[pkgsrc/trunk]: pkgsrc/www/apache Update apache package to 1.3.31.

[taca <taca%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/23e545356f93
branches:  trunk
changeset: 475275:23e545356f93
user:      taca <taca%pkgsrc.org@localhost>
date:      Thu May 13 11:39:09 2004 +0000

description:
Update apache package to 1.3.31.


                     Apache 1.3.31 Major changes

  Security vulnerabilities

     * CAN-2003-0987 (cve.mitre.org)
       In mod_digest, verify whether the nonce returned in the client
       response is one we issued ourselves.  This problem does not affect
       mod_auth_digest.

     * CAN-2003-0020 (cve.mitre.org)
       Escape arbitrary data before writing into the errorlog.

     * CAN-2004-0174 (cve.mitre.org)
       Fix starvation issue on listening sockets where a short-lived
       connection on a rarely-accessed listening socket will cause a
       child to hold the accept mutex and block out new connections until
       another connection arrives on that rarely-accessed listening socket.

     * CAN-2003-0993 (cve.mitre.org)
       Fix parsing of Allow/Deny rules using IP addresses without a
       netmask; issue is only known to affect big-endian 64-bit
       platforms

  New features

   New features that relate to specific platforms:

     * Linux 2.4+: If Apache is started as root and you code
       CoreDumpDirectory, core dumps are enabled via the prctl() syscall.

   New features that relate to all platforms:

     * Add mod_whatkilledus and mod_backtrace (experimental) for
       reporting diagnostic information after a child process crash.

     * Add fatal exception hook for running diagnostic code after a
       crash.

     * Forensic logging module added (mod_log_forensic)

     * '%X' is now accepted as an alias for '%c' in the
       LogFormat directive. This allows you to configure logging
       to still log the connection status even with mod_ssl

  Bugs fixed

   The following noteworthy bugs were found in Apache 1.3.29 (or earlier)
   and have been fixed in Apache 1.3.31:

     * Fix memory corruption problem with ap_custom_response() function.
       The core per-dir config would later point to request pool data
       that would be reused for different purposes on different requests.

     * mod_usertrack no longer inspects the Cookie2 header for
       the cookie name. It also no longer overwrites other cookies.

     * Fix bug causing core dump when using CookieTracking without
       specifying a CookieName directly.

     * UseCanonicalName off was ignoring the client provided
       port information.

diffstat:

 www/apache/Makefile         |   9 ++---
 www/apache/PLIST            |  17 ++++++---
 www/apache/distinfo         |  14 +++-----
 www/apache/patches/patch-ap |  30 ------------------
 www/apache/patches/patch-aq |  14 --------
 www/apache/patches/patch-ar |  75 ---------------------------------------------
 www/apache/patches/patch-as |  16 ---------
 7 files changed, 20 insertions(+), 155 deletions(-)

diffs (288 lines):

diff -r feac6474a675 -r 23e545356f93 www/apache/Makefile
--- a/www/apache/Makefile       Thu May 13 11:37:50 2004 +0000
+++ b/www/apache/Makefile       Thu May 13 11:39:09 2004 +0000
@@ -1,12 +1,11 @@
-# $NetBSD: Makefile,v 1.144 2004/04/26 20:06:58 jlam Exp $
+# $NetBSD: Makefile,v 1.145 2004/05/13 11:39:09 taca Exp $
 #
 # This pkg does not compile in mod_ssl, only the `mod_ssl EAPI' (a set of
 # code hooks that allow mod_ssl to be compiled separately later, if desired).
 
 DISTNAME=              apache_${APACHE_VERSION}
 PKGNAME=               apache-${APACHE_VERSION}
-PKGREVISION=           2
-APACHE_VERSION=                1.3.29
+APACHE_VERSION=                1.3.31
 CATEGORIES=            www
 MASTER_SITES=          ${MASTER_SITE_APACHE:=httpd/} \
                        ${MASTER_SITE_APACHE:=httpd/old/}
@@ -19,8 +18,8 @@
 NETBSD_LOGO=           sitedrivenby.gif
 SITES_${NETBSD_LOGO}=  http://www.NetBSD.org/images/logos/
 
