| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Changes with Apache 1.3.36
*) Reverted SVN rev #396294 due to unwanted regression.
The new feature introduced in 1.3.35 (Allow usage of the
"Include" configuration directive within previously "Include"d
files) has been removed in the meantime.
(http://svn.apache.org/viewcvs?rev=396294&view=rev)
Changes with Apache 1.3.35
*) SECURITY: CVE-2005-3352 (cve.mitre.org)
mod_imap: Escape untrusted referer header before outputting in HTML
to avoid potential cross-site scripting. Change also made to
ap_escape_html so we escape quotes. Reported by JPCERT.
[Mark Cox]
*) core: Allow usage of the "Include" configuration directive within
previously "Include"d files. [Colm MacCarthaigh]
*) HTML-escape the Expect error message. Not classed as security as
an attacker has no way to influence the Expect header a victim will
send to a target site. Reported by Thiago Zaninotti [Mark Cox]
*) mod_cgi: Remove block on OPTIONS method so that scripts can
respond to OPTIONS directly rather than via server default.
[Roy Fielding] PR 15242
|
|
|
|
|
|
can't use ap_block_alarms. Bump revision.
Problem noticed by Justin Sherrill on DragonFly's bugs list.
|
|
Apache SVN repository. Bump package revision because of that.
|
|
(An httpd service was only briefly tested.)
|
|
Previously rc.d/apache was updated to run stop & start for restart.
'/etc/rc.d/apache restart' then picked up startssl if apache was not
running, but if apache was running it has a large chance of the
start running before the stop completes, leaving no httpd running.
Instead, add a restartssl option to apachectl, and use it.
|
|
will work correctly on NetBSD-2.x. This should fix PR pkg/29398.
|
|
|
|
The main security vulnerabilities addressed in 1.3.33 are:
* CAN-2004-0940 (cve.mitre.org)
Fix potential buffer overflow with escaped characters in SSI tag string.
* CAN-2004-0492 (cve.mitre.org)
Reject responses from a remote server if sent an invalid
(negative) Content-Length.
New features
* Win32: Improve error reporting after a failed attempt to
spawn a piped log process or rewrite map process.
* Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT. It
controls how UseCanonicalName Off determines the port value if
the client doesn't provide one in the Host header. If defined
during compilation, UseCanonicalName Off will use the physical
port number to generate the canonical name. If not defined, it
tries the current Port value followed by the default port for
the current scheme.
The following bugs were found in Apache 1.3.31 (or earlier) and
have been fixed in Apache 1.3.33:
* mod_rewrite: Fix query string handling for proxied URLs. PR 14518.
* mod_rewrite: Fix 0 bytes write into random memory position. PR 31036.
* mod_digest: Fix nonce string calculation since 1.3.31 which
would force re-authentication for every connection if
AuthDigestRealmSeed was not configured. PR 30920.
* Fix trivial bug in mod_log_forensic that caused the child to
seg fault when certain invalid requests were fired at it with
forensic logging is enabled. PR 29313.
* No longer breaks mod_dav, frontpage and others. Repair a
patch in 1.3.31 which prevented discarding the request body
for requests that will be keptalive but are not currently
keptalive. PR 29237.
|
|
- mod_rewrite: Fix query string handling for proxied URLs. PR 14518.
[michael teitler <michael.teitler cetelem.fr>,
Jan Kratochvil <rcpt-dev.AT.httpd.apache.org jankratochvil.net>]
- mod_rewrite: Fix 0 bytes write into random memory position.
PR 31036. [André Malo]
- mod_digest: Fix nonce string calculation since 1.3.31 which
would force re-authentication for every connection if
AuthDigestRealmSeed was not configured. PR 30920. [Joe Orton]
- Trigger an error when a LoadModule directive attempts to
load a module which is built-in. This is a common error when
switching from a DSO build to a static build.
[Jeff Trawick, Geoffrey Young]
- Fix trivial bug in mod_log_forensic that caused the child
to seg fault when certain invalid requests were fired at it with
forensic logging is enabled. PR 29313.
