You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Dean Gaudet <dg...@arctic.org> on 1997/04/15 22:04:42 UTC
[STATUS] Tue Apr 15 13:04:15 PDT 1997
1.2b9 status as of Tue Apr 15 13:04:15 PDT 1997
* Committed since 1.2b8:
* the new FAQ
* #define memmove for SUNOS4
* PR#279: ftp proxy improvements
* PR#304: proxy uses multiple A records if needed
* mod_example
* mod_rewrite 3.0.3
* more signed/unsigned port cleanups
* allow HARD_SERVER_LIMIT to be changed in Configuration
* UnixWare compile/install instructions
* PR#369: set SHELL in Configure to deal with ULTRIX /bin/sh5
* PR#380: tweak to modules/Makefile generation
* PR#293: redirect did not preserve query strings
* PR#336, PR#340: clean up linux errors due to inconsistent platforms
Agenda for 1.2b9-dev
====================
Patches available:
* Dean's [PATCH] yet another mod_negotiation sub_req copy thing
<Pi...@twinlark.arctic.org>
Status: Dean +1
* Ralf's [PATCH] FreeBSD and SIGPIPE: perhaps solved?
<19...@en1.engelschall.com>
Status: Ralf +1
* Dean's [PATCH] PR#232: work around netscape header problem
<Pi...@twinlark.arctic.org>
Status: Dean +0
* Mitchell Blank Jr <mi...@execpc.com> rotatelogs patch
Status: Ben +1, Jim +1
* Roy's [PATCH] CutRule causes bogus entries if Rule is commented-out
<97...@paris.ics.uci.edu>
Status: Roy +1, Dean +1
* Ralf's [PATCH] mod_rewrite: fixed redirects
<19...@en1.engelschall.com>
Status: Ralf +1, Ken +1
1.2 Showstoppers with no patches yet:
* redirect of index file causes SEGV [Marc]
Status: have a way to stop the core dump, but that doesn't make
it work properly.
See also: <Pi...@localhost.imdb.com>
* SEGV under FreeBSD with lingering_close [and proxy?]
<33...@topsail.org>
Chuck says: Roy's latest timeout patches have stopped the lingering
close notifications, but the core dumps continue. The dumped image
is so trashed that it can't be backtraced. I believe the reason we
haven't seen more reports is that FreeBSD and perhaps Linux are
disabling core dumps by default as a security measure.
New status: Chuck hasn't seen a core dump in a week of heavy
testing.
Documentation Changes that should make 1.2:
* some better suexec docs would be really nice, detailing some of the
security risks and compromises discussed
Status: I think Randy said something about doing it at one point.
Randy says he thinks Jason is perhaps doing them.
[And Roy says: either somebody needs to document how it
works (I don't know), or I'll go through and remove the
documentation about how "good" it is to use it.]
New Status: not really worth holding 1.2 on
* Document problems with mismatch on FD_SETSIZE=1024?
* Navigator 3.01 and 4.0b2 says image is corrupt if Server field contains
Server: Apache/1.2b8-dev mod_perl/0.94
Status: definitely document, maybe hack a fix
New Status: it's a problem with headers being a certain length,
see <Pi...@valis.worldgate.com>
* Deal with Martin Kraemer's documentation notes:
<19...@deejai.mch.sni.de>
<19...@deejai.mch.sni.de>
Not in 1.2b8:
* Fix mod_negotiation to follow latest TCN draft
* Petr Lampa's [PATCH] mod_dir redirect&negotiation problems
If subrequest returns redirect or not acceptable, copy headers
and return immediately.
* Doug MacEachern's [PATCH] merge dbm auth configs
Status: The question is, should we be merging auth configs?
Ken says not by default and not unless it's configurable.
* [BUG?] /cgi-bin/foo/bar%2fbaz
unescape_url in util.c is forbidding %2f in PATH_INFO.
The problem is that we use the %2f check to avoid security problems
with stupid scripts. Roy thinks the best solution would be to
decode all %2f's before doing any processing on the path, and thus
reduce %2f.. to /.. before doing the path checks. This makes it
impossible to have a filename containing slash, but no big deal.
* [BUG]: "SSI stopped working in 1.2b7" on Solaris 2.x (fwd)
<Pi...@localhost.imdb.com>
* suexec/269: Server-side include exec cmd with suEXEC bug
* redo lingering_close to check for old sockets to close out before
accept() in child.
Status: doesn't look to be overly clean to do in the current
framework. Will not have time to do implementation for this
beta in any case. If it turns out to be a big issue,
could go in later. (1.2.1?)
* Marc wants to have a check to be sure
log directory(ies) isn't writable by anyone except the user starting
the server. The posting in bugtraq only highlites the problem.
Needs override. See NCSA code for sample implem.
Status: Marc busy writing
* CGIs don't get PIPE under FreeBSD; under Solaris they get a TERM
and then a PIPE in close succession. Hmm. Marc will look when
he gets a chance.
* Solaris "accept: Too many levels of remote in path" [marc]
* error compiling on NeXT:
In file included from http_main.c:108:
/NextDeveloper/Headers/bsd/netinet/tcp.h:57: duplicate member `th_off'
/NextDeveloper/Headers/bsd/netinet/tcp.h:58: duplicate member `th_x2'
Status: got a login in a NeXT OpenStep 4.x machine to test,
looks like an interaction between gcc and the header
files. It is trying to include definitions for both big and
little endian platforms, and that no work.
