You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2012/08/17 19:29:22 UTC
svn commit: r780 - /dev/httpd/
Author: jim
Date: Fri Aug 17 17:29:18 2012
New Revision: 780
Log:
httpd-2.4.3 test tarballs
Added:
dev/httpd/CHANGES_2.4.3
dev/httpd/httpd-2.4.3-deps.tar.bz2 (with props)
dev/httpd/httpd-2.4.3-deps.tar.bz2.asc
dev/httpd/httpd-2.4.3-deps.tar.bz2.md5
dev/httpd/httpd-2.4.3-deps.tar.bz2.sha1
dev/httpd/httpd-2.4.3-deps.tar.gz (with props)
dev/httpd/httpd-2.4.3-deps.tar.gz.asc
dev/httpd/httpd-2.4.3-deps.tar.gz.md5
dev/httpd/httpd-2.4.3-deps.tar.gz.sha1
dev/httpd/httpd-2.4.3.tar.bz2 (with props)
dev/httpd/httpd-2.4.3.tar.bz2.asc
dev/httpd/httpd-2.4.3.tar.bz2.md5
dev/httpd/httpd-2.4.3.tar.bz2.sha1
dev/httpd/httpd-2.4.3.tar.gz (with props)
dev/httpd/httpd-2.4.3.tar.gz.asc
dev/httpd/httpd-2.4.3.tar.gz.md5
dev/httpd/httpd-2.4.3.tar.gz.sha1
Modified:
dev/httpd/Announcement2.4.html
dev/httpd/Announcement2.4.txt
dev/httpd/CHANGES_2.4
Modified: dev/httpd/Announcement2.4.html
==============================================================================
--- dev/httpd/Announcement2.4.html (original)
+++ dev/httpd/Announcement2.4.html Fri Aug 17 17:29:18 2012
@@ -15,23 +15,29 @@
<img src="../../images/apache_sub.gif" alt="" />
<h1>
- Apache HTTP Server 2.4.2 Released
+ Apache HTTP Server 2.4.3 Released
</h1>
<p>
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to <a href="http://www.apache.org/dist/httpd/Announcement2.4.html">announce</a>
- the release of version 2.4.2 of the Apache
- HTTP Server ("Apache"). This version of Apache is our 2nd GA
+ the release of version 2.4.3 of the Apache
+ HTTP Server ("Apache"). This version of Apache is our 3rd GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of
innovation by the project, and is recommended over all previous releases. This
version of Apache is principally a security
- and bug fix release, including the following security fix:
+ and bug fix release, including the following 2 security fixes:
</p>
<ul>
- <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0883">CVE-2012-0883</a> (cve.mitre.org)
- envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the
- current working directory to be searched for DSOs.
+ <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3502">CVE-2012-3502</a> (cve.mitre.org)
+ mod_proxy_ajp, mod_proxy_http: Fix an issue in back end
+ connection closing which could lead to privacy issues due
+ to a response mixup. PR 53727.
+ </li>
+ <li>SECURITY: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2687">CVE-2012-2687</a> (cve.mitre.org)
+ mod_negotiation: Escape filenames in variant list to prevent an
+ possible XSS for a site where untrusted users can upload files to
+ a location with MultiViews enabled.
</li>
</ul>
<p>
@@ -39,7 +45,7 @@
encourage users of all prior versions to upgrade.
</p>
<p>
- Apache HTTP Server 2.4.2 is available for download from:
+ Apache HTTP Server 2.4.3 is available for download from:
</p>
<dl>
<dd><a href="http://httpd.apache.org/download.cgi"
@@ -47,7 +53,7 @@
</dl>
<p>
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.2 includes only
+ full list of changes. A condensed list, CHANGES_2.4.3 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
@@ -88,12 +94,9 @@
using (and the libraries they depend on) are thread-safe.
</p>
<p>
- NOTE to Windows users: AcceptFilter None has replaced Win32DisableAcceptEx
- and the feature appears to have interoperability issues with mod_ssl.
- Apache 2.4.2 may not yet be suitable for all Windows servers. There
- is not yet a Windows binary distribution of httpd 2.4, but this is
- expected to be remedied soon as various dependencies graduate from
- beta to GA.
+ NOTE to Windows users: The issues with AcceptFilter None replacing
+ Win32DisableAcceptEx appears to have resolved starting with version
+ 2.4.3 make Apache httpd 2.4.x suitable for Windows servers.
</p>
</body>
</html>
Modified: dev/httpd/Announcement2.4.txt
==============================================================================
--- dev/httpd/Announcement2.4.txt (original)
+++ dev/httpd/Announcement2.4.txt Fri Aug 17 17:29:18 2012
@@ -1,19 +1,25 @@
- Apache HTTP Server 2.4.2 Released
+ Apache HTTP Server 2.4.3 Released
The Apache Software Foundation and the Apache HTTP Server Project
- are pleased to announce the release of version 2.4.2 of the Apache
- HTTP Server ("Apache"). This version of Apache is our 2nd GA
+ are pleased to announce the release of version 2.4.3 of the Apache
+ HTTP Server ("Apache"). This version of Apache is our 3rd GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
recommended over all previous releases. This version of Apache is
principally a security and bug fix release, including the following
- security fix:
+ 2 security fixes:
- *) SECURITY: CVE-2012-0883 (cve.mitre.org)
- envvars: Fix insecure handling of LD_LIBRARY_PATH that could
- lead to the current working directory to be searched for DSOs.