[Will Slater <Will Slater orbisuk.com>]
- Fix memory leak in the cache handling of mod_rewrite. PR 27862.
[chunyan sheng <shengperson yahoo.com>, André Malo]
- mod_rewrite no longer confuses the RewriteMap caches if
different maps defined in different virtual hosts use the
same map name. PR 26462. [André Malo]
- mod_setenvif: Remove "support" for Remote_User variable which
never worked at all. PR 25725. [André Malo]
- mod_usertrack: Escape the cookie name before pasting into the
regexp. [André Malo]
- Win32: Improve error reporting after a failed attempt to spawn a
piped log process or rewrite map process. [Jeff Trawick]
- SECURITY: CAN-2004-0492 (cve.mitre.org)
Reject responses from a remote server if sent an invalid (negative)
Content-Length. [Mark Cox]
- Fix a bunch of cases where the return code of the regex compiler
was not checked properly. This affects mod_usertrack and
core. PR 28218. [André Malo]
- No longer breaks mod_dav, frontpage and others. Repair a patch
in 1.3.31 which prevented discarding the request body for requests
that will be keptalive but are not currently keptalive. PR 29237.
[Jim Jagielski, Rasmus Lerdorf]
- COMPATIBILITY: Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT.
It controls how UseCanonicalName Off determines the port value if
the client doesn't provide one in the Host header. If defined during
compilation, UseCanonicalName Off will use the physical port number to
generate the canonical name. If not defined, it tries the current Port
value followed by the default port for the current scheme.
[Jim Jagielski]
|
|
CAN-2004-0492. Bump package revision package of this.
|
|
No functional change (other than building again on Linux)
|
|
Apache 1.3.31 Major changes
Security vulnerabilities
* CAN-2003-0987 (cve.mitre.org)
In mod_digest, verify whether the nonce returned in the client
response is one we issued ourselves. This problem does not affect
mod_auth_digest.
* CAN-2003-0020 (cve.mitre.org)
Escape arbitrary data before writing into the errorlog.
* CAN-2004-0174 (cve.mitre.org)
Fix starvation issue on listening sockets where a short-lived
connection on a rarely-accessed listening socket will cause a
child to hold the accept mutex and block out new connections until
another connection arrives on that rarely-accessed listening socket.
* CAN-2003-0993 (cve.mitre.org)
Fix parsing of Allow/Deny rules using IP addresses without a
netmask; issue is only known to affect big-endian 64-bit
platforms
New features
New features that relate to specific platforms:
* Linux 2.4+: If Apache is started as root and you code
CoreDumpDirectory, core dumps are enabled via the prctl() syscall.
New features that relate to all platforms:
* Add mod_whatkilledus and mod_backtrace (experimental) for
reporting diagnostic information after a child process crash.
* Add fatal exception hook for running diagnostic code after a
crash.
* Forensic logging module added (mod_log_forensic)
* '%X' is now accepted as an alias for '%c' in the
LogFormat directive. This allows you to configure logging
to still log the connection status even with mod_ssl
Bugs fixed
The following noteworthy bugs were found in Apache 1.3.29 (or earlier)
and have been fixed in Apache 1.3.31:
* Fix memory corruption problem with ap_custom_response() function.
The core per-dir config would later point to request pool data
that would be reused for different purposes on different requests.
* mod_usertrack no longer inspects the Cookie2 header for
the cookie name. It also no longer overwrites other cookies.
* Fix bug causing core dump when using CookieTracking without
specifying a CookieName directly.
* UseCanonicalName off was ignoring the client provided
port information.
|
|
|
|
SECURITY [CAN-2003-0020]: escape arbitrary data before writing into the errorlog
The three patches are from Apache cvs.
http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/
Also bump PKGREVISION too.
|
|
|
|
Major changes since 1.3.28:
Security vulnerabilities
* CAN-2003-0542 (cve.mitre.org)
Fix buffer overflows in mod_alias and mod_rewrite which occurred if
one configured a regular expression with more than 9 captures.
