mod_version_for_2.0.x branch:

* Merge 191323 to 219658 from branches/2.0.x



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/mod_version_for_2.0.x@219659 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 156 insertions, 481 deletions

diff --git a/STATUS b/STATUS
index 4b9472883d..32448e1710 100644
--- a/STATUS
+++ b/STATUS
@@ -2,7 +2,24 @@ APACHE 2.0 STATUS:                                              -*-text-*-
 Last modified at [$Date$]
 
 The current version of this file can be found at:
-http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS
+
+  * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/STATUS
+
+Documentation status is maintained seperately and can be found at:
+
+  * docs/STATUS in this source tree, or
+  * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/docs/STATUS
+
+Consult the following STATUS files for information on related projects:
+
+  * http://svn.apache.org/repos/asf/apr/apr/branches/0.9.x/STATUS
+  * http://svn.apache.org/repos/asf/apr/apr-util/branches/0.9.x/STATUS
+
+Consult the trunk/ for all new development and documentation efforts:
+
+  * http://svn.apache.org/repos/asf/httpd/httpd/trunk/STATUS
+  * http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/STATUS
+
 
 Release history:
 
@@ -58,11 +75,6 @@ Release history:
     2.0a2   : released March 31, 2000
     2.0a1   : released March 10, 2000
 
-Please consult the following STATUS files for information on related projects:
-
-    * http://svn.apache.org/repos/asf/apr/apr/branches/0.9.x/STATUS
-    * http://svn.apache.org/repos/asf/apr/apr-util/branches/0.9.x/STATUS
-    * http://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x/docs/STATUS
 
 Contributors looking for a mission:
 
@@ -78,6 +90,7 @@ Contributors looking for a mission:
 
     * Open bugs in the bug database.
 
+
 CURRENT RELEASE NOTES:
 
     * Forward binary compatibility is expected of Apache 2.0.x releases, such
@@ -88,11 +101,74 @@ CURRENT RELEASE NOTES:
       as well, if they apply.  Logical progression is commit to trunk,
       get feedback and votes in STATUS, and then merge into branches/2.0.x.
 
+
 RELEASE SHOWSTOPPERS:
 
-PATCHES TO BACKPORT FROM TRUNK:
-  [ please place SVN revisions from trunk here, so it is easy to
-    identify exactly what the proposed changes are! ]
+    * Various fixes to T-E and C-L processing from trunk
+
+      Refactor mod_proxy_http.c's Transfer-Encoding/Content-Length elections
+      since they didn't follow RFC 2616, in fact didn't seem to make much
+      sense at all.  Patch to migrate request-body-handling from trunk/ based
+      on 2.1-dev request body handling behavior (although just a bit more
+      conservative on the side of C-L spooling)...
+          http://people.apache.org/~wrowe/httpd-2.0-proxy-request-3.patch
+      Revert r219061 to properly test this patch, as r219061 masks the
+      underlying bug (although it is a -good- patch in and of itself).
+
+       +1: wrowe, jim
+       -1: jorton: this is a massive patch and extremely hard to review
+           for actual interesting content; it is mixed in with all sorts
+           of unrelated stuff.  It needs to at least be split up or
+           the unrelated stuff removed.
+
+           unrelated change: s/apr_strnatcasecmp/strcasecmp/
+           unrelated change: s/b/bb/ on variable+parameter names a few times
+           unrelated change: whitespaces changes all over the shop
+           spurious change:? send_request_body() appears to have been inlined
+           unrelated change: Via header handling
+
+         trawick noted on list: we elected C-L not for efficiency, but because
+                 it's the most widely supported [paraphrasing]
+         wrowe   notes: I agree - this new patch always chooses C-L for any
+                 C-L body received.  If the origin kicks out LENGTH_REQUIRED
+                 for a T-E body it's always up to the client to react.
+                 Note proxy-sendchunks can override this behavior.
+         roy     Notes on list: we must always prefer C-L if it's going to fit
+                 in our brigade.
+         wrowe   good point; the revised patch prereads MAX_MEM_SPOOL and will
+                 try reading that before choosing C-L or T-E.
+         wrowe   adds; After testing, I've determined one brigade isn't enough,
+                 so I've extended this to a loop up to MAX_MEM_SPOOL, we will
+                 fetch up enough body to fill MAX_MEM_SPOOL and hopefully
+                 hit the C-L code path most of the time.
+
+         trawick We are counting bytes in stream_reqbody_cl but filters can
+                 change the size? [p]
+         wrowe   Yes - which is why the patch prefers spool_reqbody_cl unless
+                 the filter stack is unchanged from proto_input_filters.  The
+                 protocol filters shouldn't be changing content size.  And when
+                 it happens, we have to barf or we have a split request.
+                 The old behavior was worse; we would stream the request body
+                 in additional cases without looking to see if the byte count
+                 matched Content-Length.  Easy opportunity for split requests.
+
+         trawick What specifically was done for conformance to RFC 2616? [p]
+         wrowe   Elect the appropriate body handling, and ensure that body
+                 request contains the required *single* T-E or C-L header,
+                 and there are far few code paths to stream_reqbody_cl which
+                 was most likely to create split requests by reporting the
+                 wrong C-L.
+
+         trawick Please split philosophy from rfc violations from security 
+                 fixes in the CHANGES log? [p]
+         wrowe   The others are all a bit to intertwined, the Watchfire report 
+                 spelled out that it's different behavior and RFC 2616 deviations 
+                 that cause the vulnerability, so I don't see how we can divide 
+                 the issues of correctly sending the body and choosing the
+                 transport flavor.
+
+
+PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ please append new backports at the end of this list not the top. ]
 
