• If a server was excluded from load balancing because of an error or if it was temporary unavailable then it required administrator to manually add it back. With this release the Web Farm Service will attempt to auto-repair unavailable servers and add them back to load balancing once they become healthy again.
• Non-standard HTTP ports could not be used when communicating with servers in web farm.
• Error caused by race condition between when applicationHost.config is updated and when service reads the configuration.
• Service attempted to add firewall exception and failed if firewall service was not running.
• MSDeploy 1.1 was always installed on servers in the farm, even if MSDeploy 2.0 was available.
• Recycling of the app pool on the controller resulted in HTTP 502 errors.
• Secondary servers kept synchronizing the same changes over and over again.
• When primary server came back after downtime, the provisioning did not start automatically.
• Sync Error “An item with the same key has already been added.”
• User profile was not loaded when service was installed which caused installation failures.

Install the Web Farm Framework 2.1

To install Web Farm Framework 2.1 use the download links at the project’s home page at http://www.iis.net/expand/WebFarmFramework.

If you have Web Farm Framework 2.0 already installed, then it will be updated to v2.1. Note that a reboot maybe required during update and after the reboot the WebFarmService must be restarted on the controller server by using the command below:

net start webfarmservice

More information

• Web Farm Framework 2 Documentation
• Web Farm Framework Forum

• Workflow Builder is used to define and schedule custom tasks that can be run on all servers in the farm. The tasks can be scheduled to run periodically or can be started manually by an administrator. An example of such task could be a msdeploy command to partially sync web site content.
• Windows Credential Store support allows to store the administrator credentials used for server provisioning in a secure Windows Credential Store. This enables an added layer of security when dealing with credentials in Web Farm Framework.
• Third party load balancers support via Web Farm Framework extensibility. It is possible to configure Web Farm Framework to integrate with hardware load balancers instead of relying on IIS Application Request Routing module.
• Improved support for advanced MSDeploy operations. Options of MSDeploy can be used with Web Farm Framework for advanced deployment scenarios.
• Improved support for syncing large amount of files. Several issues related to syncing large amount of files across web farm nodes have been fixed.

In addition to that many bugs reported by beta users were fixed in this release.

Install the Web Farm Framework 2.0 – RTW

To install Web Farm Framework 2.0 use the download links at the project’s home page at http://www.iis.net/expand/WebFarmFramework.

If you have a beta build of Web Farm Framework 2.0 already installed, then it needs to be uninstalled prior to installing RTW build.

More information

• Web Farm Framework 2.0 Documentation
• Web Farm Framework Forum

IMPORTANT: Even if PHP applications on IIS do not use any of the ASP.NET features the vulnerability still exists as long as ASP.NET is enabled. It is recommended to install the security update as soon as possible.

The security update is available today via the Microsoft Download Center. In a next few days it will also be distributed via Windows Update channels. Once the update is on Windows Update, you can run the Windows Update on your servers to automatically apply the security patch.

If you plan to download the updates directly from Microsoft Download Center then follow the instructions in Scott Guthrie’s blog at:

http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-security-update-now-available.aspx

Update on Sep 28th, 2010: The security update for the vulnerability is available. More details can be found at PHP on IIS: get the latest security updates now.

Microsoft has recently released a Security Advisory about a security vulnerability in ASP.NET. This vulnerability exists in all versions of ASP.NET. The PHP applications running on IIS are also subject to this vulnerability if ASP.NET is enabled in IIS.

IMPORTANT: Even if PHP application is not using any of the ASP.NET features the vulnerability still exists as long as ASP.NET is enabled.

More information about the vulnerability can be found at the following links:

• Microsoft Security Advisory
• Security Research and Defense Blog
• Scott Guthrie’s blog about ASP.NET security vulnerability
• FaQ about about security vulnerability on Scott Guthrie’s blog

This blog post describes how to protect you PHP applications on IIS from attacks that exploit this vulnerability.

How to protect your PHP sites on IIS?