Bugs fixed
The following noteworthy bugs were found in Apache 1.3.28 (or earlier)
and have been fixed in Apache 1.3.29:
* Within ap_bclose(), ap_pclosesocket() is now called
* consistently
for sockets and ap_pclosef() for files. Also, closesocket()
is used consistenly to close socket fd's. The previous
confusion between socket and file fd's would cause problems
with some applications now that we proactively close fd's to
prevent leakage.
* Fixed mod_usertrack to not get false positive matches on the
user-tracking cookie's name.
* Prevent creation of subprocess Zombies when using CGI wrappers
such as suEXEC and cgiwrap.
|
|
mod_rewrite and mod_alias, referenced CAN-2003-0542. Bump PKGREVISION.
|
|
hard-coded commands, which may not be in the PATH depending on the operating
system. This partly addresses PR pkg/19804.
|
|
buildlink2.mk files back into the main trunk. This provides sufficient
buildlink2 infrastructure to start merging other packages from the
buildlink2 branch that have already been converted to use the buildlink2
framework.
|
|
- Prevent chown whole files under ${PREFIX}/share/httpd.
|
|
|
|
http://httpd.apache.org/info/security_bulletin_20020617.txt
|
|
Relevant changes from version 1.3.23 include:
* Prevent invalid client hostnames from appearing in the log file.
* Various mod_proxy improvements, such as the new ProxyIOBufferSize
directive.
* The new ''IgnoreCase' keyword to the IndexOptions directive.
* mod_rewrite's 'rnd' was broken and has been fixed.
* The '-S' option of 'apxs' was not able to handle quotes; also 'apxs'
is now rebuilt when options are changed.
* proxy now correctly handles Cookies and X-Cache headers.
* Fixed a problem in TPF when we were using the wrong subpool when
opening the error log.
* pthread accept() mutexes on Solaris were broken (since we were
not linking against pthread)
|
|
|
|
the EAPI patches from modssl-2.8.7-1.3.23. Also, link against the MM
Shared Memory library (devel/libmm) to provide shared memory support in
Apache/EAPI. For example, this allows mod_ssl to use a high-performance
RAM-based session cache instead of a disk-based one.
|
|
The main new features in 1.3.23 (compared to 1.3.22) are:
* HTTP/1.1 support for mod_proxy.
* Other mod_proxy improvements.
* The new 'FileETag' directive to allow one to build the
format of the ETag via runtime directives.
* Addition of a 'filter callback' function to enable modules to
intercept the output byte stream for dynamic page caching.
The following bugs were found in Apache 1.3.22 and have been fixed in
Apache 1.3.23:
* Fix incorrect "Content-Length" header in the 416 response.
* Revert mod_negotation's handling of path_info and query_args
to the 1.3.20 behavior (PRs: 8628, 8582, 8538).
* Prevent an Apache module from being loaded or added twice due
to duplicate LoadModule or AddModule directives.
|
|
from source instead of installing from a binary package (problem noted in
private email by George Coulouris <george@coulouris.org>. Also move the
ownership of SSL-related config directories to the www/ap-ssl package.
|
|
|
|
apxs are now installed with "${INSTALL} -c -o ${LIBOWN} -g ${LIBGRP}",
which should do the right thing regardless of the platform. ${INSTALL} is
replaced with the full path to the install program used by pkgsrc, which
should be /usr/bin/install on NetBSD, and /usr/ucb/install on Solaris.
This should fix pkg/14232 by Pierre Bourgin.
|
|
Using -o 0 and -g 0 doesn't work with the ucb install on Solaris.
|
|
using the pkgsrc expat library instead of the builtin one (this is to
avoid conflicts between expat libraries when an expat XML parser is loaded
by either mod_perl or mod_php), and:
Security vulnerabilities
* A vulnerability was found in the split-logfile support program. A
request with a specially crafted Host: header could allow any file
with a .log extension on the system to be written to.