     *) ap_proxy_canonenc() is over-eager in handling '%' for reverse
@@ -101,16 +177,7 @@ PATCHES TO BACKPORT FROM TRUNK:
              -       if (isenc && ch == '%') {
              +       if (isenc && (isenc != PROXYREQ_REVERSE) && ch == '%') {
 
-       +1: jim, pquerna
-
-    *) Prevent hang writing to piped logger at graceful restart time.
-       PR: 26467
-         http://svn.apache.org/viewcvs?rev=170281&view=rev
-         http://svn.apache.org/viewcvs.cgi?rev=171093&view=rev
-       +1: trawick, jorton
-       -0: pquerna: This adds a new public function.  It should be either a 
-           minor MMN bump, or be put under CORE_PRIVATE.
-           trawick: I resolved this via second commit above.  Thanks!
+       +1: jim, pquerna, wrowe
 
     *) Fix fd leak in piped logging code, fix error handling, and remove
        dead errno handling.
@@ -119,7 +186,7 @@ PATCHES TO BACKPORT FROM TRUNK:
          http://svn.apache.org/viewcvs?rev=170719&view=rev
        all-in-one patch incremental to the PR 26467 fix:
          http://people.apache.org/~jorton/ap_pipedlog2.diff
-       +1: jorton, trawick
+       +1: jorton, trawick, wrowe
        [yes, I will write a CHANGES entry too]
 
     *) several changes to improve logging of connection-oriented errors, including
@@ -127,24 +194,10 @@ PATCHES TO BACKPORT FROM TRUNK:
          http://cvs.apache.org/viewcvs.cgi/httpd-2.0/server/core.c?r1=1.289&r2=1.291
          http://cvs.apache.org/viewcvs.cgi/httpd-2.0/server/log.c?r1=1.150&r2=1.151
          http://cvs.apache.org/viewcvs.cgi/httpd-2.0/include/http_log.h?r1=1.46&r2=1.48
-       +1: trawick, stoddard
-       -0: wrowe; seems this (valid) improvement would encourage non-compatible mods.
-
-    *) mod_headers: Support {...}s tag for SSL variable lookup.
-       http://www.apache.org/~jorton/mod_headers-2.0-ssl.diff
-       +1: jorton, trawick
-       nd: two comments:
-         (1) is the use of APR_ASCII_* ebcdic-safe? I.e. shouldn't we use the
-             native chars here and it will be converted later? (I'm not sure)
-       jorton: I have no idea, let an EBCDIC-er complain if it breaks?
-       trawick: seems that '\r' and '\n' are the better chars to check
-                for; this is not raw data read from the network (or directly
-                from SSL) but instead it is either protocol data that has 
-                already been converted to the native charset or it is other
-                data which was created inside the server in the native charset
-         (2) I'd put out (null) only if val is NULL, not if it's empty.
-       jorton: ssl_var_lookup() returns "" in place of NULL, that was really
-          a deliberate choice... but maybe you're right.
+       +1: trawick, stoddard, wrowe 
+       [wrowe notes that his previous objection is moot, based on security fixes
+        applied between .44 and .54 - but -please- doxygen the version of Apache
+        required in the API header note, for users who adopt this alternative.]
 
