Hi there...

I'm trying to use Pound for most of my companys public webservers. Both 
as a security measure and as a way to save public IP addresses while 
adding a load of flexibility. And pound seems to be working perfectly 
for all of this.

But I recently discovered that our Outlook WebAccess, uses at least one 
HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.

Is there a reason why Pound does not attempt to handle this verb or 
could support for this be easily added?

Is there any way to make pound not filter the verbs at all (perhaps only 
warn of bad requests) when prod-sites run into problems like this?

Thanks in advance :-)

/Thomas

> But I recently discovered that our Outlook WebAccess, uses at least one
[...]

There was a recent thread discussing issues w/ OWA here:

http://www.apsis.ch/pound/pound_list/archive/2008/2008-06/1212428351000

You can work around the verb issue with the xHTTP directive, but the 
larger OWA issues remain for now.

Regards,[...]

Dave Steinberg wrote:[...][...]
My issue is less complicated than that one. They are using RPC over 
HTTPS whereas my setup is just plain HTTP for now. I have "xHTTP 4" in 
the cfg, but still the BPROPFIND verb is not accepted.

/Thomas

On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:[...]

Thanks Thomas, this is a simple oversight. The patch will appear in the
next release. In the meantime you can easily modify it yourself - edit
config.c and add BPROPFIND into the last regex in the xhttp array.[...]

Robert Segall wrote:[...][...][...]
Cool... Thanks a lot! :-)

/Thomas

Robert Segall wrote:[...][...][...]
See here for a patch against 2.3.2:
http://www.apsis.ch/pound/pound_list/archive/2007/2007-07/1183886721000

Robert Segall wrote:[...][...][...]
Hi Robert...

Looking in config.c, it appears that BPROPFIND should probably be in 
both xHTTP regex 3 and 4, right? The other of the B-family verbs 
(BPROPPATCH,BMOVE,BCOPY etc.) are included, starting from xHTTP 3.

This is the patch I intend to use. I just want to make sure that it will 
work the same as the next official release of Pound with respect to this.

http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch

Thanks in advance.

/Thomas

On Fri, 2008-07-04 at 00:30 -0200, Thomas M Steenholdt wrote:[...]

Yes.
[...]

Looks right to me.[...]

Robert Segall wrote:[...][...]
>>> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>>>   
>>>       
>>>> Hi there...
>>>>
>>>> I'm trying to use Pound for most of my companys public
webservers. Both 
>>>> as a security measure and as a way to save public IP addresses
while 
>>>> adding a load of flexibility. And pound seems to be working
perfectly 
>>>> for all of this.
>>>>
>>>> But I recently discovered that our Outlook WebAccess, uses at
least one 
>>>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled
by Pound.
>>>>
>>>> Is there a reason why Pound does not attempt to handle this
verb or 
>>>> could support for this be easily added?
>>>>
>>>> Is there any way to make pound not filter the verbs at all
(perhaps only 
>>>> warn of bad requests) when prod-sites run into problems like
this?
>>>>
>>>> Thanks in advance :-)
>>>>     
>>>>         
>>> Thanks Thomas, this is a simple oversight. The patch will appear
in the
>>> next release. In the meantime you can easily modify it yourself -
edit
>>> config.c and add BPROPFIND into the last regex in the xhttp array.
>>>   
>>>       [...][...][...][...]
Great - Thanks for reviewing :-)

/Thomas

Robert Segall wrote:[...][...]
>>> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>>>   
>>>       
>>>> Hi there...
>>>>
>>>> I'm trying to use Pound for most of my companys public
webservers. Both 
>>>> as a security measure and as a way to save public IP addresses
while 
>>>> adding a load of flexibility. And pound seems to be working
perfectly 
>>>> for all of this.
>>>>
>>>> But I recently discovered that our Outlook WebAccess, uses at
least one 
>>>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled
by Pound.
>>>>
>>>> Is there a reason why Pound does not attempt to handle this
verb or 
>>>> could support for this be easily added?
>>>>
>>>> Is there any way to make pound not filter the verbs at all
(perhaps only 
>>>> warn of bad requests) when prod-sites run into problems like
this?
>>>>
>>>> Thanks in advance :-)
>>>>     
>>>>         
>>> Thanks Thomas, this is a simple oversight. The patch will appear
in the
>>> next release. In the meantime you can easily modify it yourself -
edit
>>> config.c and add BPROPFIND into the last regex in the xhttp array.
>>>   
>>>       [...][...][...][...]
Just stumpled over another few... UNSUBSCRIBE and NOTIFY.

See http://msdn.microsoft.com/en-us/library/aa142917%28EXCHG.65%29.aspx

for details. They even mention an X-MS-ENUMATTS WebDAV method.

I guess UNSUBSCRIBE and NOTIFY should "just" be added to regex 3 and 4 
as they seem to simply be missing?

But what about X-MS-ENUMATTS (and other non-standard requests for that 
matter)? How could/should these be handled?

/Thomas

Thomas M Steenholdt wrote:[...][...]
>>> This is the patch I intend to use. I just want to make sure that
it 
>>> will work the same as the next official release of Pound with 
>>> respect to this.
>>>
>>> http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch
>>>     [...][...]
X-MS-ENUMATTS, since I think it stands out so I'd love to hear your view 
on this one.
I also took the liberty of updating the man page to accommodate the 
changes already made.

Anyways, my proposed patch is available from:

http://tmus.dk/stuff/pound/pound-2.4.3-extraverbs.patch

I've had it running for a few days and have not had a single false "bad 
req" since.

/Thomas