forked from apache/httpd
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGES
1683 lines (1289 loc) · 80.5 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
-*- coding: utf-8 -*-
Changes with Apache 2.5.1
*) ab: Add an optional ramp delay when starting concurrent connections so
as to not trigger denial of service protection in the network. Report
levels of concurrency achieved in cases where the test completes before
full concurrency is achieved. [Graham Leggett]
*) mod_http2: preserve the port number given in a HTTP/1.1
request that was Upgraded to HTTP/2. Fixes PR65881.
[Stefan Eissing]
*) mod_http2: :scheme pseudo-header values, not matching the
connection scheme, are forwarded via absolute uris to the
http protocol processing to preserve semantics of the request.
Checks on combinations of pseudo-headers values/absence
have been added as described in RFC 7540.
Fixes <https://github.com/icing/mod_h2/issues/230>.
[Stefan Eissing]
*) core/mpm: add hook 'child_stopped` that gets called when the MPM has
stopped all processing in a child process. This is when all running
threads shall be stopped and joined.
[Stefan Eissing]
*) core: Make sure and check that LimitXMLRequestBody fits in system memory.
[Ruediger Pluem, Yann Ylavic]
*) ab: Fix the detection for when the server performed a legitimate
connection close as per RFC7230 6.3.1. We must check whedther the
connection was previously kept alive, and not whether the current
closed request is keepalive. [Graham Leggett]
*) mod_rewrite: Make URI-to-filename rewrites work transparently with
proxy early mappings (mapping=servlet/decoded). [Yann Ylavic]
*) mod_md: do not interfere with requests to /.well-known/acme-challenge/
resources if challenge type 'http-01' is not configured for a domain.
Fixes <https://github.com/icing/mod_md/issues/279>.
[Stefan Eissing]
*) mod_proxy: Bump limit of proxy workers names to 384 characters. PR 53218
[Yann Ylavic]
*) core: Simpler connection close logic if discarding the request body fails.
[Yann Ylavic, Ruediger Pluem]
*) mod_proxy: Use the maxium of front end and backend timeouts instead of the
minimum when tunneling requests (websockets, CONNECT requests).
Backend timeouts can be configured more selectively (per worker if needed)
as front end timeouts and typically the backend timeouts reflect the
application requirements better. PR 65886 [Ruediger Pluem]
*) mod_watchdog: use the `child_stopping` and `child_stopped` hooks
to shutdown workers before pool destruction releases global
resources and libraries.
[Stefan Eissing]
*) ab: Respond appropriately to SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE.
Previously the correct event was polled for, but the response to the poll
would call write instead of read, and read instead of write. PR 55952
[Graham Leggett]
*) mod_md: the status description in MDomain's JSON, exposed in the
md-status handler (if configure) did sometimes not carry the correct
message when certificates needed renew.
[Stefan Eissing]
*) mod_tls: Fix a linkage issue with rustls when compiled
with rust 1.55, 1.56 or 1.57. This prevents the loading
of the module because of an undefined symbol: fmaf
See https://github.com/rustls/rustls-ffi/issues/133
[Christophe Jaillet]
*) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
when an efficient TLS implementation is available. [Yann Ylavic]
*) mod_reqtimeout: Fix missing handshake= timeout enforcement. [Yann Ylavic]
*) mod_dav: Fix regression when gathering properties which could lead to huge
memory consumption proportional to the number of resources.
[Evgeny Kotkov, Ruediger Pluem]
*) mod_unixd: CoreDumpDirectory requires enabling tracing on FreeBSD 11+.
PR 65819. [David CARLIER <devnexen gmail.com>]
*) mpm_event: Fix a possible listener deadlock on heavy load when restarting
and/or reaching MaxConnectionsPerChild. PR 65769. [Yann Ylavic]
*) http: Enforce that fully qualified uri-paths not to be forward-proxied
have an http(s) scheme, and that the ones to be forward proxied have a
hostname, per HTTP specifications. [Ruediger Pluem, Yann Ylavic]
*) mod_http2: fixed a bug in v2.0.0 that could lead to an infinite
loop when clients close connections prematurely.