+ *) SECURITY: CVE-2012-3502 (cve.mitre.org)
+ mod_proxy_ajp, mod_proxy_http: Fix an issue in back end
+ connection closing which could lead to privacy issues due
+ to a response mixup. PR 53727.
+
+ *) SECURITY: CVE-2012-2687 (cve.mitre.org)
+ mod_negotiation: Escape filenames in variant list to prevent an
+ possible XSS for a site where untrusted users can upload files to
+ a location with MultiViews enabled.
- Apache HTTP Server 2.4.2 is available for download from:
+ Apache HTTP Server 2.4.3 is available for download from:
http://httpd.apache.org/download.cgi
@@ -24,7 +30,7 @@
http://httpd.apache.org/docs/trunk/new_features_2_4.html
Please see the CHANGES_2.4 file, linked from the download page, for a
- full list of changes. A condensed list, CHANGES_2.4.2 includes only
+ full list of changes. A condensed list, CHANGES_2.4.3 includes only
those changes introduced since the prior 2.4 release. A summary of all
of the security vulnerabilities addressed in this and earlier releases
is available:
@@ -46,9 +52,6 @@
than the Prefork MPM), you must ensure that any modules you will be
using (and the libraries they depend on) are thread-safe.
- NOTE to Windows users: AcceptFilter None has replaced Win32DisableAcceptEx
- and the feature appears to have interoperability issues with mod_ssl.
- Apache 2.4.2 may not yet be suitable for all Windows servers. There
- is not yet a Windows binary distribution of httpd 2.4, but this is
- expected to be remedied soon as various dependencies graduate from
- beta to GA.
+ NOTE to Windows users: The issues with AcceptFilter None replacing
+ Win32DisableAcceptEx appears to have resolved starting with version
+ 2.4.3 make Apache httpd 2.4.x suitable for Windows servers.
Modified: dev/httpd/CHANGES_2.4
==============================================================================
--- dev/httpd/CHANGES_2.4 (original)
+++ dev/httpd/CHANGES_2.4 Fri Aug 17 17:29:18 2012
@@ -1,5 +1,200 @@
-*- coding: utf-8 -*-
+Changes with Apache 2.4.3
+
+ *) SECURITY: CVE-2012-3502 (cve.mitre.org)
+ mod_proxy_ajp, mod_proxy_http: Fix an issue in back end
+ connection closing which could lead to privacy issues due
+ to a response mixup. PR 53727. [Rainer Jung]
+
+ *) SECURITY: CVE-2012-2687 (cve.mitre.org)
+ mod_negotiation: Escape filenames in variant list to prevent an
+ possible XSS for a site where untrusted users can upload files to
+ a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
+
+ *) mod_authnz_ldap: Don't try a potentially expensive nested groups
+ search before exhausting all AuthLDAPGroupAttribute checks on the
+ current group. PR 52464 [Eric Covener]
+
+ *) mod_lua: Add new directive LuaAuthzProvider to allow implementing an
+ authorization provider in lua. [Stefan Fritsch]
+
+ *) core: Be less strict when checking whether Content-Type is set to
+ "application/x-www-form-urlencoded" when parsing POST data,
+ or we risk losing data with an appended charset. PR 53698
+ [Petter Berntsen <petterb gmail.com>]
+
+ *) httpd.conf: Added configuration directives to set a bad_DNT environment
+ variable based on User-Agent and to remove the DNT header field from
+ incoming requests when a match occurs. This currently has the effect of
+ removing DNT from requests by MSIE 10.0 because it deliberately violates
+ the current specification of DNT semantics for HTTP. [Roy T. Fielding]
+
+ *) mod_socache_shmcb: Fix bus error due to a misalignment
+ in some 32 bit builds, especially on Solaris Sparc.
+ PR 53040. [Rainer Jung]
+
+ *) mod_cache: Set content type in case we return stale content.
+ [Ruediger Pluem]
+
+ *) Windows: Fix SSL failures on windows with AcceptFilter https none.
+ PR 52476. [Jeff Trawick]
+
+ *) ab: Fix read failure when targeting SSL server. [Jeff Trawick]
+
+ *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
+ - mod_auth_digest: shared memory file
+ [Jeff Trawick]
+
+ *) htpasswd: Use correct file mode for checking if file is writable.
+ PR 45923. [Stefan Fritsch]
+
+ *) mod_rewrite: Fix crash with dbd RewriteMaps. PR 53663. [Mikhail T.