* A vulnerability was found when Multiviews are used to negotiate
the directory index. In some configurations, requesting a URI with
a QUERY_STRING of M=D could return a directory listing rather than
the expected index page.
General bug fixes and improvements
* Bug fixes
* The supplied icons are now also distributed in PNG format
* New directives have been added to the mod_usertrack module, The
first, CookieDomain, can be used to customise the Domain
attribute.
* A new directive, AcceptMutex, allows run-time configuration of the
mutex type used for accept serialization.
* mod_auth has been enhanced to allow access to a document to be
controlled based on the owner of the file being served.
* A new directive, AcceptFilter, has been added to control BSD
accept filters at run-time. The functionality can postpone the
requirement for a child process to handle a new connection until
an HTTP request has arrived, therefore increasing the number of
connections that a given number of child processes can handle
|
|
On NetBSD, we need to link libgcc.a whole-archive so that certain symbols
from the C++ implementation (__get_eh_context, etc.) referenced by DSOs
written in C++ will resolve correctly. This makes php4-sablot work with
mod_php4.so (from ap-php4) on ELF platforms when loaded by Apache's httpd.
|
|
NetBSD Packages Collection (pkgsrc) changes:
* Modify French page in same way as the English page. Translation
provided by Remi Zara <remi_zara@mac.com> in private e-mail.
* Use EAPI patches from mod_ssl-2.8.4-1.3.20.
* Unify repeated SED replacement info for config.layout, apache.sh,
DEINSTALL, and INSTALL into one location, FILES_SUBST.
* Modify patch to apxs to use 0:0 instead of root:wheel, as some
non-NetBSD systems don't have a wheel group.
The general bug fixes:
* Eliminate a potential segfault if an invalid floating point value
is passed to the ap_snprintf() function, on platforms supporting
isnan() and isinf().
* Fix a possible segfault at startup in the detection of a default
ServerName or IP string when no ServerName was specified.
* Fixed mod_proxy to retain empty headers, as allowed by RFC2068.
* Properly resolve the location of ndbm on Linux and some glibc2
builds, where ndbm.h is in the nonstandard db1/ subdir.
The main new features include:
* Enhanced rotatelogs to allow a UTC offset to be specified, and
the format logfile names with human-readable date/time stamps.
* Added the NOESCAPE (NS) flag to RewriteRule, to disable *all*
normal URI escaping. Note incautious use can give unexpected
results or introduce security risks.
* Added the '\' character to RewriteRule to allow escaping of
special characters. Allows embedding of both the '$' and '%'
characters in the results, so 'foo\$1' translates to 'foo$1'
rather than 'foo\<value of $1>'.
* Added the -V flag to suexec, to display the compile-time settings
with which it was built. (Only valid for root or the HTTPD_USER
username.)
* Introduced EBCDIC conversion configuration options, controlling the
conversion based on MIME type or file suffix.
|
|
2.8.2 patches and more thorough use of APACHE_SYSCONFDIR setting.
|
|
config.layout file instead of specifying every directory as on option to
the Apache configure script. This layout file might be useful later when
we package Apache 2.x. I also reordered a few lines so that it's easier
to diff apache/Makefile and apache6/Makefile (hi itojun!). Also build
the mod_define shared module from the mod_ssl sources.
Relevant changes from version 1.3.17.1 include:
*) Rewrite ap_unparse_uri_components() to make it safer and more readable
*) Under certain circumstances, Apache did not supply the
right response headers when requiring authentication.
*) Clean up some end-of-loop not reached warnings
*) Add the correct language tag for interoperation with the Taiwanese
versions of MSIE and Netscape.
*) Workaround enabled for a core dump which appeared in broken
NameVirtualHost configurations.
*) Sporadic core dump in ap_default_port_for_scheme() with
internal requests
*) SECURITY: The default installation could lead to mod_negotiation
and mod_dir/mod_autoindex displaying a directory listing instead of
the index.html.* files, if a very long path was created artificially
by using many slashes. Now a 403 FORBIDDEN is returned.
