Bug report for Apache httpd-1.3 [2009/09/13]

2009-09-14 Thread bugzilla
+---+ | Bugzilla Bug ID | | +-+ | | Status: UNC=Unconfirmed NEW=New ASS=Assigned

DAV Option Patch

2009-09-14 Thread Brian J. France
I would like to get some form of mod_dav_acl[1] added to httpd. My end goal with all of this is to get a mod_caldav and mod_cardav accepted down the line or at least be able to build the module with out hacking the core httpd source. I am going to start by splitting up the Jari's

Re: CVE-2009-3094, CVE-2009-3095: mod_proxy_ftp issues

2009-09-14 Thread Joe Orton
On Sat, Sep 12, 2009 at 10:43:29PM +0200, Stefan Fritsch wrote: On Fri, 11 Sep 2009, Joe Orton wrote: +char *p = ap_strchr(reply, '('), *ep, *term; +long port; + +/* Reply syntax per RFC 2428: 229 blah blah (|||port|) where '|' + * can be any character in ASCII from 33-126,

Re: DAV Option Patch

2009-09-14 Thread Graham Leggett
Brian J. France wrote: These patches are based off of 2.2.13, but if you would rather have patch against a branch or head, please let me know. Creating patches off head is the place to start, and once the patches have been committed to head, the next step is for people to vote on backporting

Re: svn commit: r814048 - /httpd/httpd/trunk/modules/http/http_protocol.c

2009-09-14 Thread William A. Rowe, Jr.
Ruediger Pluem wrote: Same here. Fixed in r814114. Thanks for the catch and the note to STATUS, Ruediger. Bill

Re: DAV Option Patch

2009-09-14 Thread Dan Poirier
Brian J. France br...@brianfrance.com writes: I have updated the dav-options patch against head: http://www.brianfrance.com/software/apache/dav/dav-options.diff One suggestion - using hook in the names could be confusing since this isn't using the built-in hook mechanism. Since it is using

Re: DAV Option Patch

2009-09-14 Thread Brian J. France
On Sep 14, 2009, at 10:23 AM, Graham Leggett wrote: Brian J. France wrote: These patches are based off of 2.2.13, but if you would rather have patch against a branch or head, please let me know. Creating patches off head is the place to start, and once the patches have been committed to

Re: Memory usage, core output filter, and apr_brigade_destroy

2009-09-14 Thread Stefan Fritsch
On Sun, 13 Sep 2009, Ruediger Pluem wrote: But your patch is causing core dumps during the proxy tests when running the test suite :-(. I currently don't understand why. Hmmm... either ctx-tmp_flush_bb is NULL or, since it was added in the middle of the struct, you didn't do a make distclean

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Graham Leggett
traw...@apache.org wrote: Author: trawick Date: Mon Sep 14 17:25:07 2009 New Revision: 814743 URL: http://svn.apache.org/viewvc?rev=814743view=rev Log: promote, demote With everything moved around, I am assuming you are referring to this: * htdbm: Avoid buffer overflows. PR: 30586

Re: svn commit: r797563 - in /httpd/httpd/trunk: CHANGES support/htdbm.c

2009-09-14 Thread Jeff Trawick
On Fri, Jul 24, 2009 at 1:15 PM, poir...@apache.org wrote: Author: poirier Date: Fri Jul 24 17:15:29 2009 New Revision: 797563 URL: http://svn.apache.org/viewvc?rev=797563view=rev Log: htdbm: Fix possible buffer overflow if dbm database has very long values. PR 30586 [Dan Poirier] PR

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Jeff Trawick
On Mon, Sep 14, 2009 at 1:35 PM, Graham Leggett minf...@sharp.fm wrote: traw...@apache.org wrote: Author: trawick Date: Mon Sep 14 17:25:07 2009 New Revision: 814743 URL: http://svn.apache.org/viewvc?rev=814743view=rev Log: promote, demote With everything moved around, I am

