APACHE 2.2 STATUS: -*-text-*- Last modified at [$Date$] The current version of this file can be found at: * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/STATUS Documentation status is maintained separately and can be found at: * docs/STATUS in this source tree, or * http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS Consult the following STATUS files for information on related projects: * http://svn.apache.org/repos/asf/apr/apr/trunk/STATUS * http://svn.apache.org/repos/asf/apr/apr-util/trunk/STATUS Patches considered for backport are noted in their branches' STATUS: * http://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x/STATUS * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/STATUS Release history: [NOTE that x.{odd}.z versions are strictly Alpha/Beta releases, while x.{even}.z versions are Stable/GA releases.] 2.2.12 : In development. Jim proposes release around July 10 and offers to RM. 2.2.11 : Released December 14, 2008. 2.2.10 : Released October 14, 2008. 2.2.9 : Released June 14, 2008. 2.2.8 : Released January 19, 2008. 2.2.7 : Tagged January 4, 2008. Not released. 2.2.6 : Released September 7, 2007. 2.2.5 : Tagged August 10, 2007, not released. 2.2.4 : Released on January 9, 2007 as GA. 2.2.3 : Released on July 28, 2006 as GA. 2.2.2 : Released on May 1, 2006 as GA. 2.2.1 : Tagged on April 1, 2006, not released. 2.2.0 : Released on December 1, 2005 as GA. 2.1.10 : Tagged on November 19, 2005, not released. 2.1.9 : Released on November 5, 2005 as beta. 2.1.8 : Released on October 1, 2005 as beta. 2.1.7 : Released on September 12, 2005 as beta. 2.1.6 : Released on June 27, 2005 as alpha. 2.1.5 : Tagged on June 17, 2005. 2.1.4 : not released. 2.1.3 : Released on February 22, 2005 as alpha. 2.1.2 : Released on December 8, 2004 as alpha. 2.1.1 : Released on November 19, 2004 as alpha. 2.1.0 : not released. Contributors looking for a mission: * Just do an egrep on "TODO" or "XXX" in the source. * Review the bug database at: http://issues.apache.org/bugzilla/ * Review the "PatchAvailable" bugs in the bug database: https://issues.apache.org/bugzilla/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&product=Apache+httpd-2&keywords=PatchAvailable After testing, you can append a comment saying "Reviewed and tested". * Open bugs in the bug database. CURRENT RELEASE NOTES: * Forward binary compatibility is expected of Apache 2.2.x releases, such that no MMN major number changes will occur. Such changes can only be made in the trunk. * All commits to branches/2.2.x must be reflected in SVN trunk, as well, if they apply. Logical progression is commit to trunk, get feedback and votes on list or in STATUS, then merge into branches/2.2.x, as applicable. RELEASE SHOWSTOPPERS: PATCHES ACCEPTED TO BACKPORT FROM TRUNK: [ start all new proposals below, under PATCHES PROPOSED. ] * SECURITY: CVE-2009-1891 (cve.mitre.org) Fix a potential Denial-of-Service attack against mod_deflate or other modules, by forcing the server to consume CPU time in compressing a large file after a client disconnects. 2.2.x patches: http://people.apache.org/~jorton/CVE-2009-1891.1.diff http://people.apache.org/~jorton/CVE-2009-1891.2.diff Trunk version of patch: #1 folded in during core output filter refactoring #2 http://svn.apache.org/viewvc?view=rev&revision=521681 +1: jorton, jim, rpluem rpluem asks: Are we sure that b is never NULL? Otherwise we would need to add http://svn.apache.org/viewvc?view=rev&revision=568202 as on trunk to avoid segfaults. trawick responds: if b were NULL, we would have segfaulted earlier when ap_pass_brigade "calls" APR_BRIGADE_LAST(bb) rpluem: Ahh good point. Meanwhile I had a look at trunk and the event MPM is calling the core output filter directly without ap_pass_brigade. So I am +1. PATCHES PROPOSED TO BACKPORT FROM TRUNK: [ New proposals should be added at the end of the list ] * prefork MPM: simple patch to enable mod_privileges. trunk: N/A (this patch substitutes for the availability of drop_privileges hook). 2.2.x patch: http://people.apache.org/~niq/patches/2.2mod_privileges-core-patch wrowe asks; what is proposed and why two patches here? niq replies: removing the second one, it's FYI only and not part of the backport proposal. And it needs updating! +1: niq * mod_alias: Ensure Redirect emits HTTP-compliant URLs. PR 44020 trunk patch: http://svn.apache.org/viewvc?view=rev&rev=785575 2.2.x patch: http://people.apache.org/~rpluem/patches/foreign_patches/niq_44020.diff NOTE: I'm recommending different versions because the trunk patch is too strict for a stable line and may "break" broken configs thought by their users to be working. +1: niq, rpluem * mod_cache: Add CacheIgnoreURLSessionIdentifiers directive to ignore defined session identifiers encoded in the URL when caching. Trunk version of patch: