# Significant Changes

> This page documents changes to the WASD VMS Hypertext Services Package that have some effect on configuration or behaviour. It lists changes from version 3.1 onwards, the first to be made available as freeware. Updating? Beware!

Version 7.1.1 (January 2001)

- A minor release corresponding to the closing of OpenVMS Freeware CD V5 submissions.

- The usual bugfixes :^)

- CGILIB has been updated for the new CGI interface requirements of Compaq Secure Web Server (CSWS) V1.0-1 (based on Apache 1.3.12).

- A "standard" area for script scratch space ... with the server cleaning up behind those that fail to. See the Scripting Environment, Introduction.

- QDLOGSTATS can now be used as a script and will provide an HTML form-based interface page.

Version 7.1 (November 2000)

- Scripting process creation has been moved from LIB$SPAWN() to SYS$CREPRC(). This allows some interesting new features including detached processes and scripts executing under non-server accounts (on VMS versions 6.2 and later), including user accounts. Subprocess scripting is still the default (i.e. it is backward compatible). Check the "Scripting Overview, Introduction" for the details.

- Selected server administration menu and command-line /DO= directives can now be simultaneously applied to all servers on a node or across a cluster. To see this in action, even with only one existing server on a single node, do a `$ @HT_ROOT:[000000]FREEWARE_DEMO` and then access the system's server Administration Menu.

- The server administration menu now provides specific functionality for maintaining service and message configuration.

- Proxy cache maintenance scans are now cluster-aware. A server undertaking a scan locks the cache, preventing other servers from simultaneously attempting to perform maintenance activities on the cache.

- Run-Time Environments are a persistant scripting mechanism designed to support interpreters like Perl and Java, with the objective of reducing response latency, increasing throughput and reducing system impact. This version includes an example Perl RTE, which can give a performance improvement of some twenty-five times on standard CGI Perl scripts! For Perl distribution considerations this Perl RTE must be fully compiled and linked locally.

- A new configuration directive [CgiStrictOutput] introduced in WASD 7.0 directs the server to report script responses that are neither CGI or NPH (i.e. have none or a faulty response header). This is enabled in the 7.n example configuration files. Site administrators that do completely new installations may find their old scripts are now being reported as "ERROR 502 - External agent did not respond (or not acceptably)." Either modify the script to supply an appropriate header (preferable) or disable the configuration directive.

- There have been some other refinements to the scripting environment and more detailed information provided in the Scripting Overview. It is recommended site administrators and script authors review this.

- CGILIB has been modified to become an object module/library. Compared to the code #include this is a more elegant method for delivering it's functionality. More significant WASD scripts have been modified to support this version (e.g. Conan, HyperShelf/Reader, WASDquery and others). The #includable functionality is still available.

- Changes in VMS Apache BETA behaviour between 1.3.9 (T1.3-9AG) and 1.3.12 (1.3-12) make some WASD Server and CGILIB code ineffective. As far as the author can tell there is no way to send a binary stream from a script via T1.3-12. Whether or not future changes to VMS Apache restores this functionality cannot be determined at the current time.

- The CGIUTL scripting utility has been enhanced so that POSTed request fields containing multiple lines (e.g. <TEXTAREA>s) can be processed into DCL symbols one line per symbol.

- HyperShelf now allows a URL item type. This allows a URL to be added to an ODL or BookShelf shelf file, providing a direct link to HTML/Web resources external to the local host or Bookreader environment.

- The FETCH utility FTP processing has undergone a major revision and now should present far fewer issues with some sites.

- A new utility QDLOGSTATS allows elementary server log statistics to be generated on an ad hoc basis.

- Built and verified against OpenSSL 0.9.6

Version 7.0 (June 2000)

- A major release version number change due to more significant changes to some server processing than could be justified as a minor version update.

- Extended file specification support. Under Alpha VMS V7.2ff the server and relevant scripts are ODS-5 volume compliant. This has a number of implications for server management and user activity. Please read the relevant section of the Technical and Environment Overviews.

