Re: strcasecmp raises its...

2022-05-18 Thread Stefan Eissing
> Am 18.05.2022 um 19:17 schrieb Nick Kew : > > >> On 18 May 2022, at 16:34, Ruediger Pluem wrote: >> >> Rüdiger > > What locale are YOU in there? Any attempt at locale is going to have to draw > lines: > what are the rules for when Ruediger == Rüdiger? > > In a WWW (and hence httpd) con

Re: CVE-2022-1388

2022-05-18 Thread Christopher Schultz
Eric, On 5/18/22 08:31, Eric Covener wrote: Given the above, I believe the interpretation of X-F5-Auth-Token should be that it is an end-to-end header, and should therefore NOT be removed from the proxied request. The text does say "All other headers *defined by HTTP/1.1* are end-to-end headers

Re: strcasecmp raises its...

2022-05-18 Thread Nick Kew
> On 18 May 2022, at 16:34, Ruediger Pluem wrote: > > Rüdiger What locale are YOU in there? Any attempt at locale is going to have to draw lines: what are the rules for when Ruediger == Rüdiger? In a WWW (and hence httpd) context, internationalised domain names raise all kinds of issues, i

Re: strcasecmp raises its...

2022-05-18 Thread Ruediger Pluem
On 5/18/22 4:55 PM, Joe Orton wrote: > On Wed, May 18, 2022 at 12:53:57PM +0200, Ruediger Pluem wrote: >> >> >> On 5/18/22 12:19 PM, Stefan Eissing wrote: >>> 2022 and we discuss strcasecmp() again? >>> >>> Background: OpenSSL 3.0.3 added OPENSSL_strcasecmp() and friends and there >>> are sever

Re: strcasecmp raises its...

2022-05-18 Thread Joe Orton
On Wed, May 18, 2022 at 12:53:57PM +0200, Ruediger Pluem wrote: > > > On 5/18/22 12:19 PM, Stefan Eissing wrote: > > 2022 and we discuss strcasecmp() again? > > > > Background: OpenSSL 3.0.3 added OPENSSL_strcasecmp() and friends and there > > are several issue around their implementation. Up t

Re: Named shared memory on macOS Monterey

2022-05-18 Thread Jim Jagielski
Yep. If I build APR w/ --enable-posix-shm all tests pass just fine. Otherwise I run into errors where, when creating the shared memory segments, we run out (NOSPC) > On May 18, 2022, at 8:15 AM, Eric Covener wrote: > > Is this what breaks the test framework with heartmonitor loaded? I've > lost

Re: CVE-2022-1388

2022-05-18 Thread Julian Reschke
Am 18.05.2022 um 14:50 schrieb Ruediger Pluem: On 5/18/22 2:31 PM, Eric Covener wrote: Given the above, I believe the interpretation of X-F5-Auth-Token should be that it is an end-to-end header, and should therefore NOT be removed from the proxied request. The text does say "All other headers

Re: CVE-2022-1388

2022-05-18 Thread Ruediger Pluem
On 5/18/22 2:31 PM, Eric Covener wrote: >> Given the above, I believe the interpretation of X-F5-Auth-Token should >> be that it is an end-to-end header, and should therefore NOT be removed >> from the proxied request. >> >> The text does say "All other headers *defined by HTTP/1.1* are >> end-t

Re: CVE-2022-1388

2022-05-18 Thread Eric Covener
> Given the above, I believe the interpretation of X-F5-Auth-Token should > be that it is an end-to-end header, and should therefore NOT be removed > from the proxied request. > > The text does say "All other headers *defined by HTTP/1.1* are > end-to-end headers" (emphasis mine, of course), and th

Re: Named shared memory on macOS Monterey

2022-05-18 Thread Eric Covener
Is this what breaks the test framework with heartmonitor loaded? I've lost the errors, ended up commenting out the mod and re-running Makefiles.PL to get unblocked. On Tue, May 17, 2022 at 3:26 PM Jim Jagielski wrote: > > Anyone else notice that the later version of macOS really prefer > that APR

CVE-2022-1388

2022-05-18 Thread Christopher Schultz
All, I've been doing some reading about the recently-publicized Big-IP vulnerability and I was wondering if httpd is doing the right thing. According to Randori's analysis[1] of the flaw, there is confusion between Apache httpd and Jetty (introduced by Big-IP) as to which component is respon

Re: strcasecmp raises its...

2022-05-18 Thread Ruediger Pluem
On 5/18/22 12:19 PM, Stefan Eissing wrote: > 2022 and we discuss strcasecmp() again? > > Background: OpenSSL 3.0.3 added OPENSSL_strcasecmp() and friends and there > are several issue around their implementation. Up to this version, they > relied on the POSIX strcasecmp(). Whatever their reas

strcasecmp raises its...

2022-05-18 Thread Stefan Eissing
2022 and we discuss strcasecmp() again? Background: OpenSSL 3.0.3 added OPENSSL_strcasecmp() and friends and there are several issue around their implementation. Up to this version, they relied on the POSIX strcasecmp(). Whatever their reasons for their change... Checking our sources, we have a