Apache SSL + SVN notes

Recently I started to use Apache http server again. I am trying to build a SVN repository which can be accessed through HTTPS.

Environment

Ubuntu
Apache 2.2.17 source

Doc: http://httpd.apache.org/docs/2.2/

Build

  ./configure --prefix=/home/gerald/servers/httpd-2.2.17 --enable-ssl --enable-dav --enable-so
  make
  make install

add bin directory to your PATH

add man pages:

function addManPath() { 
    if (($# != 1)); then return 0; fi

    path="$1" 
    if [ "x$MANPATH" == "x" ]; then 
        export MANPATH="$(manpath):$path" 
    else 
        export MANPATH="${MANPATH}:$path" 
    fi  
}

addManPath "~/servers/httpd-2.2.17/bin/man"

start up apache server: apachectl start

benchmarking: ab -n 10000 -c 100 http://localhost:80/

Show modules:
  httpd -M  //show all loaded modules
  httpd -S      // show parsed virtual host settings
  httpd -l    //listed compiled in modules
  httpd -L   //list available configuration directives
  httpd -V  //show compile settings (not settings for compiling the whole package, the settings for compiling the server - httpd).

Configure SSL

Prepare your certificate and private key.
Uncomment line "Include conf/extra/httpd-ssl.conf" in httpd.conf.
Change file "conf/extra/httpd-ssl.conf". The most important directives are SSLCertificateFile and SSLCertificateKeyFile.
Test whether you can access your website through HTTPS.

SSL + SVN

Get modules dav_svn and authz_svn

wget http://altruistic.lbl.gov/mirrors/ubuntu/pool/universe/s/subversion/libapache2-svn_1.6.5dfsg-1ubuntu1_i386.deb

dpkg-deb -x libapache2-svn_1.6.5dfsg-1ubuntu1_i386.deb

copy two module (.so files) to apache modules directory.

Configure modules

Edit file <Apache>/conf/extra/dav_svn.load

    LoadModule dav_svn_module modules/mod_dav_svn.so
    LoadModule authz_svn_module modules/mod_authz_svn.so

Edit file <Apache>/conf/extra/httpd.conf, add following two lines

    Include conf/extra/dav_svn.load
    Include conf/extra/dav_svn.conf

Edit file <Apache>/conf/extra/dav_svn.conf

<Location /svn/> <!-- trailing / is necessary!! -->
  DAV svn
  
  SSLRequireSSL  # enforce use of HTTPS
  #SVNPath /var/lib/svn
  SVNParentPath /home/svn/projects
  SVNListParentPath on 
  
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile Apache_Dir/conf/dav_svn.passwd

  # To enable authorization via mod_authz_svn
  AuthzSVNAccessFile Apache_Dir/conf/dav_svn.authz

  Require valid-user
</Location>

http://stackoverflow.com/questions/488778/how-do-i-list-all-repositories-with-the-svnparentpath-directive-on-apachesvn

Create authentication and authorization files

Create password file: htpassword -cm <Apache>/conf/dav_svn.passwd gerald

Edit file <Apache>/conf/dav_svn.authz

[groups]
admin=gerald
guests=guest

[/]
@admin=rw

[repository_name:/directory]
@admin=rw

Test

Restart Apache httpd server.
Go to https://your_ip/svn/ (note: the trailing / is necessary!)

 

Permission Problem

If you see following error when you try to commit some code:

svn: Commit failed (details follow):
svn: Can't open file '/path/to/your/repo/db/txn-current-lock': Permission denied

follow these steps:

1. Execute command: ps -wwf $(pgrep httpd)
   You should say one of the processes is run as root. All other processes are run as daemon (in my case).
2. To make httpd able to access(read/write) your svn repository, you should set the file permissions of svn repository correctly.
   chown -R gerald:daemon /path/to/svn/repo
   chmod -R 770 /path/to/svn/repo

Non-Ascii characters in MIME headers

Message Header Extensions for Non-ASCII Text: http://tools.ietf.org/html/rfc2047
The text is encoded in this ways:

   encoded-word = "=?" charset "?" encoding "?" encoded-text "?="
   charset = token    ; 
   encoding = token   ; 
   token = 1*<Any CHAR except SPACE, CTLs, and especials>
   especials = "(" / ")" / "<" / ">" / "@" / "," / ";" / ":" / "
               <"> / "/" / "[" / "]" / "?" / "." / "="
   encoded-text = 1*<Any printable ASCII character other than "?" or SPACE>

Supported encodings  include "Q"(similar to quoted-printable) and "B" (Base64).

For example,

=?gb2312?Q?[CSDN]=C2=DB=CC=B3=D3=C3=BB=A7=BC=A4=BB=EE=CD=A8=D6=AA?=

represents text "[CSDN]论坛用户激活通知".
Note: SPACE and TAB are not allowed in encoded text. SPACE must be encoded using "=20".