     *) mod_cgi: Added API call and overload of detached field in
        cgi_exec_info_t structure to support loading in current or new address
@@ -163,6 +216,9 @@ PATCHES TO BACKPORT FROM TRUNK:
          the changes in the httpd-2.0.x to be done in order for NetWare to work
          as expected when calling apr_proc_create. Should I do both, APR and Http,
          at the same time?
+       wrowe: commit to APR.  Use an APR version test *in httpd* to determine 
+         if the old or new behavior should be used in httpd.  In future versions
+         you could remove the test altogether.
 
     *) mod_actions: Regression from 1.3: the file referred to must exist.
        Solve this by introducing the "virtual" modifier to the Action
@@ -174,17 +230,6 @@ PATCHES TO BACKPORT FROM TRUNK:
           nd: I'm going to reverse the default
           jerenkrantz, striker: I'm confused as to the status of this backport.
 
-    *) mod_log_config: Cleanup log_header_out function to allow multiple headers
-       like Set-Cookie to be logged properly. PR 27787 (2.0 + 1.3)
-         modules/loggers/mod_log_config.c: r1.116
-       jerenkrantz asks: Isn't this what apr_table_merge is for?
-       nd replies: yep. But cookies won't be merged, because browsers don't
-                   support it.
-       jerenkrantz: Couldn't we copy the table and merge the values somehow?
-                    This just seems like a lot of code to duplicate what we
-                    have already.  *shrug*  Regardless, patch looks okay...
-       +1: nd, jerenkrantz
-
     * support/check_forensic: Fix tempfile usage
       svn rev 125495, 126224
       jerenkrantz says: r126224 fixes brokenness with r125495 on Solaris.
@@ -208,6 +253,46 @@ PATCHES TO BACKPORT FROM TRUNK:
       Votes from before the integration branch:
           +1: jerenkrantz, wrowe (trivial, would even be cool in 1.3)
 
+
+PATCHES PROPOSED TO BACKPORT FROM TRUNK:
+  [ please place SVN revisions from trunk here, so it is easy to
+    identify exactly what the proposed changes are! ]
+
+    *) Correct RFC 2616 non-compliance by refusing to proxy a request body 
+       in a TRACE request, unless TraceEnable extended is configured.
+       Introduces TraceEnable [on|off|extended] to give the administrator
+       full control of TRACE request handling.  RFC 2616 does NOT require
+       TRACE (although to disable remains silly).  Current patch at;
+          http://people.apache.org/~wrowe/httpd-2.0-trace.patch
+       +1 wrowe, jimjag
+
+    *) mod_headers: Support {...}s tag for SSL variable lookup.
+       http://www.apache.org/~jorton/mod_headers-2.0-ssl.diff
+       +1: jorton, trawick
+       nd: two comments:
+         (1) is the use of APR_ASCII_* ebcdic-safe? I.e. shouldn't we use the
+             native chars here and it will be converted later? (I'm not sure)
+       jorton: I have no idea, let an EBCDIC-er complain if it breaks?
+       trawick: seems that '\r' and '\n' are the better chars to check
+                for; this is not raw data read from the network (or directly
+                from SSL) but instead it is either protocol data that has 
+                already been converted to the native charset or it is other
+                data which was created inside the server in the native charset
+         (2) I'd put out (null) only if val is NULL, not if it's empty.
+       jorton: ssl_var_lookup() returns "" in place of NULL, that was really
+          a deliberate choice... but maybe you're right.
+
+    *) mod_log_config: Cleanup log_header_out function to allow multiple headers
+       like Set-Cookie to be logged properly. PR 27787 (2.0 + 1.3)
+         modules/loggers/mod_log_config.c: r1.116
+       jerenkrantz asks: Isn't this what apr_table_merge is for?
+       nd replies: yep. But cookies won't be merged, because browsers don't
+                   support it.
+       jerenkrantz: Couldn't we copy the table and merge the values somehow?
+                    This just seems like a lot of code to duplicate what we
+                    have already.  *shrug*  Regardless, patch looks okay...
+       +1: nd, jerenkrantz
+
     *) Provide TLS/SSL upgrade functionality in mod_ssl allowing an unsecure
        connection to be upgraded to a secure connection upon request by the
        client.  The full patch file is available at http://www.apache.org/~bnicholes/
@@ -235,10 +320,6 @@ PATCHES TO BACKPORT FROM TRUNK:
         PR: 34452
         +1: jorton
 
