Building Apache 2.4.4 from the Unix source with Openssl, zlib, libxml2, ipv6 support on Windows with Visual Studio 2012 to x86 binaries

Why would I want to even think about it? Well, because all the binaries compiled for windows have IPv6 disabled by default and the only way to enable it is to compile it yourself. Now I have to warn you, it took me well over a week to figure out what was going on and had endless failures. This procedure that follows is likely to test your patience, however, the result is a working Apache httpd running on Windows Server 2012.

That is, one that has been compiled from the original sources, and not one that has been added to by Bob down the road who has slipped in his own datalogger, if you know what I mean...

The main requirements are: Visual Studio 2012, the Platform latest SDK, perl and awk in the environment path, and CMake. Next...

Download it all

Download the latest version of apache source and unpack (Unix sources suffice) into a httpdxx root directory. All the following packages will end up in the srclib directory.
Download latest version of openssl source and unpack in to sub directory srclib\openssl
Download latest version of zlib source and unpack into in to subdirectory srclib\zlib
Download latest pcre source
Download the expat binaries compiled for windows and put into srclib\win32\bin\release
Download the prceombiled binaries and the dev packages for libiconv and copy into srclib\libiconv
Download the source for libxml2 and place into srclib\libxml

Build pcre

Unzip source into a seperate directory from your httpdxx directory. Add a build subirectory as a destination for your CMake build. Use CMake to create a solution for native Visual C 11 with the following options:
• BUILD_SHARED_LIBS Yes
• CMAKE_INSTALL_PREFIX (your httpdxx\srclib\pcre folder)
• PCRE_SUPPORT_UTF
Open the solution in Visual Studio and change to Release. Check the project to make sure that PDB’s are created. Compile the BUILDALL project. If all compiles, build the INSTALL project. Make sure the binaries end up in the same place.
Copy the pcre.dll and pcre.pdb into the srclib\pcre (needed because of badly written includes and this was the easiest option.)

Build zlib

Open your Visual Studio Dev Environment command line and cd to httpdxx\srclib\zlib
open VS Command Prompt and navigate to srrclib\zlib. build using:
nmake /f win32\Makefile.msc
nmake /f win32\Makefile.msc test

Build Openssl

cd to httpdxx\srclib\openssl
perl Configure VC-WIN32 enable-camellia no-idea no-rc5
(You do not really want zlib compiled into openssl do you? I’m shocked. Really!)
ms\do_ms.bat
nmake -f ms\ntdll.mak
Create an empty file store.h in srclib\openssl\inc32\openssl or OpenSSL will fail to build into the rest of the projects.

Prepare httpd

Update srclib\apr\include\apr.hw and change: (default is 0) This enables IPv6
#define APR_HAVE_IPV6           1
Run the following from the root of the httpd source to deal with UNIX line endings and prepared the projects for use with .net compilers:
>Perl .\srclib\apr\build\lineends.pl
>Perl .\srclib\apr\build\cvtdsp.pl -2005
Now open Visual Studio and open the Apache.dsw workspace file. It will convert the file to a Apache.sln and convert all the projects to .vcxproj.
Change properties of libhttpd:
Configuration Properties -> Linker -> General -> Additional Library Directories add .\srclib\pcre\lib (Location of pcre.lib)
Configuration Properties -> C/C++ -> General -> Additional Include Directories add ./srclib/pcre/include (location of pcre.h)
Open ApacheMonitor.rc and comment out the following line with a #:
"CREATEPROCESS_MANIFEST_RESOURCE_IF RT_MANIFEST "ApacheMonitor.manifest""
Change the Properties of ApacheMonitor:
Configuration Properties -> C/C++ -> Manifest Tool -> Input and Output -> Additional Manifest Files. Add ApacheMonitor.manifest
Change the properties of Mod_xml2enc
Configuration Properties -> C/C++ -> General -> Additional Include Directories add ./srclib/apr-iconv/lib