* Type map can't find appropriate document for language on Solaris
2.x. (I can't gistify this one; full details in message ID
<Pi...@localhost.imdb.com>.)
Reporter has provided tar.gz file of config info.
(no PR#, 1.2b7, 24/2/1997, <ej...@cise.ufl.edu>)
Status: Dean might have fixed this one (the table overlay bug)
* <IMG SRC="a CGI"> crates [sic] zombies on FreeBSDLinux
(see <Pi...@localhost.imdb.com>
for the details; I'm not going to try to decode 'em) Reporter
says hackers have told it the cause lies in an error in the loop
structure in alloc.c's fork()/signal()/wait() handling
(no PR#, 1.1.1/1.2.something (?), 23/2/1997, <sk...@www.russia.net>)
- Marc said it *might* be related to the kindercide issue
* SONY NEWS port. See both:
<Pi...@taz.hyperreal.com>
<Pi...@taz.hyperreal.com>
Jim working on a patch, but not until after 1.2b8
* [BUG]: "mod_dld problem: variable in httpd_config.c counted wrong"on Irix
<Pi...@localhost.imdb.com> and
<Pi...@localhost.imdb.com>
Dirk says he's got something to fix it that needs some work.
Contrib stuff / future:
* Start digital signing the distributions.
* PR#161 -- mod_dir performance with negotiation
Status: Petr posted patch, Dean +1 on part
Petr posted query about how it should be redone.
* Chris Adams <ca...@ro.com> patch to mod_log_config to add %m and %c.
* "Large groups cause authentication errors" on FreeBSD
[salari@cs.ubc.ca]; problem looks to be MAX_STRING_LEN buffer
in groups_for_user.
* mod_log_config patch for conditional logging
Status: contrib, not in server
* Jim has patch for time taken to handle a request in status module
* Ed has an updated patch for limiting connections per IP
* mod_include could use boyer-moore searching for <!--# and/or it could
mmap the file.
* add some setlocale stuff?
* status module available from .htaccess files; Ken posted patch
* status report shows PIDs in empty slots, user supplied some sort
of patch; behavior now is correct, but perhaps some cleanup of
how the results are displayed could be done after 1.2...
<Pi...@localhost.imdb.com>
* Marc proposed keeping a list of things broken for HTTP/1.1; on the
Web or part of the distribution?
(no PR#, 1.2, 21/2/1997, "Marc Slemko" <ma...@znep.com>)
- Chuck likes the idea (hopefully will reduce redundant
reports); thinks it should be on the Web
- Ken thinks it should be in the htdocs tree so it hits both
- Chuck gives +1 to Ken's idea, so does Ralf
* Rob's "DONE" status response check for die()
<Pi...@localhost.imdb.com>
Roy says it's a feature... Dean agrees, thinks we should slate
something for 2.0 that can handle this cleanly.
* tem@global2000.net provided a patch for mod_imap to make it more
friendly with MS FrontPage map files. Available in
<Pi...@twinlark.arctic.org>
* Dean's gif89 and expires hack
<Pi...@twinlark.arctic.org>
* mod_userdir needs a DisallowUserDir directive, a la ftp.deny, to
restrict user names that can be accessed. Ken says maybe
"UserDir disabled [user [...]]".
* get_local_host and NIS patch fo SunOS 4
<Pi...@localhost>
* internationalized documentation
* pagecounter extension to mod_include
<Pi...@taz.hyperreal.com>
* mod_expires improvements from "Miguel A.L. Paraz" <ma...@iphil.net>
at <http://www.iphil.net/~map/apache/>
* add is_initial_req() function
* mod_dir: send HEIGHT/WIDTH tags to improve performance for user see
PR#393 for a patch that provides this
* A CIDRized access list patch such as the one supplied in
<Pi...@taz.hyperreal.com>
Re: Redirect of DirectoryIndex SEGV
Posted by Dean Gaudet <dg...@arctic.org>.
On Tue, 15 Apr 1997, Paul Sutton wrote:
> While this appears to fix this particular bug, is this another case where
> the 'promote sub-req' stuff now going into mod_negotiation should be used?
I'm pretty sure this is correct. I've been meaning to look more
closely at mod_dir. It hasn't tickled things for me *yet* because I use
"DirectoryIndex index" which lets mod_negotiation "do the right thing".
Dean
Redirect of DirectoryIndex SEGV
Posted by Paul Sutton <pa...@ukweb.com>.
On Tue, 15 Apr 1997, Dean Gaudet wrote:
> 1.2 Showstoppers with no patches yet:
> * redirect of index file causes SEGV [Marc]
> Status: have a way to stop the core dump, but that doesn't make
> it work properly.
> See also: <Pi...@localhost.imdb.com>
The problem is a SEGV if you have
DirectoryIndex /index.html
Redirect /index.html http://whatever/
This is because mod_dir does a sub-req lookup for /index.html and gets a
302 status and "Location" in headers_out, then returns 302 which applies
to the _main request_, which does NOT have a Location entry in headers_out
so send_error_response dumps when it processes the location (i.e. NULL).
This patch moves the Location header into headers_out of the main request,
if mod_dir is about to return a redirect status.
While this appears to fix this particular bug, is this another case where
the 'promote sub-req' stuff now going into mod_negotiation should be used?
//pcs