-MODSSL_VERSION=                2.8.16
-MODSSL_DISTNAME=       mod_ssl-${MODSSL_VERSION}-1.3.29
+MODSSL_VERSION=                2.8.17
+MODSSL_DISTNAME=       mod_ssl-${MODSSL_VERSION}-1.3.31
 MODSSL_DIST=           ${MODSSL_DISTNAME}.tar.gz
 MODSSL_SRC=            ${WRKDIR}/${MODSSL_DISTNAME}
 SITES_${MODSSL_DIST}=  http://www.modssl.org/source/ \
diff -r feac6474a675 -r 23e545356f93 www/apache/PLIST
--- a/www/apache/PLIST  Thu May 13 11:37:50 2004 +0000
+++ b/www/apache/PLIST  Thu May 13 11:39:09 2004 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.10 2004/04/23 22:07:59 reed Exp $
+@comment $NetBSD: PLIST,v 1.11 2004/05/13 11:39:09 taca Exp $
 bin/checkgid
 bin/dbmmanage
 bin/htdigest
@@ -83,6 +83,7 @@
 share/httpd/htdocs/index.html.es
 share/httpd/htdocs/index.html.fr
 share/httpd/htdocs/index.html.he.iso8859-8
+share/httpd/htdocs/index.html.hu
 share/httpd/htdocs/index.html.it
 share/httpd/htdocs/index.html.ja.jis
 share/httpd/htdocs/index.html.kr.iso-kr
@@ -102,7 +103,6 @@
 share/httpd/htdocs/index.html.ru.utf8
 share/httpd/htdocs/index.html.se
 share/httpd/htdocs/index.html.zh-tw.big5
-share/httpd/htdocs/manual/FAQ.html
 share/httpd/htdocs/manual/LICENSE
 share/httpd/htdocs/manual/bind.html.en
 share/httpd/htdocs/manual/bind.html.fr
@@ -173,7 +173,9 @@
 share/httpd/htdocs/manual/keepalive.html.en
 share/httpd/htdocs/manual/keepalive.html.html
 share/httpd/htdocs/manual/keepalive.html.ja.jis
-share/httpd/htdocs/manual/location.html
+share/httpd/htdocs/manual/location.html.en
+share/httpd/htdocs/manual/location.html.html
+share/httpd/htdocs/manual/location.html.ja.jis
 share/httpd/htdocs/manual/logs.html
 share/httpd/htdocs/manual/man-template.html
 share/httpd/htdocs/manual/misc/API.html
@@ -242,7 +244,9 @@
 share/httpd/htdocs/manual/mod/mod_auth_db.html
 share/httpd/htdocs/manual/mod/mod_auth_dbm.html
 share/httpd/htdocs/manual/mod/mod_auth_digest.html
-share/httpd/htdocs/manual/mod/mod_autoindex.html
+share/httpd/htdocs/manual/mod/mod_autoindex.html.en
+share/httpd/htdocs/manual/mod/mod_autoindex.html.html
+share/httpd/htdocs/manual/mod/mod_autoindex.html.ja.jis
 share/httpd/htdocs/manual/mod/mod_browser.html
 share/httpd/htdocs/manual/mod/mod_cern_meta.html
 share/httpd/htdocs/manual/mod/mod_cgi.html.en
@@ -272,6 +276,8 @@
 share/httpd/htdocs/manual/mod/mod_log_config.html.en
 share/httpd/htdocs/manual/mod/mod_log_config.html.html
 share/httpd/htdocs/manual/mod/mod_log_config.html.ja.jis
+share/httpd/htdocs/manual/mod/mod_log_forensic.html.en
+share/httpd/htdocs/manual/mod/mod_log_forensic.html.html
 share/httpd/htdocs/manual/mod/mod_log_referer.html
 share/httpd/htdocs/manual/mod/mod_mime.html.en
 share/httpd/htdocs/manual/mod/mod_mime.html.html
@@ -344,7 +350,6 @@
 share/httpd/htdocs/manual/programs/suexec.html.html
 share/httpd/htdocs/manual/programs/suexec.html.ja.jis
 share/httpd/htdocs/manual/readme-tpf.html
-share/httpd/htdocs/manual/search/manual-index.cgi
 share/httpd/htdocs/manual/sections.html.en
 share/httpd/htdocs/manual/sections.html.html
 share/httpd/htdocs/manual/sections.html.ja.jis
@@ -390,6 +395,7 @@
 share/httpd/htdocs/manual/win_service.html.html
 share/httpd/htdocs/manual/win_service.html.ja.jis
 share/httpd/htdocs/manual/windows.html.en
+share/httpd/htdocs/manual/windows.html.html
 share/httpd/htdocs/manual/windows.html.ja.jis
 share/httpd/htdocs/sitedrivenby.gif
 share/httpd/icons/README
@@ -613,7 +619,6 @@
 @dirrm share/httpd/icons/small
 @dirrm share/httpd/icons
 @dirrm share/httpd/htdocs/manual/vhosts
-@dirrm share/httpd/htdocs/manual/search
 @dirrm share/httpd/htdocs/manual/programs
 @dirrm share/httpd/htdocs/manual/mod
 @dirrm share/httpd/htdocs/manual/misc
diff -r feac6474a675 -r 23e545356f93 www/apache/distinfo
--- a/www/apache/distinfo       Thu May 13 11:37:50 2004 +0000
+++ b/www/apache/distinfo       Thu May 13 11:39:09 2004 +0000
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.32 2004/04/26 20:06:58 jlam Exp $
+$NetBSD: distinfo,v 1.33 2004/05/13 11:39:09 taca Exp $
 
