[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Alan M. Carroll (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15515134#comment-15515134 ] Alan M. Carroll commented on TS-4468: - Oknet, I think you're also missing the point that in many cases

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15513834#comment-15513834 ] Oknet Xu commented on TS-4468: -- For HTTP session reuse and upon my suggestion: release/acquire server

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15513645#comment-15513645 ] Jered Floyd commented on TS-4468: - I don't see how this is relevant, as "don't use pristine_host_hdr with

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15513474#comment-15513474 ] Oknet Xu commented on TS-4468: -- Could you please do a test for the issue with the option disabled ? >

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15513178#comment-15513178 ] Jered Floyd commented on TS-4468: - I believe I considered this approach and ruled it out -- it's been a while

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15513153#comment-15513153 ] Jered Floyd commented on TS-4468: - I do. I think the problem can occur with the option disabled, but it

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15513105#comment-15513105 ] Oknet Xu commented on TS-4468: -- By review the codes, the key point is

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-22 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15512361#comment-15512361 ] Oknet Xu commented on TS-4468: -- [~jered] do you enable proxy.config.url_remap.pristine_host_hdr ? >

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-21 Thread Alan M. Carroll (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15510196#comment-15510196 ] Alan M. Carroll commented on TS-4468: - If they are always the same, then why does it matter which is used

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-21 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15510070#comment-15510070 ] Oknet Xu commented on TS-4468: -- {code} One thing that's not clear is in what situations

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-21 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15510077#comment-15510077 ] Oknet Xu commented on TS-4468: -- {code} At most, if we decided we needed to be stringent in enforcing SNI/host

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-21 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15509978#comment-15509978 ] Oknet Xu commented on TS-4468: -- RFC 6066 conflic with RFC 7540: {code} RFC 6066

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-20 Thread Susan Hinrichs (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15506995#comment-15506995 ] Susan Hinrichs commented on TS-4468: I am concerned that we would be reducing client-side session reuse

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-20 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15506899#comment-15506899 ] Jered Floyd commented on TS-4468: - This is discussing when ATS is acting as a server? I haven't addressed

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-20 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15506882#comment-15506882 ] Jered Floyd commented on TS-4468: - > As a client, we should always set SNI upon application layer. In

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-20 Thread Alan M. Carroll (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15506836#comment-15506836 ] Alan M. Carroll commented on TS-4468: - A key question would be, what should be done if the second request

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-20 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15506700#comment-15506700 ] Oknet Xu commented on TS-4468: -- {code} 4789 shared_result = httpSessionManager.acquire_session(this,

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-20 Thread Oknet Xu (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15506637#comment-15506637 ] Oknet Xu commented on TS-4468: -- By my understand to RFC6066: - As a server, we should always verify SNI while

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-08 Thread Susan Hinrichs (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15475075#comment-15475075 ] Susan Hinrichs commented on TS-4468: Sorry, disappeared off the thread. Distracted with other fires and

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-08 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15474274#comment-15474274 ] Jered Floyd commented on TS-4468: - If you're OK with my approach, then I will do so. I'm just back from two

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-08 Thread Leif Hedstrom (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15474259#comment-15474259 ] Leif Hedstrom commented on TS-4468: --- Can we get a Github Pull Request on this please? >

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-09-08 Thread Leif Hedstrom (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15474255#comment-15474255 ] Leif Hedstrom commented on TS-4468: --- [~shinrich] Any more thoughts on this? Did you review the proposed

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-07-05 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15362685#comment-15362685 ] Jered Floyd commented on TS-4468: - Hey, sorry to nag -- anyone have comments on this proposed approach? >

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-27 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15352000#comment-15352000 ] Jered Floyd commented on TS-4468: - I agree; they are related. Are you comfortable with my proposed solution?

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-27 Thread Susan Hinrichs (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15351536#comment-15351536 ] Susan Hinrichs commented on TS-4468: While searching for issues, came across TS-3082 which seems to

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-24 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15349039#comment-15349039 ] Jered Floyd commented on TS-4468: - Oh, also the return value of ServerSessionPool::acquireSession(...) is

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-08 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15321406#comment-15321406 ] Jered Floyd commented on TS-4468: - Thinking about this further, I'm wondering if session reuse blocking based

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-02 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15313555#comment-15313555 ] Jered Floyd commented on TS-4468: - Alan: The current default behavior is definitely a problem, and can be

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-02 Thread Alan M. Carroll (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15313482#comment-15313482 ] Alan M. Carroll commented on TS-4468: - For most users of Traffic Server the default behavior is not a

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-02 Thread James Peach (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15312678#comment-15312678 ] James Peach commented on TS-4468: - Contributing my 2c even though I haven't looked at this code in detail :)

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-02 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15312663#comment-15312663 ] Jered Floyd commented on TS-4468: - I would argue that the default must be "safe" as in unlikely to cause

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-06-02 Thread Susan Hinrichs (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15312583#comment-15312583 ] Susan Hinrichs commented on TS-4468: Bumping this issue to see if we can get some agreement on a good

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-05-23 Thread Susan Hinrichs (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15296480#comment-15296480 ] Susan Hinrichs commented on TS-4468: Did some research on this. The setting of SNI name for connections

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-05-23 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15296281#comment-15296281 ] Jered Floyd commented on TS-4468: - No problem; just describing the problem was enough to help me narrow down

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-05-22 Thread Leif Hedstrom (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15295882#comment-15295882 ] Leif Hedstrom commented on TS-4468: --- Thanks for the report. Sorry no one was around to help you in IRC, it

[jira] [Commented] (TS-4468) http.server_session_sharing.match = both unsafe with HTTPS

2016-05-22 Thread Jered Floyd (JIRA)
[ https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15295784#comment-15295784 ] Jered Floyd commented on TS-4468: - Also, this behavior appears to be a regression vs ATS 5.0.1, but I haven't