Re: [Patch] Async write completion for the full connection filter stack

2014-09-09 Thread Graham Leggett
On 09 Sep 2014, at 10:58 AM, Nick Kew n...@webthing.com wrote: Ideally, filters should do this, but generally they don’t: /* Do nothing if asked to filter nothing. */ if (APR_BRIGADE_EMPTY(bb)) { return ap_pass_brigade(f-next, bb); } Why on Earth should filters want to

Re: [Patch] Async write completion for the full connection filter stack

2014-09-09 Thread Graham Leggett
On 08 Sep 2014, at 8:53 PM, Ruediger Pluem rpl...@apache.org wrote: Wouldn't it make more sense instead of using an empty brigade to create yet another metabucket that signals write completion? It could also contain information how much data to send down the chain for single filters if they

Re: [Patch] Async write completion for the full connection filter stack

2014-09-08 Thread Graham Leggett
On 08 Sep 2014, at 7:50 AM, Nick Kew n...@webthing.com wrote: +/* No problems found, and we were we sent an empty brigade, and + * did this empty brigade not get passed on by a filter to the next + * filter in the chain? Compensate by passing the empty brigade to +

Re: [Patch] Async write completion for the full connection filter stack

2014-09-08 Thread Graham Leggett
On 08 Sep 2014, at 3:50 PM, Jim Jagielski j...@jagunet.com wrote: This is pretty cool... haven't played too much with it, but via inspection I like the implementation. One question: === --- server/util_filter.c

[Patch] Async write completion for the full connection filter stack

2014-09-07 Thread Graham Leggett
Hi all, I have attached a patch that attempts to support async write completion for the full connection filter stack, not just the core output filter. In turn, this should bring async write completion to mod_ssl, and can be backported to v2.4. The idea behind the patch is to change the brigade

Re: [RFC] enhancement: mod_cache bypass

2014-08-23 Thread Graham Leggett
On 23 Aug 2014, at 03:50, Mark Montague m...@catseye.org wrote: I've attached a proof-of-concept patch against httpd 2.4.10 that allows mod_cache to be bypassed under conditions specified in the conf files. It adds an optional fourth argument to the CacheEnable directive: CacheEnable

Re: [RFC] enhancement: mod_cache bypass

2014-08-23 Thread Graham Leggett
On 23 Aug 2014, at 3:40 PM, Mark Montague m...@catseye.org wrote: Does this not duplicate the functionality of the If directives? No, not in this case: If -z %{req:Cookie} CacheEnable disk / /If [root@sky ~]# httpd -t AH00526: Syntax error on line 148 of

Re: [RFC] CGIPassHeader Authorization|Proxy-Authorization|...

2014-08-18 Thread Graham Leggett
On 16 Aug 2014, at 10:16 PM, Jeff Trawick traw...@gmail.com wrote: This core directive would be used to modify the processing of ap_add_common_vars() to pass through Authorization or Proxy-Authorization as HTTP_foo. (Nothing else is currently blocked, so any other header name wouldn't

Re: Apache 2.4 - incorrect (proxy, but not user) IP on server-status page

2014-08-17 Thread Graham Leggett
On 17 Aug 2014, at 22:34, Martynas Bendorius marty...@martynas.it wrote: Would anyone be willing to review https://issues.apache.org/bugzilla/attachment.cgi?id=31706action=diff and merge it to the trunk if it looks fine? It changes connection-client_ip to useragent_ip in scoreboard, so it

Re: httpd release version confusion re HTTP Server 2.4.10

2014-07-20 Thread Graham Leggett
On 20 Jul 2014, at 18:03, dev d...@cor0.com wrote: Has 2.4.10 been released or not ? It has been released, but we need to wait for the mirrors to update before formerly announcing the release. Regards, Graham --

Re: svn commit: r1608762 - in /httpd/httpd/branches/2.4.x: ./ CHANGES modules/proxy/proxy_util.c

2014-07-09 Thread Graham Leggett
On 9 Jul 2014, at 11:56, Yann Ylavic ylavic@gmail.com wrote: On Wed, Jul 9, 2014 at 7:35 AM, Marion Christophe JAILLET christophe.jail...@wanadoo.fr wrote: Just a few details : 1) Shouldn't we use 100-continue (lowercase c) instead, to more closely match

SSL_CLIENT_S_DN_x509 and subjectAltName

2014-05-19 Thread Graham Leggett
Hi all, In httpd v2.4's mod_ssl I can access the various components of the subject and the issuer DN using SSL_CLIENT_S_DN_x509 and SSL_CLIENT_I_DN_x509. Is there a corresponding set of variables that can pull the same information out of the subjectAltName? Regards, Graham --

Re: IF/ELSE- section and mod_cache errors

2014-04-28 Thread Graham Leggett
On 27 Apr 2014, at 7:14 PM, Yann Ylavic ylavic@gmail.com wrote: Could you try the following patch? Index: modules/cache/mod_cache.c === --- modules/cache/mod_cache.c(revision 1589129) +++ modules/cache/mod_cache.c

