Hi there...

I'm trying to use Pound for most of my companys public webservers. Both 
as a security measure and as a way to save public IP addresses while 
adding a load of flexibility. And pound seems to be working perfectly 
for all of this.

But I recently discovered that our Outlook WebAccess, uses at least one 
HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.

Is there a reason why Pound does not attempt to handle this verb or 
could support for this be easily added?

Is there any way to make pound not filter the verbs at all (perhaps only 
warn of bad requests) when prod-sites run into problems like this?

Thanks in advance :-)

/Thomas

> But I recently discovered that our Outlook WebAccess, uses at least one 
> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.

There was a recent thread discussing issues w/ OWA here:

http://www.apsis.ch/pound/pound_list/archive/2008/2008-06/1212428351000

You can work around the verb issue with the xHTTP directive, but the 
larger OWA issues remain for now.

Regards,
-- 
Dave Steinberg
http://www.geekisp.com/
http://www.steinbergcomputing.com/

Dave Steinberg wrote:
>> But I recently discovered that our Outlook WebAccess, uses at least 
>> one HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by 
>> Pound.
>
> There was a recent thread discussing issues w/ OWA here:
>
> http://www.apsis.ch/pound/pound_list/archive/2008/2008-06/1212428351000
>
> You can work around the verb issue with the xHTTP directive, but the 
> larger OWA issues remain for now.
My issue is less complicated than that one. They are using RPC over 
HTTPS whereas my setup is just plain HTTP for now. I have "xHTTP 4" in 
the cfg, but still the BPROPFIND verb is not accepted.

/Thomas

On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
> Hi there...
> 
> I'm trying to use Pound for most of my companys public webservers. Both 
> as a security measure and as a way to save public IP addresses while 
> adding a load of flexibility. And pound seems to be working perfectly 
> for all of this.
> 
> But I recently discovered that our Outlook WebAccess, uses at least one 
> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
> 
> Is there a reason why Pound does not attempt to handle this verb or 
> could support for this be easily added?
> 
> Is there any way to make pound not filter the verbs at all (perhaps only 
> warn of bad requests) when prod-sites run into problems like this?
> 
> Thanks in advance :-)

Thanks Thomas, this is a simple oversight. The patch will appear in the
next release. In the meantime you can easily modify it yourself - edit
config.c and add BPROPFIND into the last regex in the xhttp array.
-- 
Robert Segall
Apsis GmbH
Postfach, Uetikon am See, CH-8707
Tel: +41-44-920 4904

Robert Segall wrote:
> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>   
>> Hi there...
>>
>> I'm trying to use Pound for most of my companys public webservers. Both 
>> as a security measure and as a way to save public IP addresses while 
>> adding a load of flexibility. And pound seems to be working perfectly 
>> for all of this.
>>
>> But I recently discovered that our Outlook WebAccess, uses at least one 
>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
>>
>> Is there a reason why Pound does not attempt to handle this verb or 
>> could support for this be easily added?
>>
>> Is there any way to make pound not filter the verbs at all (perhaps only 
>> warn of bad requests) when prod-sites run into problems like this?
>>
>> Thanks in advance :-)
>>     
>
> Thanks Thomas, this is a simple oversight. The patch will appear in the
> next release. In the meantime you can easily modify it yourself - edit
> config.c and add BPROPFIND into the last regex in the xhttp array.
>   
Cool... Thanks a lot! :-)

/Thomas

Robert Segall wrote:
> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>   
>> Hi there...
>>
>> I'm trying to use Pound for most of my companys public webservers. Both 
>> as a security measure and as a way to save public IP addresses while 
>> adding a load of flexibility. And pound seems to be working perfectly 
>> for all of this.
>>
>> But I recently discovered that our Outlook WebAccess, uses at least one 
>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
>>
>> Is there a reason why Pound does not attempt to handle this verb or 
>> could support for this be easily added?
>>
>> Is there any way to make pound not filter the verbs at all (perhaps only 
>> warn of bad requests) when prod-sites run into problems like this?
>>
>> Thanks in advance :-)
>>     
>
> Thanks Thomas, this is a simple oversight. The patch will appear in the
> next release. In the meantime you can easily modify it yourself - edit
> config.c and add BPROPFIND into the last regex in the xhttp array.
>   
See here for a patch against 2.3.2:
http://www.apsis.ch/pound/pound_list/archive/2007/2007-07/1183886721000