- Built and verified against OpenSSL 0.9.5

- Some VMS Apache-like CGI scripting compatibility characteristics (based on the 1.3.9 BETA). These are intended to ease (or even remove completely) script portability issues between the WASD and Apache environments. CGILIB has also been modified to support VMS Apache (meaning WASD scripts using CGILIB run unmodified under Apache CGI).

- The server will now generate OPCOM messages against various categories of events, e.g. server startup/exit, authorization failure, server administration (e.g. mapping reloads, etc.), configured using the [Opcom...] configuration directives.

- Server error (and success) response page format improved (or at least changed). More Apache-like, consistent, informative and (in the author's opinion) aesthetically pleasing. There is now a simple mechanism (based on per-server configuration or request path SETting) for providing basic or detailed error responses.

- Three [...BodyTag] directives allow the <BODY> tags of server generated pages (such as error reports, directory listings, etc.) to be specified. This can provide a site with a significantly consistent "look-and-feel". In addition the actual format and contents of server error and success response pages may be specified using the HTTPD$MSG configuration file.

- The [LogPerService] configuration directive used to generate a log file using only the host name of a service (which can be problematic when virtual services share the same name, e.g. WWW.domain.com). It now generates a unique name based on as much of the full service IP name string as can be accomodated by VMS syntax constraints. Previous behaviours can be retained by enabling [LogPerServiceHostOnly] directive.

- Cookie-based session tracking is available using the [Track...] directives.

- The [SearchScriptExclude] directive allows specified file types (extensions) from being processed as implied keyword searches when a query string is present.

- The directive [AuthRevalidateLoginCookie] activates a cookie-based solution to consecutive authorization dialogs sometimes occuring when [AuthRevalidateUserMinutes] is active.

- .HTA and .HTL authentication databases require renaming to .$HTA and .$HTL (see Updating? Beware).

- The update facility has had slight aesthetic improvements (or at least changes) and slightly simplified capabilities.

- Proxy services may now have proxy authentication applied to them. This controls access to a proxy service using a separate and distinct proxy authentication dialog supported by modern browsers.

- A new tool, ApacheBench © The Apache Group, as used in the Apache Distribution, is included with this package (within licence conditions). It allows ad hoc server benchmarking and stress-testing (requires VMS 7.n or greater).

- Additional information and a Perl module for using Perl within the CGIplus environment has been provided.

- There are now a few coloured icons in the HT_ROOT:[RUNTIME.HTTPD] available if the b/w ones seem a bit lifeless ;^)

Version 6.1 (December 1999)

- NETLIB is no longer supported/required. The remaining TCP/IP packages for VMS, Compaq TCP/IP (UCX), Multinet and TCPware, all support the BG driver interface (UCX $QIOs) so this can be used exclusively.

- Authentication agents provide "easily" created, external authentication/authorization functionality. These are essentially CGI/CGIplus scripts (with all the attendant programming simplicity of this environment) specially invoked by the server for authorization purposes. Working examples, including an OSU CEL-compatible authenticator, are provided.

- CGI and CGIplus scripting support for callouts. These provide direct script-server dialogs, allowing various capabilities.

- Virtual hosting is far more comprehensive than in the base version of 6.0 (although it was actually reworked for v6.0.2). It now supports mappings against the request "Host:" header field, as well as for multi-homed hosts.

- OpenSSL v0.9.4 has been built and tested against v6.0 and v6.1, with build and update procedures modified to support it. SSLeay is no longer supported against this version (though may continue to link and work).

- The Server Side Includes processor now supports OSU-specific directives to provide transparent integration of OSU `.HTMLX` documents into the WASD environment.

- A new USER mapping rule provides /~username/ mappings using the default device and directory from the SYSUAF.

