URL escape-folding security issues history

2018-09-13 Thread William A Rowe Jr
As recently disclosed in; https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975 Sergey Bobrov brought this disclosure of a moderate vulnerability in mod_userdir to the httpd project security@ team. Given various examples of invalid and valid request URL's, even the valid input

Re: 2.4.35 in Sept?

2018-09-13 Thread Daniel Ruggeri
Hi, Bill; I would be game for tagging and rolling 2.4.35 and 2.4.36 shortly after. I can volunteer to do both... in fact, with the scripts in place (but needing some minor cleanup, I think), I'm generally willing to T on-demand barring personal things that would keep me from doing so. --

Re: 2.4.35 in Sept?

2018-09-13 Thread William A Rowe Jr
I'm unaware of anything blocking a tag today, if someone wants to proceed. What is gained by waiting a few days to slip in another rushed patch to break yet another release? I see nothing in STATUS necessary to fix 2.4 regressions, but many proposed behavioral changes which suggest the likelyhood

Re: 2.4.35 in Sept?

2018-09-13 Thread Gregg Smith
On 9/12/2018 1:47 PM, Jim Jagielski wrote: What improvements do you have to suggest to improve upon this? Do you recommend a longer vote time? Do you recommend beta and/or release-candidates? Do you recommend that the 1st born of all voters be held in a camp until the release has "proven"

AW: async mod_proxy_http

2018-09-13 Thread Plüm , Rüdiger , Vodafone Group
> -Ursprüngliche Nachricht- > Von: Yann Ylavic > Gesendet: Donnerstag, 13. September 2018 12:24 > An: httpd-dev > Betreff: Re: async mod_proxy_http > > On Thu, Sep 13, 2018 at 10:55 AM Plüm, Rüdiger, Vodafone Group > wrote: > > > > > -Ursprüngliche Nachricht- > > > Von: Yann

Re: async mod_proxy_http

2018-09-13 Thread Yann Ylavic
On Thu, Sep 13, 2018 at 1:59 AM Yann Ylavic wrote: > > On Wed, Sep 12, 2018 at 5:53 PM Eric Covener wrote: > > > > Forking from the Cool Stuff thread. > > > > Have you noticed that the wstunnell stuff makes the suspended count in > > the MPM grow? There is no API for us to tell the MPM that when

Re: async mod_proxy_http

2018-09-13 Thread Yann Ylavic
On Thu, Sep 13, 2018 at 10:55 AM Plüm, Rüdiger, Vodafone Group wrote: > > > -Ursprüngliche Nachricht- > > Von: Yann Ylavic > > Gesendet: Donnerstag, 13. September 2018 10:37 > > An: httpd-dev > > Betreff: Re: async mod_proxy_http > > > > On Thu, Sep 13, 2018 at 8:49 AM Plüm, Rüdiger,

AW: async mod_proxy_http

2018-09-13 Thread Plüm , Rüdiger , Vodafone Group
> -Ursprüngliche Nachricht- > Von: Yann Ylavic > Gesendet: Donnerstag, 13. September 2018 10:37 > An: httpd-dev > Betreff: Re: async mod_proxy_http > > On Thu, Sep 13, 2018 at 8:49 AM Plüm, Rüdiger, Vodafone Group > wrote: > > > > I don't like the "misuse" of c->aborted here. I for

Re: async mod_proxy_http

2018-09-13 Thread Yann Ylavic
On Thu, Sep 13, 2018 at 8:49 AM Plüm, Rüdiger, Vodafone Group wrote: > > I don't like the "misuse" of c->aborted here. I for instance log in > the access log whether connections have been aborted or not and this > approach would mean that all proxied websocket connections would get > marked as

Re: svn commit: r1840585 - in /httpd/httpd/trunk: docs/log-message-tags/next-number modules/ssl/ssl_engine_kernel.c

2018-09-13 Thread Stefan Eissing
Great work, Joe! > Am 12.09.2018 um 18:35 schrieb Joe Orton : > > On Wed, Sep 12, 2018 at 03:11:48PM +0200, Stefan Eissing wrote: >> How much have your testings now proceeded? Yann reported interop with >> firefox for him against trunk. Did you manage to track down your >> problems? Something

AW: async mod_proxy_http

2018-09-13 Thread Plüm , Rüdiger , Vodafone Group
> -Ursprüngliche Nachricht- > Von: Eric Covener > Gesendet: Donnerstag, 13. September 2018 02:34 > An: Apache HTTP Server Development List > Betreff: Re: async mod_proxy_http > > On Wed, Sep 12, 2018 at 7:59 PM Yann Ylavic > wrote: > > > > On Wed, Sep 12, 2018 at 5:53 PM Eric Covener

AW: async mod_proxy_http

2018-09-13 Thread Plüm , Rüdiger , Vodafone Group
> -Ursprüngliche Nachricht- > Von: Yann Ylavic > Gesendet: Donnerstag, 13. September 2018 01:59 > An: httpd-dev > Betreff: Re: async mod_proxy_http > > On Wed, Sep 12, 2018 at 5:53 PM Eric Covener wrote: > > > > Forking from the Cool Stuff thread. > > > > Have you noticed that the