[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #16 from Klemen Novak --- Hi, I tested Mark Thomas version and it works on my servers. Windows 2008 R2 x64, Tomcat 7.0.54 x64. I also tested the server with SSLLabs and its ok. I works fine. -- You are receiving this mail b

Re: Building tcnative on win32 [x86_64, failing]

2014-07-01 Thread Mark Thomas
On 01/07/2014 17:24, Christopher Schultz wrote: > On 7/1/14, 12:18 PM, Mark Thomas wrote: >>> The IA64 build of OpenSSL *did* complete, but I'm not sure how >>> to check its architecture, etc. What is the "depends" tool you >>> guys have been talking about? >> >> The depends tool ships with v

Time for Tomcat Native 1.1.31 ?

2014-07-01 Thread Mark Thomas
Folks, I think I have all the pieces in place to do a Tomcat Native 1.1.31 release. Is anyone aware of anything that needs fixing before 1.1.31 is tagged? Unless someone identifies an issue then I intend to tag 1.1.31 tomorrow morning my time (in 12-14 hours time). Mark ---

svn commit: r1607163 - /tomcat/native/branches/1.1.x/java/org/apache/tomcat/

2014-07-01 Thread markt
Author: markt Date: Tue Jul 1 18:59:45 2014 New Revision: 1607163 URL: http://svn.apache.org/r1607163 Log: Update external Modified: tomcat/native/branches/1.1.x/java/org/apache/tomcat/ (props changed) Propchange: tomcat/native/branches/1.1.x/java/org/apache/tomcat/ --

[Tomcat Wiki] Update of "BuildTcNativeWin" by markt

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by markt: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=12&rev2=13 Comment: Complete instructions for IA64 build copy

[Tomcat Wiki] Update of "BuildTcNativeWin" by markt

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by markt: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=11&rev2=12 Comment: Found work around for IA64 OpenSSL build n

Re: Building tcnative on win32 [x86_64, failing]

2014-07-01 Thread Christopher Schultz
Mark, On 7/1/14, 12:18 PM, Mark Thomas wrote: > On 01/07/2014 16:40, Christopher Schultz wrote: > >> My script seemed a bit cleaner than what you are documenting on >> the wiki, plus you can get the tools for free (MS VS 12). > > None of the tools documented on the Wiki are paid for. > >> I was

Re: Building tcnative on win32 [x86_64, failing]

2014-07-01 Thread Mark Thomas
On 01/07/2014 16:40, Christopher Schultz wrote: > My script seemed a bit cleaner than what you are documenting on > the wiki, plus you can get the tools for free (MS VS 12). None of the tools documented on the Wiki are paid for. > I was able to build a complete 32-bit statically-linked > libtcna

[Tomcat Wiki] Trivial Update of "BuildTcNativeWin" by KonstantinKolinko

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by KonstantinKolinko: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=10&rev2=11 Comment: Correct a typo c:\cmsc\setenv.

Re: Working tc native build

2014-07-01 Thread Mark Thomas
On 01/07/2014 16:04, Mark Thomas wrote: > With some additional information from Mladen regrading the build tools > to use, I now have a working build environment for the Tomcat Native > connector binaries. This is documented at: > http://wiki.apache.org/tomcat/BuildTcNativeWin (excluding a working

Re: Building tcnative on win32 [x86_64, failing]

2014-07-01 Thread Christopher Schultz
Mark, On 6/30/14, 4:23 PM, Mark Thomas wrote: > On 30/06/2014 14:45, Mark Thomas wrote: >> I've got OpenSSL and APR building on x64. Currently stuck on the tc >> native build which is complaining about: >> error LNK2001: unresolved external symbol __security_cookie >> >> I'm fairly sure I've hit t

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #15 from Martin Schelldorfer --- (In reply to Mark Thomas from comment #14) > I have built x86 and x64 versions using what should be pretty much the same > toolchain as is used for the releases. The results can be obtained from:

Working tc native build

2014-07-01 Thread Mark Thomas
With some additional information from Mladen regrading the build tools to use, I now have a working build environment for the Tomcat Native connector binaries. This is documented at: http://wiki.apache.org/tomcat/BuildTcNativeWin What I don't have, yet, is the ability to reproduce the entire tcnat

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #14 from Mark Thomas --- I have built x86 and x64 versions using what should be pretty much the same toolchain as is used for the releases. The results can be obtained from: http://people.apache.org/~markt/dev/tomcat-native-1.1.