- As from v6.0.2 SYSUAF authentication honours NETWORK and REMOTE access account restrictions a new mechanism was required to support nil-access accounts. This is implemented using a new rights identifier, WASD_NIL_ACCESS.

- Administration Menu reports now allow a `SHOW PROCESS /ALL` to be performed on HTTPd processes (server, subprocess and DECnet scripts). The latter also allow individual deletion from the same report.

- The CGILIB source code has been considerably extended to support response generation, CGI callouts, Purveyor environment.

- The server can be used to cause the browser to cancel authentication against a particular path. Use "/what/ever/path?httpd=cancel", clear the fields and OK it. Then go backwards and access the original path, which should reprompt for authorization.

- Documentation now only supplied in HTML and PostScript formats. Plain-text and Bookreader formats are no longer generated, to help reduce the size of the distribution, and as a reflection of the diminishing importance of these formats.

Version 6.0 (June 1999)

- Proxy HTTP and FTP serving, with local HTTP caching.

- Authentication and authorization environment extension and refinement.

- Much improved WATCH detail for DCL, SSL and authorization.

- |  | SSL now supported using the OpenSSL 0.9.3 toolkit (with initial backward compatibility with previous SSLeay releases).

  OpenSSL now has integrated VMS support (largely thanks to Richard Levitte (levitte@lp.se)). WASD SSL packages include only object libraries, application objects, and support procedures (i.e. sufficient to support WASD's SSL). If a full OpenSSL toolkit is desired it should be obtained separately from http://www.openssl.org/ or http://www.free.lp.se/openssl/ and built locally.

- CGILIB.C source code library for easing the production of CGI C Language scripts.

- ISAPI scripting environment.

- New TMAILER script (WASD drop-in replacement for the OSU TMAIL script).

- New CGIUTL utility, assisting with scripting at the DCL level (particularly processing POSTed requests).

- Improved FETCH script/utility.

- Statement concerning Year 2000 and related issues. WASD HTTPd v6.0 has had it's directory listing dates extended to include a four digit year component.

Version 5.3 (November 1998)

- This release has some internal modifications improving performance and granularity of processing under high loads. CGI scripting performance has also been improved, and CGIplus is 75% faster in response.

- The WATCH facility, accessable from the administration menu, provides an online, real-time, in-browser-window view of request processing in the running server. Being able to observe live processing on an ad hoc basis, without changing server configuration or shutting-down/restarting the server process, makes this facility a great configuration and problem resolution tool.

- While virtual service support has been possible for some time, v5.3 extends this with a specific virtual server rule syntax and server startup procedures easing the support of virtual servers, multiple server processes on the one system, and multiple server systems within a cluster. Check the new STARTUP.COM and STARTUP_SERVER.COM functionality.

- A new SET mapping rule allows ad hoc characteristics to be set against a particular path or file template. File caching, stream-LF conversion, character set, content-type, expiry, invalid-RMS-character can currently be set on a per-path basis.

- Local-format error reporting, using CGI scripting, Server Side Include documents, or even "flat" HTML files, can now be configured using the [ErrorReportPath] configuration directive.

- SSL services may now use a server-common, or each a service-specific certificate (in line with other virtual service improvements).

- The [AddType] configuration directive now allows a character set to be specified with the content-type.

- Performance comparisons with OSU 3.3a are provided (as requested by a few of the curious).

Version 5.2 (September 1998)

- This is really a very minor revision with two bug-fixes. It coincides with the closing date for OpenVMS Freeware CD V4.

- DECnet scripting now supports connection reuse (as does OSU 3.3a) improving latency and throughput of network-based CGI and OSU scripting. The [DECnetReuseLifeTime] and [DECnetConnectListMax] configuration parameters support this.

- The [AuthRevalidateUserMinutes] configuration parameter specifies the maximum period between successive authenticated requests before the user is forced to reenter the authentication information. Zero disables this functionality.

