You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@httpd.apache.org by "William A. Rowe, Jr." <wr...@rowe-clan.net> on 2002/06/18 21:27:04 UTC

[TEST] Apache 1.3.26 Release Candidate for Testing

The new Apache release is available for immediate testing.  Please reply-to
dev@httpd.apache.org with any observed variance between this version and
your previous experience with recent Apache 1.3.x releases.

The packages, until General Availability release within the next two hours
will be available from;

   http://httpd.apache.org/dev/dist/

.tar.gz and .tar.Z files are for Unix builds, -win32-src.zip file is for 
the Windows
builders [with cr/lf line endings.]  Win32 .exe and .msi installer packages are
online for testing as well.].

Excerpting tomorrow's announcement;

This version of Apache is principally a security and bug fix
release.  A summary of the bug fixes is given at the end of this document.
Of particular note is that 1.3.26 addresses and fixes the issues noted
in CAN-2002-0392 (mitre.org) [CERT VU#944335] regarding a vulnerability
in the handling of chunked transfer encoding.  We would like to thank
Mark Litchfield of ngssoftware.com for discovering and reporting the
vulnerability.

Re: [TEST] Apache 1.3.26 Release Candidate for Testing

Posted by "Paul J. Reder" <re...@remulak.net>.

I have just finished testing 1.3.26 on AIX and it looks good to me.

William A. Rowe, Jr. wrote:

> The new Apache release is available for immediate testing.  Please reply-to
> dev@httpd.apache.org with any observed variance between this version and
> your previous experience with recent Apache 1.3.x releases.
> 
> The packages, until General Availability release within the next two hours
> will be available from;
> 
>   http://httpd.apache.org/dev/dist/
> 
> .tar.gz and .tar.Z files are for Unix builds, -win32-src.zip file is for 
> the Windows
> builders [with cr/lf line endings.]  Win32 .exe and .msi installer 
> packages are
> online for testing as well.].
> 
> Excerpting tomorrow's announcement;
> 
> This version of Apache is principally a security and bug fix
> release.  A summary of the bug fixes is given at the end of this document.
> Of particular note is that 1.3.26 addresses and fixes the issues noted
> in CAN-2002-0392 (mitre.org) [CERT VU#944335] regarding a vulnerability
> in the handling of chunked transfer encoding.  We would like to thank
> Mark Litchfield of ngssoftware.com for discovering and reporting the
> vulnerability.
> 
> 


-- 
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it.  Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein

Re: [TEST] Apache 1.3.26 Release Candidate for Testing

Posted by Jos Backus <jo...@catnook.com>.

On Tue, Jun 18, 2002 at 02:25:36PM -0700, Jos Backus wrote:
>         --show-layout

Hm, configure exits 0 before it's done generating files when show_layout=1.
Any idea why this is? I commented out the ``exit 0'' and things seem to work
just fine.

-- 
Jos Backus                 _/  _/_/_/        Santa Clara, CA
                          _/  _/   _/
                         _/  _/_/_/             
                    _/  _/  _/    _/
jos@catnook.com     _/_/   _/_/_/            use Std::Disclaimer;

Re: [TEST] Apache 1.3.26 Release Candidate for Testing

Posted by Jos Backus <jo...@catnook.com>.

Something seems wrong with the shadow tree support. I am seeing this on
Solaris 8:

kodo:~/src% gtar xzvf ~josb/apache_1.3.26.tar.gz
kodo:~/src% mv apache_1.3.26 apache-1.3.26 
kodo:~/src% cd apache-1.3.26 
kodo:~/src/apache-1.3.26% ./configure \                      
        --shadow=/depot/src/apache-1.3.26 \
        --exec-prefix=/depot/pkg/apache-1.3.26 \
        --with-port=1680 \
        --enable-shared=max \
        --with-perl=/usr/local/bin/perl \
        --prefix=/depot/pkg/apache-1.3.26 \
        --includedir=/depot/pkg/apache-1.3.26/include \
        --mandir=/depot/pkg/apache-1.3.26/man \
        --sysconfdir=/usr/home/apache/etc \
        --datadir=/usr/home/apache/share \
        --localstatedir=/usr/home/apache/var \
        --runtimedir=/usr/home/apache/var/run \
        --logfiledir=/usr/home/apache/var/log  \
        --proxycachedir=/usr/home/apache/var/proxy \
        --show-layout
Configuring for Apache, Version 1.3.26
 + using installation path layout: Apache (config.layout)
 + creating external package shadow tree (/depot/src/apache-1.3.26)
    /depot/src/apache-1.3.26/cgi-bin/printenv
   [snip]
kodo:~/src/apache-1.3.26% cd /depot/src/apache-1.3.26 
kodo:/depot/src/apache-1.3.26% make
make[1]: Entering directory `/depot/src/apache-1.3.26'
make[1]: Makefile.sun4u-sun-solaris2.280: No such file or directory
make[1]: *** No rule to make target `Makefile.sun4u-sun-solaris2.280'.  Stop.
make[1]: Leaving directory `/depot/src/apache-1.3.26'
make: *** [all] Error 2

What am I doing wrong?

-- 
Jos Backus                 _/  _/_/_/        Santa Clara, CA
                          _/  _/   _/
                         _/  _/_/_/             
                    _/  _/  _/    _/
jos@catnook.com     _/_/   _/_/_/            use Std::Disclaimer;

Re: [TEST] Apache 1.3.26 Release Candidate for Testing

Posted by Justin Erenkrantz <je...@apache.org>.

On Tue, Jun 18, 2002 at 12:30:20PM -0700, Brian Pane wrote:
> William A. Rowe, Jr. wrote:
> 
> > The new Apache release is available for immediate testing.  Please 
> > reply-to
> > dev@httpd.apache.org with any observed variance between this version and
> > your previous experience with recent Apache 1.3.x releases.
> 
> 
> I only see one thing that looks troubling.  In httpd-test,
> autoindex2.t test cases 1 and 3 work with 1.3.24 but not with
> 1.3.26.  This might just mean that my config is broken.  An
> independent verification would be really helpful, if anyone
> has time to test it.

I can verify it.  It looks like 1.3's mod_autoindex is displaying
entries for sub-requests that do not return HTTP_SUCCESS.  Test
1 is 500, test 2 is 200, and test 3 is 401.

ISTR some discussion over what the 'right' behavior is for displaying
subrequests with errors.  -- justin