Microsoft is working on releasing a patch that fixes this security vulnerability. Until the patch is released there are two options that exist today for protecting your PHP applications on IIS.

1. If you do not need ASP.NET then disable it on the server
2. If you need ASP.NET then apply the workaround described in Scott Guthrie’s blog.

How to disable ASP.NET on IIS 6?

To disable ASP.NET on IIS 6 run the aspnet_regiis tool for every .NET version as shown below:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis /u
Start uninstalling ASP.NET (2.0.50727).
......................................................
Finished uninstalling ASP.NET (2.0.50727).

%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis /u
Start uninstalling ASP.NET (1.1.4322.0).
Finished uninstalling ASP.NET (1.1.4322.0).

How to disable ASP.NET on IIS 7?

To disable ASP.NET on IIS 7 follow these steps:

1. In the Windows Start Menu choose “Run:”, type “CompMgmtLauncher” and click “Ok”;
2. Select the “Web Server (IIS)” role, then click “Remove Role Services” and then disable the “ASP.NET” and “.NET Extensibility” checkbox under “Application Development” group:

How to apply the workaround?

If your IIS server is used to host both ASP.NET and PHP or if your PHP web site uses any ASP.NET features, then disabling the ASP.NET on the server is not an option for you. Instead you will need to apply the workaround that is described in details in Scott Guthrie’s blog:

http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

• User Cache API’s can be used by PHP scripts to store PHP objects and variables in shared memory. This way PHP scripts may improve the execution speed by storing processed data in the cache and then using it in subsequent requests instead of re-creating the data on every request.
• WinCache Session Handler can be used to configure PHP to store the session data in shared memory cache. Using shared memory instead of the default file session storage helps improve performance of PHP applications that store large amount of data in session objects. The content of the WinCache session cache is persisted on disk so that it is not lost during IIS worker process recycling.
• File Change Notifications – the entries in the opcode and file caches are now updated as soon as the corresponding PHP files are modified on a file system. This is very useful for PHP applications that store its configuration in PHP files – for example Joomla!. Now the configuration changes for those applications take effect right away instead of a 30 seconds delay (default cache refresh interval).
• Lock/Unlock API’s – these API’s can be used to obtain/release an exclusive lock on a key in the cache.

Install the Windows Cache Extension 1.1 for PHP – RTW

To install the WinCache Extension 1.1 for PHP 5.2 and PHP 5.3, use the download links at the extension’s home page at http://www.iis.net/expand/WinCacheForPhp.

The installation with Web Platform Installer is the easiest as it will automatically place the extension binary into proper location and will update the PHP configuration to enable the extension. Also, if you have the previous version of the extension installed, then Web PI will upgrade it. If you install any PHP application by using Web PI then the WinCache Extension 1.1 for PHP will be offered as an optional component.

If you install the extension manually, then follow the instructions at Installing/Configuring WinCache for PHP.

Getting the extension source code

The source code for the extension is available at http://pecl.php.net/package/WinCache/1.1.0stable. For the instructions on how to build the extension yourself refer to Building WinCache Extension.

Getting support

The WinCache extension is not supported by Microsoft Product Support Services. Instead it is supported as any other community PHP extension via the forums, mailing lists and the PECL bugs database. Use the following resources:

• To get help with installation, configuration and usage – WinCache documentation on php.net;
• To ask questions about the extension – WinCache forum on iis.net;
• To report a bug in the extension – PECL bug tracking system.

• File Change Notifications – the entries in the opcode and file caches are now updated as soon as the corresponding PHP files are modified on a file system. This is very useful for PHP applications that store its configuration in PHP files – for example Joomla!. Now the configuration changes for those applications take effect right away instead of a 30 seconds delay (default cache refresh interval);
• Persistent Session Handler – the content of the WinCache session cache is persisted on disk so that it is not lost during IIS worker process recycling.
• Lock/Unlock API’s – these API’s can be used to obtain/release an exclusive lock on a key in the cache.