*) Trailing slashes (if they exist) are now removed from ServerRoot,
because there were known problems with them.
*) TPF startup/shutdown fixes.
*) Correct a typo in httpd.conf.
*) Get the correct IP address if ServerName isn't set and we can't
find a fully-qualified domain name at startup.
*) Fix pointer arithmetic in mod_rewrite map expansion.
*) Fixed a problem with file extensions being truncated during
the call to ap_os_canonical_filename().
|
|
possible to use LoadModule at all (httpd crashes soon after it forks).
This is most probably an Apache problem. Until the real problem
is tracked down, put this in as workaround.
This addresses lib/12164 and bin/12283.
|
|
|
|
-) Remove patch to avoid dlclose()ing on NetBSD. The mod_perl vs. perl CGI
mis-interaction seems to be gone and I wasn't able to reproduce it on my
system.
*) Fix the declaration of the module structure in mod_example.
*) Fix the handling of variable expansion look-ahead in mod_rewrite,
i.e. syntax like %{LA-U:REMOTE_USER}, and also fix the parsing of
more complicated nested RewriteMap lookups.
*) mod_status now respects ?refresh=n of 1 or greater. If the given
refresh value is not a number, ?refresh is set to 1 second.
*) Accomodate an out-of-space condition in the piped logs and the
rotatelogs.c code, and no longer churn log processes for this condition.
*) Make cgi-bin work as a regular directory when using mod_vhost_alias
with no VirtualScriptAlias directives.
*) Move the check of the Expect request header field after the hook
for ap_post_read_request, since that is the only opportunity for
modules to handle Expect extensions.
*) Eliminate caching problems of mod_autoindex results, so the last
modified date of the directory is returned as the Last-Modified
and ETag HTTP header tags are sent if IndexOptions TrackModified
directive/option is used.
*) Correct an issue with Alias and ScriptAlias directives that
file path arguments were not normalized in canonical form.
This correction makes no attempt to normalize regular expression
forms of Alias or ScriptAlias.
*) Add a new LogFormat directive, %c, that will log connection
status at the end of the response.
*) Update the mime.types file to the registered media types as of 2000-10-19.
*) Restore functionality broken by the mod_rewrite security fix:
rewrite map lookup keys and default values are now expanded
so that the lookup can depend on the requested URI etc.
|
|
|
|
The security fixes are:
* A problem with the Rewrite module, mod_rewrite, allowed access to
any file on the web server under certain circumstances
* The handling of Host: headers in mass virtual hosting
configurations, mod_vhost_alias, could allow access to any file on
the server
* If a cgi-bin directory is under the document root, the source to
the scripts inside it could be sent if using mass virtual hosting
The main new features include:
* Support for a directory-based configuration system. If any of the
configuration directives point to directories instead of files,
all files in that directory (and in subdirectories) will be also
parsed as configuration files
* Support name-based virtual hosting without needing to specify an
IP address in the Apache configuration file. This enables sites
that use dynamic IP addresses to support name-based virtual
hosting as well as allowing identical machines to share a
configuration file, say in a load-balanced cluster
* The SetEnvIf and BrowserMatch range of directives are now able to
be used in .htaccess files.
* Administrators who are nervous about their full server version
details being public can use the new keyword 'ProductOnly' in the
ServerTokens directive. This keyword forces the server to only
return the string "Apache" as the server version.
* The new digest authentication module, mod_auth_digest has had a
number of fixes and upgrades applied
|
|
EAPI didn't change so no need to change Apache's version number.
Also standardize package builds to have Apache listen on ports 80/443
regardless of UID of user that builds the package, and make MAINTAINER
point to me.
|
|
version numbers change, and it doesn't work correctly on a.out anyway.
Closes pkg/10309.
|
|
|
|
|
|
|
|
|
|
suppled by SUNAGAWA Keiki in PR pkg/8819. This version mostly fixes
bugs discovered since version 1.3.6.
|
|
will be fixed at OpenSSL 0.9.3's update.
|