Enhanced the scoreboard status updates on h2 connections for
mod_status. 'server-status' now gives a better idea what the
connection is working on.
[Stefan Eissing]
*) mod_http: Correctly sent a 100 Continue status code when sending an interim
response as result of an Expect: 100-Continue in the request and not the
current status code of the request. PR 65725 [Ruediger Pluem]
*) mod_proxy_connect: Honor the smallest of the backend or client timeout
while tunneling. [Yann Ylavic]
*) mod_http2: a regression in v1.15.24 of the modules was fixed that
could lead to httpd child processes not being terminated on a
graceful reload or when reaching MaxConnectionsPerChild.
When unprocessed h2 requests were queued at the time, these could stall.
See <https://github.com/icing/mod_h2/issues/212>.
[@hansborr, @famzah, Stefan Eissing]
*) mod_proxy_uwsgi: Remove duplicate slashes at the beginning of PATH_INFO.
PR 65616. [Ruediger Pluem]
*) mod_md: Fix memory leak in case of failures to load the private key.
PR 65620 [ Filipe Casal <filipe.casal@trailofbits.com> ]
* mod_http2: the new pollset implementation is disabled when
compiling with an APR version less than 1.6.
*) mod_autoindex: Add "IndexForbiddenReturn404" to return 404 instead of a
403 when Options does not included "indexes". [Eric Covener]
*) mod_dir: Add "NotFound" option to "DirectorySlash" directive to return
404 instead of a DirectorySlash redirect. [Eric Covener]
*) mod_md: adding v2.4.8 with the following changes
- Added support for ACME External Account Binding (EAB).
Use the new directive `MDExternalAccountBinding` to provide the
server with the value for key identifier and hmac as provided by
your CA.
While working on some servers, EAB handling is not uniform
across CAs. First tests with a Sectigo Certificate Manager in
demo mode are successful. But ZeroSSL, for example, seems to
regard EAB values as a one-time-use-only thing, which makes them
fail if you create a seconde account or retry the creation of the
first account with the same EAB.
- The directive 'MDCertificateAuthority' now checks if its parameter
is a http/https url or one of a set of known names. Those are
'LetsEncrypt', 'LetsEncrypt-Test', 'Buypass' and 'Buypass-Test'
for now and they are not case-sensitive.
The default of LetsEncrypt is unchanged.
- `MDContactEmail` can now be specified inside a `<MDomain dnsname>`
section.
- Treating 401 HTTP status codes for orders like 403, since some ACME
servers seem to prefer that for accessing oders from other accounts.
- When retrieving certificate chains, try to read the repsonse even
if the HTTP Content-Type is unrecognized.
- Fixed a bug that reset the error counter of a certificate renewal
and prevented the increasing delays in further attempts.
- Fixed the renewal process giving up every time on an already existing
order with some invalid domains. Now, if such are seen in a previous
order, a new order is created for a clean start over again.
See <https://github.com/icing/mod_md/issues/268>
- Fixed a mixup in md-status handler when static certificate files
and renewal was configured at the same time.
*) mod_http2:
- Fixed an issue since 1.15.24 that "Server" headers in proxied requests
were overwritten instead of preserved. [PR by @daum3ns]
- Added directove 'H2StreamTimeout' to configure a separate value for HTTP/2
streams, overriding server's 'Timeout' configuration. [rpluem]
- HTTP/2 connections now use pollsets to monitor the status of the
ongoing streams and their main connection when host OS allows this.
- Removed work-arounds for older versions of libnghttp2 and checking
during configure that at least version 1.15.0 is present.
- The HTTP/2 connection state handler, based on an experiment and draft
at the IETF http working group (abandoned for some time), has been removed.
