Re: *Match, RewriteRule POLA violation?

2015-05-04 Thread Yann Ylavic
On Fri, May 1, 2015 at 9:01 PM, Jim Riggs apache-li...@riggs.me wrote: I may go ahead and write up a patch this weekend to change them all (*Match and RewriteRule) and then we can all debate it over on bugz too! ap_getparents() may be the right place to strip (non-leading-)double-slashes, for

Re: *Match, RewriteRule POLA violation?

2015-05-04 Thread André Malo
* Jim Riggs wrote: On 1 May 2015, at 10:52, André Malo n...@perlig.de wrote: * Niklas Edmundsson wrote: On Thu, 30 Apr 2015, Yann Ylavic wrote: On Thu, Apr 30, 2015 at 2:57 PM, Jim Riggs apache-li...@riggs.me wrote: Thanks, Yann. I remember looking at this code before. The

Re: Looking ahead to 2.4.13 / 2.2.30

2015-05-04 Thread Brian J. France
While you are in mod_dav, could you review these patches and see if it makes sense to add them? httpd-2.2.x : http://www.brianfrance.com/software/apache/dav/mod_dav_fs.diff.22 httpd-2.4.x : http://www.brianfrance.com/software/apache/dav/mod_dav_fs.diff.24 We have been running these for a while

[API proposal] TSHttpTxnCacheLookupUrlSet()

2015-05-04 Thread Leif Hedstrom
This new API is the inverse of an existing API, TSHttpTxnCacheLookupUrlGet(). It also works similar to another existing API, TSCacheUrlSet(). The main difference between this new API and TSCacheUrlSet() is that we work on normal URL objects. This can in some cases avoid unnecessary string

Re: *Match, RewriteRule POLA violation?

2015-05-04 Thread William A Rowe Jr
On Mon, May 4, 2015 at 6:01 AM, Yann Ylavic ylavic@gmail.com wrote: On Fri, May 1, 2015 at 9:01 PM, Jim Riggs apache-li...@riggs.me wrote: I may go ahead and write up a patch this weekend to change them all (*Match and RewriteRule) and then we can all debate it over on bugz too!

Re: Looking ahead to 2.4.13 / 2.2.30

2015-05-04 Thread Ben Reser
On 5/4/15 7:40 AM, Brian J. France wrote: While you are in mod_dav, could you review these patches and see if it makes sense to add them? httpd-2.2.x : http://www.brianfrance.com/software/apache/dav/mod_dav_fs.diff.22 httpd-2.4.x :

Re: *Match, RewriteRule POLA violation?

2015-05-04 Thread Yann Ylavic
On Mon, May 4, 2015 at 9:20 PM, William A Rowe Jr wr...@rowe-clan.net wrote: On Mon, May 4, 2015 at 6:01 AM, Yann Ylavic ylavic@gmail.com wrote: On Fri, May 1, 2015 at 9:01 PM, Jim Riggs apache-li...@riggs.me wrote: I may go ahead and write up a patch this weekend to change them all

mod_authz_dbd question

2015-05-04 Thread Mark Taylor
Hi, I'm researching mod_authz_dbd.c and looking at the authz_dbd_login() function. Near its end, this function calls authz_dbd_run_client_login(), but I can't find where this function is defined: httpd-2.4.12# grep -r authz_dbd_run_client_login . returns no results other than

Re: Disable SSLv3 by default

2015-05-04 Thread Tim Bannister
On 4 May 2015, at 22:26, William A Rowe Jr wr...@rowe-clan.net wrote: It seems to me that SAFE at this time is TLSv1.2. It also seems to me that the first problem to solve is to ensure if the user removes SSLv3 (+/- TLSv1.0) from their openssl installed binary, that we simply respect

RE: Re: Disable SSLv3 by default

2015-05-04 Thread William A Rowe Jr
- Original Message - Subject: Re: Disable SSLv3 by default From: Arkadiusz Miśkiewicz ar...@maven.pl Date: 10/17/14 1:57 pm To: dev@httpd.apache.org On Friday 17 of October 2014, Kaspar Brand wrote: On 17.10.2014 12:02, Takashi Sato wrote: SSLv3 is now insecure (CVE-2014-3566,

Re: ALPN patch comments

2015-05-04 Thread William A Rowe Jr
The key issue I had with the lack of optional functions on the old NPN backport is addressed, that's great. Looks promising! NPN is now irrelevant with ALPN, I presume? On Wed, Apr 29, 2015 at 6:05 AM, Kaspar Brand httpd-dev.2...@velox.ch wrote: On 27.04.2015 17:04, Stefan Eissing wrote: Am

Re: mod_authz_dbd question

2015-05-04 Thread Eric Covener
These are similar to the hooks that the core uses from APR in every module. Everyone who has registered with authz_dbd_hook_client_login gets called until someone returns an error. Check out the expansion of these macros in apr_hooks.h: APR_DECLARE_EXTERNAL_HOOK

Re: [API proposal] TSHttpTxnCacheLookupUrlSet()

2015-05-04 Thread Yann Ylavic
Probably the wrong list... Regards, Yann On Mon, May 4, 2015 at 8:24 PM, Leif Hedstrom zw...@apache.org wrote: This new API is the inverse of an existing API, TSHttpTxnCacheLookupUrlGet(). It also works similar to another existing API, TSCacheUrlSet(). The main difference between this new

Re: [PATCH 0/5] Fix mod_websocket segfaults under load

2015-05-04 Thread Alex Bligh
On 30 Apr 2015, at 19:19, Jacob Champion jacob.champ...@ni.com wrote: Quick bump to this thread. Have any interested parties (Alex?) been able to give these patches a try? Not yet - sorry. -- Alex Bligh

Re: Re: Disable SSLv3 by default

2015-05-04 Thread William A Rowe Jr
On Mon, May 4, 2015 at 4:26 PM, William A Rowe Jr wr...@rowe-clan.net wrote: - Original Message - Subject: Re: Disable SSLv3 by default From: Arkadiusz Miśkiewicz ar...@maven.pl Date: 10/17/14 1:57 pm To: dev@httpd.apache.org On Friday 17 of October 2014, Kaspar Brand