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Dan Poirier
On 09/14/2009 01:25 PM, traw...@apache.org wrote: - * htcacheclean: 19 ways to fail, 1 error message. Fixed. - Trunk Patch: http://svn.apache.org/viewvc?view=revrevision=814091 - +1: minfrin, covener, poirier + -1: trawick (Memory use for dumping the database is now unbounded; it +

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Jeff Trawick
On Mon, Sep 14, 2009 at 1:59 PM, Dan Poirier poir...@pobox.com wrote: On 09/14/2009 01:25 PM, traw...@apache.org wrote: - * htcacheclean: 19 ways to fail, 1 error message. Fixed. - Trunk Patch: http://svn.apache.org/viewvc?view=revrevision=814091 - +1: minfrin, covener, poirier + -1:

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Dan Poirier
Dan Poirier poir...@pobox.com writes: Can you elaborate? I don't see how these changes create additional and unbounded memory usage. Sorry, I was confused and thought the comment applied to another, more innocuous proposed backport. I'll go look at this again. -- Dan Poirier

Re: svn commit: r814091 - in /httpd/httpd/trunk: CHANGES support/htcacheclean.c

2009-09-14 Thread Dan Poirier
On 09/11/2009 07:57 PM, minf...@apache.org wrote: Modified: httpd/httpd/trunk/support/htcacheclean.c URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/htcacheclean.c?rev=814091r1=814090r2=814091view=diff ==

Re: svn commit: r814652 - /httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c

2009-09-14 Thread Ruediger Pluem
On 09/14/2009 04:16 PM, jor...@apache.org wrote: Author: jorton Date: Mon Sep 14 14:16:14 2009 New Revision: 814652 URL: http://svn.apache.org/viewvc?rev=814652view=rev Log: Security fix - this is presumed to fix CVE-2009-3094 (the disclosed information was limited so this has not been

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Ruediger Pluem
On 09/14/2009 07:35 PM, Graham Leggett wrote: traw...@apache.org wrote: Author: trawick Date: Mon Sep 14 17:25:07 2009 New Revision: 814743 URL: http://svn.apache.org/viewvc?rev=814743view=rev Log: promote, demote With everything moved around, I am assuming you are referring to

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Jeff Trawick
On Mon, Sep 14, 2009 at 3:12 PM, Ruediger Pluem rpl...@apache.org wrote: On 09/14/2009 07:35 PM, Graham Leggett wrote: traw...@apache.org wrote: Author: trawick Date: Mon Sep 14 17:25:07 2009 New Revision: 814743 URL: http://svn.apache.org/viewvc?rev=814743view=rev Log:

Re: svn commit: r814652 - /httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c

2009-09-14 Thread Joe Orton
On Mon, Sep 14, 2009 at 09:04:08PM +0200, Ruediger Pluem wrote: On 09/14/2009 04:16 PM, jor...@apache.org wrote: +/* Reply syntax per RFC 2428: 229 blah blah (|||port|) where '|' + * can be any character in ASCII from 33-126, obscurely. Verify + * the syntax. */ +p =

Re: svn commit: r814743 - /httpd/httpd/branches/2.2.x/STATUS

2009-09-14 Thread Graham Leggett
Ruediger Pluem wrote: * htdbm: Avoid buffer overflows. PR: 30586 Trunk patch: http://svn.apache.org/viewvc?view=revrevision=797563 2.2.x patch: http://people.apache.org/~poirier/patch-2.2.x-PR30586.txt +1: poirier, minfrin -1: trawick (Memory use for dumping the database is

Re: [VOTE] release httpd mod_fcgid-2.3.1?

