Kanwaljeet Singla's Blog

Urlscan to RequestFiltering migration using MSDeploy

ksingla — Fri, 30 Oct 2009 21:57:00 GMT

In addition to FastCGI migration provider, MSDeploy 1.0 RTW shipped with a URLScan to request filtering migration provider to ease migration of UrlScan.ini settings to system.webServer/security/requestFiltering section. Even though URLScan 3.1 is supported on Win2K8 and you are not required to move to request filtering module, there are few advantages in using request filtering module. One advantage is that all your configuration can stay together in applicationHost.config and web.config and you are not required to maintain a separate configuration file. Another advantage is that you can take advantages of new configuration system features like distributed configuration, shared configuration, locking, ability to use appcmd, UI, configuration editor etc which cannot be used if you use UrlScan and your configuration is in UrlScan.ini. In Win2K8 R2, you get additional advantages like configuration system auditing. Moreover, request filtering is one of the core IIS modules and will continue to get much attention compared to URLScan. If you are running Win2K8 SP2 or Win2K8 R2 in which request filtering module has all the features available in URLScan 3.1, you should definitely evaluate migrating from URLScan to request filtering. If you decide to migrate, migration is as simple as running a MSDeploy sync command.

URLScan migration is handled by a new provider in msdeploy named UrlScanConfig which accepts “INI” or “APPHOST” as path. When path is “INI”, URLScan configuration from “%windir%\system32\inetsrv\urlscan\urlscan.ini” is read. When path is “APPHOST”, configuration is picked from system.webServer/security/requestFiltering section. This migration provider works similar to FastCGI migration provider. UrlScanConfig migration provider reads UrlScan.ini configuration and produces xml which looks like requestFiltering section configuration. MSDeploy engine then takes care of comparing xml and doing add/update/delete operations on destination to make destination configuration same as source. Because msdeploy sync is a single master sync engine, we take care of not removing configuration from requestFiltering section which doesn’t have a counterpart in UrlScan. For example, hiddenSegments configuration in apphost is not deleted (skipped using urlScanSkipIncompatRuleHandler) and also applyToWebDav properties are not touched. Below are few examples showing the usage of UrlScanConfig migration provider.

Command to dump urlscan.ini settings.
msdeploy –verb:dump –source:urlScanConfig=ini –xml
msdeploy –verb:dump –source:UrlScanConfig=apphost -xml

Command to migrate urlscan.ini to requestFiltering section.
msdeploy –verb:sync –source:urlScanConfig=ini –dest:urlScanConfig=apphost -whatif

UrlScanConfig provider can be used to migrate global urlscan.ini configuration to server level requestFiltering section. Migrating site level UrlScan.ini is not supported. Here is how various URLScan properties map to requestFiltering section.

UseAllowVerbs	If set to 1 AllowVerbs section is used. Else DenyVerbs section in urlscan.ini is used
UseAllowExtensions	If set to 1 AllowExtensions section is used. Else DenyExtensions section in urlscan.ini is used
VerifyNormalization	allowDoubleEscaping
AllowHighBitCharacters	allowHighBitCharacters
UnescapeQueryString	unescapeQueryString

RequestLimits	MaxAllowedContentLength, MaxUrl and MaxQueryString settings are moved to requestLimits.
AllowVerbs, DenyVerbs	If UseAllowVerbs is 1, verbs@allowUnlisted is set to false and entries are added with enabled=”true”. If UseAllowVerbs is 0, entries has enabled=”false” and verbs@allowUnlisted is set to true.
AllowExtensions, DenyExtensions	When UseAllowExtensions is set 1, extensions are added with enabled=”true” and fileExtensions@allowUnlisted is set to false. When UseAllowExtensions is 0, fileExtensions@allowUnlisted is set to true and entries are added with enabled=”false”.
DenyHeaders	Moved to requestLimits/headerLimits after removing colon.
AlwaysAllowedUrls	alwaysAllowedUrls collection
DenyUrlSequences	denyUrlSequences collection
AlwaysAllowedQueryStrings	alwaysAllowedQueryStrings collection
DenyQueryStringSequences	denyQueryStringSequences collection

For each rule in RulesList, a filteringRule is created and Rule properties are mapped as following.

AppliesTo	filteringRule/appliesTo
DenyDataSection	filteringRule/denyStrings.
ScanURL	filteringRule@scanUrl
ScanAllRaw	filteringRule@scanAllRaw
ScanQueryString	filteringRule@scanQueryString
ScanHeaders	filteringRule/scanHeaders

All other properties (NormalizeUrlBeforeScan, AllowDotInPat, RemoveServerHeader, AlternateServerName, AllowLateScanning, UseFastPathReject, RejectResponseUrl, EnableLogging, PerProcessLogging, PerDayLogging, LogLongUrls, LoggingDirectory) are ignored because either they don’t make sense or the feature is always enforced by IIS core. We do block migration when incompatible versions of source and destination are present. Some request filtering features like applyToWebDav and hiddenSegments were not present in webDav. urlscanConfig migration provider doesn’t touch these properties if they are present on target. Not that if version of UrlScan is not compatible with IIS version present, migration will not be performed.

