Re: mod_ssl SSL session timeout

2014-06-14 Thread Yann Ylavic
On Fri, Jun 13, 2014 at 5:19 PM, Eric Covener cove...@gmail.com wrote: On Fri, Jun 13, 2014 at 11:03 AM, Plüm, Rüdiger, Vodafone Group ruediger.pl...@vodafone.com wrote: I would prefer to keep SSLSessionCacheTimeout the only directive and use that also for the default timeout of any created

Re: mod_ssl SSL session timeout

2014-06-14 Thread Kaspar Brand
On 13.06.2014 16:55, Rainer Jung wrote: Now since a long time most clients do no longer rely on the server caching the sessions. Instead they use TLS session resumption (RFC 5077). without server-side state/stateless is actually the important term from this RFC (session resumption is a

Re: Memory leak in mod_ssl ssl_callback_TmpDH

2014-06-14 Thread Kaspar Brand
On 02.06.2014 20:49, Ruediger Pluem wrote: Joe Orton wrote: On Wed, May 28, 2014 at 10:10:16PM +0200, Ruediger Pluem wrote: Thanks, but I missed some stuff during review: 1. We don't need to have two DH pointers in make_dh_params Doh! 2. There possible frees on NULL pointers in

Re: mod_ssl SSL session timeout

2014-06-14 Thread Rainer Jung
On 14.06.2014 10:23, Kaspar Brand wrote: On 13.06.2014 16:55, Rainer Jung wrote: Now since a long time most clients do no longer rely on the server caching the sessions. Instead they use TLS session resumption (RFC 5077). without server-side state/stateless is actually the important term

Re: mod_ssl SSL session timeout

2014-06-14 Thread Rainer Jung
On 14.06.2014 11:44, Rainer Jung wrote: On 14.06.2014 10:23, Kaspar Brand wrote: On 13.06.2014 16:55, Rainer Jung wrote: Now since a long time most clients do no longer rely on the server caching the sessions. Instead they use TLS session resumption (RFC 5077). without server-side

Re: svn commit: r1602523 - in /httpd/httpd/trunk/modules/proxy: mod_proxy.c proxy_util.c

2014-06-14 Thread Eric Covener
On Fri, Jun 13, 2014 at 5:10 PM, j...@apache.org wrote: Allow for magic scheme auto which makes the scheme of the backend worker match whatever the scheme of the incoming request was... For example: ProxyPass / auto://foo.example.com/ If the incoming request is http:.../lala then the

Re: svn commit: r1602523 - in /httpd/httpd/trunk/modules/proxy: mod_proxy.c proxy_util.c

2014-06-14 Thread Jim Jagielski
On Jun 14, 2014, at 7:06 AM, Eric Covener cove...@gmail.com wrote: On Fri, Jun 13, 2014 at 5:10 PM, j...@apache.org wrote: Allow for magic scheme auto which makes the scheme of the backend worker match whatever the scheme of the incoming request was... For example: ProxyPass /

Re: svn commit: r1602523 - in /httpd/httpd/trunk/modules/proxy: mod_proxy.c proxy_util.c

2014-06-14 Thread Eric Covener
On Sat, Jun 14, 2014 at 3:29 PM, Jim Jagielski j...@jagunet.com wrote: On Jun 14, 2014, at 7:06 AM, Eric Covener cove...@gmail.com wrote: On Fri, Jun 13, 2014 at 5:10 PM, j...@apache.org wrote: Allow for magic scheme auto which makes the scheme of the backend worker match whatever the

Re: svn commit: r1602523 - in /httpd/httpd/trunk/modules/proxy: mod_proxy.c proxy_util.c

2014-06-14 Thread Jim Jagielski
I thought RFC 6455 specifies ws and wss... On Jun 14, 2014, at 3:36 PM, Eric Covener cove...@gmail.com wrote: On Sat, Jun 14, 2014 at 3:29 PM, Jim Jagielski j...@jagunet.com wrote: On Jun 14, 2014, at 7:06 AM, Eric Covener cove...@gmail.com wrote: On Fri, Jun 13, 2014 at 5:10 PM,

Re: svn commit: r1602523 - in /httpd/httpd/trunk/modules/proxy: mod_proxy.c proxy_util.c

2014-06-14 Thread Eric Covener
On Sat, Jun 14, 2014 at 6:02 PM, Jim Jagielski j...@jagunet.com wrote: I thought RFC 6455 specifies ws and wss... It doesn't go on the wire. Once a connection to the server has been established (including a connection via a proxy or over a TLS-encrypted tunnel), the client MUST send an