-SHA1 (apache_1.3.29.tar.gz) = 0fb055dfd8c86457996edb36f19fb66f09dccd6a
-Size (apache_1.3.29.tar.gz) = 2435809 bytes
+SHA1 (apache_1.3.31.tar.gz) = a5d4298e8f99cae220ba65b5ef128d5742c7298d
+Size (apache_1.3.31.tar.gz) = 2467371 bytes
 SHA1 (sitedrivenby.gif) = 7671e9a8ec2cad3961b268befd33c0920e07c658
 Size (sitedrivenby.gif) = 8519 bytes
-SHA1 (mod_ssl-2.8.16-1.3.29.tar.gz) = c098dfffd81a6e5959f414c5c3eec291f58d3e44
-Size (mod_ssl-2.8.16-1.3.29.tar.gz) = 754325 bytes
+SHA1 (mod_ssl-2.8.17-1.3.31.tar.gz) = 942ca41a95f1e671ecabf90a8704b85de42d5d42
+Size (mod_ssl-2.8.17-1.3.31.tar.gz) = 754472 bytes
 SHA1 (patch-aa) = fa3f41ea33fc0088166b067bf68fb807ac53af96
 SHA1 (patch-ab) = 71ea1f3a59e0f7bc37175b0eefd462a1f7ca4fb6
 SHA1 (patch-ac) = 12347c7a306d3e898b032c2b4b3b01670b62d4fd
@@ -20,7 +20,3 @@
 SHA1 (patch-al) = a27b9676998621229dc3a1d920ea44b8e622feb2
 SHA1 (patch-am) = d05f7c30b73c0e90daf17d9d1c4838be7fd73b02
 SHA1 (patch-ao) = 5930f9ea0f5080b260a6e0c66a37c6d1ad0df4d4
-SHA1 (patch-ap) = 3dfa2396d481aca2b746d02cb2b161bd956825f8
-SHA1 (patch-aq) = 80032eadbbb546df8eac7fe08800a784c06a06f0
-SHA1 (patch-ar) = b422847735a9a4821cfa8ba8e2e7639ce1605b39
-SHA1 (patch-as) = b81faf1a0addede23a63c1334e47633d3dba38fa
diff -r feac6474a675 -r 23e545356f93 www/apache/patches/patch-ap
--- a/www/apache/patches/patch-ap       Thu May 13 11:37:50 2004 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,30 +0,0 @@
-$NetBSD: patch-ap,v 1.3 2004/04/07 19:53:27 reed Exp $
-SECURITY [CAN-2003-0020]: escape arbitrary data before writing into the errorlog
-
---- src/main/http_log.c.orig   2003-02-03 09:13:21.000000000 -0800
-+++ src/main/http_log.c
-@@ -314,6 +314,9 @@ static void log_error_core(const char *f
-                          const char *fmt, va_list args)
- {
-     char errstr[MAX_STRING_LEN];
-+#ifndef AP_UNSAFE_ERROR_LOG_UNESCAPED
-+    char scratch[MAX_STRING_LEN];
-+#endif
-     size_t len;
-     int save_errno = errno;
-     FILE *logf;
-@@ -445,7 +448,14 @@ static void log_error_core(const char *f
-     }
- #endif
- 
-+#ifndef AP_UNSAFE_ERROR_LOG_UNESCAPED
-+   if (ap_vsnprintf(scratch, sizeof(scratch) - len, fmt, args)) {
-+       len += ap_escape_errorlog_item(errstr + len, scratch,
-+                                      sizeof(errstr) - len);
-+   }
-+#else
-     len += ap_vsnprintf(errstr + len, sizeof(errstr) - len, fmt, args);
-+#endif
- 
-     /* NULL if we are logging to syslog */
-     if (logf) {
diff -r feac6474a675 -r 23e545356f93 www/apache/patches/patch-aq
--- a/www/apache/patches/patch-aq       Thu May 13 11:37:50 2004 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,14 +0,0 @@
-$NetBSD: patch-aq,v 1.3 2004/04/07 19:53:27 reed Exp $
-SECURITY [CAN-2003-0020]: escape arbitrary data before writing into the errorlog
-
---- src/include/httpd.h.orig   2004-04-07 12:24:10.967724616 -0700
-+++ src/include/httpd.h
-@@ -1072,6 +1072,8 @@ API_EXPORT(char *) ap_escape_html(pool *
- API_EXPORT(char *) ap_construct_server(pool *p, const char *hostname,
-                                   unsigned port, const request_rec *r);
- API_EXPORT(char *) ap_escape_logitem(pool *p, const char *str);
-+API_EXPORT(size_t) ap_escape_errorlog_item(char *dest, const char *source,