+ <mi apache aldan algebra com>]
+
+ *) mod_ssl: Add new directive SSLCompression to disable TLS-level
+ compression. PR 53219. [Björn Jacke <bjoern j3e de>, Stefan Fritsch]
+
+ *) mod_lua: Add a few missing request_rec fields. Rename remote_ip to
+ client_ip to match conn_rec. [Stefan Fritsch]
+
+ *) mod_lua: Change prototype of vm_construct, to work around gcc bug which
+ causes a segfault. PR 52779. [Dick Snippe <Dick Snippe tech omroep nl>]
+
+ *) mpm_event: Don't count connections in lingering close state when
+ calculating how many additional connections may be accepted.
+ [Stefan Fritsch]
+
+ *) mod_ssl: If exiting during initialization because of a fatal error,
+ log a message to the main error log pointing to the appropriate
+ virtual host error log. [Stefan Fritsch]
+
+ *) mod_proxy_ajp: Reduce memory usage in case of many keep-alive requests on
+ one connection. PR 52275. [Naohiro Ooiwa <naohiro ooiwa miraclelinux com>]
+
+ *) mod_proxy_balancer: Restore balancing after a failed worker has
+ recovered when using lbmethod_bybusyness. PR 48735. [Jeff Trawick]
+
+ *) mod_setenvif: Compile some global regex only once during startup.
+ This should save some memory, especially with .htaccess.
+ [Stefan Fritsch]
+
+ *) core: Add the port number to the vhost's name in the scoreboard.
+ [Stefan Fritsch]
+
+ *) mod_proxy: Fix ProxyPassReverse for balancer configurations.
+ PR 45434. [Joe Orton]
+
+ *) mod_lua: Add the parsebody function for parsing POST data. PR 53064.
+ [Daniel Gruno]
+
+ *) apxs: Use LDFLAGS from config_vars.mk in addition to CFLAGS and CPPFLAGS.
+ [Stefan Fritsch]
+
+ *) mod_proxy: Fix memory leak or possible corruption in ProxyBlock
+ implementation. [Ruediger Pluem, Joe Orton]
+
+ *) mod_proxy: Check hostname from request URI against ProxyBlock list,
+ not forward proxy, if ProxyRemote* is configured. [Joe Orton]
+
+ *) mod_proxy_connect: Avoid DNS lookup on hostname from request URI
+ if ProxyRemote* is configured. PR 43697. [Joe Orton]
+
+ *) mpm_event, mpm_worker: Remain active amidst prevalent child process
+ resource shortages. [Jeff Trawick]
+
+ *) Add "strict" and "warnings" pragmas to Perl scripts. [Rich Bowen]
+
+ *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
+ - core: the scoreboard (ScoreBoardFile), pid file (PidFile), and
+ mutexes (Mutex)
+ [Jim Jagielski]
+
+ *) ab: Fix bind() errors. [Joe Orton]
+
+ *) mpm_event: Don't do a blocking write when starting a lingering close
+ from the listener thread. PR 52229. [Stefan Fritsch]
+
+ *) mod_so: If a filename without slashes is specified for LoadFile or
+ LoadModule and the file cannot be found in the server root directory,
+ try to use the standard dlopen() search path. [Stefan Fritsch]
+
+ *) mpm_event, mpm_worker: Fix cases where the spawn rate wasn't reduced
+ after child process resource shortages. [Jeff Trawick]
+
+ *) mpm_prefork: Reduce spawn rate after a child process exits due to
+ unexpected poll or accept failure. [Jeff Trawick]
+
+ *) core: Log value of Status header line in script responses rather
+ than the fixed header name. [Chris Darroch]
+
+ *) mpm_ssl: Fix handling of empty response from OCSP server.
+ [Jim Meyering <meyering redhat.com>, Joe Orton]
+
+ *) mpm_event: Fix handling of MaxConnectionsPerChild. [Stefan Fritsch]
+
+ *) mod_authz_core: If an expression in "Require expr" returns denied and
+ references %{REMOTE_USER}, trigger authentication and retry. PR 52892.
+ [Stefan Fritsch]
+
+ *) core: Always log if LimitRequestFieldSize triggers. [Stefan Fritsch]
+
+ *) mod_deflate: Skip compression if compression is enabled at SSL level.
+ [Stefan Fritsch]
+
+ *) core: Add missing HTTP status codes registered with IANA.
+ [Julian Reschke <julian.reschke gmx.de>, Rainer Jung]
+
+ *) mod_ldap: Treat the "server unavailable" condition as a transient
+ error with all LDAP SDKs. [Filip Valder <filip.valder vsb.cz>]
+
+ *) core: Fix spurious "not allowed here" error returned when the Options
+ directive is used in .htaccess and "AllowOverride Options" (with no
+ specific options restricted) is configured. PR 53444. [Eric Covener]
+
+ *) mod_authz_core: Fix parsing of Require arguments in <AuthzProviderAlias>.
