mod_autoindex string pluggability

2013-08-05 Thread Sven Dowideit
Hello Everyone, I'm scratching an itch to make mod_autoindex output what I want, and would love to know what, if anything would make the changes merge-able. In its simplest form, I'd like apache to be able to give me an index in JSON format - previously, I've parsed the html in javascript, but

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-08-05 Thread Thomas Eckert
One could do an 'OPTIONS *' request. But I am not sure if that is any better than proxy-initial-not-pooled in terms of performance. I don't see why an OPTIONS request should not encounter problems where a GET request will. After all, the problem is on the transport layer, not on the application

Re: r1470679, async write completion, non blocking writes, and mod_ssl

2013-08-05 Thread Stefan Fritsch
On Mon, 5 Aug 2013, Graham Leggett wrote: Are you seeing a specific problem? Well, when I download a large file over a slow link, the request does not enter write completion state but rather the worker thread is still hogged for (nearly) the entire download. The way openssl's async behaviour

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-08-05 Thread Eric Covener
On Mon, Aug 5, 2013 at 2:49 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: One could do an 'OPTIONS *' request. But I am not sure if that is any better than proxy-initial-not-pooled in terms of performance. I don't see why an OPTIONS request should not encounter problems where a GET

[PATCH] fix timeout in mod_ssl's trace2 log output

2013-08-05 Thread Faidon Liambotis
timeout is nowadays a duration, not an absolute value. Fix the trace2 output to print it as such, instead of subtracting time(NULL) and resulting in lines such as: [Mon Aug 05 03:51:07.369625 2013] [ssl:trace2] [pid 7916:tid 140003006699264] ssl_engine_kernel.c(1698): Inter-Process Session

[PATCH] mod_socache_memcache: don't ignore expiry

2013-08-05 Thread Faidon Liambotis
The memcache socache backend currently completely ignores the expiry value, presumably due to historical limitations of aprutil that don't apply anymore. The current behavior is to always send 0 as the expiry value, which in the memcached protocol translates as never. This could have security

Re: mod_autoindex string pluggability

2013-08-05 Thread Tim Bannister
How about implementing XHTML → JSON as a filter? Either with existing modules or with something dedicated to autoindex. TimOn 05/08/2013 7:26 Sven Dowideit wrote: Hello Everyone, I'm scratching an itch to make mod_autoindex output what I want, and would love to know what, if anything would make

Re: [PATCH] fix timeout in mod_ssl's trace2 log output

2013-08-05 Thread Jeff Trawick
On Mon, Aug 5, 2013 at 7:19 AM, Faidon Liambotis parav...@debian.orgwrote: timeout is nowadays a duration, not an absolute value. Fix the trace2 output to print it as such, instead of subtracting time(NULL) and resulting in lines such as: [Mon Aug 05 03:51:07.369625 2013] [ssl:trace2] [pid

Re: r1470679, async write completion, non blocking writes, and mod_ssl

2013-08-05 Thread Jim Jagielski
On Aug 5, 2013, at 4:00 AM, Stefan Fritsch s...@sfritsch.de wrote: An ideal solution would put the buffering/decision for blocking/non-blocking into ap_pass_brigade(). This way other filters like deflate could also be called asynchronously. But I am not too optimistic that this can be

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-08-05 Thread Rainer Jung
On 05.08.2013 13:18, Eric Covener wrote: On Mon, Aug 5, 2013 at 2:49 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: One could do an 'OPTIONS *' request. But I am not sure if that is any better than proxy-initial-not-pooled in terms of performance. I don't see why an OPTIONS request

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-08-05 Thread Jim Jagielski
On Aug 5, 2013, at 10:13 AM, Rainer Jung rainer.j...@kippdata.de wrote: On 05.08.2013 13:18, Eric Covener wrote: On Mon, Aug 5, 2013 at 2:49 AM, Thomas Eckert thomas.r.w.eck...@gmail.com wrote: One could do an 'OPTIONS *' request. But I am not sure if that is any better than

[PATCH 55360] Potential buffer overflows in support/ab

2013-08-05 Thread Mike Rumph
Hello all, A comment section in support/ab.c lists the following known problems: /* * BUGS: * * - uses strcpy/etc. * - has various other poor buffer attacks related to the lazy parsing of * response headers from the server * - doesn't implement much of HTTP/1.x, only accepts certain

[RFC] mod_authnz_fcgi

2013-08-05 Thread Jeff Trawick
I have been working on an AA (just 2 for now ;) ) over FastCGI interface for httpd 2.4+ which uses the provider APIs. The source still needs some TLC (especially some parts which originated with mod_proxy_fcgi but still need drastic restructure to suit the more limited requirements of auth), but

Re: [PATCH 55360] Potential buffer overflows in support/ab

2013-08-05 Thread Jeff Trawick
On Mon, Aug 5, 2013 at 2:11 PM, Mike Rumph mike.ru...@oracle.com wrote: Hello all, A comment section in support/ab.c lists the following known problems: /* * BUGS: * * - uses strcpy/etc. * - has various other poor buffer attacks related to the lazy parsing of * response headers

Re: [PATCH 55360] Potential buffer overflows in support/ab

2013-08-05 Thread Jeff Trawick
On Mon, Aug 5, 2013 at 4:10 PM, Jeff Trawick traw...@gmail.com wrote: On Mon, Aug 5, 2013 at 2:11 PM, Mike Rumph mike.ru...@oracle.com wrote: Hello all, A comment section in support/ab.c lists the following known problems: /* * BUGS: * * - uses strcpy/etc. * - has various other

Re: r1470679, async write completion, non blocking writes, and mod_ssl

2013-08-05 Thread Stefan Fritsch
Am Montag, 5. August 2013, 09:57:16 schrieb Jim Jagielski: On Aug 5, 2013, at 4:00 AM, Stefan Fritsch s...@sfritsch.de wrote: An ideal solution would put the buffering/decision for blocking/non-blocking into ap_pass_brigade(). This way other filters like deflate could also be called

Re: [RFC] http_log functions to log buffers

2013-08-05 Thread Michael Felt
I have not studied logging in httpd. The only logs I have ever looked at are the error_logs and access_logs. These look like something different. For systems security I like to use syslog as a place to collect data. If apr already supports, please excuse my ignorance and ignore this. If not,