- H2SerializeHeaders no longer has an effect. A warning is logged when it is
set to "on". The switch enabled the internal writing of requests to be parsed
by the internal HTTP/1.1 protocol handler and was introduced to avoid
potential incompatibilities during the introduction of HTTP/2.
- Removed the abort/redo of tasks when mood swings lower the active limit.
[Ruediger Pluem, daum3ns, Stefan Eissing]
*) core: Be safe with ap_lingering_close() called with a socket NULL-ed by
a third-party module. PR 65627.
[acmondor <bz.apache.org acmondor.ca>, Yann Ylavic]
*) mpm_event: Restart stopping of idle children after a load peak. PR 65626.
[Yann Ylavic, Ruediger Pluem]
*) mod_proxy: SetEnv proxy-nohalfclose (or alike) allows to disable TCP
half-close forwarding when tunneling protocols. [Yann Ylavic]
*) mod_tls: added mod_tls from abetterinternet, donated
by ISRG/Prossimo <https://github.com/abetterinternet/mod_tls>.
- adds font-/backend TLS (v1.2/v1.3) via the Rust rustls crate
and its rustls-ffi C binding <https://github.com/rustls/rustls-ffi>.
- documentation at <https://github.com/abetterinternet/mod_tls>
(adding to Apache's manual TBD)
- build support for Apache httpd configure on *nix platforms,
rustls is linked statically into mod_tls.
*) mod_md: values for External Account Binding (EAB) can
now also be configured to be read from a separate JSON
file. This allows to keep server configuration permissions
world readable without exposing secrets.
[Stefan Eissing]
*) core: Add ap_unescape_url_ex() for better decoding control, and deprecate
unused AP_NORMALIZE_DROP_PARAMETERS flag.
[Yann Ylavic, Ruediger Pluem, Stefan Eissing, Joe Orton]
*) core: AP_NORMALIZE_DECODE_UNRESERVED should normalize the second dot in
the uri-path when it's preceded by a dot. [Yann Ylavic]
*) mod_proxy: New tunnel_forward hooking mechanism allowing modules to handle
Upgrade(d) protocols data. [Yann Ylavic]
*) mod_dav: Correctly handle errors returned by dav providers on REPORT
requests. [Ruediger Pluem]
*) mod_rewrite: Fix UDS ("unix:") scheme for [P] rules. PR 57691 + 65590.
[Janne Peltonen <janne.peltonen sange.fi>]
*) mod_proxy: Handle UDS URIs with empty hostname ("unix:///...") as if they
had no hostname ("unix:/..."). [Yann Ylavic]
*) event mpm: Correctly count active child processes in parent process if
child process dies due to MaxConnectionsPerChild.
PR 65592 [Ruediger Pluem]
*) core: Add ap_pre_connection() as a wrapper to ap_run_pre_connection()
and use it to prevent that failures in running the pre_connection
hook cause crashes afterwards. [Ruediger Pluem]
*) mod_md: fixed a bug in handling multiple parallel OCSP requests. These could
run into an assertion which terminated (and restarted) the child process where
the task was running. Eventually, all OCSP responses were collected, but not
in the way that things are supposed to work.
See also <https://bz.apache.org/bugzilla/show_bug.cgi?id=65567>.
The bug was possibly triggered when more than one OCSP status needed updating
at the same time. For example for several renewed certificates after a server
reload.
*) mod_md: when MDMessageCmd for a 'challenge-setup:<type>:<dnsname>'
fails (!= 0 exit), the renewal process is aborted and an error is
reported for the MDomain. This provides scripts that distribute
information in a cluster to abort early with bothering an ACME
server to validate a dns name that will not work. The common
retry logic will make another attempt in the future, as with
other failures.
Fixed a bug when adding private key specs to an already working
MDomain, see <https://github.com/icing/mod_md/issues/260>.
[Stefan Eissing]
*) core: Add ap_create_connection() to create either a server or client/proxy
connection.