+ PR 53048. [Stefan Fritsch]
+
+ *) mod_log_config: Fix %{abc}C truncating cookie values at first "=".
+ PR 53104. [Greg Ames]
+
+ *) mod_ext_filter: Fix error_log spam when input filters are configured.
+ [Joe Orton]
+
+ *) mod_rewrite: Add "AllowAnyURI" option. PR 52774. [Joe Orton]
+
+ *) htdbm, htpasswd: Don't crash if crypt() fails (e.g. with FIPS enabled).
+ [Paul Wouters <pwouters redhat.com>, Joe Orton]
+
+ *) core: Use a TLS 1.0 close_notify alert for internal dummy connection if
+ the chosen listener is configured for https. [Joe Orton]
+
+ *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
+ forwarding to SSL backends. PR 53134.
+ [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem]
+
+ *) mod_info: Display all registered providers. [Stefan Fritsch]
+
+ *) mod_ssl: Send the error message for speaking http to an https port using
+ HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when
+ using SNI. PR 50823. [Stefan Fritsch]
+
+ *) core: Fix segfault in logging if r->useragent_addr or c->client_addr is
+ unset. PR 53265. [Stefan Fritsch]
+
+ *) log_server_status: Bring Perl style forward to the present, use
+ standard modules, update for new format of server-status output.
+ PR 45424. [Richard Bowen, Dave Brondsema, and others]
+
+ *) mod_sed, mod_log_debug, mod_rewrite: Symbol namespace cleanups.
+ [Joe Orton, André Malo]
+
+ *) core: Prevent "httpd -k restart" from killing server in presence of
+ config error. [Joe Orton]
+
+ *) mod_proxy_fcgi: If there is an error reading the headers from the
+ backend, send an error to the client. PR 52879. [Stefan Fritsch]
+
Changes with Apache 2.4.2
*) SECURITY: CVE-2012-0883 (cve.mitre.org)
@@ -11,6 +206,9 @@
*) mod_ssl: Fix crash with threaded MPMs due to race condition when
initializing EC temporary keys. [Stefan Fritsch]
+ *) mod_rewrite: Fix RewriteCond integer checks to be parsed correctly.
+ PR 53023. [Axel Reinhold <apache freakout.de>, André Malo]
+
*) mod_proxy: Add the forcerecovery balancer parameter that determines if
recovery for balancer workers is enforced. [Ruediger Pluem]
@@ -109,7 +307,7 @@
*) Rewrite and proxy now decline what they don't support rather
than fail the request. [Joe Orton]
- *) Fix building against external apr plus ap-util if apr is not installed
+ *) Fix building against external apr plus apr-util if apr is not installed
in a system default path. [Rainer Jung]
*) Doxygen fixes and improvements. [Joe Orton, Igor GaliÄ]
Added: dev/httpd/CHANGES_2.4.3
==============================================================================
--- dev/httpd/CHANGES_2.4.3 (added)
+++ dev/httpd/CHANGES_2.4.3 Fri Aug 17 17:29:18 2012
@@ -0,0 +1,209 @@
+ -*- coding: utf-8 -*-
+
+Changes with Apache 2.4.3
+
+ *) SECURITY: CVE-2012-3502 (cve.mitre.org)
+ mod_proxy_ajp, mod_proxy_http: Fix an issue in back end
+ connection closing which could lead to privacy issues due
+ to a response mixup. PR 53727. [Rainer Jung]
+
+ *) SECURITY: CVE-2012-2687 (cve.mitre.org)
+ mod_negotiation: Escape filenames in variant list to prevent an
+ possible XSS for a site where untrusted users can upload files to
+ a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
+
+ *) mod_authnz_ldap: Don't try a potentially expensive nested groups
+ search before exhausting all AuthLDAPGroupAttribute checks on the
+ current group. PR 52464 [Eric Covener]
+
+ *) mod_lua: Add new directive LuaAuthzProvider to allow implementing an
+ authorization provider in lua. [Stefan Fritsch]
+
+ *) core: Be less strict when checking whether Content-Type is set to
+ "application/x-www-form-urlencoded" when parsing POST data,
+ or we risk losing data with an appended charset. PR 53698
+ [Petter Berntsen <petterb gmail.com>]
+
+ *) httpd.conf: Added configuration directives to set a bad_DNT environment
+ variable based on User-Agent and to remove the DNT header field from
+ incoming requests when a match occurs. This currently has the effect of
+ removing DNT from requests by MSIE 10.0 because it deliberately violates
+ the current specification of DNT semantics for HTTP. [Roy T. Fielding]
+
+ *) mod_socache_shmcb: Fix bus error due to a misalignment
+ in some 32 bit builds, especially on Solaris Sparc.
+ PR 53040. [Rainer Jung]
+
+ *) mod_cache: Set content type in case we return stale content.
+ [Ruediger Pluem]
+
+ *) Windows: Fix SSL failures on windows with AcceptFilter https none.