Build Libxml2

The Libxml2 source contains a folder called win32\VC10. Add the libxml2.vcxproj to your Apache solution. Change the properties of the libxml2 project. (You may need to upgrade the project first by going to Project -> Upgrade Projects.)
Configuration Properties -> General
-Configuration Type Dynamic Library (.dll)
Configuration Properties -> C/C++ -> All Options
-Enable Function-Level Linking: No
-Enable Instrisic Function: No
-Output Directory ..\Release (Or it will go into the httpd\Release folder. Not a good idea. You will need to create a win32\Release folder)
Configuration Properties -> Linker -> All Options
-Output File: ../Release/libxml2.dll
-Additional Library Directories: ../../../libiconv/lib;../../../libiconv/bin
-SubSystem: Windows
-Additional Dependencies: libiconv.lib;libcharset.lib;ws2_32.lib;mswsock.lib;
-Link Time Code Generation: Default
-Generate Debug Info: Yes
Modify mod_proy_html and mo_xml2enc. These two projects need Lib2xml.
Configuration Properties -> C/C++ -> All Options
-Additional Include Directories: ../../include;../../srclib/apr/include;../../srclib/libiconv/include;../../srclib/apr-iconv/include;../../srclib/apr-util/include;../../srclib/libxml2/include;
Configuration Properties -> Linker -> All Options
-Additional Library Directories: ../../srclib/libxml2/win32/Release;../../srclib/libiconv/lib;../../srclib/libxml2/win32/bin.msvc;
-Additional Depdencies: (Add) ws2_32.lib;mswsock.lib;

Build Apache

Go to Solution Congifuration. Change to Release and remove the build tick from the following projects:
• all projects beginning apr_db
• BuildAll
• BuildBin
• Fcgistarter
• gen_test_char
• InstallBin
• Libarpiconv_ccs_modules
• Libarpiconv_ces_modules
• Mod_lbmethod_rr
• Mod_lua
• Mod_session_crypto
• Mod_socache_dc
Build the Solution. This should allow everything to build successfully. There may well be something I have missed. Believe me, it is possible to fix it! I did.
Open your Visual Studio Dev Environment command line.
>Cd \htppdxx\srclib\apr-iconv\ces
Use NMake to create a batch file from the MakeFile instructions:
>NMAKE /nologo /f Makefile.win BUILD_MODE="Win32 Release" BIND_MODE=shared /N /U >>make.bat
Edit the make.bat file to remove all the leading tabs and remove all of " /Yuinconv.h " This stops the building of components using precompiled headers, otherwise you get an external reference error.
Run the batch file to compile these, do NOT compile them in Visual Studio.
Do the same in the ccs directory.
Amend Makefile.win. Find the section list below and add the line in bold:
!IF EXIST("srclib\libxml2")
 copy srclib\libxml2\win32\$(LONG)\libxml2.$(src_dll) "$(inst_dll)" <.y 
 copy modules\filters\$(LONG)\mod_proxy_html.$(src_so)  "$(inst_so)" <.y
 copy modules\filters\$(LONG)\mod_xml2enc.$(src_so)  "$(inst_so)" <.y
Save MakeFile.win.
Finally go to the root of the source directory and run the install script to pull out all the compiled files into an installation directory (in my case D:\Apache24)
>cd \httpdxx
>nmake -f makefile.win INSTDIR=D:\apache24 SHORT=R LONG=Release _install

Strip the Binaries

You now have about 86MB of Apache Server. You can make that a lot lighter by doing the following.
Remove all the debug information (i.e. del /S /Q *.pdb)
Delete the Manual Directory (That why Google was invented)
Delete the Include and Lib directories (Unless you are going to do some development work using this set of binaries.)
You should now have about 8MB of web server.

Install on Server 2008 R2/2012

Install the Visual C redistributable (You will need the 2012 version, of course)
Copy your cut down binaries to your chosen location on your server.
From a (elevated) Command Prompt, navigate to bin directory and run:
httpd.exe –k install (installs as a service and starts…)
Configure Server using the configuration files
Now – I cheated – of sorts. In order to get an initially working conf file, I installed apache using the MSI and ran through the initial configuration. When I then compiled my own version of apache, I used the same working configuration file and amended it from there.

Configuration Gotchas

SSLPassPhraseDialog The default setting (builtin) does not work on windows so you need to point to a pass phrase programme. I used Notepad.exe. I removed the pass phrases from my passwords (Just Google “retrieving a key and certificate from a PFX file.” Very effective)
SSLSessionCache This requires a path not broken by spaces. If you have installed to the default location (as with the msi installed provided by apache) then you’re not quite stuck, but it feels it. Create a shortcut in the root of the c drive that points to your apache directory. Then use shmcb:C:\Apache\etc…

And that is it. As I have said, I have probably missed some things out here, but I do have a working solution, so it is possible, if akin to having your fingernail being pulled out.

