The Apache HTTP Server Project is an effort to develop and maintain an
open-source HTTP server for various modern desktop and server operating
systems, such as UNIX and Windows NT. The goal of this project is to
provide a secure, efficient and extensible server which provides HTTP
services in sync with the current HTTP standards.
The 2.x branch of Apache Web Server includes several improvements like
threading, use of APR, native IPv6 and SSL support, and many more.
WWW: http://httpd.apache.org/
- Fix IGNORE quoting in Makefile.modules.3rd; unbreak www/mod_vhsH
While I'm here fix typo
PR: ports/89125
Submitted by: Ion-Mihai "IOnut" Tetcu
Pointy hat to: clement
Mass-conversion to the USE_AUTOTOOLS New World Order. The code present
in bsd.autotools.mk essentially makes this a no-op given that all the
old variables set a USE_AUTOTOOLS_COMPAT variable, which is parsed in
exactly the same way as USE_AUTOTOOLS itself.
Moreover, USE_AUTOTOOLS has already been extensively tested by the GNOME
team -- all GNOME 2.12.x ports use it.
Preliminary documentation can be found at:
http://people.FreeBSD.org/~ade/autotools.txt
which is in the process of being SGMLized before introduction into the
Porters Handbook.
Light blue touch-paper. Run.
- Fix CAN-2005-2700
* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that
renegotiation is performed for a transition from "SSLVerifyClient
optional" to "SSLVerifyClient require".
- Fix CAN-2005-2491 (integer overflow in pcre)
- Fix memory leak in byterange stuff, which can lead to DoS.
http://issues.apache.org/bugzilla/show_bug.cgi?id=29962
Obtained from: Apache SVN repo
Reported by: simon
Approved by: portmgr (self)
- Add fix for CAN-2005-2088
From Changelog:
*) SECURITY: CAN-2005-2088
core: If a request contains both Transfer-Encoding and Content-Length
headers, remove the Content-Length, mitigating some HTTP Request
Splitting/Spoofing attacks. [Paul Querna, Joe Orton]
- Rename previous patch to CVE ID
- bump PORTREVISION
Security: CAN-2005-2088
Obtained From: Apache repository
- Fix memory leak
*) core_input_filter: Move buckets to a persistent brigade instead of
creating a new brigade. This stop a memory leak when proxying a
Streaming Media Server.
Obtained from: Apache httpd repository
- backout previous commit.
I blindly committed a change from my dev tree. Since USE_APACHE design
is flacky, it had a very annoying impact.
PR: ports/77391 [1]
Also reported by: pointyhat via kris,
Scot Hetzel <swhetzel@gmail.com> [1]
Pointy hat to: clement
- Update to 2.0.53
- Download bz2'd tarball [1]
- Add print-closest-mirrors target.
It allows you to find the 6 (3 http/3 ftp) closest mirror,
base on http://www.apache.org/dyn/closer.cgi/httpd/
make print-closest-mirrors >> /etc/make.conf automatically add
the six closest mirror to the head of ${MASTER_SITE_APACHE_HTTPD}.
Requested by: delphij
Changes in Makefile.modules.3rd
o Major change(s)
- in some cases, modules are still built as static modules, making
modules selection useless and generate a non-desired httpd
o Minor change(s)
- apxs detection is done only if port isn't a server one.
- Mark modules ports as IGNORED if apaxhe is built statically
- fix make show-modules when when WITH_ALL_STATIC_MODULES is defined
Most issues discovered by: Jason Mealins <jason_mealins@bigfix.com>
- Add support for databases/db43 in apache2[1] and apache21.
- rename files/patch-srclib:apr-utils:build:dbm.m4 to
files/patch-srclib:apr-util:build:dbm.m4
Based on PR: ports/76152 [1]
Submitted by: Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net> [1]
o startup script:
- Use apache{2,21}flags variable in apache{2,21}_checkconfig().
It fixes restart when apache2ssl_enable is set to YES in rc.conf
and httpd.conf is "old" (i.e. non -DSSL safe) [1]
o Makefile
- split post-install target to add install-startup-script:
User can now upgrade startup script without reinstalling apache2.
NOTE: this is NOT package-safe and NOT supported, even if in most of
cases they're no risk.
