Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread KaiGai Kohei
Nick Kew wrote: > > On 8 Apr 2009, at 03:27, Graham Dumpleton wrote: > > [following up to Graham because two posts by him are all I have > in this thread] > >> 2009/4/8 KaiGai Kohei : >>> Graham Dumpleton wrote: Explain first why using FASTCGI and suexec wouldn't be a better option? >>> >>>

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread Graham Dumpleton
2009/4/8 KaiGai Kohei : > KaiGai Kohei wrote: >> Graham Dumpleton wrote: >>> 2009/4/8 KaiGai Kohei : Graham Dumpleton wrote: > Explain first why using FASTCGI and suexec wouldn't be a better option? Thease are limited to cgi applications, so we cannot apply such kind of restricti

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread KaiGai Kohei
KaiGai Kohei wrote: > Graham Dumpleton wrote: >> 2009/4/8 KaiGai Kohei : >>> Graham Dumpleton wrote: Explain first why using FASTCGI and suexec wouldn't be a better option? >>> Thease are limited to cgi applications, so we cannot apply such kind >>> of restriction on the built-in script langua

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread Nick Kew
On 8 Apr 2009, at 03:27, Graham Dumpleton wrote: [following up to Graham because two posts by him are all I have in this thread] 2009/4/8 KaiGai Kohei : Graham Dumpleton wrote: Explain first why using FASTCGI and suexec wouldn't be a better option? Thease are limited to cgi applications,

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread Graham Dumpleton
2009/4/8 KaiGai Kohei : > Graham Dumpleton wrote: >> 2009/4/8 KaiGai Kohei : >>> Graham Dumpleton wrote: Explain first why using FASTCGI and suexec wouldn't be a better option? >>> Thease are limited to cgi applications, so we cannot apply such kind >>> of restriction on the built-in script la

Re: segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread Plüm, Rüdiger, VF-Group
> -Ursprüngliche Nachricht- > Von: Paul Querna > Gesendet: Dienstag, 7. April 2009 20:15 > An: dev@httpd.apache.org > Betreff: Re: segfaults / core dumps caused by > ap_internal_fast_redirect > > On Tue, Apr 7, 2009 at 10:01 AM, William A. Rowe, Jr. > wrote: > > Plüm, Rüdiger, VF-Gro

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread KaiGai Kohei
Graham Dumpleton wrote: > 2009/4/8 KaiGai Kohei : >> Graham Dumpleton wrote: >>> Explain first why using FASTCGI and suexec wouldn't be a better option? >> Thease are limited to cgi applications, so we cannot apply such kind >> of restriction on the built-in script languages and references on >> st

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread Graham Dumpleton
2009/4/8 KaiGai Kohei : > Graham Dumpleton wrote: >> Explain first why using FASTCGI and suexec wouldn't be a better option? > > Thease are limited to cgi applications, so we cannot apply such kind > of restriction on the built-in script languages and references on > static documents (like *.html).

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread KaiGai Kohei
Graham Dumpleton wrote: > Explain first why using FASTCGI and suexec wouldn't be a better option? Thease are limited to cgi applications, so we cannot apply such kind of restriction on the built-in script languages and references on static documents (like *.html). # For example, when we want to a

Re: [RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread Graham Dumpleton
Explain first why using FASTCGI and suexec wouldn't be a better option? It concerns me that in your plans, even though you are changing the security context of a single thread within an existing process, that that thread may still has access to all the process memory and so could read or modify me

[RFC] A new hook: invoke_handler and web-application security

2009-04-07 Thread KaiGai Kohei
Hello, I've posted my idea to improve web-application security a few times however, it could not interest folks unfortunatelly. :( So, I would like to offer another approach for the purpose. The attached patch is a proof of the concept of newer idea. Any comments are welcome, and please feel free.

Re: segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread Paul Querna
On Tue, Apr 7, 2009 at 10:01 AM, William A. Rowe, Jr. wrote: > Plüm, Rüdiger, VF-Group wrote: > >> How to solve? >> >> I don't know. This is why I write this mail :-). > > We eliminate internal_fast_redirect ;-) > hell yeah, I would love to eliminate internal redirects completely.

Re: svn commit: r762771 - /httpd/httpd/trunk/modules/cluster/mod_heartmonitor.c

2009-04-07 Thread Ruediger Pluem
On 04/07/2009 03:38 PM, jfcl...@apache.org wrote: > Author: jfclere > Date: Tue Apr 7 13:38:01 2009 > New Revision: 762771 > > URL: http://svn.apache.org/viewvc?rev=762771&view=rev > Log: > Arrange traces. > > Modified: > httpd/httpd/trunk/modules/cluster/mod_heartmonitor.c > > Modified:

Re: svn commit: r762730 - /httpd/httpd/trunk/modules/cluster/mod_heartmonitor.c

2009-04-07 Thread Ruediger Pluem
On 04/07/2009 02:10 PM, jfcl...@apache.org wrote: > Author: jfclere > Date: Tue Apr 7 12:10:57 2009 > New Revision: 762730 > > URL: http://svn.apache.org/viewvc?rev=762730&view=rev > Log: > Set keep_running and clean pool if not. > > Modified: > httpd/httpd/trunk/modules/cluster/mod_heartm

Re: segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread William A. Rowe, Jr.
Plüm, Rüdiger, VF-Group wrote: > How to solve? > > I don't know. This is why I write this mail :-). We eliminate internal_fast_redirect ;-)

mod_proxy_balancer

2009-04-07 Thread h iroshan
hi all, please can I know is there any technical documentation for mod_proxy_balancer module. Best Regards, H. Iroshan

Re: segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread Plüm, Rüdiger, VF-Group
> -Ursprüngliche Nachricht- > Von: Joe Orton > Gesendet: Dienstag, 7. April 2009 15:51 > An: dev@httpd.apache.org > Betreff: Re: segfaults / core dumps caused by > ap_internal_fast_redirect > > On Tue, Apr 07, 2009 at 01:29:20PM +0200, "Plüm, Rüdiger, > VF-Group" wrote: > ... > > I t

Re: very brief sketch of configure interface and autoconf foo to support shared MPMs

2009-04-07 Thread Jeff Trawick
On Tue, Apr 7, 2009 at 10:31 AM, Nick Kew wrote: > Jeff Trawick wrote: > >> Comments on interface or the minimal implementation details? >> >> > Externally, the selection of the default MPM should match this logic >> (slight expansion on Jim's simple default=event change): >> >> if have-APR_POLL

Re: very brief sketch of configure interface and autoconf foo to support shared MPMs

2009-04-07 Thread Nick Kew
Jeff Trawick wrote: Comments on interface or the minimal implementation details? traditional: --with-mpm=FOO includes the FOO mpm, statically linked temporary hack: --with-mpm=shared avoids building/linking in an MPM future: traditional --with-mpm is retained; also support --with-mpms-shared=

Re: SNI in 2.2.x (Re: Time for 2.2.10?)

2009-04-07 Thread Henri Gomez
I'm working on securing massive NameVirtualHost sites using SSL. The SNI support should be avoided since we needed a stock Apache 2.x / mod_ssl solution, so it prevent us to take a look at mod_gnutls/gnutls. Question : How hard will it be to have SNI support conditional and activated/disabled by

Re: segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread Joe Orton
On Tue, Apr 07, 2009 at 01:29:20PM +0200, "Plüm, Rüdiger, VF-Group" wrote: ... > I think the reason for this behaviour is the following: > > 1. The subrequest created by mod_dir uses a subpool of r->pool for its > allocations. > 2. ap_internal_fast_redirect uses the data allocated out of this sub

very brief sketch of configure interface and autoconf foo to support shared MPMs

2009-04-07 Thread Jeff Trawick
Comments on interface or the minimal implementation details? traditional:--with-mpm=FOO includes the FOO mpm, statically linked temporary hack: --with-mpm=shared avoids building/linking in an MPM future: traditional --with-mpm is retained; also support --with-mpms-shared=MPM-LIST; this has to be u

Re: open_logs vs post_config

2009-04-07 Thread Jeff Trawick
On Mon, Apr 6, 2009 at 8:08 PM, Nick Kew wrote: > > On 7 Apr 2009, at 00:14, William A. Rowe, Jr. wrote: > > Nick Kew wrote: >> >>> As a matter of curiosity, why do we have two separate hooks with >>> identical signatures running consecutively? AFAIK it's not historic - >>> it goes right back t

Re: segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread Plüm, Rüdiger, VF-Group
> -Ursprüngliche Nachricht- > Von: "Plüm, Rüdiger, VF-Group" [mailto:ruediger.pl...@vodafone.com] > Gesendet: Dienstag, 7. April 2009 13:29 > An: dev@httpd.apache.org > Betreff: segfaults / core dumps caused by ap_internal_fast_redirect > How to solve? > > I don't know. This is why I

segfaults / core dumps caused by ap_internal_fast_redirect

2009-04-07 Thread Plüm, Rüdiger, VF-Group
Today I stubled accross some rather weird intermittent segfaults / core dumps with trunk plus APR trunk that get created when running the perl test framework. Below is the stack trace: #0 0x002a95f7f829 in kill () from /lib64/tls/libc.so.6 #1 #2 ap_ident_lookup (r=0x2a9cc9fd50) at mod_id

Re: SNI in 2.2.x (Re: Time for 2.2.10?)

2009-04-07 Thread Plüm, Rüdiger, VF-Group
> -Ursprüngliche Nachricht- > Von: Kaspar Brand > Gesendet: Montag, 30. März 2009 18:15 > An: dev@httpd.apache.org > Betreff: Re: SNI in 2.2.x (Re: Time for 2.2.10?) > > Ruediger Pluem wrote: > > Going through the archive I noticed several attachments > with the same > > basename and