This year's IPv6 Roadblock

Are you wondering why most companies are not looking at IPv6? Why is adoption so slow?

The answer may be Web Filtering!!!

Go back 5 years and the blocks to IPv6 adoption were multiple. Device compatibility, especially firewalls and switching, applications. Even Active Directory in its 2003 form could not support IPv6.

That is all past. Today, lack of IPv6 support is a warning sign that the company you are purchasing from is lazy on the development front. Consequently, such companies are on a slow downward trend. Watch carefully and you'll see them disappear or bought out. Except for Web Filtering.

Most filtering companies are still on the edge of the cliff, gathering together for warmth and seeing who is going to jump in first. Well guess what, no one with any mind for web security (which is just about every minor organisation with the financial oomph to purchase such a package) is going to go IPv6 for web browsing until filtering is in place. Companies that look into IPv6 adoption don't jump and then look how they are going to do things, they want the whole project plan down first. So when they get to the final step and find that they cannot cross it, the whole project fails.

So it is not that companies are not looking for IPv6 filtering, they are just waiting for Web Filtering companies to get on board. Guess what, Web filtering companies are waiting for firms to tell them they want it. That is not going to happen! So if any web filtering company is reading this, want to get ahead of the competition in this tough season, IPv6 is your boost. Get in first and you may give yourself that needed lift to not only survive the current financial crisis, but to come out fighting.

Stateless IPv6 with DNS Options

Yes is it possible to have your cake and eat it!

IPv6 brought us stateless auto-configuration. Your routers do the work with router advertisements. This means no more having to configure every new VLAN with a DHCP range, worrying about your exceptions, your statics or router addresses. Now you can even have two routers on the one VLAN and your clients will happily talk to both/either. 

One of the problems to overcome is how to configure DNS while at the same time retaining a stateless IPv6 Addressing scheme. While running Dual Stack, this is not a problem; you will have already done the work in IPv4 and assigned DNS and Suffix Options to your DHCP range. Your IPv4 DNS server settings will happily serve AAAA addresses.

The days of IPv6 only networks are around the corner. They aren't here yet, so you have some time, but you will want to be ready.

First of all you will need a DHCPv6 server. If you are running DHCP on Windows Server 2008 or 2008 R2 this will serve. You need to bind your DHCP to a static IPv6 address on the server. There is a problem with Server 2008. DHCPv6 will not respond if it does not recognise all the options in the forward request. A solution to this can be found on KB Article 972962, and a hotfix is available. You need to set up your server options. I have at least one scope set up in the IPv6 section, although it is not used. You only need to set up a scope for a particular VLAN if you are intending to provide scope options different to that of the server options. As you are not intending to distribute IP addresses from the DHCPv6 server only the Server Options need concern you.

On your router, you need to enable the "other config flag." This flag is an option in the router advertisement package that signals the availability of other configuration options from a DHCPv6 server. This flag is an invitation, not an instruction, the client must act on it. Windows 7 does this. I have not tested other clients. The Cisco IOS interface command for this is:

ipv6 nd other-config-flag

You also then need a DHCP relay on the same interface that points back to the static binding on your DHCPv6 server. It is noted that in the past that our Cisco switches would not relay DHCP messages unless the DHCP server was running on the switch itself. So you may have to configure a DHCP pool on the switch, even if you do not use it. It is noted that on some older switches you can set up an IPv6 DHCP pool, provide the DNS server and domain prefix and user the ipv6 dhcp server command in the interface. This works as good as using the DHCPv6 server on windows. However, my latest routers running IOS-XE probably require an Enterprise Services License to do this. For the cost difference, I'll stick to relaying to a DHCPv6 Windows 2008 server running on VMware. The Cisco IOS interface command for setting up a DHCP relay is:

ipv6 dhcp relay destination [DHCPv6 Static IPv6 Address]

And that's it.

Remember that your clients will pick up the settings at the same time as they configure their IPv6 addresses, not their IPv4 addresses. This means that ipconfig /release and ipconfig /renew will have no effect on picking up these options. Either a restart is needed (preferable) or you can disable/re-enable the interface (or pull the cable out.) It has been noted that the later options can result in an inconsistent routing table on Windows 7, so use with caution.

