Re: mod_deflate DoS using HEAD

2009-07-15 Thread Joe Orton
On Tue, Jul 14, 2009 at 05:47:16PM +0200, Plüm, Rüdiger, VF-Group wrote: -Original Message- From: William A. Rowe, Jr. Sent: Montag, 13. Juli 2009 23:58 To: dev@httpd.apache.org Subject: Re: mod_deflate DoS using HEAD Nick Kew wrote: Eric Covener wrote:

Re: mod_deflate DoS using HEAD

2009-07-15 Thread William A. Rowe, Jr.
Joe Orton wrote: I'm confused. Why do this check so late, and why does r-bytes_sent matter? Why does it screw up the protocol if the DEFLATE filter does nothing for a HEAD request? Because of the concern that a HEAD will return a different C-L C-E to a GET on the same resource with

RE: mod_deflate DoS using HEAD

2009-07-15 Thread Plüm, Rüdiger, VF-Group
-Original Message- From: Joe Orton [mailto:jor...@redhat.com] Sent: Mittwoch, 15. Juli 2009 09:51 To: dev@httpd.apache.org Subject: Re: mod_deflate DoS using HEAD On Tue, Jul 14, 2009 at 05:47:16PM +0200, Plüm, Rüdiger, VF-Group wrote: -Original Message-

Re: [warn] worker http://ip_maquina/ already used by another worker

2009-07-15 Thread ricardo13
Hi, I studied this error and I undestand that error is created for ProxyPass. My httpd.conf: IfModule rewrite_module RewriteEngine on RewriteLog /usr/local/apache2/logs/rewrite_log RewriteLogLevel 5 RewriteLock /usr/local/apache2/logs/file.lock

Re: [warn] worker http://ip_maquina/ already used by another worker

2009-07-15 Thread ricardo13
Hi, I've resolvel this error. Thank you Ricardo ricardo13 wrote: Hi, I have a webcluster and I'm prioritize the requests. I modify request_rec adding a field called prior and conditional test ( IF() ) in mod_rewrite for classify. All time that start APACHE show the follow: #

Re: mod_deflate DoS using HEAD

2009-07-15 Thread Dan Poirier
William A. Rowe, Jr. wr...@rowe-clan.net writes: Joe Orton wrote: Does 2616 mandate that a resource must always exactly the same set of content-codings across methods and time? (AFAICT there is no MUST on that front; it's a SHOULD if anything) Read through to the end, it breaks all

Re: How do I manipulate request_rec Object in worker.c

2009-07-15 Thread Eric Covener
On Wed, Jul 15, 2009 at 7:39 AM, ricardo13ricardoogra...@gmail.com wrote: hi all, I modified request_rec simply adding a field in request_rec. Now, I would like get this field in worker.c My doubt about this is because worker.c manipulates only sockets and doesn't request_rec object. How

Re: mod_deflate DoS using HEAD

2009-07-15 Thread Joe Orton
On Wed, Jul 15, 2009 at 11:03:24AM +0200, Plüm, Rüdiger, VF-Group wrote: I'm confused. Why do this check so late, and why does r-bytes_sent matter? Why does it screw up the protocol if the DEFLATE All depends on the first brigade that passes mod_deflate. If this brigade contains the

Re: Hacking in an SLA for proxied requests in mod_proxy_http

2009-07-15 Thread Akins, Brian
I haven't looked at the code, but +1 for the idea. We had a hack that did something somewhat similar, but it was gross and in 2.0 - we never used it in prod. Is the proxy-timeout for the entire request to be returned, the first byte, or just an i/o timeout? -- Brian Akins

Re: AuthBasicProvider failover and mod_authnz_ldap

2009-07-15 Thread Brad Nicholes
On 7/13/2009 at 3:31 PM, in message 1404e5910907131431m42ec4cffwc08caf273b71f...@mail.gmail.com, Eric Covener cove...@gmail.com wrote: PR#47521 points out that when mod_authnz_ldap has some fatal LDAP connectivity error, it doesn't allow other AuthBasicProviders to have a shot at checking the

RE: AuthBasicProvider failover and mod_authnz_ldap

2009-07-15 Thread Plüm, Rüdiger, VF-Group
-Original Message- From: Brad Nicholes Sent: Mittwoch, 15. Juli 2009 16:58 To: dev@httpd.apache.org Subject: Re: AuthBasicProvider failover and mod_authnz_ldap authn_alias where the answer should be no? The second issue is what should authnz_ldap do? Authnz_ldap has already