-     *) fix z/OS annoyance with pathname on debug messages in error log
-        http://svn.apache.org/viewcvs?rev=178299&view=rev
-        +1: trawick
-
      *) EBCDIC: Handle chunked input from client or, with proxy, origin
         server.
         http://svn.apache.org/viewcvs?rev=178262&view=rev
@@ -251,12 +332,6 @@ PATCHES TO BACKPORT FROM TRUNK:
         http://svn.apache.org/viewcvs?rev=170354&view=rev
         +1: trawick, jorton
 
-     *) Downgrade the log level of a worker MPM apr_proc_mutex_foo error
-        message when it occurs during restart (as we already do for a couple
-        of other calls).
-        http://svn.apache.org/viewcvs?rev=179317&view=rev
-        +1: trawick, jorton
-
      *) proxy FTP: Fix confusion about globbing characters which could lead
         to getting a directory listing when a file was requested.  PR 34512.
         2.1 patch was http://svn.apache.org/viewcvs?rev=179704&view=rev
@@ -278,6 +353,21 @@ PATCHES TO BACKPORT FROM TRUNK:
         PR: 35279
         +1: jorton
 
+     *) mod_include: Fix possible variable corruption with nested
+        includes.
+        http://svn.apache.org/viewcvs?rev=179763&view=rev
+        2.0.x patch: http://people.apache.org/~jorton/ap_pr12655.patch
+        PR: 12655
+        +1: jorton
+
+     *) mod_auth_digest: Fix hostinfo validation for CONNECT requests.
+        http://svn.apache.org/viewcvs.cgi?rev=193127&view=rev
+        +1: jorton
+
+     *) Add httxt2dbm for creating RewriteMap DBM Files.
+        http://svn.apache.org/viewcvs.cgi?rev=209539&view=rev
+        +1: pquerna
+
 PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON:
 
     *) Remove LDAP toolkit specific code from util_ldap and mod_auth_ldap.
@@ -424,6 +514,7 @@ PATCHES TO BACKPORT THAT ARE ON HOLD OR NOT GOING ANYWHERE SOON:
             inspect headers will in fact work better because the headers will
             reflect reality.
 
+
 CURRENT VOTES:
 
     * Reverse proxy cookie patch from PR#10722 (c.f. comment 16)
@@ -491,6 +582,7 @@ CURRENT VOTES:
       -0:   Lars, wrowe (let's make this defacto for the 2.2 release.),
             nd (for 2.0)
 
+
 RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:
 
     * There is a bug in how we sort some hooks, at least the pre-config
@@ -743,49 +835,12 @@ RELEASE NON-SHOWSTOPPERS BUT WOULD BE REAL NICE TO WRAP THESE UP:
       Message-ID: <Pine.LNX.4.44.0203011354090.16457-200000@deepthought
                   .cs.virginia.edu>
 
-TODO ISSUES REMAINING IN MOD_SSL:
-
-    * In order to use a DSO version of mod_ssl we have to link with
-      -lssl and -lcrypto. A workaround is in place right now where the
-      entire EXTRA_LIBS macro is being appended to the objects list, but
-      this is a hack. We should either revamp the APACHE_CHECK_SSL_TOOLKIT
-      autoconf function or come up with some other autoconf checks to
-      search for libssl and libcrypto and properly add them to mod_ssl's
-      link flags.
-
-    * SSL renegotiations in combination with POST request
-
-    * Port or dispose all code inside #if 0...#endif blocks that remain
-      from the porting effort.
-
-    * Do we need SSL_set_read_ahead()?
-
-    * the ssl_expr api is NOT THREAD SAFE.  race conditions exist:
-       -in ssl_expr_comp() if SSLRequire is used in .htaccess
-        (ssl_expr_info is global)
-       -is ssl_expr_eval() if there is an error
-        (ssl_expr_error is global)
-
-    * SSLRequire directive (parsing of) leaks memory
-
-    * Diffie-Hellman-Parameters for temporary keys are hardcoded in
-      ssl_engine_dh.c, while the comment in ssl_engine_kernel.c says:
-      "it is suggested that keys be changed daily or every 500
-      transactions, and more often if possible."
-
-    * ssl_var_lookup could be rewritten to be MUCH faster
-
-    * CRL callback should be pluggable
-
-    * session cache store should be pluggable
-
-    * init functions should return status code rather than ssl_die()
-
-    * ssl_engine_pphrase.c needs to be reworked so it is generic enough
-      to also decrypt proxy keys
+    * ap_discard_request should be converted to use the bucket API
+      directly rather than waste cycles copying buffers with the old API.
 