Thanks,

Kanwal

Feature additions and bug fixes coming up in WinCache

ksingla — Mon, 05 Oct 2009 21:35:00 GMT

We are seeing huge momentum behind adoption of WinCache . In the month of September, WinCache v1 Beta was downloaded more than 13,000 times making it one of the most downloaded IIS extensions in the first month following its release. Many happy customers...(read more)

Migrating FastCGI configuration from IIS 5.1/6.0 to IIS 7.0/7.5

ksingla — Fri, 25 Sep 2009 01:18:00 GMT

Problem As you know FastCGI functionality on IIS 5.1 and IIS 6.0 is provided by FastCGI ISAPI extension which is available as an independent download. On IIS 7.0 and beyond, FastCGI functionality is provided by IIS FastCGI module which comes with the...(read more)

How WinCache make PHP run faster

ksingla — Sun, 20 Sep 2009 02:03:00 GMT

Why WinCache? Use of PHP accelerators is very common to make PHP run faster. Most of the existing PHP accelerators which are in use today are designed keeping *nix architecture in mind and mostly doesn’t work well on Windows. For example, APC which is...(read more)

Getting both FastCGI module and AppPool CPULimit to work

ksingla — Thu, 02 Jul 2009 23:29:00 GMT

FastCGI module available in IIS 7.0 did not work when CPULimit for the application pool was enabled. This was because when CPULimit feature was enabled WAS uses job objects to track CPU usage of worker processes. WAS keeps a job object for each application...(read more)

FastCGI ISAPI 1.5 Beta for WinXP and Win2K3

ksingla — Tue, 21 Apr 2009 05:39:00 GMT

IIS team today released FastCGI ISAPI 1.5 Beta for WinXP and Win2K3 which has some very nice additions to existing FastCGI ISAPI functionality. Following additions have been made to FastCGI ISAPI 1.0 . 1. Few features we added to FastCGI module in IIS...(read more)

Using advanced logging to log custom module data

ksingla — Sun, 19 Apr 2009 03:34:00 GMT

Advanced logging module which media team released few days ago uses IIS tracing subsystem and allow module developers to log custom data in W3C compatible format using familiar IHttpTraceContext interface. If you are a module developer and want to generate...(read more)

Implementing IAppHostPathMapper in C

ksingla — Sat, 18 Apr 2009 22:38:00 GMT

Few days ago I was required to implement IAppHostPathMapper interface in native C to map configuration path MACHINE/WEBROOT/APPHOST to DefaultAppPool.config and struggled with finding good documentation. With help of some incomplete, hard to find documentation...(read more)

New features in configuration system and appcmd in IIS 7.5

ksingla — Wed, 25 Mar 2009 17:48:00 GMT

Following new features have been added to IIS configuration system and appcmd command line tool in IIS 7.5. Configuration System 1. Configuration system tracing and logging In IIS 7.5, IIS native configuration system can generate trace events capturing...(read more)

IIS 7.5 updates to custom errors and compression

ksingla — Mon, 16 Feb 2009 22:44:00 GMT

Looking at number of people reaching my first blog post while searching for information on IIS 7.5, I figured I should do few more posts on changes which are coming in IIS 7.5. In this blog post I am covering new features which have been added to compression...(read more)

Improvements to FastCGI in IIS 7.5

ksingla — Thu, 22 Jan 2009 18:10:00 GMT

Following improvements have been made to FastCGI module in Win7 (and Win2K8 R2). 1. Monitor changes to a file We have added ability to monitor changes to a file for each FastCGI process pool. Module will recycle FastCGI processes for the process pool...(read more)

Generating trace information in native modules

ksingla — Thu, 01 Jan 2009 19:36:00 GMT

IIS7 has really nice tracing capabilities which are available to all module developers. If you want to make it easy for you and your customers to debug problems in your modules, you should definitely be using them. You can use IHttpTraceContext::RaiseTraceEvent...(read more)

Using IMetadataInfo::GetModuleContextContainer to store configuration data

ksingla — Mon, 22 Dec 2008 04:05:00 GMT

If you write an IIS7 module, you would typically want to control its behavior based on some configuration data. IIS7 makes it really easy for developers to extend configuration schema so that their customers can put configuration data for their modules...(read more)

Generating configuration to allow/deny access to countries

ksingla — Fri, 19 Dec 2008 21:26:00 GMT

There have been few requests on forums where people wanted to control access to sites based on country from where request originated. We recommended people to use IP restriction module functionality which required people to add IP address ranges of the...(read more)

GenSCode updated to help use AhAdmin in C#, JavaScript

ksingla — Sun, 15 Jun 2008 18:25:00 GMT

As promised in my previous post , I updated genscode tool to provide intellisense for AhAdmin code in C# and JavaScript. GenSCode now accepts an optional codetype switch which can be AhAJavaScript to help use AhAdmin in JavaScript, AhACSharp to help use...(read more)