- The [LogExcludeHosts] configuration parameter allows certain hosts or ranges of hosts to be excluded from access logs. This can eliminate the web-administrator's "noise" accesses, etc.

- The [StreamLFpaths] configuration parameter limits variable record to stream-LF file conversion to specified paths.

- The [DirNoImpliedWildcard] configuration parameter allows selection of directory listing behaviour for subdirectories with home pages.

- Improved HyperShelf/HyperReader behaviour in DECW$BOOK environments.

Version 5.1 (July 1998)

- The package's build support and distribution content has undergone a significant overhaul. VMS V6.0, V6.1, V6.2 through to V7.1 should be supported (almost) out-of-the box. Executables are no longer provided! All installations and updates will require a link prior to any other activity.

  To assist with this, along with installation and maintenance in general, two procedures are provided:

  1. INSTALL.COM
  2. UPDATE.COM

- The HTTPd itself has generally undergone minimal change. A few improvements to HTTP behaviour. A small number of bug-fixes.

- The Server Side Includes processor has been considerably extended, providing facilities similar to Apache's XSSI. User-assignable variables and the conditional processing of sections of a document provide the main functionality.

- For servers providing multiple services a per-service access log may now be generated. See configuration parameter [LogPerService].

- The server now allows a request to specify the content-type of a returned file.

- Finer control in the use of SYSUAF authentication is now possible using rights identifiers and the server /SYSUAF=ID qualifier.

- User CGI and OSU scripting is now supported within WASD's DECnet scripting environment.

- SSL support is now provided using a package based on SSLeay v0.9.0b. The server will still link and work with the 0.8.1 version.

- WASD script output has been changed to provide a more consistent look-and-feel, including customizable colour schemes (consult the source code for more information). Extensive use of HTML 3.2 tables provides heading and button formatting (in the late '90s we should be expecting at least this from our GUI browsers, and Lynx v2.8 still reproduces the pages quite acceptably). A non-table-centric layout is also generally available. Logos and other non-essential graphics have been eliminated improving the overall efficiency and responsiveness.

  Some scripts have had their behaviour or functionality slightly improved (or at least changed ;^) In particular, the HyperReader script has (arguably) better layout, robustness and non-English language document friendliness.

Version 5.0 (March 1998)

- Secure Sockets Layer protocol (SSL), supported using SSLeay v0.8.1 (optional package).

- DECnet-based CGI and OSU-emulated scripting.

- Directory listing file size may now be configured to display in bytes, kbytes and Mbytes. I like bytes, try `[DirLayout] I__L__R__S:b__D`

- Of course new bugs have been introduced through the ongoing process of fixing the old bugs, making refinements and introducing new capability `;^)`

Version 4.5 (November 1997)

- Configurable, monitorable file data and revision time cache introduced.

- Configurable script run-time environments. Script interpreters such as Perl may now be transparently activated to execute a particular script.

- Log files may now be configured to change according to a specified period ... daily, weekly, or monthly, providing some automation in managing file duration and size.

- Minor bugs fixed and minor refinements made.

- Everybody else is powered by ... something-or-other, well now we're `:^)`

Version 4.4 (October 1997)

- Due to optimizations in critical sections of the server and the elimination of debug code from production executables the server's performance has significantly improved.

- The server can now support multi-homed hosts and multiple-port services from the one process. Due to changes in connection request processing some NETLIB supporting TCP/IP packages can no longer provide DNS lookup (it now occurs at AST level, see the NETLIB documentation).

- Conditional rule mapping; applies rules only after certain criteria other than the initial path match are met (e.g. client internet address, browser-prefered language, browser-accepted content-type, browser identification string, authenticated remote user, HTTP method).

- The server can optionally use the VMS security profile of a SYSUAF-authenticated user name to determine whether access to a particular file or directory is permitted.

- Configurable message database, supporting multiple, concurrent languages.

- In addition to the common log format the server now supports the common+server and combined pre-defined formats, as well as user-defined formats.