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #13 from Mark Thomas --- (In reply to Mark Thomas from comment #12) > There appear to be a couple of problems with those DLLs. > > The depends tool reports that: > - the 32-bit DLL depends on 64-bit libraries That looks like i

[Tomcat Wiki] Update of "BuildTcNativeWin" by ChristopherSchultz

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by ChristopherSchultz: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=9&rev2=10 svn co http://svn.apache.org/repos/asf/t

[Tomcat Wiki] Update of "BuildTcNativeWin" by markt

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by markt: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=8&rev2=9 Comment: Remainder of build instructions * Need t

[Bug 53952] Add support for TLS 1.1 and 1.2

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=53952 Mark Hobden changed: What|Removed |Added CC||m...@mclgm.net -- You are receiving

[Tomcat Wiki] Update of "BuildTcNativeWin" by markt

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by markt: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=7&rev2=8 Comment: IA64 OpenSSL build fails. Add missing text.

[Tomcat Wiki] Update of "BuildTcNativeWin" by markt

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by markt: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=6&rev2=7 Comment: OpenSSL build for static linking on all three p

[Tomcat Wiki] Update of "BuildTcNativeWin" by markt

2014-07-01 Thread Apache Wiki
Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification. The "BuildTcNativeWin" page has been changed by markt: https://wiki.apache.org/tomcat/BuildTcNativeWin?action=diff&rev1=5&rev2=6 Comment: APR build for static linking on all three platf

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #12 from Mark Thomas --- There appear to be a couple of problems with those DLLs. The depends tool reports that: - the 32-bit DLL depends on 64-bit libraries - the 64-bit DLL depends the MS Visual C runtime msvcr100.dll There

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #11 from Martin Schelldorfer --- DLLs for Win32/x64 APR 1.5.1 and OpenSSL 1.0.1h 5 Jun 2014 -- You are receiving this mail because: You are the assignee for the bug. --

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 Martin Schelldorfer changed: What|Removed |Added Attachment #31776|tomcat-native-1.1.31beta|DLL for Win32 descrip

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #10 from Martin Schelldorfer --- Created attachment 31777 --> https://issues.apache.org/bugzilla/attachment.cgi?id=31777&action=edit DLL for x64 DLL for x64 APR 1.5.1 and OpenSSL 1.0.1h 5 Jun 2014 -- You are receiving this

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #9 from Martin Schelldorfer --- Created attachment 31776 --> https://issues.apache.org/bugzilla/attachment.cgi?id=31776&action=edit tomcat-native-1.1.31beta DLL for Win32 APR 1.5.1 and OpenSSL 1.0.1h 5 Jun 2014 -- You are r

[Bug 43925] org.apache.jasper.runtime.BodyContentImpl causing huge memory allocations

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=43925 --- Comment #15 from Issa Gorissen --- I made some changes to the test case you provided to excluded the random (so that the random numbers are always the same for both cases) and run the test for one target only. JVM is Java HotSpot(TM) 64

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #8 from Klemen Novak --- Martin Schelldorfer is will test them. Please provide me with link. Thank you. I will test them with tomcat 6 and 7 on windows 2008 R2 and then try with SSLLabs. -- You are receiving this mail because

[Bug 56596] OpenSSL 1.0.1g is vulnerable to a man-in-the-middle attack

2014-07-01 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56596 --- Comment #7 from Martin Schelldorfer --- I was able to build the DLL for Win32 and x64 using Visual Studio 2010. It contains APR 1.5.1 and OpenSSL 1.0.1h 5 Jun 2014. I tested the Win32 DLL on Tomcat 7.0.53 / Windows Server 2003 and it's