Noticed by: many [1]
- Fix a bug in mod_ssl. When client aborts connection, mod_ssl still try
to send its data, ad vitam eternam.
Noticed by: Didier Bringer <bringer at echo dot fr>
Patched by: Bruno Ducrot <ducrot at poupinou dot org>
- Remove useless APR_FROM_PORTS check in post-install
- Add support for modular sbin/envvars
You can now put your own scripts you want to execute at envvars
stage in ${PREFIX}/etc/apache2/envvars.d
Only script ending by *.env are run.
Example:
/usr/local/etc/apache2/envvars.d/mod_python3.env
Discussed with: perky on -apache@
- Fix apache2 build, I hope...
Noticed by: many
Committed from: EuroBSDcon Hotel's bar.
Pointy hat to: me
Under supervision from: mat, thierry, erwin (former mentor)
- Remove WITH_APR_FROM_PORTS knob
- Add a note to UPDATING, to warn users they won't be able to build apache2
if they keep apr 0.9.x
Discussed with: Craig Rodrigues (apr maintainer), kuriyama
- Fix apr detection
WARNING: apache2 + apr 1.0 is BROKEN
I'm working on a small compat hack. But don't dream too much.
apache 2.0.x is not designed to work with apr 1.x.
Forgotten by: kuriyama
- Yet Another Security Fix
Fix CAN-2004-0885:
* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that a
correct cipher suite has been negotiated, else deny access.
* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol): With OpenSSL
0.9.7, prevent session resumption during a renegotiation to force the
client to negotiate a new (and acceptable) cipher suite.
Credits: Hartmut Keil, Joe Orton
- Update to 2.0.52
- Use "PORTDOCS= #" and get rid of docs entry in plist.
- Support for FreeBSD 6 in apr
- Move of cache modules from THREADS to EXPERIMENTAL category and make
sure we enable THREADS modules (cgid only) when a threaded MPM is
selected.
- Resurect WITH_EXTRA_MODULES knob
- powerlogo.gif is now hosted by FreeBSD mirrors
- WITH_<category> is definitively no longer supported.
- Add Includes dir when installed via a package [1]
PR: ports/72309 [1]
Submitted by: Christian Kratzer <ck at cksoft dot de> [1]
Security fixes [1]:
*) SECURITY: CAN-2004-0786 (cve.mitre.org)
Fix an input validation issue in apr-util which could be
triggered by malformed IPv6 literal addresses. [Joe Orton]
*) SECURITY: CAN-2004-0747 (cve.mitre.org)
Fix buffer overflow in expansion of environment variables in
configuration file parsing. [Andr<E9> Malo]
*) SECURITY: CAN-2004-0809 (cve.mitre.org)
mod_dav_fs: Fix a segfault in the handling of an indirect lock
refresh. PR 31183. [Joe Orton]
- Update documentation (finally!) and fix WITH_<CATEGORY>_MODULES
for special modules like LDAP or SSL [2]
Noticed by: nectar [1]
Requested by: Emile Heitor <imil at home dot imil dot net> [2]
Approved by: portmgr (marcus)
- Add support for exception hook:
* WITH_EXCEPTION_HOOK now exists
* Automatically add if WITH_DEBUG is set
* Update still-outdated-documentation
- Remove automatic debuf mode if DEBUG_FLAGS is set
Exception hook is very useful for debugging (upcoming www/mod_backtrace
and www/mod_whatkilledus modules)
Makefile.modules.3rd:
- Fix CONFIGURE_ARGS for dynamic module selection.
It's now fully usuable for apache13 ports
- Remove an useless WANT_APACHE check
- Move apxs detection at the beginning of the file, to use APXS_PREFIX
for apache major version detection [1]
The main advantage of this patch is to provide a nice way to
have multiple apache versions, without altering ${LOCALBASE}.
Submitted by: "ports/c0decafe.net" <ports at c0decafe dot net> [1]
- Bump PORTREVISION for all previous changes
- Allow access to /home if mod_userdir is loaded
- We don't need apache2libs.sh if apr is installed from ports.
- Add recent changes to UPGRADING
apache2 NG patch 2/5.
Makefile.modules:
- Export rewritten modules selection from Makefile.modules
to Makefile.modules.3rd
- Remove proxy support by default.
