations of Apache of 2.2 and 2.4. I don't know anything
about Apache, so I don't know what version introduced multithreaded support.

--
-- Rob

[Stephen Hoffman]

Switching to threading would either involve porting to KP Threads or
porting to and testing with DECthreads, and with what would seem
dubious benefits for the effort involved.

AFAIK, it's still all process-based and that's what all the
installations I'm working with all use.

Pull down the source code for the VSI port and have a look?

Most of the available HPE open source software is outdated including
the HPE Apache port, and the HPE Apache httpd port has very old SSL
support embedded.

The HPE httpd Apache port very likely won't pass an audit.

The HPE port is based on 2.0.63, which is ~2009 era code. The 2013-era
2.0.65 was the last of that 2.0 series, and Apache httpd 2.4.33 is
current. The VSI httpd Apache port (based on Apache httpd 2.4.13,
where 2.4.33 is current).

Audits are starting to flag issues with the VSI 2.4.13 port around TLS.

The VSI port is also missing the recently-added mod_md ACME certificate
authority support — access to ACME-based providers including the free
LetsEncrypt certificates — among some other fixes and updates.



--
Pure Personal Opinion | HoffmanLabs LLC

[Jan-Erik Söderholm]

> LetsEncrypt certificates.....

http://wasd.vsm.com.au/SRC/wcme/readmore.html

[Arne Vajhøj]

On 4/16/2018 5:20 PM, Stephen Hoffman wrote:
> On 2018-04-14 11:20:42 +0000, don....@gmail.com said:
>> Although the Apache 2.0 stream contains support for running the server
>> in a hybrid multiprocess, multithreaded mode, the SWS Version 2.1-1
>> kit is built on a process-based model. Wondering if the new release
>> from VSI provide multithreaded mode?
>
> Switching to threading would either involve porting to KP Threads or
> porting to and testing with DECthreads, and with what would seem dubious
> benefits for the effort involved.
>
> AFAIK, it's still all process-based and that's what all the
> installations I'm working with all use.

The 2.x code base from Apache has support for threading on *nix.

I suppose that mean pthreads.

VMS support pthreads.

Would compile with flags to include the threading modes
and LINK /THREADS_ENABLE work?

Arne

[Craig A. Berry]

You'd have to try it to find out. There are a couple of things missing
on VMS, and whether Apache needs them or could live with workarounds is
an open question. For example, there is no pthread_sigmask() on VMS as
all signals are per-process rather than per-thread. For a busy server
process that does a lot of signaling, having to handle all signals in
the main thread might more or less defeat the purpose of having threads.

It also appears that the mixed process/thread model uses fork():

<https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/mpm/worker/worker.c?view=co>

so whatever was done for the preforking implementation of MPM would
probably need to be done here as well.

[Neil Rieck]

"I thought" the latest VSI offering of Apache for OpenVMS was based upon 2.4

Neil Rieck
Waterloo, Ontario, Canada.
http://neilrieck.net

[Jan-Erik Söderholm]

Why "think"... :-)

Page 13 (PDF-page, it says "36" on the page itself):
Under "V8.4-2, March 2016: "CSWS (based on Apache 2.4.12)".

But that was what Stephan said, wasn't it?

[Stephen Hoffman]

On 2018-04-17 02:06:47 +0000, Arne Vajh j said:

> On 4/16/2018 5:20 PM, Stephen Hoffman wrote:
>> On 2018-04-14 11:20:42 +0000, don....@gmail.com said:
>>> Although the Apache 2.0 stream contains support for running the server
>>> in a hybrid multiprocess, multithreaded mode, the SWS Version 2.1-1 kit
>>> is built on a process-based model. Wondering if the new release from
>>> VSI provide multithreaded mode?
>>
>> Switching to threading would either involve porting to KP Threads or
>> porting to and testing with DECthreads, and with what would seem
>> dubious benefits for the effort involved.
>>
>> AFAIK, it's still all process-based and that's what all the
>> installations I'm working with all use.
>
> The 2.x code base from Apache has support for threading on *nix.
>
> I suppose that mean pthreads.
>
> VMS support pthreads.