Robert Segall wrote:
> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>   
>> Hi there...
>>
>> I'm trying to use Pound for most of my companys public webservers. Both 
>> as a security measure and as a way to save public IP addresses while 
>> adding a load of flexibility. And pound seems to be working perfectly 
>> for all of this.
>>
>> But I recently discovered that our Outlook WebAccess, uses at least one 
>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
>>
>> Is there a reason why Pound does not attempt to handle this verb or 
>> could support for this be easily added?
>>
>> Is there any way to make pound not filter the verbs at all (perhaps only 
>> warn of bad requests) when prod-sites run into problems like this?
>>
>> Thanks in advance :-)
>>     
>
> Thanks Thomas, this is a simple oversight. The patch will appear in the
> next release. In the meantime you can easily modify it yourself - edit
> config.c and add BPROPFIND into the last regex in the xhttp array.
>   
Hi Robert...

Looking in config.c, it appears that BPROPFIND should probably be in 
both xHTTP regex 3 and 4, right? The other of the B-family verbs 
(BPROPPATCH,BMOVE,BCOPY etc.) are included, starting from xHTTP 3.

This is the patch I intend to use. I just want to make sure that it will 
work the same as the next official release of Pound with respect to this.

http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch

Thanks in advance.

/Thomas

On Fri, 2008-07-04 at 00:30 -0200, Thomas M Steenholdt wrote:
> Robert Segall wrote:
> > On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
> >   
> >> Hi there...
> >>
> >> I'm trying to use Pound for most of my companys public webservers. Both 
> >> as a security measure and as a way to save public IP addresses while 
> >> adding a load of flexibility. And pound seems to be working perfectly 
> >> for all of this.
> >>
> >> But I recently discovered that our Outlook WebAccess, uses at least one 
> >> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
> >>
> >> Is there a reason why Pound does not attempt to handle this verb or 
> >> could support for this be easily added?
> >>
> >> Is there any way to make pound not filter the verbs at all (perhaps only 
> >> warn of bad requests) when prod-sites run into problems like this?
> >>
> >> Thanks in advance :-)
> >>     
> >
> > Thanks Thomas, this is a simple oversight. The patch will appear in the
> > next release. In the meantime you can easily modify it yourself - edit
> > config.c and add BPROPFIND into the last regex in the xhttp array.
> >   
> Hi Robert...
> 
> Looking in config.c, it appears that BPROPFIND should probably be in 
> both xHTTP regex 3 and 4, right? The other of the B-family verbs 
> (BPROPPATCH,BMOVE,BCOPY etc.) are included, starting from xHTTP 3.

Yes.

> This is the patch I intend to use. I just want to make sure that it will 
> work the same as the next official release of Pound with respect to this.
> 
> http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch

Looks right to me.
-- 
Robert Segall
Apsis GmbH
Postfach, Uetikon am See, CH-8707
Tel: +41-44-920 4904

Robert Segall wrote:
> On Fri, 2008-07-04 at 00:30 -0200, Thomas M Steenholdt wrote:
>   
>> Robert Segall wrote:
>>     
>>> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>>>   
>>>       
>>>> Hi there...
>>>>
>>>> I'm trying to use Pound for most of my companys public webservers. Both 
>>>> as a security measure and as a way to save public IP addresses while 
>>>> adding a load of flexibility. And pound seems to be working perfectly 
>>>> for all of this.
>>>>
>>>> But I recently discovered that our Outlook WebAccess, uses at least one 
>>>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
>>>>
>>>> Is there a reason why Pound does not attempt to handle this verb or 
>>>> could support for this be easily added?
>>>>
>>>> Is there any way to make pound not filter the verbs at all (perhaps only 
>>>> warn of bad requests) when prod-sites run into problems like this?
>>>>
>>>> Thanks in advance :-)
>>>>     
>>>>         
>>> Thanks Thomas, this is a simple oversight. The patch will appear in the
>>> next release. In the meantime you can easily modify it yourself - edit
>>> config.c and add BPROPFIND into the last regex in the xhttp array.
>>>   
>>>       
>> Hi Robert...
>>
>> Looking in config.c, it appears that BPROPFIND should probably be in 
>> both xHTTP regex 3 and 4, right? The other of the B-family verbs 
>> (BPROPPATCH,BMOVE,BCOPY etc.) are included, starting from xHTTP 3.
>>     
>
> Yes.
>
>   
>> This is the patch I intend to use. I just want to make sure that it will 
>> work the same as the next official release of Pound with respect to this.
>>
>> http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch
>>     
>
> Looks right to me.
>   
Great - Thanks for reviewing :-)