*) mod_http2: when a server is restarted gracefully, any idle h2 worker
threads are shut down immediately. [Stefan Eissing]
*) core: Initialize the request fields on read failure to avoid NULLs.
[Yann Ylavic]
*) mod_proxy: Do not canonicalize the proxied URL when both "nocanon" and
"ProxyPassInterpolateEnv On" are configured. PR 65549.
[Joel Self <joelself gmail.com>]
*) mpm_event: Fix children processes possibly not stopped on graceful
restart. PR 63169. [Joel Self <joelself gmail.com>]
*) mod_unique_id: Reduce the time window where duplicates may be generated
PR 65159
[Christophe Jaillet]
*) Revert "mod_unique_id: Fix potential duplicated ID generation under heavy load.
PR 65159" added in 2.4.47.
This causes issue on Windows.
[Christophe Jaillet]
*) mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker. [Yann Ylavic]
*) mod_md: Certificate/keys pairs are verified as matching before a renewal is accepted
as successful or a staged renewal is replacing the existing certificates.
This avoid potential mess ups in the md store file system to render the active
certificates non-working. [@mkauf]
*) mod_proxy: Fix a potential infinite loop when tunneling Upgrade(d)
protocols from mod_proxy_http, and a timeout triggering falsely when
using mod_proxy_wstunnel, mod_proxy_connect or mod_proxy_http with
upgrade= setting. PRs 65521 and 65519. [Yann Ylavic]
*) mod_proxy: Faster unix socket path parsing in the "proxy:" URL.
[Yann Ylavic]
*) mpm_event: Fix graceful stop/restart of children processes if connections
are in lingering close for too long. [Yann Ylavic]
*) mod_md: fixed a potential null pointer dereference if ACME/OCSP
server returned 2xx responses without content type. Reported by chuangwen.
[chuangwen, Stefan Eissing]
* core/mpm: add hook 'child_stopping` that gets called when the MPM is
stopping a child process. The additional `graceful` parameter allows
registered hooks to free resources early during a graceful shutdown.
[Yann Ylavic, Stefan Eissing]
*) mod_proxy: Fix icomplete initialization of BalancerMember(s) from the
balancer-manager, which can lead to a crash. [Yann Ylavic]
*) mod_http2:
- Aborting requests via RST_STREAM no longer affect the available
resources of a connection when the first chunk of the response
body has been sent.
- H2Min/MaxWorkers behave as intended again. The module will initially
create H2MinWorkers threads and add up to H2MaxWorkers when needed. These
additional workers time out when idle after H2MaxWorkerIdleSeconds and
disappear again.
- Added a timeout to h2 worker cleanup to exit latest after 5 seconds of
waiting on idle workers to terminate. This happens after all connections
have been processed. a WARNING is logged in case workers lagged behind.
- When the shutdown of a child is detected (e.g. graceful shutdown), the
module will terminate all idle workers above H2MinWorkers right away.
This detection currently only happens when a HTTP/2 connection is active.
[Stefan Eissing]
*) mod_md:
- Domain names in `<MDomain ...>` can now appear in quoted form.
- Fixed a failure in ACME challenge selection that aborted further searches
when the tls-alpn-01 method did not seem to be suitable.
- Changed the tls-alpn-01 setup to only become unsuitable when none of the
dns names showed support for a configured 'Protocols ... acme-tls/1'. This
allows use of tls-alpn-01 for dns names that are not mapped to a VirtualHost.
[Stefan Eissing]
*) core/mod_proxy/mod_ssl:
Adding `outgoing` flag to conn_rec, indicating a connection is
initiated by the server to somewhere, in contrast to incoming
connections from clients.
Adding 'ap_ssl_bind_outgoing()` function that marks a connection
as outgoing and is used by mod_proxy instead of the previous
optional function `ssl_engine_set`. This enables other SSL
module to secure proxy connections.
