Re: Time for httpd 2.4.0-RC1 ??

2011-12-15 Thread Jim Jagielski
On Dec 14, 2011, at 3:02 PM, William A. Rowe Jr. wrote: On 12/14/2011 6:09 AM, Jim Jagielski wrote: Let's talk about the specifics of carrying this out... the main issues is how we tag and roll this. Recall that we don't have any real concept of Release Candidates. I like it that way,

Re: Time for httpd 2.4.0-RC1 ??

2011-12-15 Thread Jim Jagielski
On Dec 15, 2011, at 9:23 AM, Jim Jagielski wrote: So to make sure I'm clear, what is your recommendation? Another beta or just drop 2.4.0? FWIW, my plan, without a clear RC charter, is to do a final 2.3.x beta (from the httpd-2.4 branch) and then a GA. IMO, there have been too many

[VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Jim Jagielski
The 2.3.16-beta (prerelease) tarballs are available for download at test: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as 2.3.16-beta BETA and, with luck, this IS our last beta and the next release in ~2weeks or less will be 2.4.0 GA!! Vote will last the

Re: Time for httpd 2.4.0-RC1 ??

2011-12-15 Thread Igor Galić
- Original Message - On Dec 15, 2011, at 9:23 AM, Jim Jagielski wrote: So to make sure I'm clear, what is your recommendation? Another beta or just drop 2.4.0? FWIW, my plan, without a clear RC charter, is to do a final 2.3.x beta (from the httpd-2.4 branch) and then a GA.

Re: [RFC] further proxy/rewrite URL validation security issue (CVE-2011-4317)

2011-12-15 Thread Jeff Trawick
On Wed, Nov 23, 2011 at 9:23 AM, Joe Orton jor...@redhat.com wrote: Prutha Parikh from Qualys reported a variant on the CVE-2011-3368 attack against certain mod_proxy/mod_rewrite configurations.  A new CVE name, CVE-2011-4317, has been assigned to this variant. The configurations in question

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread sridhar basam
On Thu, Dec 15, 2011 at 9:48 AM, Jim Jagielski j...@jagunet.com wrote: The 2.3.16-beta (prerelease) tarballs are available for download at test: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as 2.3.16-beta BETA and, with luck, this IS our last beta and the

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Igor Galić
- Original Message - On Thu, Dec 15, 2011 at 9:48 AM, Jim Jagielski j...@jagunet.com wrote: The 2.3.16-beta (prerelease) tarballs are available for download at test: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as 2.3.16-beta BETA and, with

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Graham Leggett
On 15 Dec 2011, at 4:48 PM, Jim Jagielski wrote: The 2.3.16-beta (prerelease) tarballs are available for download at test: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as 2.3.16-beta BETA and, with luck, this IS our last beta and the next release in

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Igor Galić
- Original Message - The 2.3.16-beta (prerelease) tarballs are available for download at test: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as 2.3.16-beta BETA and, with luck, this IS our last beta and the next release in ~2weeks or less will be

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Igor Galić
- Original Message - - Original Message - The 2.3.16-beta (prerelease) tarballs are available for download at test: http://httpd.apache.org/dev/dist/ I'm calling a VOTE on releasing these as 2.3.16-beta BETA and, with luck, this IS our last beta and the next

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread sridhar basam
2011/12/15 Igor Galić i.ga...@brainsware.org apr is fine, but you'll need the apr-util 1.4.1 Thanks, using the --with-included-apr fixed the compile time errors. Looks good on 11.10 x86. sridhar

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Steffen
Builds fine on Windows 32, still the reported warnings. Third-party modules are broken, for example: c:\apache23\include\httpd.h(1043) : see declaration of 'conn_rec' mod_security2.c(1254) : error C2039: 'remote_ip' : is not a member of 'conn_rec' c:\apache23\include\httpd.h(1043) : see

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Steffen
Looks like the name is changed to client_ip/addr and not remote_ip/addr Changed to the new name in the sources from eg. mod_security and changed also msr-remote_port = r-connection-remote_addr-port to msr-remote_port = r-connection-client_addr-port Builds now, but running it crashes:

Re: [RFC] further proxy/rewrite URL validation security issue (CVE-2011-4317)

2011-12-15 Thread Eric Covener
On Thu, Dec 15, 2011 at 11:04 PM, Jeff Trawick traw...@gmail.com wrote: On Wed, Nov 23, 2011 at 9:23 AM, Joe Orton jor...@redhat.com wrote: Prutha Parikh from Qualys reported a variant on the CVE-2011-3368 attack against certain mod_proxy/mod_rewrite configurations.  A new CVE name,

Re: Time for httpd 2.4.0-RC1 ??

2011-12-15 Thread William A. Rowe Jr.
On 12/15/2011 8:23 AM, Jim Jagielski wrote: On Dec 14, 2011, at 3:02 PM, William A. Rowe Jr. wrote: On 12/14/2011 6:09 AM, Jim Jagielski wrote: Let's talk about the specifics of carrying this out... the main issues is how we tag and roll this. Recall that we don't have any real concept

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread William A. Rowe Jr.
On 12/15/2011 10:54 AM, Igor Galić wrote: apr/apu versions are the versions which come with the OS distro (1.4.5 and 1.3.12) apr is fine, but you'll need the apr-util 1.4.1 No. apr-util 1.3.x is fine. You will lose functionality of two specific modules, of course.

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread William A. Rowe Jr.
On 12/15/2011 1:18 PM, Steffen wrote: Builds fine on Windows 32, still the reported warnings. Third-party modules are broken That is to be expected, this is a major/minor revision with API changes.

Re: [VOTE] Release 2.3.16-beta as beta

2011-12-15 Thread Graham Leggett
On 15 Dec 2011, at 9:18 PM, Steffen wrote: Builds fine on Windows 32, still the reported warnings. Third-party modules are broken, for example: Module authors need to go through the list of changes at http://httpd.apache.org/docs/trunk/developer/new_api_2_4.html to determine whether their