The beta builds of the extension can be downloaded and installed from the extension home page at: http://www.iis.net/expand/wincacheforphp (look for the “WinCache 1.1 – Beta 2” section there). The source code can be obtained from http://pecl.php.net/package/WinCache/1.1.0beta2. The documentation for the extension can be found on PHP.NET WinCache documentation.

To learn how to change popular PHP applications to use WinCache 1.1 features refer to the following:

• Performance Improvement in Joomla using WINCACHE user cache
• Performance Improvement in Drupal using WINCACHE user cache
• Make WordPress faster on IIS with Wincache 1.1

This is the beta release and the WinCache team is looking for your feedback on new features and functionality. Use the WinCache Community Forum to ask questions about the extension, report bugs and problems and to suggest features and improvements.

• Express complex URL rewriting logic by using custom rewrite providers written in .NET.
• Replace the URLs generated by a web application in the response HTML with a more user friendly and search engine friendly equivalent
• Fix up the content of any HTTP response by using regular expression pattern matching.
• Modify HTTP request and response headers and IIS server variables.

For the complete list of features available in this version, refer to Using URL Rewrite Module 2.0.

Install the URL Rewrite 2.0 – RTW

To install the URL Rewrite 2.0, use the download links at the module’s home page at http://www.iis.net/expand/urlrewrite. Note that this is a final, production ready release that is officially supported by Microsoft.

Upgrade notes:

• If a previous version of URL Rewrite Module, such as v1.0 and v1.1, is already installed then it will be upgraded to the v2.0;
• If an RC version of the URL Rewrite Module 2.0 is already installed, then it will be upgraded to RTW version.

Install the URL Rewrite Extensibility Samples

An important new feature in this release is the support for custom rewrite providers that can be written in .NET. Custom rewrite providers can be used to implement complex rewrite logic which cannot be expressed by using built-in rewriting functionality.

The URL Rewrite Extensibility Samples include the .NET assemblies and the source code implementing the following providers:

• DbProvider – this provider can be used to retrieve rewrite mappings from a SQL Server database table by executing a stored procedure;
• FileMapProvider – this provider can be used to retrieve rewrite mappings stored in a text file;
• FileContainsProvider – this provider can be used to check if any string in a text file is a substring of the provider’s input string.

Download the URL Rewrite Extensibility Samples from MSDN Code Gallery.

More Information

The following documentation about URL Rewrite 2.0 is available on IIS.net:

• Using Custom Rewrite Providers with URL Rewrite Module
• Developing a Custom Rewrite Provider for URL Rewrite Module
• Creating Outbound Rules for URL Rewrite Module
• Reverse Proxy with URL Rewrite 2.0 and Application Request Routing
• Using Outbound Rules to insert Web Analytics Tracking Code
• Setting HTTP Request Headers and Server Variables
• Modifying HTTP Response Headers
• SEO Rule Templates
• User Friendly URL – rule template
• Reverse Proxy – Rule Template
• URL Rewrite Module v2.0 configuration reference

Also, visit the URL Rewrite Forum on IIS.NET if you have run into any problems when using the module or have questions or suggestions.

The update can be downloaded from the following locations:

• Update for Windows Server 2008 (KB980363)
• Update for Windows Server 2008 for Itanium-based Systems (KB980363)
• Update for Windows Server 2008 x64 Edition (KB980363)
• Update for Windows Vista (KB980363)
• Update for Windows Vista for x64-based Systems (KB980363)

The features that are enabled by this update:

• Monitor changes to a file. The module can be configured to listen for file change notifications on a specific file and when that file changes, the module will recycle FastCGI processes for the process pool. This feature can be used to recycle PHP processes when changes to php.ini file occur. To enable this feature use the monitorChangesTo setting in the <fastCgi> configuration element.
• Real-time tuning of MaxInstances setting. This MaxInstances setting dictates the maximum number of FastCGI processes which can be launched for each application pool. Set it to 0 to let FastCGI module automatically adjust the number of instances up or down based on the system load and number of requests waiting in the queue.
• STDERR stream handling. There are several options of how the module can handle text sent by FastCGI application on STDERR. The module can send the error data as a failure response to the HTTP client or it can ignore the error and send whatever was received on STDOUT as a response with 200 status code. This behavior is controlled by the stderrMode setting.
• Sending a termination signal to FastCGI processes. The module can be configured to send a termination signal to FastCGI process before terminating it. This enables FastCGI processes to do a clean shutdown before getting killed. The signalBeforeTerminateSeconds setting can be used to specify how long the module will wait before it forcefully shuts down the FastCGI process that does not respond to the termination signal. This feature is disabled by default.
• _FCGI_X_PIPE_ environment variable. This variable is set by FastCGI module and it contains the name of the named pipe that is used for communication between the module and FastCGI process.
• Relaxed enforcement of response headers syntax. The FastCGI module now has less strict enforcements for the correctness of the response headers.
• Using UTF-8 encoding for server variable values. By default FastCGI uses ASCII encoding when setting server variables. If a FastCGI application requires UTF-8 encoded values for certain server variables, the module can be configured to use UTF-8 only for required server variables. Follow these instructions to enable this functionality.

Note: To get UTF-8 encoding support in IIS 7.5 in Windows 7 and Windows Server 2008 R2 download the KB 2277918 hotfix.

In addition to that several important bugs have been fixed, most notable of those are the ones reported by Franklin Tse:

• FastCGI module replaces redirect status code set by PHP with HTTP 302
• Custom application errors were masked by the generic IIS errors

If you are using IIS 7.0 to host PHP applications, then it is highly recommended to apply this update to ensure you have the latest version of FastCGI module.

Today IIS team has published a beta of WinCache 1.1, which provides more options for improving performance of PHP applications on Windows. Specifically, the new version includes :

• User Cache API’s, that can be used by PHP scripts to store PHP objects and variables in shared memory. This way PHP scripts may improve the execution speed by storing processed data in the cache and then using it in subsequent requests instead of re-creating the data on every request. The addition of these API’s closes the remaining feature gap that WinCache had when compared with other similar caching solutions like APC and XCache.
• WinCache Session Handler, that can be used to configure PHP to store the session data in shared memory cache. Using shared memory instead of the default file session storage helps improve performance of PHP applications that store large amount of data in session objects.

The beta builds of the extension can be downloaded and installed from the extension home page at: http://www.iis.net/expand/wincacheforphp (look for the “WinCache 1.1 – Beta” section there). The source code can be obtained from http://pecl.php.net/package/WinCache/1.1.0. The documentation for the extension can be found on PHP.NET WinCache documentation.

This is the beta release and the WinCache team is looking for your feedback on new features and functionality. Use the WinCache Community Forum to ask questions about the extension, report bugs and problems and to suggest features and improvements.

• Fixed require_once on PHP5.3. If the files were absolute and similar files were included in different case, require_once was including it twice.
• Changed relative path cache to act as resolve path cache. Incremented refcounts under aplist lock. Did comparison using InterlockedCompareExchange.
• Fixed crashes which were happening because aplist refcount and opcode cache refcount can get out of sync due to local cache.
• Exposed is_local_cache property from ocache_fileinfo and fcache_fileinfo. Stats page will use this to indicate when local opcode data is shown.
• Updated the wincache.php to pass chart data on query string to ensure that the charts show the same data that is displayed in tables
• Updated the wincache.php to show whether information about a global or local cache instance is being displayed
• Changed variable names and comments to indicate rplist is resolve path cache and not just relative path cache
• Changed wincache.php to use resolve_path instead of relative_path

The new release is available for download from the extension’s home page at: http://www.iis.net/expand/wincacheforphp. The source code for the extension is available on PHP PECL page here: http://pecl.php.net/package/WinCache/1.0.1. The documenation for the extension can be found at http://www.php.net/manual/en/book.wincache.php.