Makefile.modules.3rd:
- Add support for WANT_APACHE common13/common2 to share
code/functionalities between apache13 and apache2 server ports.
Rewrite of modules selection:
- WITH_MODULES and WITHOUT_MODULES are no more conflicting
WITHOUT_MODULES can be safely used internally to remove conflicting
modules
- Selection is based on modules categories to improve flexibility
- WITH_${category}[_MODULES]
- WITHOUT_${category}
- WITH_CUSTOM_${category}
- Support apache13, apache2{0,1}
This is EXPERIMENTAL. I'll test it IRL with www/apache13-ssl,
and it should be easily usuable in future bsd.apache.mk
apache2 NG patch 1/5.
o Changes in httpd.conf
- mod_userdir:
. set Userdir if mod_userdir is loaded [1]
. Userdir is denied for users from /etc/ftpusers
- set more "secure" permissions.
By default, policy is to deny access to filesystem.
You HAVE to _ENABLE_ access to your filesystem in httpd.conf.
- Add an "Includes" directory to ${PREFIX}/etc/apache2/
to make configuration more flexible
${PREFIX}/etc/apache2/*.conf files are now automatically loaded.
o apache.sh
- be closer to apachectl, apache.sh need envvars [2]
It should restore subversion behavior.
Partially submitted by:
kuriyama [1],
Gregory (Grisha) Trubetskoy <grisha at apache dot org> [2]
Future changes are mostly written, they should be committed during the
week-end.
If you're interrested in changes, feel free contact me.
- Fix hostname resolution if IPv4 are mapped. [1]
- Add WITHOUT_V4MAPPED knob and explicitly set --disable-v4-mapped
if WITHOUT_V4MAPPED or WITH_IPV6_V6ONLY
Also submitted by: Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp> [1]
- Improve plist generation.
It fixes problems when you deinstall a port with $PREFIX != $(apxs -q
prefix). Now plist is aware of real location of apache module.
- Add WITHOUT_IPV6 knob to workaround problem with IP resolution
when --enable-v4-mapped is used (default).
Use WITHOUT_IPV6 knob if you have problem with "HostnameLookup On" on
IPv4-only server(s).
I hope I can provide a real fix soon.
- Update to 2.0.50
Important changes:
*) SECURITY: CAN-2004-0493 (cve.mitre.org)
Close a denial of service vulnerability identified by Georgi
Guninski which could lead to memory exhaustion with certain
input data. [Jeff Trawick]
*) SECURITY: CAN-2004-0488 (cve.mitre.org)
mod_ssl: Fix a buffer overflow in the FakeBasicAuth code for a
(trusted) client certificate subject DN which exceeds 6K in length.
[Joe Orton]
Details can be found here:
http://www.apache.org/dist/httpd/CHANGES_2.0
- Use autoconf 2.59
- Add add SUEXEC_LOGFILE tunable to set suexec logfile [1]
- Silently ignore removal of libexec/apache2 directory
(Only the first 15 lines of the commit message are shown above )
- Do not activate module automatically [1]
- Cosmectic change in autogenerated plist (run apxs before the removal
of the module file, it can make apxs fail if you change module
name/shortname)
Forgotten by: me [1]
Reminded by: discussion with kris [1]
Add Makefile.modules.3rd, which should simplify apache modules porting.
It can not be used with USE_APACHE knob.
Most important knobs:
WANT_APACHE= {13,2}
Apache version required. if undefined, both apache version
are allowed.
AP_FAST_BUILD
Do ${APXS} -c ${APXS} -i for you
AP_GENPLIST
Autogenerate a _SIMPLE_ plist:
See future commits to know how to use this file.
- Fix install when people use a different /bin/sh
This shouldn't have been fixed, but I don't like setting UID and GID
variables.
so ${*} -> ${WWW*}
PR: 64032
Noticed by: Patrick Schoenfeld <schoenfeld@in-medias-res.com>
- s/ac_cv_pthreads/apr_cv_pthreads/ (due to changes in 2.0.49)
WITH_PTHREAD_LIBS and WITH_PTHREAD_CFLAGS are now working again
WARNING: This option is still NOT offically supported.
You can't flame me,but you still cansend me some backtrace ;-)