/Thomas

Robert Segall wrote:
> On Fri, 2008-07-04 at 00:30 -0200, Thomas M Steenholdt wrote:
>   
>> Robert Segall wrote:
>>     
>>> On Thu, 2008-07-03 at 09:21 -0200, Thomas M Steenholdt wrote:
>>>   
>>>       
>>>> Hi there...
>>>>
>>>> I'm trying to use Pound for most of my companys public webservers. Both 
>>>> as a security measure and as a way to save public IP addresses while 
>>>> adding a load of flexibility. And pound seems to be working perfectly 
>>>> for all of this.
>>>>
>>>> But I recently discovered that our Outlook WebAccess, uses at least one 
>>>> HTTP verb (BPROPFIND)  that do not seem to be accepted/handled by Pound.
>>>>
>>>> Is there a reason why Pound does not attempt to handle this verb or 
>>>> could support for this be easily added?
>>>>
>>>> Is there any way to make pound not filter the verbs at all (perhaps only 
>>>> warn of bad requests) when prod-sites run into problems like this?
>>>>
>>>> Thanks in advance :-)
>>>>     
>>>>         
>>> Thanks Thomas, this is a simple oversight. The patch will appear in the
>>> next release. In the meantime you can easily modify it yourself - edit
>>> config.c and add BPROPFIND into the last regex in the xhttp array.
>>>   
>>>       
>> Hi Robert...
>>
>> Looking in config.c, it appears that BPROPFIND should probably be in 
>> both xHTTP regex 3 and 4, right? The other of the B-family verbs 
>> (BPROPPATCH,BMOVE,BCOPY etc.) are included, starting from xHTTP 3.
>>     
>
> Yes.
>
>   
>> This is the patch I intend to use. I just want to make sure that it will 
>> work the same as the next official release of Pound with respect to this.
>>
>> http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch
>>     
>
> Looks right to me.
>   
Just stumpled over another few... UNSUBSCRIBE and NOTIFY.

See http://msdn.microsoft.com/en-us/library/aa142917%28EXCHG.65%29.aspx 
for details. They even mention an X-MS-ENUMATTS WebDAV method.

I guess UNSUBSCRIBE and NOTIFY should "just" be added to regex 3 and 4 
as they seem to simply be missing?

But what about X-MS-ENUMATTS (and other non-standard requests for that 
matter)? How could/should these be handled?

/Thomas

Thomas M Steenholdt wrote:
> Robert Segall wrote:
>>  
>>> This is the patch I intend to use. I just want to make sure that it 
>>> will work the same as the next official release of Pound with 
>>> respect to this.
>>>
>>> http://tmus.dk/stuff/pound/pound-2.4.3-bpropfind.patch
>>>     
>>
>> Looks right to me.
>>   
> Just stumpled over another few... UNSUBSCRIBE and NOTIFY.
>
> See 
> http://msdn.microsoft.com/en-us/library/aa142917%28EXCHG.65%29.aspx 
> for details. They even mention an X-MS-ENUMATTS WebDAV method.
>
> I guess UNSUBSCRIBE and NOTIFY should "just" be added to regex 3 and 4 
> as they seem to simply be missing?
>
> But what about X-MS-ENUMATTS (and other non-standard requests for that 
> matter)? How could/should these be handled?
>
I have added UNSUBSCRIBE and NOTIFY to regex 3 and 4. I have left out 
X-MS-ENUMATTS, since I think it stands out so I'd love to hear your view 
on this one.
I also took the liberty of updating the man page to accommodate the 
changes already made.

Anyways, my proposed patch is available from:

http://tmus.dk/stuff/pound/pound-2.4.3-extraverbs.patch

I've had it running for a few days and have not had a single false "bad 
req" since.

/Thomas