Re: Comparing LibreSSL and OpenSSL based on ApacheTest t/ssl results

2015-07-16 Thread William A Rowe Jr
On Thu, Jul 16, 2015 at 12:02 PM, Michael Felt mamf...@gmail.com wrote: Here I have the output of just one test t/ssl/pr12355.t - and note the differences in the ssl_access_log - not just the error messages (I have removed all debug messages from the logs as they were in the way. LibreSSL is

Re: Comparing LibreSSL and OpenSSL based on ApacheTest t/ssl results

2015-07-16 Thread Yann Ylavic
On Thu, Jul 16, 2015 at 7:02 PM, Michael Felt mamf...@gmail.com wrote: A longish read - basically while 2.4.12 had few errors when built against OpenSSL 0.9.8 LibreSSL has quite a few errors - perhaps because it has removed many unsafe crypto combinations. The root question is: is this

Bug 58118

2015-07-16 Thread Tobias Adolph
Hello everybody, I would be very grateful if somebody could look into bug report 58118 https://bz.apache.org/bugzilla/show_bug.cgi?id=58118 The issue concerns the logging of a 503 status code in modules/proxy/mod_proxy_fcgi.c at 836 although a 200 has been sent to the client. This can happen

The show goes on - 2.4.16

2015-07-16 Thread Michael Felt
First little thing I ran into - that I did not have with 2.4.12 is this: root@x065:[/data/prj/apache/httpd/test]/opt/httpd/sbin/apachectl start AH00534: httpd: Configuration error: More than one MPM loaded. Granted, I should perhaps change to pre-fork (I noticed some had only tested that) - but

Re: The show goes on - 2.4.16

2015-07-16 Thread Michael Felt
I do not know why both are there - something to do with the configure statement perhaps. As I said above - not had this show up before. In any case, just finished ApacheTest and is looking very good. All tests successful. Files=110, Tests=4843, 364 wallclock secs ( 3.38 usr 0.50 sys + 88.88

Re: Release annoucements missing on annou...@httpd.apache.org

2015-07-16 Thread Michael Felt
Also, the home page still says 2.4.12 and 2.2.29 - but the Download page is up to date... On Thu, Jul 16, 2015 at 1:47 PM, Jim Jagielski j...@jagunet.com wrote: Oops. Sorry. On Jul 15, 2015, at 5:03 PM, Bostjan Skufca bost...@a2o.si wrote: Hi all, since 2.4.10 and 2.2.29 the

Re: Release annoucements missing on annou...@httpd.apache.org

2015-07-16 Thread Jim Jagielski
refresh your browser cache. :) On Jul 16, 2015, at 8:22 AM, Michael Felt mamf...@gmail.com wrote: Also, the home page still says 2.4.12 and 2.2.29 - but the Download page is up to date... On Thu, Jul 16, 2015 at 1:47 PM, Jim Jagielski j...@jagunet.com wrote: Oops. Sorry. On Jul 15,

Re: Release annoucements missing on annou...@httpd.apache.org

2015-07-16 Thread Jim Jagielski
Oops. Sorry. On Jul 15, 2015, at 5:03 PM, Bostjan Skufca bost...@a2o.si wrote: Hi all, since 2.4.10 and 2.2.29 the annou...@httpd.apache.org is abandoned. Is this intentional? Someone already asked about this last year: http://marc.info/?l=apache-httpd-devm=141157921203967w=2 If

Re: Release annoucements missing on annou...@httpd.apache.org

2015-07-16 Thread Bostjan Skufca
I see 2.4.16 since yesterday (if I remember correctly). Are you talking about http://httpd.apache.org/ ? b. On 16 July 2015 at 14:22, Michael Felt mamf...@gmail.com wrote: Also, the home page still says 2.4.12 and 2.2.29 - but the Download page is up to date... On Thu, Jul 16, 2015 at 1:47

Congradulations on the new release(s)

2015-07-16 Thread Michael Felt
I am a bit behind - yet looking forward. I wish to recall a pleasant get together last April in Texas just before ApacheCon. At that time I mentioned LibreSSL and building httpd against it (actually mod_ssl is all it amounts to). The build itself was quite simple - I shall repeat that now for

Re: Release annoucements missing on annou...@httpd.apache.org

2015-07-16 Thread Michael Felt
Should have thought of that earlier :p @ me. On Thu, Jul 16, 2015 at 2:34 PM, Jim Jagielski j...@jagunet.com wrote: refresh your browser cache. :) On Jul 16, 2015, at 8:22 AM, Michael Felt mamf...@gmail.com wrote: Also, the home page still says 2.4.12 and 2.2.29 - but the Download page

Re: The show goes on - 2.4.16

2015-07-16 Thread Reindl Harald
Am 16.07.2015 um 15:03 schrieb Michael Felt: First little thing I ran into - that I did not have with 2.4.12 is this: root@x065:[/data/prj/apache/httpd/test]/opt/httpd/sbin/apachectl start AH00534: httpd: Configuration error: More than one MPM loaded. Granted, I should perhaps change to

Re: The show goes on - 2.4.16

2015-07-16 Thread Michael Felt
My comment is that with 2.4.12 the same configure did not do this. This is new behavior. I was testing with 2.4.12 all day yesterday, using the same build scripts today with 2.4.16 came up differently. So now, after the build I have this difference in httpd.conf

Re: The show goes on - 2.4.16

2015-07-16 Thread William A Rowe Jr
On Jul 16, 2015 8:04 AM, Michael Felt mamf...@gmail.com wrote: First little thing I ran into - that I did not have with 2.4.12 is this: root@x065:[/data/prj/apache/httpd/test]/opt/httpd/sbin/apachectl start AH00534: httpd: Configuration error: More than one MPM loaded.

