As reported at http://drupal.org/node/168828#comment-643863 it seems not unheard of that people are running Drupal on sites where httpd is configured to not allow outbound network connections. :( This obviously renders update.module useless, since it can't "phone home". Seems like we need to:
A) Document this in the "OPTIONAL REQUIREMENTS" section of INSTALL.txt.
B) If drupal_http_request() fails, notice it, log an error to watchdog(), and if we're doing a manual check, drupal_set_message() about it, too.
C) Figure out if it's possible to test for this problem (without WSOD or triggering a hang/timeout/etc) on the status report and inform the site admin that their httpd configuration prevents update.module from working, then disable attempts to check for updates.
Given that this has string-freeze implications, we should try to clean this up before the RC1 release, so I'm marking this critical. However, I'm not able to work on this immediately, so if anyone else can get this started, please assign it to yourself.
Thanks,
-Derek
| Comment | File | Size | Author |
|---|---|---|---|
| #27 | drupal_http_request_fails_10.patch | 10.6 KB | dww |
| #25 | drupal_http_request_fails_9.patch | 11.45 KB | dww |
| #23 | drupal_http_request_fails.patch | 9.69 KB | chx |
| #18 | drupal_http_request_fails.patch | 9.38 KB | chx |
| #17 | drupal_http_request_fails.patch | 8.18 KB | chx |
Comments
Comment #1
dwwFor the interested reader:
http://fedoraproject.org/wiki/SELinux/apache (search for "httpd_can_network_connect")
https://bugzilla.redhat.com/show_bug.cgi?id=164700
http://www.php.net/manual/en/function.fopen.php#56551
http://www.php.net/manual/en/ref.ftp.php#76271
Comment #2
sunA completed, B + C missing.
Comment #3
gábor hojtsyHow can you distinguish in C between a regular timeout and blocked requests? It this is not possible, I'd not suggest blocking further tries on the updates if we cannot distinguish. Otherwise all sounds reasonable.
Comment #4
dwwI don't know how to distinguish yet, that's part of why I posted this issue, in case others know. It really depends on how this apache config knob is implemented. I'm guessing there's no way to tell just from the errno of the connect() failing, in which case we're kinda screwed. I'm hoping there's some way to directly ask httpd about this configuration knob, so we can test that, instead of just trying the connection and failing.
However, either way, if the http request fails, we should log it, and ideally print a nice message on the status report and update status pages about it, instead of a blank screen...
Comment #5
ChrisKennedy commentedShould we log all failed drupal_http_requests() or just those related to update.module?
Comment #6
chx commentedYou can request the clean URL page -- if that fails, that's surely not a timeout.
Comment #7
chx commentedB is impossible. Failure can have so many faces... you might even get a webpage telling you that stuff is denied. There are so many broken configs I would not try to figure out in drupal_get_request whether a request has failed. I will let every module decide for itself whether the result it got resembles what it expects.
Comment #8
chx commentedMuch better comments. (I was kind of satisfied that menu_execute_active_handler can run with any path :) otherwise I'd needed to patch that.) So we first get the JSON for the clean URL check -- why that? Because it's the simplest page I know. And then drupal_http_request it. The two should match.
Comment #9
dwwApplied the patch to a clean HEAD install, and added a "return NULL" at the top of function drupal_http_request() to simulate error. When I try to check for updates from the status report page, I see:
{ "status": true }printed directly to the screen. When I view the available updates page, I see that before the page headers, so I see a screen full of HTML, not the rendered page. :(
Comment #10
dwwOh, and after reloading the status report once the error's been hit, I get a bunch of E_ALL warnings:
Comment #11
chx commentedComment #12
chx commentedAdded title, too.
Comment #13
chx commentedThou shall not hack.
Comment #14
dwwAfter the reviews and testing with chx that led to the above patches, the functionality is now working fine. Thanks, chx! Here's a re-roll that attempts to clean up some of the user-facing text.
I'm still not sure if this menu handler and requirement check belong in system.module (under the premise that they might be shared by other modules), or if they should just go in update.module (the only part of core that's using them). Thoughts on this welcome. For now, I left them in system, as with chx's versions of the patch, though I think I lean towards making this stuff internal to update.module.
Comment #15
dwwDoh, wrong patch. ;) Try this one. However, the previous patch is useful if you want to test this one. ;)
Comment #16
chx commentedKeep it in system. I had good reasons to put it there -- others might want to use it and it's not like it's a big bloat or somethin'
Comment #17
chx commentedThere are many places that issues these requests. And yet we can't add simply to drupal_http_request because as I said above, failure can have many faces. We are adding this check after the reply does not parse.
Comment #18
chx commentedAdded a way to get the variable cleared.
Comment #19
gábor hojtsy- So why was calling of the clean URL check page considered hackish? This 'Nothing' menu items looks much more hackish to me. We can rename the clean URL check menu item to something more general to apply to both cases, if this is the only problem.
- It looks like that some code populates $result->error with an English message, while another part adds a t()-ed string (with a strange space at the start of the string). How is this supposed to work?
Comment #20
chx commentedThe clean menu URL issues a JS content type header which neatly fscks up the forthcoming plain HTML page. I am not aware of any way to remove an issued header and another content type header to mask the JS one, now that's a hack if I have ever seen one. The nothing entry is nice and compact :) The result error space is not significant now, I'll remove it later, the $result->error usually comes from fsockopen so it's usually not translated, so this special case is actually a bit better than other error strings.
Comment #21
gábor hojtsyStill you can name it "request-test" or whatever, not "nothing"...
Comment #22
keith.smith commentedAs a suggestion, how about this:
in the place of this:
Not worth holding up the patch, but just thought I'd suggest in in case of a reroll for some other reason.
Comment #23
chx commentedRenamed to request-test, added keith.smith 's text (thanks), changed deliberate no break to Deliberate because it's a sentence, removed the starting white space in aggregator.
Comment #24
dwwThis is looking great, chx, you rock! There are a few typos and formatting problems in various comments in the code, which I'm re-rolling now. Also, I'm fixing the INSTALL.txt text to be more general (it's not just about update.module anymore), and wrapping the hard-coded error message in t() -- granted, most of the errors aren't translatable, but this one is, so I don't see the harm... New patch coming soon, stay tuned.
Comment #25
dwwRe-rolled for the following:
Comment #26
dwwNo longer applies cleanly. :( Guess, I'll re-roll it.
Comment #27
dwwComment #28
snufkin commentedI tested by adding a return; in the first line of function drupal_http_request to simulate the block. When trying to run the status update it returns the blocked report, and it is also indicated correctly on the status report page. After removing the return and running the update the warning disappears, also from the status report. I read the INSTALL.txt modification, it looks good to me.
Comment #29
snufkin commentedhence i mark it RTBC
Comment #30
gábor hojtsyHm, committed this one, thanks.
Comment #31
(not verified) commentedAutomatically closed -- issue fixed for two weeks with no activity.
Comment #32
Battlehard commentedsorry this might be a really stupid question But how do i us this patch ?? sorry total newbie.. but I'm suffering the same problem.