2009-09-14 Thread William A. Rowe, Jr.
William A. Rowe, Jr. wrote: [X] +1 to release as 2.3.1-beta Beta, not GA yet IMHO. I'll work out the schema of httpd.a.o/mod_fcgid/ following mod_ftp's pattern and call this vote completed, with all positive responses; +1's from trawick and wrowe, plus a nod from from Rainer, Gregg, and

Re: Memory usage, core output filter, and apr_brigade_destroy

2009-09-14 Thread Ruediger Pluem
On 09/14/2009 07:32 PM, Stefan Fritsch wrote: On Sun, 13 Sep 2009, Ruediger Pluem wrote: But your patch is causing core dumps during the proxy tests when running the test suite :-(. I currently don't understand why. Hmmm... either ctx-tmp_flush_bb is NULL or, since it was added in the

Re: DAV Option Patch

2009-09-14 Thread Brian J. France
On Sep 14, 2009, at 12:04 PM, Dan Poirier wrote: One suggestion - using hook in the names could be confusing since this isn't using the built-in hook mechanism. Since it is using the provider mechanism, maybe names like dav_options_provider would be clearer. I have updated the patches:

accept mutex failure causes fork bomb

2009-09-14 Thread Greg Ames
I'm trying to debug a problem where apparently the accept mutex went bad on a z/OS system running the worker MPM. I'm guessing that some memory that we use for the semaphore got clobbered but don't have proof yet. The error log looks like: [Mon Sep 07 08:01:59 2009] [emerg] (121)EDC5121I

Re: Memory usage, core output filter, and apr_brigade_destroy

2009-09-14 Thread Paul Querna
On Mon, Sep 14, 2009 at 12:48 PM, Ruediger Pluem rpl...@apache.org wrote: On 09/14/2009 07:32 PM, Stefan Fritsch wrote: On Sun, 13 Sep 2009, Ruediger Pluem wrote: But your patch is causing core dumps during the proxy tests when running the test suite :-(. I currently don't understand why.

Re: DAV Option Patch

2009-09-14 Thread Graham Leggett
Brian J. France wrote: I have updated the patches: http://www.brianfrance.com/software/apache/dav/dav-option-provider.diff Committed in r814832, can you verify that I have attributed the patch correctly in CHANGES? Regards, Graham -- smime.p7s Description: S/MIME Cryptographic Signature

Re: Memory usage, core output filter, and apr_brigade_destroy

2009-09-14 Thread Ruediger Pluem
On 09/14/2009 10:29 PM, Paul Querna wrote: On Mon, Sep 14, 2009 at 12:48 PM, Ruediger Pluem rpl...@apache.org wrote: On 09/14/2009 07:32 PM, Stefan Fritsch wrote: On Sun, 13 Sep 2009, Ruediger Pluem wrote: But your patch is causing core dumps during the proxy tests when running the test

Re: DAV Option Patch

2009-09-14 Thread Joe Orton
On Mon, Sep 14, 2009 at 10:11:24AM -0400, Brian J. France wrote: I would like to get some form of mod_dav_acl[1] added to httpd. My end goal with all of this is to get a mod_caldav and mod_cardav accepted down the line or at least be able to build the module with out hacking the core httpd

Re: DAV Option Patch

2009-09-14 Thread Brian J. France
On Sep 14, 2009, at 04:32 PM, Graham Leggett wrote: Brian J. France wrote: I have updated the patches: http://www.brianfrance.com/software/apache/dav/dav-option-provider.diff Committed in r814832, can you verify that I have attributed the patch correctly in CHANGES? Thanks! Can you

Re: DAV Option Patch

2009-09-14 Thread Graham Leggett
Brian J. France wrote: Can you credit Jari Urpalainen (jari.urpalainen nokia.com) as well as these are all based on his patches for his mod_dav_acl. Done in 814860. More patches tomorrow. I see the example module that you asked not to commit is ASF licensed, is this true also of the patches

Re: svn commit: r814864 - /httpd/httpd/branches/2.2.x/CHANGES

2009-09-14 Thread Graham Leggett
rpl...@apache.org wrote: * Follow the standard format for security CHANGES entries Thanks for this. Regards, Graham -- smime.p7s Description: S/MIME Cryptographic Signature

Re: [VOTE] release httpd mod_fcgid-2.3.1?