The optional functions `ssl_engine_set`, `ssl_engine_disable` and
`ssl_proxy_enable` are now provided by the core to have backward
compatibility with non-httpd modules that might use them. mod_ssl
itself no longer registers these functions, but keeps them in its
header for backward compatibility.
The core provided optional function wrap any registered function
like it was done for `ssl_is_ssl`.
[Stefan Eissing]
*) mod_h2: Don't strip headers from 304 responses. [Yann Ylavic]
*) mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match worker instances
with others when their URLs contain a '$' substitution. PR 65419.
[Yann Ylavic]
*) mpm_prefork: Block signals for child_init hooks to prevent potential
threads created from there to catch MPM's signals.
[Ruediger Pluem, Yann Ylavic]
*) mod_ssl: tighten the handling of ALPN for outgoing (proxy)
connections. If ALPN protocols are provided and sent to the
remote server, the received protocol selected is inspected
and checked for a match. Without match, the peer handshake
fails.
An exception is the proposal of "http/1.1" where it is
accepted if the remote server did not answer ALPN with
a selected protocol. This accomodates for hosts that do
not observe/support ALPN and speak http/1.x be default.
* mod_log_config/mod_ssl: moved the log_handlers registered by mod_ssl
into mod_log_config itself. These now use the global `ap_ssl_var_lookup()`
functions and work for all running SSL modules.
The dependency from mod_ssl to mod_log_config and its header is removed.
mod_ssl now provides the content of "{errstr}c" as variable "SSL_CLIENT_VERIFY_ERRSTR".
This change should be fully compatible to all deployed configurations.
[Stefan Eissing]
*) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
an attempt to load a dbm driver fails, log clearly which driver triggered
the error (not "default"), and what the error was. [Graham Leggett]
*) core: Fix a regression that stripped the ETag header from 304 responses.
PR 61820 [Ruediger Pluem, Roy T. Fielding]
*) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. This
allows modules to access and provide OCSP response data without being tied
of each other. The data is exchanged in standard, portable formats (PEM encoded
certificates and DER encoded responses), so that the actual SSL/crypto
implementations used by the modules are independant of each other.
Registration and retrieval happen in the context of a server (server_rec)
which modules may use to decide if they are configured for this or not.
The area of changes:
1. core: defines 2 functions in include/http_ssl.h, so that modules may
register a certificate, together with its issuer certificate for OCSP
response provisioning and ask for current response data (DER bytes) later.
Also, 2 hooks are defined that allow modules to implement this OCSP
provisioning.
2. mod_ssl uses the new functions, in addition to what it did already, to
register its certificates this way. If no one is interested in providing
OCSP, it falls back to its own (if configured) stapling implementation.
3. mod_md registers itself at the core hooks for OCSP provisioning. Depending
on configuration, it will accept registrations of its own certificates only,
all certificates or none.
[Stefan Eissing]
*) mod_proxy_wstunnel: Add ProxyWebsocketFallbackToProxyHttp to opt-out the
fallback to mod_proxy_http for WebSocket upgrade and tunneling.
[Yann Ylavic]
*) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic]
*) mod_lua: Add support to Lua 5.4 [Joe Orton, Giovanni Bechis, Ruediger Pluem]
*) mod_md: Tolerate a missing "revokeCert" or "keyChange" resource.
[Fraser Tweedale <ftweedal redhat.com>]
*) mod_ssl: Add SSL_{CLIENT,SERVER}_B64CERT variables with
base64-encoded DER certificates. Add SSL_CLIENT_B64CERT_CHAIN_n
equivalents for SSL_CLIENT_CERT_CHAIN_n, and new
"ExportBase64CertData" argument for SSLOptions. PR 65169.
[Joe Orton]
*) mod_proxy_balancer: Include nonce in XML output. PR 63074.
Federico Mennite <federico.mennite lifeware.ch>
*) mod_http2: Fixed a race condition that could lead to streams being
aborted (RST to the client), although a response had been produced.
[Stefan Eissing]
*) mod_unique_id: Fix potential duplicated ID generation under heavy load.