Re: svn commit: r1589986 - in /httpd/httpd/trunk: CHANGES docs/manual/expr.xml docs/manual/mod/mod_authnz_ldap.xml server/util_expr_eval.c

2014-04-25 Thread Graham Leggett
On 25 Apr 2014, at 1:04 PM, Jeff Trawick traw...@gmail.com wrote: Unless httpd trunk as a whole already prereqs 1.5.x, please ifdef this based on version of apr: +#include apr_escape.h #include limits.h /* for INT_MAX */ @@ -1061,6 +1062,12 @@ static const char

Re: mod_ssl: TLS/HTTPS multiplexing with other protocols

2014-04-24 Thread Graham Leggett
On 23 Apr 2014, at 8:39 PM, Daniel Pocock dan...@pocock.pro wrote: This brings me to the observation that something needs to do the TLS handshake and then look at the request body from the client (e.g. the HTTP request line or SIP request line) to work out what type of request it is. All of

Re: svn commit: r1384924 - in /httpd/httpd/trunk: include/httpd.h server/request.c

2014-04-24 Thread Graham Leggett
On 24 Apr 2014, at 8:34 AM, Christophe JAILLET christophe.jail...@wanadoo.fr wrote: the comment is wrong. 'ap_sub_req_lookup_dirent' uses the fact that 'rnew-uri' has some extra space after the NUL. 'rnew-uri' is allocated via 'ap_escape_uri' which is defined as: #define

Re: mod_cache thundering herd bug

2014-04-21 Thread Graham Leggett
On 19 Apr 2014, at 10:26 PM, Eric Covener cove...@gmail.com wrote: Graham -- related subject brought up either in Denver or in the bug. It seems that when we serve a stale file while the cache is locked, the age headers are small instead of large. I got totally lost trying to track down the

SSLUserName - mod_auth_user

2014-04-21 Thread Graham Leggett
Hi all, Right now, we have the SSLUserName directive, which takes an arbitrary SSL variable and turns it into a username for the benefit of the request. This has the downside that only SSL variables (and some CGI variables) are usable as usernames, and it combines with FakeBasicAuth to create

Re: [PATCH] mod_ssl APIs to allow implementation of Certificate Transparency as a separate mod

2014-04-14 Thread Graham Leggett
On 14 Apr 2014, at 2:03 PM, Joe Orton jor...@redhat.com wrote: Interesting stuff! I do think it is preferable to keep mod_ssl.h toolkit-agnostic. +1. Because the API you are adding is not indended to be private, I'd suggest mod_ssl_openssl.h or something like that instead. Pass what

Re: half-OT: heartbleed CVE-2014-0160

2014-04-09 Thread Graham Leggett
On 09 Apr 2014, at 1:48 PM, Reindl Harald h.rei...@thelounge.net wrote: after update openssl and re-new all certificates one question remains: in case of httpd-prefork would a attacker only have been able to compromise the private key and data of his worker-process or as well access the

Re: half-OT: heartbleed CVE-2014-0160

2014-04-09 Thread Graham Leggett
On 09 Apr 2014, at 2:14 PM, Roman Drahtmueller dr...@suse.de wrote: There have been some zero-before-free changes in mozilla-nss recently. It may be time to have object reuse issues in mind for both core and at least the auth* modules. The following function was added to apr-util to do that:

Re: [PATCH ASF bugzilla# 55897]prefork_mpm patch with SO_REUSEPORT support

2014-04-07 Thread Graham Leggett
On 07 Apr 2014, at 6:21 PM, Lu, Yingqi yingqi...@intel.com wrote: I just want to ping again on the modifications we made on both of the patches [bugzilla #55897 and bugzilla #56279]. Please let us know your comments and feedback. I am reattaching the patch files here in case you missed

Re: Which Apache module write the access log file

2014-03-28 Thread Graham Leggett
On 28 Mar 2014, at 7:04 AM, Miguel Villarreal miguel_villarrea...@hotmail.com wrote: I received this answer to my question: mod_log_confighttp://httpd.apache.org/docs/current/mod/mod_log_config.html#customlog Is this module also the one in charge of creating the access log file if it

Re: [VOTE] Release Apache httpd 2.4.8 as GA

2014-03-12 Thread Graham Leggett
On 12 Mar 2014, at 12:37 PM, Jim Jagielski j...@jagunet.com wrote: At the very least, upgrading from 2.4.7 to 2.4.8 should not cause this much pain. I will let the vote run a bit more to gauge additional feedback, but my sense says that 2.4.8 will likely be revoked/dropped and 2.4.9 will be

Re: [PATCH ASF bugzilla# 55897]prefork_mpm patch with SO_REUSEPORT support

2014-03-06 Thread Graham Leggett
On 06 Mar 2014, at 10:15 AM, Plüm, Rüdiger, Vodafone Group ruediger.pl...@vodafone.com wrote: +1 to a new MPM on trunk. This gives it more time to settle and to stabilize without disrupting current stuff. And if it is fast and stable it will certainly cause the 'older' MPM to drop in

Re: Resolving apr dependencies while generating httpd rpm build compiled from source

2014-03-03 Thread Graham Leggett
On 3 Mar 2014, at 08:05, Venkatesh Prabu Narayanan venkateshprab...@gmail.com wrote: Further to my previous mail, I have generated apr rpm build and successfully installed after installing the dependency packages (autoconf, libtool, doxygen). After this I tried installing apr-util 1.5.3

Re: Resolving apr dependencies while generating httpd rpm build compiled from source

2014-03-03 Thread Graham Leggett
On 3 Mar 2014, at 10:07, Venkatesh Prabu Narayanan venkateshprab...@gmail.com wrote: Most of these dependencies are not available for RHEL 4 via yum and that is why I have commented it out. If you comment out a dependency, you need to comment out the parameter to ./configure that enables

Re: Resolving apr dependencies while generating httpd rpm build compiled from source

2014-03-02 Thread Graham Leggett
On 2 Mar 2014, at 07:00, Venkatesh Prabu Narayanan venkateshprab...@gmail.com wrote: I am new to this list. I am trying to compile httpd 2.2.24 rpm build from source tar ball and it is failing with apr, apr-util dependencies. [root@localhost httpd]# rpmbuild -ba httpd-2.2.24.spec error:

Re: svn commit: r1565657 - in /httpd/httpd/trunk: include/ap_mmn.h include/http_core.h include/httpd.h server/connection.c server/core.c

2014-02-07 Thread Graham Leggett
On 07 Feb 2014, at 3:54 PM, j...@apache.org wrote: Author: jim Date: Fri Feb 7 13:54:38 2014 New Revision: 1565657 URL: http://svn.apache.org/r1565657 Log: Add in the concept of slave connections... Allows for several connections all resulting in a single real connection that talks to

Re: svn commit: r1565657 - in /httpd/httpd/trunk: include/ap_mmn.h include/http_core.h include/httpd.h server/connection.c server/core.c

2014-02-07 Thread Graham Leggett
On 07 Feb 2014, at 5:34 PM, Jim Jagielski j...@jagunet.com wrote: These are all good questions, and I'm not sure what the answer is right now... another one, maybe ap_run_create_connection should return a *slave* connection (it creates both master and its slave, but returns the slave). That

Re: svn commit: r1565657 - in /httpd/httpd/trunk: include/ap_mmn.h include/http_core.h include/httpd.h server/connection.c server/core.c

2014-02-07 Thread Graham Leggett
On 07 Feb 2014, at 6:26 PM, Jim Jagielski j...@jagunet.com wrote: Some kind of callback for each conn_rec, such that when we are done with it, it knows what do to (rejoin mod_proxy's pool, pool cleanup, whatever). In some ways, the slave connection actually behaves like a router, between

Re: http/2, spdy and bears, oh my!

2014-02-06 Thread Graham Leggett
On 05 Feb 2014, at 9:09 PM, Jim Jagielski j...@jagunet.com wrote: With http/2 becoming closer and closer, and spdy being in place as we speak, it seems that we should really ramp up development on trunk to support these new techs. Lets get serious on what needs to be done w/ trunk to get

Re: mod_session and friends need some help

2014-01-31 Thread Graham Leggett
On 30 Jan 2014, at 7:01 PM, Erik Pearson e...@adaptations.com wrote: On this specific sub-thread, you chose to single out a single topic. When you asked I'm not following the problem you're trying to solve., I chose to list the number of enhancements and bugs that I've encountered over a few

Re: mod_session and friends need some help

2014-01-30 Thread Graham Leggett
On 30 Jan 2014, at 3:32 AM, Erik Pearson e...@adaptations.com wrote: Au contraire -- most of the changes I'm making are driven by the application need, not just to clean up the code. Of course I do also have an interest in the design of the modules, from a programmer's perspective. But isn't

Re: svn commit: r1562500 - /httpd/httpd/branches/2.4.x/STATUS

2014-01-29 Thread Graham Leggett
On 29 Jan 2014, at 16:24, kbr...@apache.org wrote: Author: kbrand Date: Wed Jan 29 16:24:43 2014 New Revision: 1562500 URL: http://svn.apache.org/r1562500 Log: propose SSLCertificate[Key]File/SSLCertificateChainFile overhaul for mod_ssl Would it be possible to do the same for the

Re: mod_session and friends need some help

2014-01-29 Thread Graham Leggett
On 29 Jan 2014, at 11:17 PM, Erik Pearson e...@adaptations.com wrote: Actually, the more I've delved and actually used mod_session and friends, the more fundamental the changes have become. For instance, a lot of the code that lives in mod_session_cookie and mod_session_dbd seems more