IPv6 Reverse Proxy using Apache on Windows

Moving to IPv6 poses certain problems. The biggest of which is application compatibility. Of Course, as one would expect, Microsoft is on the bandwagon for IPv6. Unexpectedly, their web proxying product, Forefront TMG, does not play happy with IPv6. Maybe Microsoft are expecting us to put all our web servers out there straight on to the IPv6 web, bolts and all. We have all our web servers safely in our intranet, and use a single firewall/reverse proxy application to serve pages to the outside from multiple sources inside without the need to expose those servers, or multi-home them.

So what is out there that can do the job? Thankfully, Apache comes to the rescue. Apache makes proxying fairly simple, if you like text configuration files. After tinkering with it for a little bit, you'll see why I say that. Unfortunately, the IPv6 troll strikes again. In the standard Apache binaries, compiled for Windows, IPv6 is not built into the listening stack. But that is not the end of the world, because you can compile Apache yourself with Visual Studio's command line tools. I used Visual Studio 2010 professional in my attempt.

So, this document details how to build your own Apache binaries, with IPv6 listeners enabled:

To start off with you will need the locations of perl and awk.exe to be in the path variable. Check out where to get these from the Compiling Apache for Windows page.

Download the latest source versions. You are going to need the source code for Apache, Openssl and zlib. Create a working directory for the Apache source code and extract it there. You will find amongst the directory structure a directory called srclib. In this directory, create a sub-directory called openssl. Extract the Openssl source there. In the srclib directory, create another folder called zlib. Extrack the zlib source in there.

Build the components in the following order: zlib - Openssl - Apache

Building zlib: Open srclib\zlib\win32\makefile.msc. Add 'inffast.obj' to the OBJS= line and save the file. From your visual studio command prompt navigate to srclib\zlib. Build using the following two commands:
nmake -f win32\Makefile.msc
nmake -f win32\Makefile.msc test
If this is successful, you will see a series of tests where a file is created, compressed and decompressed.

Building openssl: From your visual studio command prompt navigate to srclib\openssl. the following commands:
perl Configure VC-WIN32 enable-camellia no-idea no-rc5
ms\do_ms.bat
nmake -f ms\ntdll.mak
Finally, create an empty file and name it store.h and place it in srclib\openssl\inc32\openssl

Building Apache: Open the file srclib\apr\include\apr.hw. Fine the line:
#define APR_HAVE_IPV6    0
Change the 0 for a 1. From your visual studio command prompt, navigate to the root of your Apache source code. Compile with the following commands:
nmake /f Makefile.win _apacher
nmake /f Makefile.win installr INSTDIR=D:\Apache2
(For D:\Apache2 put in a blank directory of your choice. Once compiled, this will contain the complete programme file structure for Apache.)

Now move the whole installation to your destination server. We used server 2008 R2. Place into the Program Files directory of your choice. Once located run httpd.exe -k to install the application as a service.

Now a little cheat. I had previously downloaded the msi installation files off the Apache website and had been fiddling around with that until I discovered that they had compiled it without IPv6 support. If you want to get up and running quickly, run the installer and answer all the questions. Your conf file is then set up to run for your server. I then deleted the contents of the programme files and inserted my compiled version, keeping the original working configuration.

So to add an IPv6 listener to Apache open the main httpd.conf file and add, for example:
listen [2xxx:xxxx:xxxx:xxxx::xxxx]:80
listen [2xxx:xxxx:xxxx:xxxx::xxxx]:443
Make sure your ssl certificates are all in place, by un-commenting the httpd-ssl.conf (in httpd.conf) and changing the settings accordingly. Thankfully, the Apache configuration files are well commented and set up is not rocket science.

Un-comment the httpd-vhosts.conf (in httpd.conf) and add your own site in place. Here are two examples:

Permanent redirection to https:

<VirtualHost [2xxx:xxxx:xxxx:xxxx::xxxx]:80>
 ServerAdmin admin@s.org.uk
 ServerName host.s.org.uk
 ServerAlias *.s.org.uk
 ErrorLog "logs/host.s.org.uk-error.log"
 CustomLog "logs/host.s.org.uk-access.log" common
 ProxyRequests Off
 
http://host.s.org.uk/*>
  Order deny,allow
  Allow from all
 

 redirect permanent / https://host.s.org.uk/
VirtualHost>
Proxy a http site over https

