Re: Apache C++ equivalent of javax.servlet.Filter

2013-05-03 Thread Sindhi Sindhi
I'm so sorry, I searched, and found that request_rec has the below members - char *args; char *unparsed_uri; apr_uri_t parsed_uri; Which of the below members will have the exact URI that is passed from the browser? On Fri, May 3, 2013 at 1:19 PM, Sindhi Sindhi sindhi@gmail.com wrote:

Re: Apache C++ equivalent of javax.servlet.Filter

2013-05-03 Thread Joe Lewis
On 05/03/2013 01:53 AM, Sindhi Sindhi wrote: I'm so sorry, I searched, and found that request_rec has the below members - char *args; char *unparsed_uri; apr_uri_t parsed_uri; Which of the below members will have the exact URI that is passed from the browser? unparsed_uri will have what you

Re: URL scanning by bots

2013-05-03 Thread Reindl Harald
Am 03.05.2013 06:35, schrieb Ben Reser: On Thu, May 2, 2013 at 4:53 PM, Guenter Knauf fua...@apache.org wrote: isnt that one of the core issues - that folks who dont know what they do run a webserver? And then, shouldnt these get punished with being hacked so that they try to learn and finally

Re: URL scanning by bots

2013-05-03 Thread Marian Marinov
On 05/03/2013 07:24 AM, Ben Reser wrote: On Tue, Apr 30, 2013 at 5:23 PM, André Warnier a...@ice-sa.com wrote: Alternatives : 1) if you were running such a site (which I would still suppose is a minority of the 600 Million websites which exist), you could easily disable the feature. 2) you

Re: URL scanning by bots

2013-05-03 Thread Dirk-Willem van Gulik
On 3 mei 2013, at 10:55, Marian Marinov m...@yuhu.biz wrote: If Apache by default delays 404s, this may have some effect in the first month or two after the release of this change. But then the the botnet writers will learn and update their software. I do believe that these guys are

Re: URL scanning by bots

2013-05-03 Thread André Warnier
Ben Reser wrote: On Tue, Apr 30, 2013 at 5:23 PM, André Warnier a...@ice-sa.com wrote: Alternatives : 1) if you were running such a site (which I would still suppose is a minority of the 600 Million websites which exist), you could easily disable the feature. 2) you could instead return a

Re: URL scanning by bots

2013-05-03 Thread Reindl Harald
Am 03.05.2013 11:38, schrieb André Warnier: I agree that 404's are legitimate responses. And I agree that legitimate clients/users can expect to receive them. But if they do receive them when appropriate, but receive them slower than other kinds of responses, this is not really breaking

Re: URL scanning by bots

2013-05-03 Thread André Warnier
Marian Marinov wrote: On 05/03/2013 07:24 AM, Ben Reser wrote: On Tue, Apr 30, 2013 at 5:23 PM, André Warnier a...@ice-sa.com wrote: Alternatives : 1) if you were running such a site (which I would still suppose is a minority of the 600 Million websites which exist), you could easily disable

Re: URL scanning by bots

2013-05-03 Thread Tom Evans
On Fri, May 3, 2013 at 10:54 AM, André Warnier a...@ice-sa.com wrote: So here is a challenge for the Apache devs : describe how a bot-writer could update his software to avoid the consequences of the scheme that I am advocating, without consequences on the effectivity of their URL-scanning.

Re: URL scanning by bots

2013-05-03 Thread Graham Leggett
On 03 May 2013, at 11:54 AM, André Warnier a...@ice-sa.com wrote: So here is a challenge for the Apache devs : describe how a bot-writer could update his software to avoid the consequences of the scheme that I am advocating, without consequences on the effectivity of their URL-scanning.

Re: mod_proxy seg faulting ?

2013-05-03 Thread Stefan Fritsch
On Thursday 02 May 2013, Thomas Eckert wrote: Lately, I've been seeing httpd/mod_proxy seg faulting in reverse proxy setups, frequency increasing. I am pretty sure that this is a thread-unsafe pool usage. create_proxy_config() puts the global config pool into (proxy_server_conf)-pool. It is

Re: URL scanning by bots

2013-05-03 Thread André Warnier
Tom Evans wrote: On Fri, May 3, 2013 at 10:54 AM, André Warnier a...@ice-sa.com wrote: So here is a challenge for the Apache devs : describe how a bot-writer could update his software to avoid the consequences of the scheme that I am advocating, without consequences on the effectivity of their

Re: URL scanning by bots

2013-05-03 Thread Michael Felt
An interesting discussion. The admin of the server I use is rather critical about malicious connections. His way to prevent continuing malicious connections is to route the source IP address (incoming) to 127.0.0.1 after X errors reported from a single IP address within Y minutes. From the logic

help with fixing a mod_auth_form bug regarding kept_body

2013-05-03 Thread David Mansfield
I'm hitting this bug (I think): https://issues.apache.org/bugzilla/show_bug.cgi?id=53692 This bug makes the mode described in the docs. for mod_auth_form called Inline with Body Preservation impossible, because it's impossible to access the POSTed data from inside the login handler. (I've