Re: Simplifying mod_alias

2014-01-27 Thread Graham Leggett
On 27 Jan 2014, at 9:58 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: When doing this please keep in mind there is a huge amount of users out there who are not developers and who will struggle with something like LocationMatch ^/foo/(?bar[^/]+) Alias

Re: unsetting encrypted cookies when encryption key changes

2014-01-27 Thread Graham Leggett
On 27 Jan 2014, at 1:04 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: It just woke up - committed in r1560977 and proposed for backport to v2.4.x. Nice, thank you ! Isn't it curious how the expiry is inspected before the session is decoded? Why ? I was also confused by the

Simplifying mod_alias

2014-01-26 Thread Graham Leggett
Hi all, A look at mod_alias shows it has 7 directives: • Alias • AliasMatch • Redirect • RedirectMatch • RedirectPermanent • RedirectTemp • ScriptAlias • ScriptAliasMatch In theory we only need these three: • Alias • Redirect • ScriptAlias What I'm keen to do is enable expression support and

Re: unsetting encrypted cookies when encryption key changes

2014-01-24 Thread Graham Leggett
On 16 Jan 2014, at 5:15 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: I've had this deployed for some time now and it works just fine. Did this just fall asleep or is further explanation desired ? It just woke up - committed in r1560977 and proposed for backport to v2.4.x. Regards,

Re: mod_alias' Redirect with dynamic host

2014-01-22 Thread Graham Leggett
On 22 Jan 2014, at 5:36 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: Some time ago I put up HTTP to HTTPS redirects in place which now needed an update so they would not only work for constant host names but use the 'Host' header information as target host. So a simple Redirect

Re: svn commit: r1554300 - in /httpd/httpd/trunk: CHANGES include/ap_mmn.h include/ap_regex.h include/http_core.h modules/proxy/mod_proxy.c modules/proxy/mod_proxy.h server/core.c server/request.c ser

2014-01-15 Thread Graham Leggett
On 15 Jan 2014, at 3:04 PM, Jim Jagielski j...@jagunet.com wrote: Sounds good to me :) Had to do some digging to get my head around the impact. If the PCRE_DUPNAMES is missing, the list of names of variables is shorter than the list of variables defined, and you could have a variable value

mod_ssl: querying any certificate in the chain

2014-01-14 Thread Graham Leggett
Hi all, https://httpd.apache.org/docs/trunk/mod/mod_ssl.html#envvars described how we might query many of the parameters in the current certificate, however I have a need to query parameters in parent certificates in the chain, not just the primary certificate. Most specifically, I am after

Re: svn commit: r1554300 - in /httpd/httpd/trunk: CHANGES include/ap_mmn.h include/ap_regex.h include/http_core.h modules/proxy/mod_proxy.c modules/proxy/mod_proxy.h server/core.c server/request.c ser

2014-01-03 Thread Graham Leggett
On 01 Jan 2014, at 7:26 PM, Stefan Fritsch s...@sfritsch.de wrote: I am in favor of adding a prefix. If there are important use cases for setting arbitrary variables, one could (later) add a special opt-in mechanism, e.g. using noprefix:foo in the regex leads to variable foo without the

Re: svn commit: r1554300 - in /httpd/httpd/trunk: CHANGES include/ap_mmn.h include/ap_regex.h include/http_core.h modules/proxy/mod_proxy.c modules/proxy/mod_proxy.h server/core.c server/request.c ser

2014-01-01 Thread Graham Leggett
On 01 Jan 2014, at 1:59 PM, Stefan Fritsch s...@sfritsch.de wrote: I definitely like this idea. While I haven't done a full review of the patch, I have a few questions: Aren't the apr_table keys case insensitive anyway? Why do we need the case conversion of the key names? All the

Re: please sign new apache releases only with strong keys -- trimming the KEYS file

2013-12-31 Thread Graham Leggett
On 31 Dec 2013, at 20:07, Issac Goldstand mar...@beamartyr.net wrote: Not in this case. Revoking would be a statement by the key owner that the key is no good (something that would probably be smart to do, but at the same time way out of the PMC's control). Pruning the KEYS file is a

mod_dav: Can dav be enabled in the root / location?

2013-12-30 Thread Graham Leggett
Hi all, I am currently struggling to turn mod_dav on. In theory, it is just Dav on, but in practice I am getting a 405 Method Not Allowed in response to PROPFIND, and nothing in the error_log to give a clue that anything is wrong. So, before I go off and crank this up in a debugger to figure

Re: mod_dav: Can dav be enabled in the root / location?

2013-12-30 Thread Graham Leggett
On 31 Dec 2013, at 5:36 PM, Chris Darroch chr...@pearsoncmg.com wrote: By any chance, are you using 2.4.x/trunk and do you have mod_dir included in the build? I have a patch for a regression in 2.4.x/trunk where mod_dir hijacks PROPFIND and triggers a 405. Try taking mod_dir out and see

Re: mod_dav: Can dav be enabled in the root / location?