Uniform Resource Identifier(URI) and Uniform Resource Locators (URL) - (RFC 1738 and RFC 3986)

Character Escape
URI consists of a set of characters.
uric = reserved | unreserved | escaped

Reserved characters
Principle: a character is reserved if the semantics of the URI changes if the character is replaced with its escaped escaped encoding.

    gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"
    sub-delims  = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="

Their usage within URI component is limited to their reserved purpose. If the data would conflict with the reserved purpose, it must be escaped.
Characters in the "reserved" set are NOT reserved in all contexts. The reserved characters in a URI component is defined by that specific component.

Unreserved characters
a-z A-z 0-9 "-" "_" "." "~"
These characters can be escaped WITHOUT changing the semantics of the URI.
But this should NOT be done UNLESS the escape is necessary.

Disallowed characters
Some characters are disallowed for various reasons. To use those characters, they MUST be escaped.
Disallowed US-ASCII Characters:
control:      <US-ASCII coded characters 0x00-0x1F and 0x7F>
space:        <US-ASCII coded character 0x20>
delimiters:  < > # % "
unwise:       { } | \ ^ [ ] `

When to escape?
When a character does not have a representation using an unreserved character, it must be escaped. It includes:
(1) data that does not correspond to printable characters (ANSII coding)
(2) disallowed characters
Note: here, whether a character is unreserved is context-specific.

Escape sequences:
A "%" followed by hex representation of the character.
escaped = "%" hex hex
E.g. %20 %35
Uppercase hexadecimal digits should be used in percent-encoding!

Syntax
Generic URI syntax: 
    <scheme>:<scheme-specific-part>
Interpretation of scheme-specific-part depends on the scheme.
    <scheme>://<authority><path>?<query>

scheme
    alpha *( alpha | digit | "+" | "-" | "." )

authority
URI component authority can be internet-based server or a scheme-specific registry.
authority (server based) = username@host:port
userinfo = *( unreserved | escaped |";" | ":" | "&" | "=" | "+" | "$" | "," )
About domain label:

"The rightmost domain label of a fully qualified domain name will never start with a digit, thus syntactically distinguishing domain names from IPv4 addresses, and may be followed by a single "." if it is necessary to distinguish between the complete domain name and any local domain."

Query
query = *uric
Within a query component, the characters ";", "/", "?", ":", "@", "&", "=", "+", ",", and "$" are reserved.

Fragment
Fragment is not part of a URI, but is often used in conjunction with a URI.
URI-reference = [ absoluteURI | relativeURI ] [ "#" fragment ]

from RFC 2396:
"The semantics of a fragment identifier is a property of the data resulting from a retrieval action, regardless of the type of URI used in the reference.
   A fragment identifier is only meaningful when a URI reference is intended for retrieval and the result of that retrieval is a document for which the identified fragment is consistently defined."

Relative URI reference
to be continued in the future.

Specific schemes

scheme	syntax	Explanation	Note
file	file://<host>/<path>	Access a file on a specific host. <host> can be "localhost" or empty to indicate local host. E.g. file:///usr/home	Unlike http and ftp, It does not specify an internet protocol to access the files.
ftp	ftp://<host>:<port>/ <cwd1>/<cwd2>/.../<cwdN>/ <name>;type=<typecode>	<cwd1> through <cwdN> are strings and <typecode> can be "a", "i" or "d". If <typecode> is "d", <name> is used as the argument of NLIST command.	Within the <name> or a CWD component, / and ; must be escaped. E.g. ftp://test.com/%2Froot/a.txt
mailto	mailto:<mail-address>	RFC 2822 specifies the format of internet messages.	Usually, "%" must be escaped.
http	http://<host>:<port>/ <path>?<query>

Resources
URI working group: http://labs.apache.org/webarch/uri/

Fiddler in Firefox

The only reason that sometimes I use IE is Fiddler which is an excellent HTTP analytic and debugging tool. By searching around, I found that it could be used with Firefox besides IE. The official document is here http://www.fiddlertool.com/Fiddler/help/hookup.asp.

For Firefox 1.x, you need to select Tools -> Options -> General -> Connection Settings, then a pop-up windows is displayed. You select "Automatic proxy configuration URL" and input "C:\Documents and Settings\gerald\My Documents\Fiddler2\Scripts\BrowserPAC.js" in my case. You should modify the path accordingly. That file BrowserPAC.js is created and maintained by Fiddler which contains proxy information. Every time Fiddler is started or shutdown, that file is modified to reflect the state of Fiddler.

When Fiddler is started, the file is changed to:

function FindProxyForURL(url, host){
  return 'PROXY 127.0.0.1:8888';
}

From the content, you can guess that, actually Fiddler works as a proxy server which listens at port 8888. You can make any HTTP application which supports proxy setting redirect traffic to Fiddler.
Of course, you can set "Manual proxy configuration" for Firefox and type proxy address 127.0.0.1:8888. However, every time you want to  or don't want to use Fiddler, you must change the proxy setting. It is not convenient.

When Fiddler is shut down, the file is changed to:

function FindProxyForURL(url, host){
  return 'DIRECT';
}

That looks great, right? But there is a pitfall. Firefox does not detect change of the proxy configuration file. It means when you start or shut down Fiddler, Firefox will not be able to detect that. You must force Firefox to reload the proxy file: