2004-05-13 23:21:27 by David Brownlee | Files touched by this commit (2) |
Log message:
Regenerate patch-aa to obtain correct offsets so this works with Linux 'patch'.
No functional change (other than building again on Linux)
|
2004-05-13 13:39:10 by Takahiro Kambe | Files touched by this commit (7) | |
Log message:
Update apache package to 1.3.31.
Apache 1.3.31 Major changes
Security vulnerabilities
* CAN-2003-0987 (cve.mitre.org)
In mod_digest, verify whether the nonce returned in the client
response is one we issued ourselves. This problem does not affect
mod_auth_digest.
* CAN-2003-0020 (cve.mitre.org)
Escape arbitrary data before writing into the errorlog.
* CAN-2004-0174 (cve.mitre.org)
Fix starvation issue on listening sockets where a short-lived
connection on a rarely-accessed listening socket will cause a
child to hold the accept mutex and block out new connections until
another connection arrives on that rarely-accessed listening socket.
* CAN-2003-0993 (cve.mitre.org)
Fix parsing of Allow/Deny rules using IP addresses without a
netmask; issue is only known to affect big-endian 64-bit
platforms
New features
New features that relate to specific platforms:
* Linux 2.4+: If Apache is started as root and you code
CoreDumpDirectory, core dumps are enabled via the prctl() syscall.
New features that relate to all platforms:
* Add mod_whatkilledus and mod_backtrace (experimental) for
reporting diagnostic information after a child process crash.
* Add fatal exception hook for running diagnostic code after a
crash.
* Forensic logging module added (mod_log_forensic)
* '%X' is now accepted as an alias for '%c' in the
LogFormat directive. This allows you to configure logging
to still log the connection status even with mod_ssl
Bugs fixed
The following noteworthy bugs were found in Apache 1.3.29 (or earlier)
and have been fixed in Apache 1.3.31:
* Fix memory corruption problem with ap_custom_response() function.
The core per-dir config would later point to request pool data
that would be reused for different purposes on different requests.
* mod_usertrack no longer inspects the Cookie2 header for
the cookie name. It also no longer overwrites other cookies.
* Fix bug causing core dump when using CookieTracking without
specifying a CookieName directly.
* UseCanonicalName off was ignoring the client provided
port information.
|
2004-05-08 17:12:52 by grant beattie | Files touched by this commit (1) |
Log message:
include apache's buildlink3.mk if using buildlink3.
|
2004-04-26 22:06:58 by Johnny C. Lam | Files touched by this commit (3) |
Log message:
Convert to use bdb.buildlink3.mk and fix sources so that we can use db4.
|
2004-04-25 08:21:11 by Soren Jacobsen | Files touched by this commit (1) |
Log message:
Convert to buildlink3.
|
2004-04-25 00:46:14 by Johnny C. Lam | Files touched by this commit (109) |
Log message:
Relinquish maintainership of packages to tech-pkg@NetBSD.org.
|
2004-04-24 00:08:00 by Jeremy C. Reed | Files touched by this commit (109) |
Log message:
mk/bsd.pkg.install.mk now automatically registers
the RCD_SCRIPTS rc.d script(s) to the PLIST.
This GENERATE_PLIST idea is part of Greg A. Woods'
PR #22954.
This helps when the RC_SCRIPTS are installed to
a different ${RCD_SCRIPTS_EXAMPLEDIR}. (Later,
the default RCD_SCRIPTS_EXAMPLEDIR will be changed
to be more clear that they are the examples.)
These patches also remove the etc/rc.d/ scripts from PLISTs
(of packages that use RCD_SCRIPTS). (This also removes
now unused references from openssh* makefiles. Note that
qmail package has not been changed yet.)
I have been doing automatic PLIST registration for RC_SCRIPTS
for over a year. Not all of these packages have been tested,
but many have been tested and used.
Somethings maybe to do:
- a few packages still manually install the rc.d scripts to
hard-coded etc/rc.d. These need to be fixed.
- maybe remove from mk/${OPSYS}.pkg.dist mtree specifications too.
|
2004-04-08 00:35:01 by Matthias Scheler | Files touched by this commit (2) |
Log message:
Fix patch checksums and bump package revision again because the security
patches weren't applied before.
|
2004-04-07 21:53:28 by Jeremy C. Reed | Files touched by this commit (4) |
Log message:
Add three patches to resolve security issue:
SECURITY [CAN-2003-0020]: escape arbitrary data before writing into the errorlog
The three patches are from Apache cvs.
http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/
Also bump PKGREVISION too.
|
2004-03-29 07:05:56 by Johnny C. Lam | Files touched by this commit (55) |
Log message:
Add a BUILDLINK_PKGBASE.<pkg> definition where it's not equal to <pkg>,
e.g. "BUILDLINK_PKGBASE.gtk?= gtk+". This is mandated by the example
buildlink[23].mk files in bsd.buildlink[23].mk.
|