2013-12-30 Thread Graham Leggett
On 30 Dec 2013, at 6:14 PM, Eric Covener cove...@gmail.com wrote: there is also a PR potentially in the same neighborhood: https://issues.apache.org/bugzilla/show_bug.cgi?id=53929 For a while I thought it was a remove DefaultType issue in 2.4.x but I think that is probably wrong. A quick

Re: digest auth is not really more secure than basic auth (Fwd: svn commit: r1554276 - /httpd/httpd/trunk/docs/manual/mod/mod_auth_digest.xml)

2013-12-30 Thread Graham Leggett
On 30 Dec 2013, at 6:58 PM, Stefan Fritsch s...@sfritsch.de wrote: Does anyone disagree with the below change (not yet merged to 2.x branches)? There is a similar paragraph in howto/auth.xml that I intend to remove. I would say digest authentication is insecure because it (to my knowledge)

[Patch] LocationMatch (and friends) and back references

2013-12-28 Thread Graham Leggett
On 26 Dec 2013, at 11:45 AM, Graham Leggett minf...@sharp.fm wrote: Why not using the standard regex syntax: LocationMatch ~ ^/(?MYPREFIXfoo|bar)/baz/(?MYFILE.*) Is it supported by our current API? It wasn't, but it is in this patch. What this patch does is add all matching named variables

Re: LocationMatch (and friends) and back references

2013-12-26 Thread Graham Leggett
On 26 Dec 2013, at 10:13, Nick Gearls nickgea...@gmail.com wrote: Why not using the standard regex syntax: LocationMatch ~ ^/(?MYPREFIXfoo|bar)/baz/(?MYFILE.*) Is it supported by our current API? Regards, Graham --

LocationMatch (and friends) and back references

2013-12-25 Thread Graham Leggett
Hi all, It seems it is currently not possible to make reference to backreferences in regexes: LocationMatch ~ ^/(foo|bar)/baz Something ${1} /LocationMatch One of the tricky things to overcome to make this possible is that multiple LocationMatch'es might match, which makes the traditional

r-handler being overwritten with mime type

2013-12-12 Thread Graham Leggett
Hi all, I have just tripped over a case where mod_auth_form has been configured to do inline login. What is supposed to happen is that on successful parsing of the POST of the login form, we do an internal redirect to turn the request back into a GET (or whatever method the original form

Re: unsetting encrypted cookies when encryption key changes

2013-12-12 Thread Graham Leggett
On 12 Dec 2013, at 16:57, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: The patch does not help but I think it got me on the right track though I'm a bit confused about the 'dirty' flag. Where is that flag supposed to be used ? In both trunk and 2.4.7 I only found one place

Re: unsetting encrypted cookies when encryption key changes

2013-12-11 Thread Graham Leggett
On 09 Dec 2013, at 10:50 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: So it should work out of the box. I figured as much but was unsure whether I hit a bug or forgot a configuration directive. Will look into it once I have the time :-/ Here is an untested patch, can you give it a

Re: Do pools lead to bad programming?

2013-12-11 Thread Graham Leggett
On 12 Dec 2013, at 2:00 AM, Kean Johnston kean.johns...@gmail.com wrote: So I've been spending a fair bit of time inside Apache recently and I've seen a pattern. Consider the following code (from mod_proxy_fcgi.c): apr_uri_t *uri = apr_palloc(r-pool, sizeof(*uri));

Re: unsetting encrypted cookies when encryption key changes

2013-12-08 Thread Graham Leggett
On 04 Dec 2013, at 11:53 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: The encrypted session cookie, sent out in step 4, is never changed. I can not see any Set-Cookie headers coming from apache, not even in step 10. That is definitely a bug - if the session is decrypted with any key

Re: make mod_auth_form tell you where the credentials came from

2013-12-03 Thread Graham Leggett
On 03 Dec 2013, at 1:27 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: I have been having problems with mod_auth_form on returning DENIED from my custom auth provider. This provider has it's own module-local session cache, where stuff like accessible paths, credentials and the like are

Re: make mod_auth_form tell you where the credentials came from

2013-12-03 Thread Graham Leggett
On 03 Dec 2013, at 5:29 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: This whole process is important for supporting two factor authentication - in my example with OTP - but I doubt this is the only use case. In general it's a good idea to let the auth providers know where the user

Re: svn commit: r1546693 - in /httpd/httpd/trunk: docs/log-message-tags/next-number modules/ssl/ssl_engine_config.c modules/ssl/ssl_engine_init.c

2013-11-30 Thread Graham Leggett
On 30 Nov 2013, at 9:44 AM, kbr...@apache.org wrote: Author: kbrand Date: Sat Nov 30 07:44:27 2013 New Revision: 1546693 URL: http://svn.apache.org/r1546693 Log: Tweaks for SSLOpenSSLConfCmd: - use cfgMergeArray, and reduce the size of the initial array - move SSL_CONF_cmd calls from

Re: Does mod_perl/mod_??? need a hook called when a request/conn leaves the original worker thread?