RE: mod_deflate DoS using HEAD

2009-07-15 Thread Plüm, Rüdiger, VF-Group
-Original Message- From: Joe Orton [mailto:jor...@redhat.com] Sent: Mittwoch, 15. Juli 2009 15:29 To: dev@httpd.apache.org Subject: Re: mod_deflate DoS using HEAD On Wed, Jul 15, 2009 at 11:03:24AM +0200, Plüm, Rüdiger, VF-Group wrote: I'm confused. Why do this check so

Re: Hacking in an SLA for proxied requests in mod_proxy_http

2009-07-15 Thread Neal Richter
Brian Akins wrote: Is the proxy-timeout for the entire request to be returned, the first byte, or just an i/o timeout? To set a 900ms timeout the code does approximately this: apr_interval_time_t new_timeout = apr_time_make(0, 900 * (APR_USEC_PER_SEC/1000));

Re: AuthBasicProvider failover and mod_authnz_ldap

2009-07-15 Thread Eric Covener
On Wed, Jul 15, 2009 at 10:58 AM, Brad Nicholesbnicho...@novell.com wrote: The question here is given this context, should AUTH_GENERAL_ERROR == AUTH_USER_NOT_FOUND?  Given this context, the answer is probably yes. However are there any cases dealing with authn_alias where the answer should

Re: mod_deflate DoS using HEAD

2009-07-15 Thread Greg Ames
On Tue, Jul 14, 2009 at 11:47 AM, Plüm, Rüdiger, VF-Group ruediger.pl...@vodafone.com wrote: All very true. But how about the following patch. It should do no harm and should solve the issue in at least some cases (I think in most cases): Index: modules/filters/mod_deflate.c +if

Re: mod_deflate DoS using HEAD

2009-07-15 Thread William A. Rowe, Jr.
Joe Orton wrote: On Wed, Jul 15, 2009 at 11:03:24AM +0200, Plüm, Rüdiger, VF-Group wrote: I'm confused. Why do this check so late, and why does r-bytes_sent matter? Why does it screw up the protocol if the DEFLATE All depends on the first brigade that passes mod_deflate. If this brigade

Re: mod_deflate DoS using HEAD

2009-07-15 Thread Nick Kew
William A. Rowe, Jr. wrote: So +1 to the proposed patch; in fact, +1 on unsetting C-L and treating HEAD to the same processing as 304. +1. Since it's a SHOULD not a MUST, we can be pragmatic with the headers. That's back to Eric's original patch, isn't it? -- Nick Kew

William Rowe Jr. is now V.P., Apache HTTP Server

2009-07-15 Thread Roy T. Fielding
Since I have been elected onto the ASF board and don't want to be criticizing my own reports, I have resigned as chair of the project. The PMC nominated OtherBill for the post and, after I added a just-in-time resolution to today's board meeting agenda, I am happy to report that it was

How do I manipulate request_rec Object in worker.c

2009-07-15 Thread ricardo13
hi all, I modified request_rec simply adding a field in request_rec. Now, I would like get this field in worker.c My doubt about this is because worker.c manipulates only sockets and doesn't request_rec object. How do I do this ?? Thank you Ricardo -- View this message in context:

Re: How do I manipulate request_rec Object in worker.c

2009-07-15 Thread Ray Morris
I modified request_rec simply adding a field in request_rec. Now, I would like get this field in worker.c You also wouldn't modify request_rec, adding a new data member, to add information about a request anyway. If you wanted to add information about a request, you would add it to

Re: How do I manipulate request_rec Object in worker.c

2009-07-15 Thread ricardo13
Ray Morris wrote: I modified request_rec simply adding a field in request_rec. Now, I would like get this field in worker.c You also wouldn't modify request_rec, adding a new data member, to add information about a request anyway. If you wanted to add information about a

RE: How do I manipulate request_rec Object in worker.c

2009-07-15 Thread Houser, Rick
You realize that you could trivially handle most related issues without changing Apache at all just by prioritizing your backend work, right? For example, put your higher priority work in a faster server process than the low priority work. If your applications are written according to best

RE: How do I manipulate request_rec Object in worker.c

2009-07-15 Thread ricardo13
Hi, This is Task university. We have scheduling algorithms for request priorization (QoS). But, these algorithms were simulated. Now, my idea is to implement these algorithms. Analyze the behavior in production. Thank you Ricardo Houser, Rick wrote: You realize that you could trivially

mod_deflate feature needed

2009-07-15 Thread Anthony J. Biacco
I'm trying to use mod_deflate to compress data coming out of tomcat through mod_jk and need the proper content-length header set for the COMPRESSED data, but can't do this because the data is streamed and sent after the headers are set, therefore we don't know the compressed content-length until