+ PR 52476. [Jeff Trawick]
+
+ *) ab: Fix read failure when targeting SSL server. [Jeff Trawick]
+
+ *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
+ - mod_auth_digest: shared memory file
+ [Jeff Trawick]
+
+ *) htpasswd: Use correct file mode for checking if file is writable.
+ PR 45923. [Stefan Fritsch]
+
+ *) mod_rewrite: Fix crash with dbd RewriteMaps. PR 53663. [Mikhail T.
+ <mi apache aldan algebra com>]
+
+ *) mod_ssl: Add new directive SSLCompression to disable TLS-level
+ compression. PR 53219. [Björn Jacke <bjoern j3e de>, Stefan Fritsch]
+
+ *) mod_lua: Add a few missing request_rec fields. Rename remote_ip to
+ client_ip to match conn_rec. [Stefan Fritsch]
+
+ *) mod_lua: Change prototype of vm_construct, to work around gcc bug which
+ causes a segfault. PR 52779. [Dick Snippe <Dick Snippe tech omroep nl>]
+
+ *) mpm_event: Don't count connections in lingering close state when
+ calculating how many additional connections may be accepted.
+ [Stefan Fritsch]
+
+ *) mod_ssl: If exiting during initialization because of a fatal error,
+ log a message to the main error log pointing to the appropriate
+ virtual host error log. [Stefan Fritsch]
+
+ *) mod_proxy_ajp: Reduce memory usage in case of many keep-alive requests on
+ one connection. PR 52275. [Naohiro Ooiwa <naohiro ooiwa miraclelinux com>]
+
+ *) mod_proxy_balancer: Restore balancing after a failed worker has
+ recovered when using lbmethod_bybusyness. PR 48735. [Jeff Trawick]
+
+ *) mod_setenvif: Compile some global regex only once during startup.
+ This should save some memory, especially with .htaccess.
+ [Stefan Fritsch]
+
+ *) core: Add the port number to the vhost's name in the scoreboard.
+ [Stefan Fritsch]
+
+ *) mod_proxy: Fix ProxyPassReverse for balancer configurations.
+ PR 45434. [Joe Orton]
+
+ *) mod_lua: Add the parsebody function for parsing POST data. PR 53064.
+ [Daniel Gruno]
+
+ *) apxs: Use LDFLAGS from config_vars.mk in addition to CFLAGS and CPPFLAGS.
+ [Stefan Fritsch]
+
+ *) mod_proxy: Fix memory leak or possible corruption in ProxyBlock
+ implementation. [Ruediger Pluem, Joe Orton]
+
+ *) mod_proxy: Check hostname from request URI against ProxyBlock list,
+ not forward proxy, if ProxyRemote* is configured. [Joe Orton]
+
+ *) mod_proxy_connect: Avoid DNS lookup on hostname from request URI
+ if ProxyRemote* is configured. PR 43697. [Joe Orton]
+
+ *) mpm_event, mpm_worker: Remain active amidst prevalent child process
+ resource shortages. [Jeff Trawick]
+
+ *) Add "strict" and "warnings" pragmas to Perl scripts. [Rich Bowen]
+
+ *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
+ - core: the scoreboard (ScoreBoardFile), pid file (PidFile), and
+ mutexes (Mutex)
+ [Jim Jagielski]
+
+ *) ab: Fix bind() errors. [Joe Orton]
+
+ *) mpm_event: Don't do a blocking write when starting a lingering close
+ from the listener thread. PR 52229. [Stefan Fritsch]
+
+ *) mod_so: If a filename without slashes is specified for LoadFile or
+ LoadModule and the file cannot be found in the server root directory,
+ try to use the standard dlopen() search path. [Stefan Fritsch]
+
+ *) mpm_event, mpm_worker: Fix cases where the spawn rate wasn't reduced
+ after child process resource shortages. [Jeff Trawick]
+
+ *) mpm_prefork: Reduce spawn rate after a child process exits due to
+ unexpected poll or accept failure. [Jeff Trawick]
+
+ *) core: Log value of Status header line in script responses rather
+ than the fixed header name. [Chris Darroch]
+
+ *) mpm_ssl: Fix handling of empty response from OCSP server.
+ [Jim Meyering <meyering redhat.com>, Joe Orton]
+
+ *) mpm_event: Fix handling of MaxConnectionsPerChild. [Stefan Fritsch]
+
+ *) mod_authz_core: If an expression in "Require expr" returns denied and
+ references %{REMOTE_USER}, trigger authentication and retry. PR 52892.
+ [Stefan Fritsch]
+
+ *) core: Always log if LimitRequestFieldSize triggers. [Stefan Fritsch]
+
+ *) mod_deflate: Skip compression if compression is enabled at SSL level.
+ [Stefan Fritsch]
+
+ *) core: Add missing HTTP status codes registered with IANA.