2013-11-26 Thread Graham Leggett
On 26 Nov 2013, at 3:51 PM, Jeff Trawick traw...@gmail.com wrote: As it turns out (or, why didn't I refresh my understanding before), the MPM only knows about the conn_rec. * It could do extra work to learn about the request in order to pass the request to the new hook. * It could avoid

mod_ssl and pkcs11

2013-11-26 Thread Graham Leggett
Hi all, I am trying to use a pkcs11 engine within mod_ssl, and am digging as to how this might be done. The closest I've found is this patch https://issues.apache.org/bugzilla/show_bug.cgi?id=52473 Anyone know if there is anything newer out there? Regards, Graham --

Re: unsetting encrypted cookies when encryption key changes

2013-11-25 Thread Graham Leggett
On 25 Nov 2013, at 2:43 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: Switching mailing list from users to dev becazse to me this does not appear to be a configuration problem. Anyone care to give a hint ? and redirecting the user back to the form page again and again. I don't see a

Re: unsetting encrypted cookies when encryption key changes

2013-11-25 Thread Graham Leggett
On 25 Nov 2013, at 7:30 PM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: If I have misunderstood, and you simply want all the old cookies ignored and/or removed, then just list the new key by itself, the old cookies will not be considered at all - I'm not sure if the invalid cookie is

Re: [Patch] non blocking writes in core

2013-11-21 Thread Graham Leggett
On 21 Nov 2013, at 10:43 AM, Joe Orton jor...@redhat.com wrote: Those rules are written (explicitly) for resource-level filters. They would have to be a little different for CONNECTION level, e.g. EOS handling should probably be different... though I'm not sure how we'd write the rule.

Re: [Patch] non blocking writes in core

2013-11-21 Thread Graham Leggett
On 21 Nov 2013, at 4:50 PM, Plüm, Rüdiger, Vodafone Group ruediger.pl...@vodafone.com wrote: If this filter sets aside all stuff until eos (or a flush bucket) is seen it might cause a huge amount of memory consumption. So we possibly need some limit for memory consuming buckets which when

Re: [Patch] non blocking writes in core

2013-11-19 Thread Graham Leggett
On 18 Nov 2013, at 1:24 PM, Plüm, Rüdiger, Vodafone Group ruediger.pl...@vodafone.com wrote: +rv = send_brigade_nonblocking(net-client_socket, bb, + (ctx-bytes_written), c); +if (APR_STATUS_IS_EAGAIN(rv)) { +

Re: [Patch] non blocking writes in core

2013-11-19 Thread Graham Leggett
On 19 Nov 2013, at 7:44 PM, Graham Leggett minf...@sharp.fm wrote: This is indeed broken, fixed. Some more testing has revealed that mod_ssl's output filter breaks rules 2 and 5 of the 10 output filter rules published here: http://httpd.apache.org/docs/trunk/da/developer/output

[Patch] non blocking writes in core

2013-11-17 Thread Graham Leggett
Hi all, Continuing on from the discussion about how we might support write completion in mod_ssl, I have come up with the following patch below. I started by changing the event MPM to call all protocol filters instead of just the hard coded write filter: rv =

Re: http_filters

2013-11-13 Thread Graham Leggett
On 13 Nov 2013, at 2:04 PM, Jim Jagielski j...@jagunet.com wrote: It doesn't look like one to me... :/ One thing it does is make the return codes more targeted. Where previously any kind of failure would have returned 500 Internal Server Error[1] now we might return more specific codes based

Re: [VOTE] Release Apache httpd 2.2.26 as GA

2013-11-13 Thread Graham Leggett
On 13 Nov 2013, at 7:03 PM, Jim Jagielski j...@jagunet.com wrote: The pre-release test tarballs for Apache httpd 2.2.26 can be found at the usual place: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as Apache httpd 2.2.26 GA. [ ] +1: Good to go +1 for

Re: mod_ssl: why do we flush on EOS in ssl_io_filter_output()?

2013-11-12 Thread Graham Leggett
On 11 Nov 2013, at 12:29 PM, Stefan Fritsch s...@sfritsch.de wrote: The filter calls during write completion are done in the worker threads. There is no strict requirement that they must not block. I had an idea in my head that write completion took place in the listening thread not the

Re: Question on APLOGNO assignment, 2.4 vs trunk

2013-11-12 Thread Graham Leggett
On 12 Nov 2013, at 11:41 PM, William A. Rowe Jr. wr...@rowe-clan.net wrote: Trying to apply http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/log-message-tags/next-number?r1=1527925r2=1527924pathrev=1527925 ... there is no next-number tracking. How are we tracking numbers on 2.4 vs.