-    * the shmcb code should just align its memory segment rather than
-      jumping through all the "safe" memcpy and memset hoops
+    * SIGSEGV on Linux (glibc 2.1.2) isn't caught properly by a
+      sigwaiting thread. We need to work around this, perhaps unless
+      there is hope soon for a fixed glibc.
 
 
 EXPERIMENTAL MODULES:
@@ -795,383 +850,3 @@ EXPERIMENTAL MODULES:
     
     * Fix the shared memory cache
 
-PRs that have been suspended forever waiting for someone to
-put them into 'the next release':
-
-    * documentation and Q&A
-
-      PR#2221: Make online documentation search link back to my installation
-        Status: 
-
-      PR#2906: Propose that Apache recommend $UNIQUE_ID for all "session id"
-      algorithms
-        Status: 
-
-      PR#2793: When will Apache support P3P? Any Plans?
-        Status: 
-
-    * build
-
-      PR#2113: HTTP Server Rebuild Line Needs Changing for the better
-        Status: 
-
-      PR#2421: problem specifying ndbm library for build ?with autoconfigure
-        Status: 
-
-    * config
-
-      PR#76: missing call to "setlocale();"
-        Status: 
-
-      PR#628: Request of "Options SymLinksIfGroupMatch"
-        Status: 
-
-      PR#793: RLimitCPU and RLimitMEM don't apply to all children like they should
-        Status: 
-
-      PR#922:  it is useful to allow specifiction that root-owned symlinks
-      should always be followed
-        Status: 
-
-      PR#1028: DoS attacks involving memory consumption
-        Status: 
-
-      PR#1191: setlogin() is not called, causing problems with e.g. identd
-        Status: 
-
-      PR#1204: regerror() exists, use it
-        Status: 
-
-      PR#2284: Can not POST to ErrorDocument - Apache/1.3b6
-        Status: 
-
-      PR#2396: Proposal for TimeZone directive
-        Status: 
-
-      PR#2446: AllowOverride FileInfo is too coarse
-        Status: 
-
-      PR#2760: [PATCH] User/Group for <Directory> and <Location> i.e. not only
-      in global and <Virtual>.
-        Status: 
-
-      PR#2907: suggestion: power up your Include directive :)
-        Status: 
-
-      PR#3018: cannot limit some HTTP methods
-        Status: 
-
-      PR#3677: New ErrorDocumentMatch directive
-        Status: 
-
-      PR#4244: "Files" and "FilesMatch" regexp does not recognize bang as
-      negation operator
-        Status: 
-
-      PR#5993: AllowOverride should have a 'CheckNone' and 'AllowNone' argument
-      instead of only 'None'
-        Status: 
-
-    * mod_access
-
-      PR#537: mod_access syntax allows hosts that should be restricted
-        Status: 
-
-      PR#1287: add allow,deny/deny,allow warning to mod_access
-        Status: 
-
-      PR#2512: <IfDenied> directive wanted
-        Status: 
-
-    * mod_auth-any
-
-      PR#557: ~UserHome directories are not honored in absolute pathname
-      requests (.htaccess)
-        Status: 
-
-      PR#1117: Using NIS passwd.byname dbm files with AuthDBMUserFile
-        Status: 
-
-      PR#1809: Suggestion for improving authentication modules and core source
-      code, problem with 401 and ErrorDocument
-        Status: 
-
-    * mod_autoindex
-
-      PR#1263: Add frame-safe anchor attribute to mod_autoindex links
-        Status: 
-
-    * mod_cgi (and suexec)
-
-      PR#921: suexec Uses cwd before filling it in, doesn't use syslog
-        Status: 
-
-      PR#1176: Apache cannot handle continuation line in headers
-        Status: 
-
-      PR#1120: suexec does not parse arguments to #exec cmd
-        Status: 
-
-      PR#1268: CGI scripts running as Apache user: security (suexec etc.)
-        Status: 
-
-      PR#1285: Error messages could be easier to spot in cgi.log file for suexec.c
-        Status: 
-
-      PR#1905: suexec - Allow modules to set user:group for execution.
-        Status: 
-
-      PR#2360: suexec for general access of user content?