Porting is such sweet sorrow.

> Would compile with flags to include the threading modes and LINK
> /THREADS_ENABLE work?

Would it work? That's doubtful. Not without specific work and testing.

There are likely some benefits to this work, but I'm skeptical there
are a large number of folks where the differences here would matter.

The current pthreads spec is IEEE 1003.1-2017 and which is a revision
of the 2008 spec, and the OpenVMS pthreads implementation is apparently
based on IEEE 1003.1-1996. I don't know which pthreads spec is
targeted for Apache, but 2008 wouldn't be ab unexpected dependency.
There are a bunch of other parts of POSIX and C that could use updates
too, and the folks at VSI undoubtedly have lists of some of those
around.

OpenVMS isn't a big web-serving platform, with ~368 public-facing web
servers running Apache world-wide, ~223 running HTTP and ~140 HTTPS,
and ~3 using oddball ports. A number of these OpenVMS web servers are
running OpenSSL 0.9.7d or 0.9.8o, too. For comparison purposes, there
are ~381,089 running Apache on Linux, and 7,231,296 Windows IIS, and
18,126,562 nginx. There'll be more servers within network perimeters
and others that are running with "prod" set, certainly.

Getting to current Apache httpd and current OpenSSL and current mod_ssl
is probably higher on the likely work list than efforts around
improving the process handling, too. Maybe getting Apache httpd
changes pushed upstream or the porting more automated, and maybe
getting the Apache sources posted openly in a DVCS repository to allow
non-VSI folks access.

There's also the knock-off work around updating pthreads, for whatever
might be missing or malfunctioning or in need of updates.

It'll probably also be more productive to create an OpenVMS MPM using
KP Threads and use that, rather than using pthreads. It'd then be
entertaining to mix KP Threads threading with ICC communications in
some distant future update, but then that'd also involve getting IP
working cross-cluster working and connection hand-offs working rather
more transparently. But that'd also be a pretty powerful and flexible
Apache server configuration.

[Jan-Erik Söderholm]

> OpenVMS isn't a big web-serving platform, with ~368 public-facing...

Now, I see the web servers (any of them) running on VMS, mainly as a
tool to expand the interfaces to VMS based data within some specific
organisation. Not very much to present VMS data to "the world".

I see the main use of VMS hosted web servers to add to, and sometimes
replace, older VT based application interfaces. And that is mainly
within specific organisations, not on the wild world web.

[Arne Vajhøj]

Web servers are a must have in most modern solutions.

Including VMS solutions.

These traditional business web front ends will typical not
have enough users to make the forking/threading model
important.

But I hate the "VMS is OK with half the functionality of
*nix * win" thought.

Arne

[Jan-Erik Söderholm]

Yes, correct. I was just commenting on the use of the number of
publicly visible web servers as some measurement on the importance
of web servers on VMS in general.

And who has talked about “half the functionality”? Maybe you
are referring to that other half as “runs on *nix”?

Due to platform differences, some things done on *nix cannot be
done of VMS (and in some cases doesn't need to be done on VMS).

Jan-Erik.

[Arne Vajhøj]

On 4/17/2018 12:34 PM, Stephen Hoffman wrote:
> On 2018-04-17 02:06:47 +0000, Arne Vajh j said:
>> On 4/16/2018 5:20 PM, Stephen Hoffman wrote:
>>> On 2018-04-14 11:20:42 +0000, don....@gmail.com said:
>>>> Although the Apache 2.0 stream contains support for running the
>>>> server in a hybrid multiprocess, multithreaded mode, the SWS Version
>>>> 2.1-1 kit is built on a process-based model. Wondering if the new
>>>> release from VSI provide multithreaded mode?
>>>
>>> Switching to threading would either involve porting to KP Threads or
>>> porting to and testing with DECthreads, and with what would seem
>>> dubious benefits for the effort involved.
>>>
>>> AFAIK, it's still all process-based and that's what all the
>>> installations I'm working with all use.
>>
>> The 2.x code base from Apache has support for threading on *nix.
>>
>> I suppose that mean pthreads.
>>
>> VMS support pthreads.
>
> Porting is such sweet sorrow.
>
>> Would compile with flags to include the threading modes and LINK
>> /THREADS_ENABLE work?
>
> Would it work?   That's doubtful.   Not without specific work and testing.