Re: The show goes on - 2.4.16

2015-07-16 Thread Yann Ylavic
On Thu, Jul 16, 2015 at 4:41 PM, Michael Felt mamf...@gmail.com wrote: My comment is that with 2.4.12 the same configure did not do this. This is new behavior. Probably a consequence of [1] which may not play very well with --enable-load-all-modules. [1] http://svn.apache.org/r1661848

Re: The show goes on - 2.4.16

2015-07-16 Thread Andy Wang
http://svn.apache.org/viewvc?view=revisionrevision=1661848 https://bz.apache.org/bugzilla/show_bug.cgi?id=53882 Looks like it was explicitly changed to track mpms like any other shared module, and as Bill noted, --enable-load-all-modules simply loaded them all mpms included. Andy On

Re: The show goes on - 2.4.16

2015-07-16 Thread Yann Ylavic
Yes, and with --enable-load-all-modules (not so common, I think, when not testing with the framework...). On Thu, Jul 16, 2015 at 5:19 PM, Jim Jagielski j...@jagunet.com wrote: Yeah... gr. In any case, this would affect only those w/ virgin builds, right? On Jul 16, 2015, at 11:01 AM,

Re: The show goes on - 2.4.16

2015-07-16 Thread Michael Felt
Nothing serious of course - AND the advantage is that I do not have to do a new build to switch to pre-fork (which was the old way iirc). So - was I the first to find a bug in the new release :P btw - I am much more interested in the ssl tests and whether it is a failed test (going back to MC4

Re: Congradulations on the new release(s)

2015-07-16 Thread Michael Felt
I really should have titled this differently - sigh! On Thu, Jul 16, 2015 at 2:20 PM, Michael Felt mamf...@gmail.com wrote: I am a bit behind - yet looking forward. I wish to recall a pleasant get together last April in Texas just before ApacheCon. At that time I mentioned LibreSSL and

Re: The show goes on - 2.4.16

2015-07-16 Thread Jim Jagielski
Yeah... gr. In any case, this would affect only those w/ virgin builds, right? On Jul 16, 2015, at 11:01 AM, Yann Ylavic ylavic@gmail.com wrote: On Thu, Jul 16, 2015 at 4:41 PM, Michael Felt mamf...@gmail.com wrote: My comment is that with 2.4.12 the same configure did not do this.

Re: finally...

2015-07-16 Thread Jim Jagielski
Testing as we speak... will commit if all OK :) On Jul 15, 2015, at 12:26 PM, Stefan Eissing stefan.eiss...@greenbytes.de wrote: ...got the test framework to PASS on my OS X against httpd/trunk built. I added more description of what I found in the README and checked that in. I have

Comparing LibreSSL and OpenSSL based on ApacheTest t/ssl results

2015-07-16 Thread Michael Felt
Moving this to a thread with a better title! A longish read - basically while 2.4.12 had few errors when built against OpenSSL 0.9.8 LibreSSL has quite a few errors - perhaps because it has removed many unsafe crypto combinations. The root question is: is this LibreSSL misbehaving, or are the

Re: [VOTE] [24 hr] Release 2.2.31 as GA?

2015-07-16 Thread William A Rowe Jr
On Wed, Jul 15, 2015 at 11:44 AM, William A Rowe Jr wr...@rowe-clan.net wrote: The pre-release candidate tarballs of Apache httpd 2.2.31, can be found in; http://httpd.apache.org/dev/dist/ +/-1 [+1] Release 2.2.31 GA (apr 1.5.2, apr-util 1.5.4) My own vote after preparing

[VOTE] [PASSES] Release 2.2.31 as GA?

2015-07-16 Thread William A Rowe Jr
With 4/5 of the 2.2.30 voters having re-reviewed 2.2.31, and the single s/-1/+1/ based on this re-roll, I'm confident in calling this vote a success, and am pushing this release to the mirrors for announcement tomorrow. Thanks all for all the reviews of both 2.2 candidates (and all of the 4 2.4

Re: The show goes on - 2.4.16

2015-07-16 Thread Yann Ylavic
On Thu, Jul 16, 2015 at 5:38 PM, Michael Felt mamf...@gmail.com wrote: btw - I am much more interested in the ssl tests and whether it is a failed test (going back to MC4 128-bit) when the initial connection was much better. I assume this is not logjam (or some other horrible recent OpenSSL

Re: The show goes on - 2.4.16

2015-07-16 Thread Rainer Jung
Am 16.07.2015 um 17:26 schrieb Yann Ylavic: Yes, and with --enable-load-all-modules (not so common, I think, when not testing with the framework...). Exactly, thats mostly a flag to produce non-production bus test ready configs. Not so nice that it doesn't startup, but I would be astonished

Re: finally...

2015-07-16 Thread Stefan Eissing
Thanks, Jim! Am 16.07.2015 um 17:22 schrieb Jim Jagielski j...@jagunet.com: Testing as we speak... will commit if all OK :) On Jul 15, 2015, at 12:26 PM, Stefan Eissing stefan.eiss...@greenbytes.de wrote: ...got the test framework to PASS on my OS X against httpd/trunk built. I

Re: Comparing LibreSSL and OpenSSL based on ApacheTest t/ssl results

2015-07-16 Thread Michael Felt
I'll look at it and hopefully understand something. but tomorrow. On Thu, Jul 16, 2015 at 7:56 PM, William A Rowe Jr wr...@rowe-clan.net wrote: On Thu, Jul 16, 2015 at 12:02 PM, Michael Felt mamf...@gmail.com wrote: Here I have the output of just one test t/ssl/pr12355.t - and note the