-        Status: 
-
-      PR#2460: TimeOut applies to output of CGI scripts
-        Status: 
-
-      PR#2573: CGI's for general use still have to be run as another user
-      with suExec
-        Status: 
-
-      PR#4241: Need to be able to override shebang line to make CGI scripts
-      more portable.
-        Status: 
-
-      PR#4490: mod_cgi prevents handling of OPTIONS requests
-        Status: 
-
-    * mod_env
-
-      PR#370: Modified PATH environemnt variable is not passed, instead
-      system's is used
-        Status: 
-
-    * mod_headers
-
-      PR#1383: I make mod_headers to modify request headers as well as
-      response ones.
-        Status: 
-
-      PR#1677: mod_headers should allow mod_log_config-style formats in
-      header values
-        Status: 
-
-    * mod_imap
-
-      PR#759: imap should read <MAP><AREA>*</MAP> too!
-        Status: 
-
-    * mod_include
-
-      PR#78: Additional status for XBitHack directive
-        Status: 
-
-      PR#623: A smarter "Last Modified" value for SSI documents (see PR number 600)
-        Status: 
-
-      PR#1145: mod_include
-      Allow for Last-Modified: without resorting to XBitHack
-        Status: 
-
-      PR#1803: patches to mod_include to allow for file tests
-        Status: 
-
-      PR#4459: Suggestion for better handling of Last-modified headers
-        Status: 
-
-    * mod_info
-
-      PR#2415: /server-info doesn't check for the virtual host to list the info
-        Status: 
-
-    * mod_log-any
-
-      PR#1050: Logging of virtual server to error_log as well
-        Status: 
-
-      PR#1358: Selective url-encode of log fields (or maybe a pseudo
-      log_rewrite module?)
-        Status: 
-
-      PR#2073: pipelined connections are not logged correctly
-        Status: 
-
-      PR#4448: Please allow CGI env variables (QUERY_STRING, ...) to be logged
-      with %{}e
-        Status: 
-
-    * mod_negotiation
-
-      PR#3191: no way to set global quality-of-source (qs) coneg values
-      with multiviews
-        Status: 
-
-    * mod_proxy
-
-      PR#362: Mod_proxy doesn't allow change of error pages
-        Status: 
-
-      PR#440: Proxy doesn't deliver documents if not connected
-        Status: 
-
-      PR#534: proxy converts ~name to %7Ename when name starts with a dot (.)
-        Status: 
-
-      PR#612: Proxy FTP Authentication Fails
-        Status: 
-
-      PR#700: Proxy doesn't do links right for OpenVMS files through ftp:
-        Status: 
-
-      PR#980: Controlling Access to Remote Proxies would be nice...
-        Status: 
-
-      PR#994: Adding authentication "on the fly" through the proxy module
-        Status: 
-
-      PR#1085: ProxyRemote make a dead cycle.
-        Status: 
-
-      PR#1166: ``nph-'' not honored (no buffering) for ProxyRemote mapping
-        Status: 
-
-      PR#1290: Need to know "hit-rate" on proxy cache
-        Status: 
-
-      PR#1532: Proxy transfer logging
-        Status: 
-
-      PR#1547: No HTTP_X_FORWARDED_FOR set...
-        Status: 
-
-      PR#1567: ProxyRemote proxy requests fail authentication by firewall
-        Status: 
-
-      PR#1702: mod_proxy to support persistent conns?
-        Status: 
-
-      PR#1878: listing of proxy cache content
-        Status: 
-
-      PR#2314: patterns in ProxyRemote
-        Status: 
-
-      PR#2648: Cache file names in Proxy module
-        Status: 
-
-      PR#3568: Accessing URL through proxy server corrupts data.
-        Status: 
-
-      PR#3605: Some anonymous FTP URLs ask for authentication
-        Status: 
-
-    * mod_rewrite
-
-      PR#1582: mod_rewrite forms REQUEST_URI different than mod_cgi does
-        Status: 
-
-      PR#2074: mod_rewrite doesn't pass Proxy Throughput on internal subrequests
-        Status: 
-
-    * mod_status
-
-      PR#2138: mod_status always displays 256 possible connection slots
