Re: [SPAM?]: Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests

2013-12-11 Thread Peter Sylvester
On 12/12/2013 12:15 AM, William A. Rowe Jr. wrote: On Tue, 26 Nov 2013 09:47:44 +0100 Yann Ylavic wrote: On Tue, Nov 26, 2013 at 9:29 AM, Yann Ylavic wrote: On Tue, Nov 26, 2013 at 6:31 AM, Kaspar Brand wrote: On 26.11.2013 00:46, Yann Ylavic wrote: Ideas for the appropriate patch to htt

Re: [SPAM?]: Re: [SPAM?]: Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests

2013-12-11 Thread Peter Sylvester
On 12/12/2013 12:20 AM, William A. Rowe Jr. wrote: On Tue, 26 Nov 2013 18:47:39 +0100 Peter Sylvester wrote: Hi: On 11/26/2013 06:18 PM, Kaspar Brand wrote: On 26.11.2013 09:29, Yann Ylavic wrote: Another point is that SNI can not be an IP address according to the RFC 6066 : 3. Server Nam

Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests

2013-12-11 Thread Kaspar Brand
On 12.12.2013 00:15, William A. Rowe Jr. wrote: > The rest of the SNI hostname processing steps are where the problem > lies. We still need to perform http headers -> vhost translation after > the connection is established. If there's any desire to do SNI hostname > validation, that has to be lim

Re: Do pools lead to bad programming?

2013-12-11 Thread Kean Johnston
I'd love to see these things fixed, because they add up. If you post them here they are likely to be reviewed very quickly, as they'll no doubt be simple to review. Cool. Here's a patch for the case I just mentioned. It also eliminates an un-needed automatic (yes, I obsess about stack frames to

Re: Do pools lead to bad programming?

2013-12-11 Thread Ben Reser
On 12/11/13 4:00 PM, Kean Johnston wrote: > Am I being too obsessive? If not, would you like patches to correct these as I > find them, and if so, should I open a bug about this or just post patches here > (they are all likely to be a simple move of 1 or 2 lines)? There are two ways this sort of t

Re: Do pools lead to bad programming?

2013-12-11 Thread Graham Leggett
On 12 Dec 2013, at 2:00 AM, Kean Johnston wrote: > So I've been spending a fair bit of time inside Apache recently and I've seen > a pattern. Consider the following code (from mod_proxy_fcgi.c): > >apr_uri_t *uri = apr_palloc(r->pool, sizeof(*uri)); > >ap_log_rerror(APLOG_MARK, APLOG_D

mod_rewrite and mod_dav_svn

2013-12-11 Thread Ben Reser
We've recently made a change to mod_dav_svn to start implementing translate_name and map_to_storage hooks in order to prevent r->filename from being set to a bogus path since Subversion is servering content that isn't actually accessible via the standard file I/O APIs... You can see the reasoning

Do pools lead to bad programming?

2013-12-11 Thread Kean Johnston
Hi all, So I've been spending a fair bit of time inside Apache recently and I've seen a pattern. Consider the following code (from mod_proxy_fcgi.c): apr_uri_t *uri = apr_palloc(r->pool, sizeof(*uri)); ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01076) "url:

Re: [SPAM?]: Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests

2013-12-11 Thread Yann Ylavic
On Thu, Dec 12, 2013 at 12:20 AM, William A. Rowe Jr. wrote: > On Tue, 26 Nov 2013 18:47:39 +0100 > Peter Sylvester wrote: > > > Hi: > > > > On 11/26/2013 06:18 PM, Kaspar Brand wrote: > > > On 26.11.2013 09:29, Yann Ylavic wrote: > > >> Another point is that SNI can not be an IP address accordin

Re: http_filter.c r1524770 open issue?

2013-12-11 Thread William A. Rowe Jr.
On Sat, 23 Nov 2013 19:10:21 +0100 Yann Ylavic wrote: > On Sat, Nov 23, 2013 at 6:52 PM, Yann Ylavic > wrote: > > > On Tue, Nov 19, 2013 at 3:27 PM, Yann Ylavic > > wrote: > > > >> On Mon, Nov 18, 2013 at 6:28 PM, William A. Rowe Jr. > >> >> > wrote: > >> > >>> > >>> By closing our write-end

Re: unsetting encrypted cookies when encryption key changes

2013-12-11 Thread Graham Leggett
On 09 Dec 2013, at 10:50 AM, Thomas Eckert wrote: > So it should work out of the box. I figured as much but was unsure whether I > hit a bug or forgot a configuration directive. Will look into it once I have > the time :-/ Here is an untested patch, can you give it a try and confirm? Index: m

Re: [SPAM?]: Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests

2013-12-11 Thread William A. Rowe Jr.
On Tue, 26 Nov 2013 18:47:39 +0100 Peter Sylvester wrote: > Hi: > > On 11/26/2013 06:18 PM, Kaspar Brand wrote: > > On 26.11.2013 09:29, Yann Ylavic wrote: > >> Another point is that SNI can not be an IP address according to > >> the RFC 6066 : > >> > >> 3. Server Name Indication > >> [...]

multiple load balancers with overlapping members

2013-12-11 Thread Mihai Iacob
Hello dev, Scenario: URL 1 must be handled by one the first two workers and URL 2 can be handled by any worker. And would like to achieve uniform balancing across all three workers. An attempt to achieve this is the example below. What is the expected behavior of the following setup, where ther

Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests

2013-12-11 Thread William A. Rowe Jr.
On Tue, 26 Nov 2013 09:47:44 +0100 Yann Ylavic wrote: > On Tue, Nov 26, 2013 at 9:29 AM, Yann Ylavic > wrote: > > > On Tue, Nov 26, 2013 at 6:31 AM, Kaspar Brand > > wrote: > > > >> On 26.11.2013 00:46, Yann Ylavic wrote: > >> >> Ideas for the appropriate patch to httpd? Scope this fix to > >>

Re: mod_remoteip

2013-12-11 Thread William A. Rowe Jr.
On Mon, 09 Dec 2013 11:10:46 -0800 Mike Rumph wrote: > As you can see from the bug report, I have been looking into this. > It might also be important to consider the related bug 55637: > - https://issues.apache.org/bugzilla/show_bug.cgi?id=55637 Closed invalid. The incorrect assumptions are v

Re: ProxyPass in ... why not??

2013-12-11 Thread Eric Covener
On Mon, Dec 9, 2013 at 2:02 PM, Jim Jagielski wrote: > We know that ProxyPass works in , since it was > added in http://svn.apache.org/viewvc?view=revision&revision=1026184. > > However, the very next patch > (http://svn.apache.org/viewvc?view=revision&revision=1031758) > prevents it from working

Re: mod_remoteip

2013-12-11 Thread William A. Rowe Jr.
On Mon, 09 Dec 2013 19:52:35 +0100 Reindl Harald wrote: > > the mod_remoteip config looks like below > > RemoteIPHeader X-Forwarded-For > RemoteIPProxiesHeader X-Forwarded-For That config would be bad, and disagrees with the documentation. The RemoteIPProxiesHeader leaves a breadcrumb

Re: ProxyPass in ... why not??

2013-12-11 Thread William A. Rowe Jr.
On Mon, 9 Dec 2013 14:02:33 -0500 Jim Jagielski wrote: > We know that ProxyPass works in , since it was > added in http://svn.apache.org/viewvc?view=revision&revision=1026184. > > However, the very next patch > (http://svn.apache.org/viewvc?view=revision&revision=1031758) > prevents it from work