Re: Question on APLOGNO assignment, 2.4 vs trunk

2013-11-12 Thread Graham Leggett
On 13 Nov 2013, at 12:00 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: Follow-up question; is reuse recommended? In this small bit of trunk (comments removed for simplicity); -else if (!lenp) { +else if (f-r-proxyreq == PROXYREQ_RESPONSE) {

Re: mod_ssl: why do we flush on EOS in ssl_io_filter_output()?

2013-11-04 Thread Graham Leggett
On 28 Oct 2013, at 6:23 PM, Eric Covener cove...@gmail.com wrote: It would seem at the very least in order for any kind of write completion to be possible we would need to stop mod_ssl from trying to flush on EOS. Is there a specific problem that mod_ssl tries to solve by doing this? If

Re: [Patch] mod_ssl write completion

2013-10-29 Thread Graham Leggett
On 29 Oct 2013, at 12:07 PM, Plüm, Rüdiger, Vodafone Group ruediger.pl...@vodafone.com wrote: +status = ap_save_brigade(f, (filter_ctx-bb), bb, +filter_ctx-deferred_write_pool); When will this saved brigade handed over to the core output filter? How

mod_ssl: why do we flush on EOS in ssl_io_filter_output()?

2013-10-28 Thread Graham Leggett
Hi all, I am currently trying to find out why mod_ssl stops CONN_STATE_WRITE_COMPLETION from working correctly, and have noticed that for no clear reason, mod_ssl flushes the output filters when it receives an EOS bucket:

[Patch] mod_ssl write completion

2013-10-28 Thread Graham Leggett
Hi all, I was on the wrong track with regards mod_ssl and the flush-on-eos, the patch below to mod_ssl echoes a similar strategy the core output filter uses to enter write completion mode. The idea is that if the brigade to be written contains an EOS bucket but not a flush bucket, we can

Re: stop copying footers to r-headers_in?

2013-10-21 Thread Graham Leggett
On 21 Oct 2013, at 5:20 PM, Plüm, Rüdiger, Vodafone Group ruediger.pl...@vodafone.com wrote: Bikeshed... r-trailers_in? +1 to all this anyway. I'd be tempted to (lazily) stop here to see whether any users actually care about trailers. It looks like a pain to thread this change through both

Re: uds support

2013-10-15 Thread Graham Leggett
On 15 Oct 2013, at 7:01 PM, Jim Jagielski j...@jagunet.com wrote: I went ahead and made an exec decision to baseline unix:/path/to/sock.sock|http: as canon. trunk now does this. Can we further define it that /path/to/sock.sock is urlencoded? The | character makes me twitch, but I

Re: svn commit: r1531559 - /httpd/httpd/branches/2.4.x/STATUS

2013-10-12 Thread Graham Leggett
On 12 Oct 2013, at 17:51, bre...@apache.org wrote: + + * mod_dav: Fix 55397. dav_resource-uri treated as unencoded. This was an +unnecessary ABI changed introduced in 2.4.6. +trunk patches: https://svn.apache.org/r1529559 + https://svn.apache.org/r1531505 +

Re: Add skiplist to APR 1.5 (Was: Re: event MPM (Was: Re: Planning for 2.4.7 in Oct))

2013-09-28 Thread Graham Leggett
On 26 Sep 2013, at 15:44, Jim Jagielski j...@jagunet.com wrote: Like I said, I think that skiplist fits better in APR; in fact there are a few other things in httpd that would be better in APR, but APR and httpd are 2 sep projects and so we can't force things. In fact, I'm adding

Re: r1470679, async write completion, non blocking writes, and mod_ssl

2013-08-04 Thread Graham Leggett
On 04 Aug 2013, at 8:52 PM, Stefan Fritsch s...@sfritsch.de wrote: Hi, I did some testing/reviewing of the ssl/event backport proposal * core, mod_ssl: Lift the restriction that prevents mod_ssl taking full advantage of the event MPM. Enable the ability for a module to reverse

Re: AuthBasicProvider ssl-client-cert?

2013-07-21 Thread Graham Leggett
On 17 Jul 2013, at 4:44 PM, Eric Covener cove...@gmail.com wrote: All of the client-cert-as-basic-auth-substitute mechanisms we have require you to check the dummy password with a real authbasicprovider. Now that we have the expression parser and AuthBasicFake, would anyone be interested

Re: [VOTE] The 'RM' Baton

2013-07-10 Thread Graham Leggett
On 10 Jul 2013, at 8:41 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: A major problem which has occurred repeatedly, since the rapid pace of release candidates in the 2.0 series, is that the RM baton has been announced and dropped on the ground for weeks, if not many months. The prime

Re: Whereforeartthou, 2.5.0?