-        Status: 
-
-      PR#2343: Status module averages are for entire uptime
-        Status: 
-
-    * apache-api
-
-      PR#1004: request_config field in request_rec is moderately bogus
-        Status: 
-
-      PR#1158: improvements to child spawning API
-        Status: 
-
-      PR#1233: there is no way to keep per-connection per-module state
-        Status: 
-
-      PR#2024: adding auth_why to conn_rec
-        Status: 
-
-      PR#2873: Feedback/Comment on APACI
-        Status: 
-
-      PR#3143: No module specific data hook for per-connection data
-        Status: 
-
-    * generally odds and ends
-
-      PR#2431: A small addition to rotatelogs.c to improve program functionality.
-        Status: 
-
-      PR#2763: mailto tags and bundling bug report script
-        Status: 
-
-      PR#2785: os-aix Support for System Resource Controller
-        Status: 
-
-      PR#2889: Inclusion of RPM spec file in CVS/distributions
-        Status: 
-
-      PR#5713: os-windows [PATCH] install as win32 service with domain account
-        Status: Cannot accept password-as-arg, we should prompt the
-                user when -k install/-k config with a user argument.
-
-
-
-Other bugs that need fixing:
-
-    * ap_discard_request should be converted to use the bucket API
-      directly rather than waste cycles copying buffers with the old API.
-
-    * MaxRequestsPerChild measures connections, not requests.
-        Until someone has a better way, we'll probably just rename it
-        "MaxConnectionsPerChild".
-    
-    * Regex containers don't work in an intutive way
-        Status: No one has come up with an efficient way to fix this
-        behavior. Dean has suggested getting rid of regex containers
-        completely.
-        OtherBill suggests: We at least seem to agree on eliminating
-                            the <Container ~ foo> forms, and using only
-                            <ContainerMatch foo> semantics.
-
-    * SIGSEGV on Linux (glibc 2.1.2) isn't caught properly by a
-      sigwaiting thread. We need to work around this, perhaps unless
-      there is hope soon for a fixed glibc.
-
-    * orig_ct in the byterange/multipart handling may not be
-      needed. Apache 1.3 just never stashed "multipart" into
-      r->content_type. We should probably follow suit since the
-      byterange stuff doesn't want the rest of the code to see the
-      multipart content-type; the other code should still think it is
-      dealing with the <orig_ct> stuff.
-        Status: Greg volunteers to investigate (esp. since he was most 
-                likely the one to break it :-)
-
-Binaries (2.0.52):
-
- Platform                      Avail.  Volunteer
- ------------------------------------------------------------------
- AIX 4.3.3                     no      Bill Stoddard
- Mandrake 8.1                  no      open
- FreeBSD 4.1                   no      open
- hppa2.0w-hp-hpux11.00         no      Cliff Woolley
- i386-pc-solaris2.9            no      Aaron Bannert
- i386-unknown-freebsd4.5       no
- i386-unknown-freebsd4.6       no      Cliff Woolley
- i386-unknown-freebsd4.10      no      Aaron Bannert
- i686-pc-linux-gnu-slackware81 no      Cliff Woolley
- i686-pc-linux-gnu-rh70        no      Aaron Bannert
- i686-pc-linux-gnu-rh73        no      Cliff Woolley
- i686-pc-linux-gnu             no      Graham Leggett
- ia64-hp-hpux11.20             no
- powerpc-apple-darwin7.4.0     no      Aaron Bannert
- powerpc-unknown-linux-gnu     no      Graham Leggett
- s390-ibm-linux                no      Greg Ames
- sparc-sun-solaris2.8          no      Jim Jagielski
- NetWare                       no      Brad Nicholes
- OS/2                          no      Brian Havard
- OS/390                        no      Greg Ames
- Win32-x86                     yes     William Rowe
- x86_64-unknown-linux-gnu      no      Aaron Bannert