<VirtualHost [2xxx:xxxx:xxxx:xxxx::xxxx]:443>
 SSLEngine on
 SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
 SSLCertificateFile "C:\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\cert.pem"
 SSLCertificateKeyFile "C:\Program Files (x86)\Apache Software Foundation\Apache2.2\conf\cert.key"

 ServerAdmin admin@s.org.uk
 ServerName host.s.org.uk
 ServerAlias *.s.org.uk
 ErrorLog "logs/ssl.host.s.org.uk-error.log"
 CustomLog "logs/ssl.host.s.org.uk-access.log" common
 ProxyRequests Off

 http://host.s.org.uk/*>
  Order deny,allow
  Allow from all
 

 ProxyPass / http://host.s.org.uk/
 ProxyPassreverse / http://host.s.org.uk/
 ProxyPreserveHost Off
VirtualHost>

There are a few configuration gotchas in Apache to watch out for:
SSLPassPhraseDialog: No doubt you will want to run https on this. Unfortunately, the default setting (builtin) does not work on Windows. So you have to point this setting to an application. I pointed it to notepad. Having removed the need to enter a pass phrase this never gets called.

SSLSessionCache: This setting requires a path not broken by spaces. If you have placed your installation in Programme Files, this setting does not work. To get round it, create a shortcut in the root of the drive that points to your Apache directory. Then use that shortcut in the setting. (e.g. shmcb:c:\Apache\etc...)

Maybe Microsoft and other vendors will get their IPv6 act together before people start realising that the products they paid for are not up to scratch, and before freeware products like Apache start stealing their thunder...

Sonicwall NSA Support for IPv6

You may see a few posts on IPv6 through the summer. Keep tuned.

Sonicwall NSA firewall devices DO support IPv6. What they do not tell you is that you need a specific version of the firmware. (5.5.6) When you go to the downloads site, click on the previous versions link and look for the feature release - Version 5.5.6.0-IPv6.

Why they do not mention this anywhere is beyond me. But you've heard it here now. I hope my two days of frustrated hunting around will save you time.

IT Managers' Meeting at Westminster

In the spirit of Ian Yorston's talk on micro-blogging and social networking, all the resources for this event are going to be hosted "in the cloud." I thought to announce this move straight away on Twitter. I was therefore rather amused when I discovered that for a second day in a row the micro-blogging site had fallen off it's branch. Despite this knockback we shall soldier on.

As not everyone is on Twitter, and not following my particular Tweet, I hope that Ian will forgive me for using that conventional method of distribution; the Corporate Email.

The PowerPoint presentations will be hosted on my SkyDrive, that remarkable 5Gb of storage space provided to individuals for free as part of the Live package. The SkyDrive allows for both private and public documents. You can now take your presentation to your next meeting without a single piece of hardware on you. If they have internet, you can present it.

Of course, the SkyDrive is also a great place to share documents. You do this by adding documents to the Public Folder in your SkyDrive. It is then possible to use an amazingly long and complex link to share your files. Which leads me to the fourth and final piece of public air estate... http://www.tinyurl.cc/

A single SkyDrive link will overflow the 140 character limit of Blogger. (The links below were 144 characters in length.) It also looks horrendous. Go to Tinyurl and enter this complex link address and you are provided with a tiny url to replace the massively complex one. Not only can I now include these links in my Tweet, but my post here looks much neater. The URLs are practically permanent provided they are used. Unused URLs are deleted after a year of inactivity. If you have ever received an email with the URL cut in half, you will also appreciate the usefulness of Tinyurl.

The other sites mentioned in Ian's talk were:

• Hootsuite
• Facebook

And so to the other presentations:

http://tiny.cc/GbsMD VMWare - Server Virtualisation presented by Richard Hindley. This details Westminster School's implementation of and resoning behind using VMware to virtualise Servers and keep data safe.

http://tiny.cc/P7EsV App-v - Application Virtualisation presented by me. A lively discussion on Microsoft's idea of Virtual Applications and possibly the future of application delivery?

http://tiny.cc/vAOVx To VLE or not - On VLEs and MLEs presented by Ian Phillips. There is much more in this document than time allowed Ian to present.

http://tiny.cc/3Y7Ua Pupil Connectivity - This presentation was not shown in the end. Instead we had a discussion on the subject. This presentation details the thinking behind Westminster's implementation of a Cafe style wireless.

http://tiny.cc/bjApH IPv6 - A technical look at why we should keep an eye on IPv6. Presented briefly by me.

Enjoy...