2009-09-14 Thread Chris Darroch
William A. Rowe, Jr. wrote: Please fetch up the newly minted mod_fcgid-2.3.1.tar.gz (or bz2) or the win32 suitable package mod_fcgid-2.3.1-crlf.zip from: http://httpd.apache.org/dev/dist/mod_fcgid/ review, take it for a spin, and cast your choice [X] +1 to release as 2.3.1-beta Gave

Re: DAV Option Patch

2009-09-14 Thread Brian J. France
On Sep 14, 2009, at 05:23 PM, Graham Leggett wrote: Brian J. France wrote: Can you credit Jari Urpalainen (jari.urpalainen nokia.com) as well as these are all based on his patches for his mod_dav_acl. Done in 814860. More patches tomorrow. I see the example module that you asked not to

Re: DAV Option Patch

2009-09-14 Thread William A. Rowe, Jr.
Brian J. France wrote: While Jari's mod_dav_acl is licensed under LGPL, can the patches to httpd be licensed that way? They are licensed however he licenses them. What would we need to do to get them added if Jari's patches (or even mod_dav_acl) would fall under LGPL? I know he is would

Re: DAV Option Patch

2009-09-14 Thread Brian J. France
On Sep 14, 2009, at 05:02 PM, Joe Orton wrote: On Mon, Sep 14, 2009 at 10:11:24AM -0400, Brian J. France wrote: I would like to get some form of mod_dav_acl[1] added to httpd. My end goal with all of this is to get a mod_caldav and mod_cardav accepted down the line or at least be able to

Re: DAV Option Patch

2009-09-14 Thread Jeff Trawick
On Mon, Sep 14, 2009 at 5:42 PM, Brian J. France br...@brianfrance.comwrote: Jari is the original author of mod_dav_acl, which requires patches to httpd to work. I need the same functionality added to httpd to get a mod_dav_acl type module working, so I have split up his patch into smaller

Re: [VOTE] release httpd mod_fcgid-2.3.1?

2009-09-14 Thread William A. Rowe, Jr.
Chris Darroch wrote: [X] +1 to release as 2.3.1-beta Gave it a quick compile and test run -- no heavy testing but it handles a pre-2.3 script fine, at least. So I'd vote we get a beta out there and encourage others to take a look. Thanks again, Thanks Chris, I saw your positive

Re: [VOTE] release httpd mod_fcgid-2.3.1?

2009-09-14 Thread Chris Darroch
William A. Rowe, Jr. wrote: Chris Darroch wrote: [X] +1 to release as 2.3.1-beta Gave it a quick compile and test run -- no heavy testing but it handles a pre-2.3 script fine, at least. So I'd vote we get a beta out there and encourage others to take a look. Thanks again, Thanks

Re: [VOTE] release httpd mod_fcgid-2.3.1?

2009-09-14 Thread William A. Rowe, Jr.
Chris Darroch wrote: William A. Rowe, Jr. wrote: Chris Darroch wrote: [X] +1 to release as 2.3.1-beta Gave it a quick compile and test run -- no heavy testing but it handles a pre-2.3 script fine, at least. So I'd vote we get a beta out there and encourage others to take a look.

Re: [VOTE] release httpd mod_ftp-0.9.5 beta?

2009-09-14 Thread William A. Rowe, Jr.
William A. Rowe, Jr. wrote: William A. Rowe, Jr. wrote: [X] +1 to release as 0.9.5-beta But with a single vote, I'll declare this vote DOA on Tuesday night, after seven days of voting. And in 18 hours, with no other voters, it seems appropriate to begin a vote for dissolving mod_ftp from

Re: Output filter order selection

2009-09-14 Thread Ben Noordhuis
On Mon, Sep 14, 2009 at 21:39, Ivan Ristic ivan.ris...@gmail.com wrote: There's an incompatibility between ModSecurity and mod_deflate, which I would like to fix it. (It is triggered when AddOutputFilterByType is used.) I basically need to ensure that ModSecurity's output filter runs before