http://svn.apache.org/viewvc?rev=777042&view=rev http://svn.apache.org/viewvc?rev=777091&view=rev http://svn.apache.org/viewvc?rev=778438&view=rev http://svn.apache.org/viewvc?rev=778439&view=rev Backport version for 2.2.x of patch: Trunk version of patch works +1: rpluem, * mod_proxy_http: fix case sensitivity checking transfer encoding PR 47383 Patch: http://svn.apache.org/viewvc?view=rev&revision=785661 +1: niq, rpluem * mod_dir: add DefaultHandler directive PR 47184 Trunk patch: http://svn.apache.org/viewvc?view=rev&revision=785425 2.2.x patch: http://people.apache.org/~niq/patches/47184.patch (identical but for offsets, but patch failed on trunk version) +1: niq * mod_alias: Enforce sanity in args to Redirect PR 44729 patch: http://svn.apache.org/viewvc?view=rev&revision=778942 http://svn.apache.org/viewvc?view=rev&revision=780648 http://svn.apache.org/viewvc?view=rev&revision=780655 http://svn.apache.org/viewvc?view=rev&revision=780692 http://svn.apache.org/viewvc?view=rev&revision=780697 http://svn.apache.org/viewvc?view=rev&revision=780699 +1: niq, rpluem * mod_proxy_http: fix Host: header for literal IPv6 addresses. PR 47177 patch: http://svn.apache.org/viewvc?view=rev&revision=778531 +1: niq, rpluem * mod_rewrite: Remove locking for writing to the rewritelog. PR 46942 trunk patch: http://svn.apache.org/viewvc?view=rev&revision=783734 2.2.x patch: http://people.apache.org/~niq/patches/46942.patch +1: niq, rpluem PATCHES/ISSUES THAT ARE STALLED * srclib/pcre and vendor/pcre http://www.vuxml.org/freebsd/pkg-pcre.html update to pcre-7.8 outcome: remove from trunk, leave alone in branches/2.2.x and branches/2.0.x * core, authn/z: Avoid calling access control hooks for internal requests with configurations which match those of initial request. Revert to original behaviour (call access control hooks for internal requests with URIs different from initial request) if any access control hooks or providers are not registered as permitting this optimization. Introduce wrappers for access control hook and provider registration which can accept additional mode and flag data. Convert common provider version strings to macros. The core purpose of this pile of patches is to avoid unnecessary authn/z hooks when a single request spawns large numbers of internal requests to which an identical set of httpd configurations apply. This permits modules such as mod_authn_dbd and mod_dav to work together acceptably. Because certain external modules such as mod_authz_svn rely on the old behaviour, this optimization can be made only when all authn/z hooks and providers are registered with the appropriate flag. It would be excellent if Windows and NetWare people could ensure this builds correctly. In particular, mod_auth.h must be included into request.c and I've left mod_auth.h under modules/aaa rather than try to replicate wrowe's work in trunk moving all the include files around. I'm open to suggestions that this remain in trunk only, but in that case, it would be very helpful to know whether most people expect a 2.4 branch or just a 3.0 branch to be next. If 3.0, some of the backwards compatibility work could potentially be ditched. Trunk version of patches: http://svn.apache.org/viewvc?view=rev&revision=644525 http://svn.apache.org/viewvc?view=rev&revision=644562 (trunk MMN bump) http://svn.apache.org/viewvc?view=rev&revision=645395 http://svn.apache.org/viewvc?view=rev&revision=645472 http://svn.apache.org/viewvc?view=rev&revision=645540 http://svn.apache.org/viewvc?view=rev&revision=646445 (reverted by r659160) http://svn.apache.org/viewvc?view=rev&revision=658046 http://svn.apache.org/viewvc?view=rev&revision=659160 Backport version for 2.2.x of patch: http://people.apache.org/~chrisd/patches/walk_cache/walk_cache-2.2.x.patch +1: chrisd -0: jim (would prefer to see in 2.4, and to push 2.4 out) * beos MPM: Create pmain pool and run modules' child_init hooks when entering ap_mpm_run(), then destroy pmain when exiting ap_mpm_run(). Otherwise modules' child_init hooks appear to never be executed. Also, destroying pmain ensures that cleanups registered in modules' child_init hooks are performed (e.g., mod_log_config and mod_dbd). Trunk version of patch: http://svn.apache.org/viewvc?view=rev&revision=491922 2.2.x version of patch: http://people.apache.org/~chrisd/patches/mod_dbd_pools_groups/mpm_child_init-beos-2.2.x.patch +0: chrisd (abstaining; unable to test) * PKCS#7: backport PCKS#7 patches from trunk. +1 ben jerenkrantz: What's the revision number to backport? wrowe asks: ditto jerenkrantz sctemme: svn blame suggests r424707 rpluem: Digging through the history suggests that r424735 r424821 r424823 need to be added to this. See also http://mail-archives.apache.org/mod_mbox/httpd-dev/200607.mbox/%3c20060723093125.GA19423@redhat.com%3e and follow ups for more details.