Suggestion for improvment: Let apache does not fail after restart if a log dir is missing and let put an error or warning message in error log.

2011-12-21 Thread Ali Nebi
Hello, I would like to make a suggestion to apache web server developer and to open a discussion related with the way apache is working currently when a directory where apache must create logs files does not exists. Currently if I create a virtual host and set there Error/Custom Log entries to

Re: Suggestion for improvment: Let apache does not fail after restart if a log dir is missing and let put an error or warning message in error log.

2011-12-21 Thread Reindl Harald
On 21.12.2011 09:04, Ali Nebi wrote: Hello, I would like to make a suggestion to apache web server developer and to open a discussion related with the way apache is working currently when a directory where apache must create logs files does not exists. and at least fix that apachectl

Re: Proposal: adoption of mod_policy subproject

2011-12-21 Thread Graham Leggett
On 13 Dec 2011, at 6:22 PM, Graham Leggett wrote: - mod_policy: HTTP protocol police Based on the support expressed, and the expressed preference that the module be part of httpd, I have written appropriate documentation for the module, as well as documentation targeted at developers affected

Re: Proposal: adoption of mod_policy subproject

2011-12-21 Thread William A. Rowe Jr.
On 12/21/2011 4:35 AM, Graham Leggett wrote: On 13 Dec 2011, at 6:22 PM, Graham Leggett wrote: - mod_policy: HTTP protocol police Based on the support expressed, and the expressed preference that the module be part of httpd, I have written appropriate documentation for the module, as

Re: svn commit: r1221668 - in /httpd/httpd/trunk: CHANGES NWGNUmakefile build/installwinconf.awk configure.in docs/conf/extra/httpd-policy.conf.in docs/conf/httpd.conf.in modules/test/config.m4 module

2011-12-21 Thread Ruediger Pluem
minf...@apache.org wrote: Author: minfrin Date: Wed Dec 21 10:42:34 2011 New Revision: 1221668 URL: http://svn.apache.org/viewvc?rev=1221668view=rev Log: mod_policy: Add a new testing module to help server administrators enforce a configurable level of protocol compliance on their

Re: [Result] [Vote] .htaccess logic abuse

2011-12-21 Thread Joe Orton
On Tue, Dec 20, 2011 at 03:25:09AM -0600, William Rowe wrote: On 11/18/2011 4:38 PM, William A. Rowe Jr. wrote: After several prods, it seems the security@ and hackathon participants can't be drawn out of their shells on to dev@. So I'll simply call for a majority vote on the following

Re: svn commit: r1221668 - in /httpd/httpd/trunk: CHANGES NWGNUmakefile build/installwinconf.awk configure.in docs/conf/extra/httpd-policy.conf.in docs/conf/httpd.conf.in modules/test/config.m4 module

2011-12-21 Thread Graham Leggett
On 21 Dec 2011, at 2:57 PM, Ruediger Pluem wrote: +apr_table_addn(r-headers_out, Warning, apr_psprintf(r-pool, +299 %s \%s\, ap_get_server_name(r), message)); What is this 299 about? It's described in RFC2616:

Re: svn commit: r1221668 - in /httpd/httpd/trunk: CHANGES NWGNUmakefile build/installwinconf.awk configure.in docs/conf/extra/httpd-policy.conf.in docs/conf/httpd.conf.in modules/test/config.m4 module

2011-12-21 Thread Ruediger Pluem
Graham Leggett wrote: On 21 Dec 2011, at 2:57 PM, Ruediger Pluem wrote: +apr_table_addn(r-headers_out, Warning, apr_psprintf(r-pool, +299 %s \%s\, ap_get_server_name(r), message)); What is this 299 about? It's described in RFC2616:

Re: svn commit: r1221668 - in /httpd/httpd/trunk: CHANGES NWGNUmakefile build/installwinconf.awk configure.in docs/conf/extra/httpd-policy.conf.in docs/conf/httpd.conf.in modules/test/config.m4 module

2011-12-21 Thread Graham Leggett
On 21 Dec 2011, at 5:48 PM, Ruediger Pluem wrote: Ahh. Thanks for the pointer. Missed that it got set as a Warning header. I thought that this string got logged :-). Hence my confusion. Anyway shouldn't we #define 299 to a selfspeaking name like other HTTP codes such that this is

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Greg Ames
On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@ #define IS_SLASH(s) (s == '/') #endif +/*

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Guenter Knauf
Am 21.12.2011 20:08, schrieb Greg Ames: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Guenter Knauf
Am 21.12.2011 23:28, schrieb Guenter Knauf: Am 21.12.2011 20:08, schrieb Greg Ames: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Rüdiger Plüm
Am 21.12.2011 20:08, schrieb Greg Ames: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@