- Some additional command-line server control functionality.

- Of course, the usual bugfixes (a couple of significant but not obvious ones this time) and minor refinements.

Version 4.3 (August 1997)

- MadGoat NETLIB support. As well as native Digital TCP/IP Services (UCX) support the server can now (potentially) support these packages:

  - Cisco MultiNet for OpenVMS, any version
  - PathWay from Attachmate Inc., any version
  - TCPware from Process Software Corporation, any version
  - CMU TCP/IP (VAX only) v6.5 or later is not supported due to too great a variation from the other packages.

- Activity report. This provides a graphical representation of server activity (requests and bytes transfered) for up to the previous 28 days.

- DCL scripting now has greater CGI compliance. Prior to v4.3 POSTed scripts would read the request header then the body (i.e. the full request). The CGI standard is body-only. This is now the default. A configuration parameter allows the previous behaviour to be explicitly selected.

- Logging can now be enabled and disabled on an ad hoc basis from the Server Administration Menu.

- Some minor bugfixes and refinements.

Version 4.2 (July 1997)

- Change of name from "HFRD VMS Hypertext Services" to "WASD VMS Hypertext Services". This follows a change of role and name for the Division.

- CGI scripting redesigned to improve performance through the use of persistant DCL subprocedures. Some additional configuration parameters support the reworked DCL module.

- CGIplus scripting (minor extension to standard CGI scripting) to further improve CGI performance through the use of persistant CGI applications.

- Additional server administration reports on requests (current and history) and DCL/scripting.

Version 4.1 (April 1997)

- Documentation brought more-or-less `:^)` up-to-date.

- HTTP response headers now more consistant.

- Delete-on-close for temporary files. Primarily used by the UPDate facility for previewing documents. (Beware ... any file name comprising a leading hyphen, sixteen digits and a trailing hyphen will be deleted on close!)

Version 4.0 (February 1997)

- Very significant changes to internal data structures and processing.

- Changes to startup and login procedures to more easily support multiple servers within clusters.

- On-line server administration menu providing reports, configuration and run-time actions of server. Obsoletes some of the `$ HTTPD/DO=...` functionality previously available from the command. More extensive server reports, and much more, available via `/httpd/-/admin/` (obsoletes `/httpd/-/report/`). These menus and dialogues generally require an HTML-table-capable browser, such as Netscape Navigator.

- Ability to configure server characterstics requires changes to the format of the HTTPD$CONFIG and HTTPD$AUTH files. Both are backward compatible, but if upgrading and using the on-line configuration the format will be changed the first time they are updated.

- HTTPd server becomes HTTP-cookie-aware.

Version 3.4 (October 1996)

- More extensive server reports (via `/httpd/-/report/` ... obsoleted by v4.0)

- Minor changes to error reporting.

Version 3.3 (August 1996)

- ``Basic'' and ``Digest'' authentication and path authorization. The digest scheme has, to date, only been tested against NCSA X Mosaic 2.7-4b, which seems to behave a little flakey when reloading documents, and does not elegantly support stale nonces.

- A configurable module is provided to automatically convert variable to stream-LF record format files. The stream format is much more efficiently processed by the server. (VARIABLE and VFC are read record-by-record, all others in block mode).

- To allow controlled access using authorization the server report is now generated via a path, as in the anchor ```<A HREF=/httpd/-/report>`'' (obsoleted by v4.0)

Version 3.2 (April 1996)

- The HTTPD$CONF configuration file no longer requires the encoding directive (7bit, 8bit, binary, etc.). This must be removed before upgrading from earlier versions. Encoding is now determined from the VMS file record format (VARIABLE and VFC are read record-by-record, all others in block mode).

- Persistent connections (HTTP/1.0 defacto standard) are now supported (for the majority of HTTP transactions). This significantly reduces request network overhead.

Version 3.1 (January 1996)

- Initial GNU Licensed freeware release.