2013-07-10 Thread Graham Leggett
On 10 Jul 2013, at 8:19 AM, William A. Rowe Jr. wr...@rowe-clan.net wrote: Fellow PMC folk... I think everyone on this list can agree that the pace of releases has slowed to a crawl; we are 6+ mos between releases of our active/stable 2.4 series, which has little if any adoption, and are

Re: [discuss] The 'RM' Baton [was: VOTE]

2013-07-10 Thread Graham Leggett
On 10 Jul 2013, at 9:09 PM, William A. Rowe Jr. wr...@rowe-clan.net wrote: Right, but let's just take a look at our official STATUS and how you have treated it in the past year, and how that differed from 2.2...

Re: Decrypting mod_session-created cookie

2013-07-08 Thread Graham Leggett
On 9 Jul 2013, at 00:11, Daniel Lescohier daniel.lescoh...@cbsi.com wrote: https://httpd.apache.org/docs/2.4/mod/mod_session.html#sessionprivacy The session will be automatically decrypted on load, and encrypted on save by Apache, the underlying application using the session need have no

Re: Decrypting mod_session-created cookie

2013-07-08 Thread Graham Leggett
On 9 Jul 2013, at 00:29, Mikhail T. mi+t...@aldan.algebra.com wrote: Thank you, Daniel, for providing a you don't need to know answer to a question. I do, however, have this need -- in my application the cookie will need to be created by a server completely different from the one, that

Re: increase socache_shmcb maximum size

2013-06-17 Thread Graham Leggett
On 17 Jun 2013, at 3:15 PM, Jens Låås jel...@gmail.com wrote: Current maximum size of socache_shmcb is 64MB, which is rather small if you want to use it with mod_cache_socache. Memory is cheap etc. I also noticed that different data types seemed to be used to represent cache sizes:

Re: asynch websockets tunnel

2013-06-14 Thread Graham Leggett
On 15 Jun 2013, at 12:40 AM, Jim Jagielski j...@jagunet.com wrote: Anyone opposed if I commit to trunk? +1 to commit to trunk, that's where this stuff takes shape :) Regards, Graham --

Re: mod_cache_socache onliner bugfix

2013-06-13 Thread Graham Leggett
On 13 Jun 2013, at 1:07 PM, Jens Låås jel...@gmail.com wrote: Makes config merge work. Thanks for this, committed to trunk in http://svn.apache.org/r1492663, proposed for backport to v2.4. Regards, Graham --

Re: looking for luv

2013-06-13 Thread Graham Leggett
On 12 Jun 2013, at 20:08, Stefan Fritsch s...@sfritsch.de wrote: There doesn't seem to be any user of the skiplist than register_timed_callback, and there doesn't seem to be any user of register_timed_callback besides mod_dialup.c. Is mod_dialup really that important? And is the

Re: svn commit: r1491466 - in /httpd/httpd/branches/2.4.x: ./ CHANGES STATUS modules/proxy/proxy_util.c

2013-06-11 Thread Graham Leggett
On 11 Jun 2013, at 1:08 PM, Christophe JAILLET christophe.jail...@wanadoo.fr wrote: + *) proxy_util: NULL terminate the right buffer in 'send_http_connect'. + [Christophe Jaillet] + *) mod_remoteip: close file in error path. [Christophe Jaillet] *) mod_lua: Sync 2.4 branch with

Re: Forbid directive in core?

2013-06-10 Thread Graham Leggett
On 10 Jun 2013, at 3:35 PM, Eric Covener cove...@gmail.com wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration instead of require all denied. http://people.apache.org/~covener/forbid.diff This protects from a broad

Re: asynch websockets tunnel

2013-06-07 Thread Graham Leggett
On 07 Jun 2013, at 2:55 PM, Jim Jagielski j...@jagunet.com wrote: Yeah, I think conn_rec would make sense if we were a single-threaded server, but considering the hybrid that we are, the real thing we're concerned about are the raw sockets. This also makes more sense with things like SPDY,

Re: asynch websockets tunnel

2013-06-05 Thread Graham Leggett
On 05 Jun 2013, at 3:00 PM, Eric Covener cove...@gmail.com wrote: I've been playing with this in my sandbox, it adds a socket readable callback to event, similar to the timed callback, which allows mod_proxy_wstunnel to hop on and off the thread like test/mod_dialup.

Re: Time for 2.4.5 ??

2013-05-28 Thread Graham Leggett
On 28 May 2013, at 3:33 PM, Steinar H. Gunderson sgunder...@bigfoot.com wrote: Let me again ask for backports of r1368121, r1388447 and r1389339 from trunk; they are required to build mpm-itk without patching Apache. Proposed. Regards, Graham -- smime.p7s Description: S/MIME cryptographic

Re: mod_security core dumps and r-per_dir_config

2013-05-24 Thread Graham Leggett
On 24 May 2013, at 10:38 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: Why would the per_dir_config be NULL here ? I don't think that should ever be encountered during the request's lifetime, right ? I had this recently, and a completely clean rebuild sorted it out. Regards, Graham --

<    1   2   3   4   5   6   7   8   9   10   >