+ [Julian Reschke <julian.reschke gmx.de>, Rainer Jung]
+
+ *) mod_ldap: Treat the "server unavailable" condition as a transient
+ error with all LDAP SDKs. [Filip Valder <filip.valder vsb.cz>]
+
+ *) core: Fix spurious "not allowed here" error returned when the Options
+ directive is used in .htaccess and "AllowOverride Options" (with no
+ specific options restricted) is configured. PR 53444. [Eric Covener]
+
+ *) mod_authz_core: Fix parsing of Require arguments in <AuthzProviderAlias>.
+ PR 53048. [Stefan Fritsch]
+
+ *) mod_log_config: Fix %{abc}C truncating cookie values at first "=".
+ PR 53104. [Greg Ames]
+
+ *) mod_ext_filter: Fix error_log spam when input filters are configured.
+ [Joe Orton]
+
+ *) mod_rewrite: Add "AllowAnyURI" option. PR 52774. [Joe Orton]
+
+ *) htdbm, htpasswd: Don't crash if crypt() fails (e.g. with FIPS enabled).
+ [Paul Wouters <pwouters redhat.com>, Joe Orton]
+
+ *) core: Use a TLS 1.0 close_notify alert for internal dummy connection if
+ the chosen listener is configured for https. [Joe Orton]
+
+ *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
+ forwarding to SSL backends. PR 53134.
+ [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem]
+
+ *) mod_info: Display all registered providers. [Stefan Fritsch]
+
+ *) mod_ssl: Send the error message for speaking http to an https port using
+ HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when
+ using SNI. PR 50823. [Stefan Fritsch]
+
+ *) core: Fix segfault in logging if r->useragent_addr or c->client_addr is
+ unset. PR 53265. [Stefan Fritsch]
+
+ *) log_server_status: Bring Perl style forward to the present, use
+ standard modules, update for new format of server-status output.
+ PR 45424. [Richard Bowen, Dave Brondsema, and others]
+
+ *) mod_sed, mod_log_debug, mod_rewrite: Symbol namespace cleanups.
+ [Joe Orton, André Malo]
+
+ *) core: Prevent "httpd -k restart" from killing server in presence of
+ config error. [Joe Orton]
+
+ *) mod_proxy_fcgi: If there is an error reading the headers from the
+ backend, send an error to the client. PR 52879. [Stefan Fritsch]
+
+
+ [Apache 2.3.0-dev includes those bug fixes and changes with the
+ Apache 2.2.xx tree as documented, and except as noted, below.]
+
+Changes with Apache 2.2.x and later:
+
+ *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup
+
+Changes with Apache 2.0.x and later:
+
+ *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/CHANGES?view=markup
+
Added: dev/httpd/httpd-2.4.3-deps.tar.bz2
==============================================================================
Binary file - no diff available.
Propchange: dev/httpd/httpd-2.4.3-deps.tar.bz2
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/httpd/httpd-2.4.3-deps.tar.bz2.asc
==============================================================================
--- dev/httpd/httpd-2.4.3-deps.tar.bz2.asc (added)
+++ dev/httpd/httpd-2.4.3-deps.tar.bz2.asc Fri Aug 17 17:29:18 2012
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (Darwin)
+
+iQIVAwUAUC59kjTqduZ5FIWoAQrqyw//Y/e8GfbFvZYMO1+cM1Ao4k2HTAyZ7EEg
+GLIt2FBNFh7ZDJxQTcftf56yZIlNeTeC7ut1lirvRFTWasyxNV3huiw+pbRBgDx6
+agcbluN0VcVhlZrtLyTKgyPNmJNRec5C0dFW0W59fFtwShxMqzJKkJHaE+SUSKv0
+mF62tOCJSJLCEkUAq99PTUxlPWxuqu9uhSDQGLe2P58ckRtr1If2YjEz5jVqf8XO
+SmvetV3O42mXpuVK586yScNDey6IRvk6FbU7KZjsTegwKoMVzBq+jjU5LdjhmOaU
+l/cXmjblqUm6gElXJR1JOuUyIJg8Wq2fEHyOTHV8npMLakhqtGwS13elGA0ihUDv
+jEI+0hRGczkh0XFNPHVYjkbuyTFIElNNsagc2AombaP/TLocwJ8Wf+KOhRxJ2GZ4
+1mlxnO5nCyLMsNG1HA3Fx/6uqAPvCaOYvL6Hpi85c8jcCWHgzF2/6lRCuXgYqsAS
+rzjRQafYg09zM8FWL4wJ2r46Glfk+aEIX57gVgrzpaWpWoesQ7pRpghr2QN7VLHA
+PaDeClB5G28it+NJi9d71OBqxElHl9vTJAkBlAiOQdVHSngwAa05WI3PiEyb33Eb
+3YoXHgJtTRUDOUC6UzC+6ORUg8C8V7OE0enShVyF4zbOoKnb+aJYapNy/ao47AtF
+L5VrsydsIxM=
+=eVUw
+-----END PGP SIGNATURE-----
Added: dev/httpd/httpd-2.4.3-deps.tar.bz2.md5
==============================================================================
--- dev/httpd/httpd-2.4.3-deps.tar.bz2.md5 (added)
+++ dev/httpd/httpd-2.4.3-deps.tar.bz2.md5 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+0ac7afab1dab1f1caa9a1bfc5cc258da *httpd-2.4.3-deps.tar.bz2
Added: dev/httpd/httpd-2.4.3-deps.tar.bz2.sha1
==============================================================================
--- dev/httpd/httpd-2.4.3-deps.tar.bz2.sha1 (added)
+++ dev/httpd/httpd-2.4.3-deps.tar.bz2.sha1 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+7eb5e04f14c6122cde56771109e304a079e4b441 *httpd-2.4.3-deps.tar.bz2
Added: dev/httpd/httpd-2.4.3-deps.tar.gz
==============================================================================
Binary file - no diff available.
