Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
To: users@httpd.apache.org
References: <d4a1bc3c-aa1f-4aaa-5393-d36d9f991b34@gmx.de>
 <CAH7-e5tA4kQ_Z39LBzh32RarrDM4OS75reMfaDezrSuRSh6mHA@mail.gmail.com>
 <CAH7-e5vPojmKZiXpTER=4e2vLmY3d3Q7sg_aNsZUH_LQdDkt8w@mail.gmail.com>
 <89630e940dbb4ada9d57bf4ffa85693a@evcspmbx04.ads.northwestern.edu>
 <1485237678.3937.4.camel@mimir.webthing.com>
From: Hajo Locke <Hajo.Locke@gmx.de>
Message-ID: <abc876c9-0c80-5b30-5d2d-34665d60e4e5@gmx.de>
Date: Tue, 24 Jan 2017 08:27:21 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.6.0
MIME-Version: 1.0
In-Reply-To: <1485237678.3937.4.camel@mimir.webthing.com>
Content-Type: multipart/alternative;
 boundary="------------5F8C75679C9AA1DDC41D9E2F"
Subject: Re: [users@httpd] apache 2.4 handling of subdomains with unallowed
 characters
archived-at: Tue, 24 Jan 2017 07:28:48 -0000

--------------5F8C75679C9AA1DDC41D9E2F
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

Hello,

Am 24.01.2017 um 07:01 schrieb Nick Kew:
> On Mon, 2017-01-23 at 21:26 +0000, Darryl Philip Baker wrote:
>> DNS doesn’t allow underscore in host and domain names so how a URL
>> with an underscore would have ever worked is beyond me.
> Yeah, but is it the webserver's role to enforce that?
>
> Old answer: be liberal in what you accept.
> New answer: enforce HTTP much more strictly to pre-empt the next
> security alert based on smuggling something through.
>
> In reply to the OP, does HTTPProtocolOptions may be what you're
> looking for, though I haven't verified it.
>
yes, |HttpProtocolOptions is the option i was looking for, Thanks. The 
invalid subdomain is working again.
I am aware of dangers by setting this to unsafe. I will try to avoid 
this und eliminate this invalid hosts.

Thanks,
Hajo
|

--------------5F8C75679C9AA1DDC41D9E2F
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    Hello,<br>
    <br>
    <div class="moz-cite-prefix">Am 24.01.2017 um 07:01 schrieb Nick
      Kew:<br>
    </div>
    <blockquote cite="mid:1485237678.3937.4.camel@mimir.webthing.com"
      type="cite">
      <pre wrap="">On Mon, 2017-01-23 at 21:26 +0000, Darryl Philip Baker wrote:
</pre>
      <blockquote type="cite">
        <pre wrap="">DNS doesn’t allow underscore in host and domain names so how a URL
with an underscore would have ever worked is beyond me.
</pre>
      </blockquote>
      <pre wrap="">
Yeah, but is it the webserver's role to enforce that?

Old answer: be liberal in what you accept.
New answer: enforce HTTP much more strictly to pre-empt the next
security alert based on smuggling something through.

In reply to the OP, does HTTPProtocolOptions may be what you're
looking for, though I haven't verified it.

</pre>
    </blockquote>
    yes, <code>HttpProtocolOptions is the option i was looking for,
      Thanks. The invalid subdomain is working again.<br>
      I am aware of dangers by setting this to unsafe. I will try to
      avoid this und eliminate this invalid hosts.<br>
      <br>
      Thanks,<br>
      Hajo<br>
    </code>
  </body>
</html>

--------------5F8C75679C9AA1DDC41D9E2F--