On 14.12.2013 09:36, William A. Rowe Jr. wrote:
> I beg to differ. We are left with a question of whether you are
> responsible to defend the current behavior, or whether I can simply
> rely on RFC2817 to document that you are wrong,
RFC 2817 is irrelevant in the context of https: URIs (see its a
On Sat, 14 Dec 2013 09:04:53 +0100
Kaspar Brand wrote:
> I won't defend the checks introduced with r757373 under all
> circumstances, but they are definitely not the cause for this
> purported defect.
I beg to differ. We are left with a question of whether you are
responsible to defend the curr
On 13.12.2013 20:17, William A. Rowe Jr. wrote:
> I will agree, plain-text forward proxy listeners are unaffected, only
> https:// listeners are tested for TLS/Host: mismatches. Also, if the
> proxy request refers to a resource on the same proxy host, I suppose
> that would also succeed. Although
On 13.12.2013 15:52, Yann Ylavic wrote:
> I can't tell whether this applies to all the other SSL parameters though
> (most -if not all?- seem to be handled the same way in ssl_hook_Access(),
> but I didn't do an exhaustive search to tell the truth, and maybe it is not
> feasible here for all).
An