Propchange: dev/httpd/httpd-2.4.3-deps.tar.gz
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/httpd/httpd-2.4.3-deps.tar.gz.asc
==============================================================================
--- dev/httpd/httpd-2.4.3-deps.tar.gz.asc (added)
+++ dev/httpd/httpd-2.4.3-deps.tar.gz.asc Fri Aug 17 17:29:18 2012
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (Darwin)
+
+iQIVAwUAUC59jTTqduZ5FIWoAQrFkg/+Pw36NJk8oPU0Dx2T6347+cD+niBLxZzf
+sHppZH0ibCem+vn8N149N/1ZhU1o3FeDJ6AvQHAqWHkksOeASSl0T6iPZeiW/R28
+Z4O1LMZwoLVpokdo1s0BplxPozeGLTTa6wo/nNbWHJU8CIEScFRCiaDXpjPR9nJ9
+5mN2/pzse3Qaot+B4VG32UuD1eeJc/go0/j0p7OcoLUmCbpiV2jcJAnH5i7sbFP9
+gyTxYlcy5kveR+hkNJAXlb83+ODwYcc3fBPicKlSLPwPUjizruqXeP5fy/FOuzD4
+/VcJurwsO2v68pJVZ6BvV7xp8kpmR6nB416OHfrpnT3eLrZXlqTDgMFu1IYKUMnT
+v2+S+8MjQ+yEANF/NzUB15mCE13mcv/KKNI718JN/hEZ2kUjg5/j9tPOZiZ4Mdbx
+MifajJDIIb+c6IyAcM+z0vO6aUbnXw7OHF+0OqVfwOEsIyL/IKS3D1zaYp/JrZ2z
+OqN1ayIRHZPkUOr0i9r+Jbu7AoGgQm2ufozwnUp8NQt86Z+cVhuhx8eofNtTmhyI
+EVDeckCVA/0WLmcW9kyEb7bziKBt7NIiFYIGbAeswDA/kLCDrfBs98cP3imD3uUy
+W8hC/6tGBGaErbnnB611ogFcKqU6aYGna1xBaMrWHBRaQXo0m7rC3T8my8DQxoCS
+8evTzhQFsic=
+=tRxc
+-----END PGP SIGNATURE-----
Added: dev/httpd/httpd-2.4.3-deps.tar.gz.md5
==============================================================================
--- dev/httpd/httpd-2.4.3-deps.tar.gz.md5 (added)
+++ dev/httpd/httpd-2.4.3-deps.tar.gz.md5 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+03dcb87715320c9cfc211ab3ee5c7993 *httpd-2.4.3-deps.tar.gz
Added: dev/httpd/httpd-2.4.3-deps.tar.gz.sha1
==============================================================================
--- dev/httpd/httpd-2.4.3-deps.tar.gz.sha1 (added)
+++ dev/httpd/httpd-2.4.3-deps.tar.gz.sha1 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+c58ff2f2ddbaa5c0e41497eeba35b60ccac8f51e *httpd-2.4.3-deps.tar.gz
Added: dev/httpd/httpd-2.4.3.tar.bz2
==============================================================================
Binary file - no diff available.
