Re: [VOTE] Release mod_fcgid 2.3.8

2013-10-03 Thread Steffen
Running in real at AL for an hour with patch revert-r1377398.txt Results, see www.apachelounge.com/status-revert-r1377398.html Observation: No hanging with working and no accesses anymore Still quite some more processes: with 2.3.7 1-3 and now 8 Processes with idle time more then 300

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-10-03 Thread Yann Ylavic
Having a look at MPM event's doc ( http://httpd.apache.org/docs/current/mod/event.html#asyncrequestworkerfactor), I found this : [...] if all workers are busy, [mpm_event] will close connections in keep-alive state even if the keep-alive timeout has not expired . On Fri, Aug 2, 2013 at 2:33

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-10-03 Thread Micha Lenk
Hi Yann, Am 01.10.2013 17:08, schrieb Yann Ylavic: As far as I understand the issue, the main point of prefetch was to fix CVE-2005-2088, a HTTP Request Smuggling attack (see also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2088). This is discussed in PR40029 and is

Looking for vote

2013-10-03 Thread Jim Jagielski
There are a few proposed backports in 2.4 STATUS that could use some votes and some luv... Be a Goat; Test and Vote.

Re: mod_proxy, oooled backend connections and the keep-alive race condition

2013-10-03 Thread Yann Ylavic
Hi Micha, On Thu, Oct 3, 2013 at 2:07 PM, Micha Lenk mi...@lenk.info wrote: Independent from how the HRS issue (CVE-2005-2088) was fixed at that time, I still believe that it is a bad idea in terms of security to flush the buffer and forward its content to the backend before the *whole*

Re: [PATCH 55593] Add SSLServerInfoFile directive

2013-10-03 Thread Trevor Perrin
On Tue, Oct 1, 2013 at 3:15 AM, Dr Stephen Henson shen...@opensslfoundation.com wrote: OpenSSL has the concept of the current certificate. That is the last certificate set. So you set certificate foo and then any parameters you set are associated with it until another certificate is set.

Re: [VOTE] Release mod_fcgid 2.3.8

2013-10-03 Thread Jeff Trawick
On Thu, Oct 3, 2013 at 5:45 AM, Steffen i...@apachelounge.com wrote: Running in real at AL for an hour with patch revert-r1377398.txt Results, see www.apachelounge.com/status-revert-r1377398.html Observation: No hanging with working and no accesses anymore Still quite some more