Of course it will need testing. And possible some code changes as well.

But maybe it is not that huge a task since the foundation seems to
be there.

> There are likely some benefits to this work, but I'm skeptical there are
> a large number of folks where the differences here would matter.
>
> The current pthreads spec is IEEE 1003.1-2017 and which is a revision of
> the 2008 spec, and the OpenVMS pthreads implementation is apparently
> based on IEEE 1003.1-1996.  I don't know which pthreads spec is targeted
> for Apache, but 2008 wouldn't be ab unexpected dependency. There are a
> bunch of other parts of POSIX and C that could use updates too, and the
> folks at VSI undoubtedly have lists of some of those around.

It is not my impression that the difference in pthreads versions
are that big.

At least I typical just see "pthreads required" not
"pthreads YYYY required".

But maybe I don't read the right stuff.

> OpenVMS isn't a big web-serving platform, with ~368 public-facing web
> servers running Apache world-wide, ~223 running HTTP and ~140 HTTPS, and
> ~3 using oddball ports.   A number of these OpenVMS web servers are
> running OpenSSL 0.9.7d or 0.9.8o, too.   For comparison purposes, there
> are ~381,089 running Apache on Linux, and 7,231,296 Windows IIS, and
> 18,126,562 nginx.   There'll be more servers within network perimeters
> and others that are running with "prod" set, certainly.

The Apache/VMS number sounds very plausible.

I don't think I believe in that Apache/Linux number.

Nginx and IIS numbers seem weird as well.

https://news.netcraft.com/archives/2017/12/26/december-2017-web-server-survey.html

Where did you get these numbers from?

> Getting to current Apache httpd and current OpenSSL and current mod_ssl
> is probably higher on the likely work list than efforts around improving
> the process handling, too.  Maybe getting Apache httpd changes pushed
> upstream or the porting more automated, and maybe getting the Apache
> sources posted openly in a DVCS repository to allow non-VSI folks access.

Totally agree.

> There's also the knock-off work around updating pthreads, for whatever
> might be missing or malfunctioning or in need of updates.
>
> It'll probably also be more productive to create an OpenVMS MPM using KP
> Threads and use that, rather than using pthreads.   It'd then be
> entertaining to mix KP Threads threading with ICC communications in some
> distant future update, but then that'd also involve getting IP working
> cross-cluster working and connection hand-offs working rather more
> transparently.  But that'd also be a pretty powerful and flexible Apache
> server configuration.

Possible.

But that would be a lot of work.

Just getting base Apache code - all of it - working may be more
manageable.

Arne

[Arne Vajhøj]

On 4/17/2018 7:26 PM, Jan-Erik Söderholm wrote:
> Den 2018-04-18 kl. 01:16, skrev Arne Vajhøj:
>> On 4/17/2018 6:19 PM, Jan-Erik Söderholm wrote:
>>> Den 2018-04-17 kl. 18:34, skrev Stephen Hoffman:
>>>> OpenVMS isn't a big web-serving platform, with ~368 public-facing...
>>>
>>> Now, I see the web servers (any of them) running on VMS, mainly as a
>>> tool to expand the interfaces to VMS based data within some specific
>>> organisation. Not very much to present VMS data to "the world".
>>>
>>> I see the main use of VMS hosted web servers to add to, and sometimes
>>> replace, older VT based application interfaces. And that is mainly
>>> within specific organisations, not on the wild world web.
>>
>> Web servers are a must have in most modern solutions.
>>
>> Including VMS solutions.
>>
>> These traditional business web front ends will typical not
>> have enough users to make the forking/threading model
>> important.
>>
>> But I hate the "VMS is OK with half the functionality of

> And who has talked about “half the functionality”? Maybe you
> are referring to that other half as “runs on *nix”?