-+                                           size_t buflen);
- API_EXPORT(char *) ap_escape_shell_cmd(pool *p, const char *s);
- 
- API_EXPORT(int) ap_count_dirs(const char *path);
diff -r feac6474a675 -r 23e545356f93 www/apache/patches/patch-ar
--- a/www/apache/patches/patch-ar       Thu May 13 11:37:50 2004 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,75 +0,0 @@
-$NetBSD: patch-ar,v 1.3 2004/04/07 19:53:27 reed Exp $
-SECURITY [CAN-2003-0020]: escape arbitrary data before writing into the errorlog
-
---- src/main/util.c.orig       2003-02-03 09:13:23.000000000 -0800
-+++ src/main/util.c
-@@ -1520,6 +1520,69 @@ API_EXPORT(char *) ap_escape_logitem(poo
-     return ret;
- }
- 
-+API_EXPORT(size_t) ap_escape_errorlog_item(char *dest, const char *source,
-+                                           size_t buflen)
-+{
-+    unsigned char *d, *ep;
-+    const unsigned char *s;
-+
-+    if (!source || !buflen) { /* be safe */
-+        return 0;
-+    }
-+
-+    d = (unsigned char *)dest;
-+    s = (const unsigned char *)source;
-+    ep = d + buflen - 1;
-+
-+    for (; d < ep && *s; ++s) {
-+
-+        if (TEST_CHAR(*s, T_ESCAPE_LOGITEM)) {
-+            *d++ = '\\';
-+            if (d >= ep) {
-+                --d;
-+                break;
-+            }
-+
-+            switch(*s) {
-+            case '\b':
-+                *d++ = 'b';
-+                break;
-+            case '\n':
-+                *d++ = 'n';
-+                break;
-+            case '\r':
-+                *d++ = 'r';
-+                break;
-+            case '\t':
-+                *d++ = 't';
-+                break;
-+            case '\v':
-+                *d++ = 'v';
-+                break;
-+            case '\\':
-+                *d++ = *s;
-+                break;
-+            case '"': /* no need for this in error log */
-+                d[-1] = *s;
-+                break;
-+            default:
-+                if (d >= ep - 2) {
-+                    ep = --d; /* break the for loop as well */
-+                    break;
-+                }
-+                c2x(*s, d);
-+                *d = 'x';
-+                d += 3;
-+            }
-+        }
-+        else {
-+            *d++ = *s;
-+        }
-+    }
-+    *d = '\0';
-+
-+    return (d - (unsigned char *)dest);
-+}
- 
- API_EXPORT(char *) ap_escape_shell_cmd(pool *p, const char *str)
- {
diff -r feac6474a675 -r 23e545356f93 www/apache/patches/patch-as
--- a/www/apache/patches/patch-as       Thu May 13 11:37:50 2004 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,16 +0,0 @@
-$NetBSD: patch-as,v 1.3 2004/04/26 20:06:58 jlam Exp $
-
---- src/modules/standard/mod_auth_db.c.orig    Mon Feb  3 12:13:27 2003
-+++ src/modules/standard/mod_auth_db.c
-@@ -170,7 +170,10 @@ static char *get_db_pw(request_rec *r, c
-     q.data = user;
-     q.size = strlen(q.data);
- 
--#if defined(DB3) || defined(DB4)
-+#if defined(DB4)
-+    if (   db_create(&f, NULL, 0) != 0 
-+        || f->open(f, NULL, auth_dbpwfile, NULL, DB_HASH, DB_RDONLY, 0664) != 0) {
-+#elif defined(DB3)
-     if (   db_create(&f, NULL, 0) != 0 
-         || f->open(f, auth_dbpwfile, NULL, DB_HASH, DB_RDONLY, 0664) != 0) {
- #elif defined(DB2)