Propchange: dev/httpd/httpd-2.4.3.tar.bz2
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/httpd/httpd-2.4.3.tar.bz2.asc
==============================================================================
--- dev/httpd/httpd-2.4.3.tar.bz2.asc (added)
+++ dev/httpd/httpd-2.4.3.tar.bz2.asc Fri Aug 17 17:29:18 2012
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (Darwin)
+
+iQIVAwUAUC59iTTqduZ5FIWoAQpNYBAAi24m6JtM9Ryhf0pZaplz7jozsxn0eRGv
+/aYfgJiLDqgxl7zpSji87kaztCurvAkR/Rey008fwVMO7B/u7i81pVBpB8m8Gywn
+1lNkQAZjsun7Sab+L2QLp1BFZpyavi7mzRJzqY9CqEKIzWCDOcnEaLwmHT5PFUUH
+KU2jVTv2xl/7xqGSWlPa05zH2aXid5qpSD9Gsg+VKxhTbGUakfCZU51NHAVKvPMa
+1gUWPqtDEwrzRIY84MtBV65y5nJz4yl9Qe7Q25Bqaqd18Woaged237k9gJwTx8se
+6+0p9/EtxPBHT/L4w7J8qramwVpids6RiiYZpzDOmFnPNDNKpKWDWn7ms9XmaB4H
+DJGL8w2MRKqzGePFcoSkgjKvnAKuSr6CPlvCCaCOMz6zSzlKEXoRTUejfNYguLvA
+/icpoJF5TEju1uX1032LTM7abJytoFnjTHVxchAi+xuIahungG/CXQHoIMY1Bbys
+s8yeL+xEs3r0DuR1GpLNNJPddubthSoFK+BXSK4SXad/vv2Q50QZS26IHgcDv3Lm
+S0ddCTlSZ7nxxgkTfTCWg+5pncmGAxBXtOSTGImRFeCa93Fa1Ee/kqH7gZcLoNkC
+AK7HNJ9fzLIxWgziknfgQRQk3araHkFurO7EWAmQolQKNXhSAkdnspCeSTFPhPBh
+HO2AqCjpTZg=
+=E0dg
+-----END PGP SIGNATURE-----
Added: dev/httpd/httpd-2.4.3.tar.bz2.md5
==============================================================================
--- dev/httpd/httpd-2.4.3.tar.bz2.md5 (added)
+++ dev/httpd/httpd-2.4.3.tar.bz2.md5 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+87aaf7bc7e8715f0455997bb8c6791aa *httpd-2.4.3.tar.bz2
Added: dev/httpd/httpd-2.4.3.tar.bz2.sha1
==============================================================================
--- dev/httpd/httpd-2.4.3.tar.bz2.sha1 (added)
+++ dev/httpd/httpd-2.4.3.tar.bz2.sha1 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+0ef1281bb758add937efe61c345287be2f27f662 *httpd-2.4.3.tar.bz2
Added: dev/httpd/httpd-2.4.3.tar.gz
==============================================================================
Binary file - no diff available.
Propchange: dev/httpd/httpd-2.4.3.tar.gz
------------------------------------------------------------------------------
svn:mime-type = application/octet-stream
Added: dev/httpd/httpd-2.4.3.tar.gz.asc
==============================================================================
--- dev/httpd/httpd-2.4.3.tar.gz.asc (added)
+++ dev/httpd/httpd-2.4.3.tar.gz.asc Fri Aug 17 17:29:18 2012
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (Darwin)
+
+iQIVAwUAUC59hTTqduZ5FIWoAQq/JA//SFjtJP+jKy/jjy1GGs6lJBJvR7isOGhv
++4Yirw97JNaOyi6vn8euLN7o30KUA+MmcYSJwVe9F0TqLej5ZbymKQ0a1aO80o+8
+uXlQTr2erTLvl0L+cFBlv9rkN/vtmXNbthQ11hUbZBpUGhJmq6dU/ZR/KW1UA6cx
+dHFmA0bNrJaLjFNCv00OI23KtTSdw6NFSInc/muyWQU9+QVgScjJmkQmES5vzkOs
+dxcvau1ZrTPpoJIzuOvWehPgG2HJnE1zYhZQD8Y0lmQaql5NQt8SdZsFEna14rUw
+49AozeGU9W6heiTwRpB3hFDr0HpOJXzP/BQT6B61EjrUsUMO9gbZvCPm4pEPb6l8
++cR18CyLkFLj4T7HPnD8rb2++H51yh8nAYXC5pdTXxS12G18+CMB/zSP/iaNe323
+nl1G70DqIyqOD4fdEy65wzInriyxLFSaZIsAUlKevFybjkUYQAxNI5ZtkCMuSG5m
+qeC8n/XodPV59eob3+C7tpVptEEjMtLzBgKmECMlaIxfyekj9bEHbV53X28WgaM3
+MSwX7tdYCWCFhZwzs0vJLqiMhQKngY8LCbSqSL8fpKrEp2CrcOKe2qCgJ3Z7sT6Z
+M2EbQBGlcpw4uVCfL8lDEkUggEuzTXo13ddrnYGL9xV5Mfvl1+gFNrYXrHXOtHmW
+mkLZzId4bRI=
+=bYBp
+-----END PGP SIGNATURE-----
Added: dev/httpd/httpd-2.4.3.tar.gz.md5
==============================================================================
--- dev/httpd/httpd-2.4.3.tar.gz.md5 (added)
+++ dev/httpd/httpd-2.4.3.tar.gz.md5 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+538dccd22dd18466fff3ec7948495417 *httpd-2.4.3.tar.gz
Added: dev/httpd/httpd-2.4.3.tar.gz.sha1
==============================================================================
--- dev/httpd/httpd-2.4.3.tar.gz.sha1 (added)
+++ dev/httpd/httpd-2.4.3.tar.gz.sha1 Fri Aug 17 17:29:18 2012
@@ -0,0 +1 @@
+845ca56816b0352c7759b6b8f47bd012c0864efd *httpd-2.4.3.tar.gz