Re: I'm stuck with an OS X module problem and -mmacosx-version-min=10.5

2009-11-17 Thread Patrick McManus
William, thanks for the response. A clearer way of asking my question: How do I (can I?) build a single binary module that runs on both OS X 10.5 and 10.6 with the standard apache package found on those systems - they are 2.2.11 and 2.2.13 respectively. Creating such a full executable

r833582

2009-11-17 Thread Plüm, Rüdiger, VF-Group
I now see the following warning: ssl_engine_kernel.c: In function `ssl_callback_Info': ssl_engine_kernel.c:1943: warning: passing arg 1 of `SSL_state' discards qualifiers from pointer target type Regards Rüdiger

Re: r833582

2009-11-17 Thread Mladen Turk
On 17/11/09 10:06, Plüm, Rüdiger, VF-Group wrote: I now see the following warning: ssl_engine_kernel.c: In function `ssl_callback_Info': ssl_engine_kernel.c:1943: warning: passing arg 1 of `SSL_state' discards qualifiers from pointer target type See the:

Re: r833582

2009-11-17 Thread Joe Orton
On Tue, Nov 17, 2009 at 10:06:32AM +0100, Plüm, Rüdiger, VF-Group wrote: I now see the following warning: ssl_engine_kernel.c: In function `ssl_callback_Info': ssl_engine_kernel.c:1943: warning: passing arg 1 of `SSL_state' discards qualifiers from pointer target type r881222 should fix it.

Re: handling request splicing in case of server initiated renegotiation CVE-2009-3555

2009-11-17 Thread Hartmut Keil
Hi Joe Joe Orton wrote: On Mon, Nov 16, 2009 at 09:59:12PM +0100, Hartmut Keil wrote: With the change described in https://issues.apache.org/bugzilla/show_bug.cgi?id=48204 the buffer used in ssl_io_input_read(..) will be reset, and so the second request of the MITM will be dropped. The

AIX build as installp package ready for testing

2009-11-17 Thread Michael Felt
It has taken a while for me to figure out what I was doing wrong - but that seems to be resolved. I have a build of apache2.2.14 ready. But rather than provide a link to the world before testing by others I wanted to ask for suggestions for finding testers - perhaps among the dev list. The basic

Re: mod_rewrite and mod_fcgid pass wrong fcgi request

2009-11-17 Thread Jeff Trawick
On Mon, Nov 16, 2009 at 7:06 AM, Jeff Trawick traw...@gmail.com wrote: On Mon, Nov 16, 2009 at 1:04 AM, Felipe Alcacibar falcaci...@gmail.com wrote: ... When comparing modes of PHP execution: - CGI and FastCGI are directly comparable because the information that Apache needs to pass to PHP

Re: handling request splicing in case of server initiated renegotiation CVE-2009-3555

2009-11-17 Thread Hartmut Keil
Joe Orton wrote: On Tue, Nov 17, 2009 at 11:42:40AM +0100, Hartmut Keil wrote: Joe Orton wrote: This would break HTTP pipelining over SSL (for affected configurations), and it might not fail gracefully - the server would appear to simply never receive the pipelined requests. I'm relucant

Re: TLS renegotiation disabling : mod_ssl and OpenSSL 0.9.8l

2009-11-17 Thread Jean-Marc Desperrier
Rainer Jung wrote: In the presence of the session ticket extension, session IDs observed on the server are no longer a good measurement for session reuse. Nice remark, except it's not that, it's really broken. With session tickets off (confirmed by the absence of the session ticket extension

Re: TLS renegotiation disabling : mod_ssl and OpenSSL 0.9.8l

2009-11-17 Thread Jean-Marc Desperrier
Joe Orton wrote: Please file a bug and attach all of: a) error_log output at LogLevel debug for that case b) the config snipping that you're using for /authentication c) the mod_ssl configuration This is now done in bug https://issues.apache.org/bugzilla/show_bug.cgi?id=48215 error.log

Re: TLS renegotiation disabling : mod_ssl and OpenSSL 0.9.8l

2009-11-17 Thread Dr Stephen Henson
Jean-Marc Desperrier wrote: Joe Orton wrote: Please file a bug and attach all of: a) error_log output at LogLevel debug for that case b) the config snipping that you're using for /authentication c) the mod_ssl configuration This is now done in bug

Re: Obsolete modules in 2.3

2009-11-17 Thread Gregg L. Smith
Lars Eilebrecht wrote: Or just use the 2.2 modules with 2.4. It was just my recent findings with 2.3.3-alpha that this will not work. If the APR 1.4(?) that was in httpd-2.3.3-alpha-deps.tar.gz is anything close to what will be shipped with 2.4 then no, this may not work. I had to rebuild all

Re: Obsolete modules in 2.3

2009-11-17 Thread Guenter Knauf
Hi, Gregg L. Smith schrieb: Lars Eilebrecht wrote: Or just use the 2.2 modules with 2.4. It was just my recent findings with 2.3.3-alpha that this will not work. If the APR 1.4(?) that was in httpd-2.3.3-alpha-deps.tar.gz is anything close to what will be shipped with 2.4 then no, this may

Re: Obsolete modules in 2.3

2009-11-17 Thread Roy T. Fielding
I personally find it useful to continue having support for features that were once used in the past, specifically to test things that once worked to see if they still work with the current version of Apache. Therefore, I do not consider these modules to be obsolete. Unless they are somehow

Re: Obsolete modules in 2.3

2009-11-17 Thread William A. Rowe Jr.
Roy T. Fielding wrote: I personally find it useful to continue having support for features that were once used in the past, specifically to test things that once worked to see if they still work with the current version of Apache. Therefore, I do not consider these modules to be obsolete.

[PATCH] useful ldap feature

2009-11-17 Thread Joe Schaefer
This patch applies against the 2.2 branch and adds the AuthLDAPBindAuthoritative directive, which allows infra to failover login requests to file based authentication. Normally what happens is that LDAP is authoritative when it can locate the dn for the user. This patch allows *both* passwords,

Re: [PATCH] useful ldap feature

2009-11-17 Thread Albert Lash
This patch applies against the 2.2 branch and adds the AuthLDAPBindAuthoritative directive, which allows infra to failover login requests to file based authentication. Normally what happens is that LDAP is authoritative when it can locate the dn for the user. This patch allows *both*