Pound-current has evolved since I took a copy of it on 8/30, but the
changes don't seem to be memorialized except in the code.  Would it be
possible to change the release/development version patter to do
sub-releases?  At the moment, I am confused as to which version I should
be useing.  V1.7 had major problems which Pound-current-040830 seems to
have fixed.  

On the other hand, we continue to see a high incidence of 500 errors and a
few incidents of transmission probems--missing headers, incorrect content.  
I don't now if the transmission errors can be blamed on Pound, but the 500
errors seem to be Pound related.  Should I upgrade to the latest
Pound-current before I begin trying to localize these problems, or should
I use the 2004/08/30 version?"

-d

One more thing --
We are running RH7.3, openssl-devel-0.9.6b-35.7, and glibc-2.2.5-44.
What versions of these support packages does Pound expect?

On Mon, 13 Sep 2004, Dennis Allison wrote:
[...]

On Tuesday 14 September 2004 00.44, Dennis Allison wrote:[...]

Latest -current is from 07SEP04. The current change log (against 1.7):

- fixed bug if multiple listening ports/addresses
- added support for non-blocking connect(2)
- added support for 414 - Request URI too long
- added RedirectRewrite directive - to prevent redirect changes
- added support for NoHTTPS11 value 2 (for MSIE clients only)
- fixed memory leak in SSL
- added supervisor process disable configuration flag
- improved threads detection code in autoconf
- flush stdout after each log message
- assumes only 304, 305 and 306 codes to have no content
- fixed problem with time-outs in HTTPS
- fixed problem with delays in 302 without content
- tweak for the Location rewriting code (only look at current GROUP)

As I mentioned in a previous post, after 1.8 we'll go to distinct sub-version 
(instead of a generic -current you'll see 1.9rc1, 1.9rc2, etc).

Your supporting packages versions should be OK, with the exception of OpenSSL. 
This is not a Pound issue, but some vulnerabilities were discovered and fixed 
in OpenSSL since 0.9.6b: I believe the current versions are 0.9.6l or 0.9.7d. 
See openssl.org for details.

I am not aware of "missing headers" or "incorrect content", and I can't really 
imagine how it could happen (Pound does not change the response contents in 
any way). 500 is generated by Pound, but it is always the result of something 
else happening - as discussed in previous messages.

In general we recommend tracking the latest -current, but it really is your 
choice.[...]

> On Tuesday 14 September 2004 00.44, Dennis Allison wrote:[...][...]

IIRC the mentioned rpms contain backported fixes so from the security
point of view they should be okay.
[...]

Robert, thanks for the versions clarification.  Last night I moved to the
latest Pound-current and modified the error routines to report back to the
user which of the errors the e500 represents.  This because some of our
users were reporting 500 errors at times which the logs showed none.
I am hoping to learn more today.
[...]

The only way these problems could occur would be if Pound (or some other
subsystem) were greatly confused.  This problem manifests itself by the
display of raw html and javascript as the page content or by the display
of content, but content from the wrong URL.  Both occur infrequently and
are not repeatable.