I think Stephen indicated that VMS may be OK with just one MPM
while Unix got three.

> Due to platform differences, some things done on *nix cannot be
> done of VMS (and in some cases doesn't need to be done on VMS).

True.

But I threading should actually be easier on VMS than
forking!

Arne

[Stephen Hoffman]

On 2018-04-17 23:16:41 +0000, Arne Vajh j said:

> Web servers are a must have in most modern solutions.

Ayup. Same with integrated IP networking, distributed authentication,
connection security, and a whole bunch of stuff that didn't factor into
older app designs. Expectations change.

> Including VMS solutions.

Ayup. We're not headed back to VT-era user-interface designs, nor to
home-grown app networking and communications designs and tooling.
Tooling evolves.

> But I hate the "VMS is OK with half the functionality of *nix * win" thought.

Half of the capabilities of Unix would be an improvement in various
areas. Not the least of which would include the installation and
configuration, and remote management interfaces.

[Stephen Hoffman]

On 2018-04-17 23:29:16 +0000, Arne Vajh j said:

> On 4/17/2018 12:34 PM, Stephen Hoffman wrote:
>
>> OpenVMS isn't a big web-serving platform, with ~368 public-facing web
>> servers running Apache world-wide, ~223 running HTTP and ~140 HTTPS,
>> and ~3 using oddball ports.   A number of these OpenVMS web servers are
>> running OpenSSL 0.9.7d or 0.9.8o, too.   For comparison purposes, there
>> are ~381,089 running Apache on Linux, and 7,231,296 Windows IIS, and
>> 18,126,562 nginx.   There'll be more servers within network perimeters
>> and others that are running with "prod" set, certainly.
>
> The Apache/VMS number sounds very plausible.
>
> I don't think I believe in that Apache/Linux number.
>
> Nginx and IIS numbers seem weird as well.
>
> https://news.netcraft.com/archives/2017/12/26/december-2017-web-server-survey.html
>
>
> Where did you get these numbers from?

Shodan.

[Arne Vajhøj]

On 4/18/2018 1:26 PM, Stephen Hoffman wrote:
> On 2018-04-17 23:16:41 +0000, Arne Vajh j said:
>> But I hate the "VMS is OK with half the functionality of *nix * win"
>> thought.
>
> Half of the capabilities of Unix would be an improvement in various
> areas.

It would be an improvement in most areas.

But I still don't want to settle for half.

Arne

[Arne Vajhøj]

20 times more IIS/Windows than Apache/Linux does not match
my impression nor (and that is probably a lot more relevant)
Netcraft numbers.

Arne

[Stephen Hoffman]

On 2018-04-19 01:01:29 +0000, Arne Vajh j said:

> 20 times more IIS/Windows than Apache/Linux does not match my
> impression nor (and that is probably a lot more relevant) Netcraft
> numbers.

25,829,749 for Apache.

Those numbers also include Windows with Windows Server as both offer
IIS, and there's more than a little room for implementation and survey
differences and in any de-duplication of the results, etc.

Arguably, it also indicates that ~368 OpenVMS systems are incorrectly
configured.

[Arne Vajhøj]

On 4/19/2018 11:41 AM, Stephen Hoffman wrote:
> On 2018-04-19 01:01:29 +0000, Arne Vajh j said:
>> 20 times more IIS/Windows than Apache/Linux does not match my
>> impression nor (and that is probably a lot more relevant) Netcraft
>> numbers.
>
> 25,829,749 for Apache.
>
> Those numbers also include Windows with Windows Server as both offer
> IIS, and there's more than a little room for implementation and survey
> differences and in any de-duplication of the results, etc.

25.8M Apache and only 0.4M Apache/Linux definitely sound wrong.

Linux as way more popular than Solaris, FreeBSD, Windows for running
Apache.

I don't know what is wrong.

If I were to guess then I would suspect that they have numbers for
Apache/RHEL, Apache/CentOS etc. and only use Apache/Linux for
"other Linuxes".

Arne