PR 65159
[Jonas Müntener <jonas.muentener ergon.ch>, Christophe Jaillet]
*) core: provide ap_ssl_* functions in new http_ssl.h header file.
[Stefan Eissing]
*) mod_socache_shmcb: Avoid double SHM cleanup and possible crash on
restart/stop. PR 59798. [Yann Ylavic]
*) mod_md: v2.4.0 with improvements and bugfixes
- MDPrivateKeys allows the specification of several types. Beside "RSA" plus
optional key lengths elliptic curves can be configured. This means you can
have multiple certificates for a Managed Domain with different key types.
With ```MDPrivateKeys secp384r1 rsa2048``` you get one ECDSA and one RSA
certificate and all modern client will use the shorter ECDSA, while older
client will get the RSA certificate.
Many thanks to @tlhackque who pushed and helped on this.
- Support added for MDomains consisting of a wildcard. Configuring
```MDomain *.host.net``` will match all virtual hosts matching that pattern
and obtain one certificate for it (assuming you have 'dns-01' challenge
support configured). Addresses #239.
- Removed support for ACMEv1 servers. The only known installation used to
be Let's Encrypt which has disabled that version more than a year ago for
new accounts.
- Andreas Ulm (<https://github.com/root360-AndreasUlm>) implemented the
```renewing``` call to ```MDMessageCmd``` that can deny a certificate
renewal attempt. This is useful in clustered installations, as
discussed in #233).
- New event ```challenge-setup:<type>:<domain>```, triggered when the
challenge data for a domain has been created. This is invoked before the
ACME server is told to check for it. The type is one of the ACME challenge
types. This is invoked for every DNS name in a MDomain.
- The max delay for retries has been raised to daily (this is like all
retries jittered somewhat to avoid repeats at fixed time of day).
- Certain error codes reported by the ACME server that indicate a problem
with the configured data now immediately switch to daily retries. For
example: if the ACME server rejects a contact email or a domain name,
frequent retries will most likely not solve the problem. But daily retries
still make sense as there might be an error at the server and un-supervised
certificate renewal is the goal. Refs #222.
- Test case and work around for domain names > 64 octets. Fixes #227.
When the first DNS name of an MD is longer than 63 octets, the certificate
request will not contain a CN field, but leave it up to the CA to choose one.
Currently, Lets Encrypt looks for a shorter name in the SAN list given and
fails the request if none is found. But it is really up to the CA (and what
browsers/libs accept here) and may change over the years. That is why
the decision is best made at the CA.
- Retry delays now have a random +/-[0-50]% modification applied to let
retries from several servers spread out more, should they have been
restarted at the same time of day.
- Fixed several places where the 'badNonce' return code from an ACME server
was not handled correctly. The test server 'pebble' simulates this behaviour
by default and helps nicely in verifying this behaviour. Thanks, pebble!
- Set the default `MDActivationDelay` to 0. This was confusing to users that
new certificates were deemed not usably before a day of delay. When clocks are
correct, using a new certificate right away should not pose a problem.
- When handling ACME authorization resources, the module no longer requires
the server to return a "Location" header, as was necessary in ACMEv1.
Fixes #216.
- Fixed a theoretical uninitialized read when testing for JSON error responses
from the ACME CA. Reported at <https://bz.apache.org/bugzilla/show_bug.cgi?id=64297>.
- ACME problem reports from CAs that include parameters in the Content-Type
header are handled correctly. (Previously, the problem text would not be
reported and retries could exist CA limits.)
- Account Update transactions to V2 CAs now use the correct POST-AS-GET method.
Previously, an empty JSON object was sent - which apparently LE accepted,
but others reject.
- MDCertificateFile and MDCertificateKeyFile can now be specified several
times to add multiple, static certificates to a MDomain.
[Stefan Eissing, @tlhackque, Andreas Ulm]
*) mod_session: Improve session parsing. [Yann Yalvic]
*) mod_proxy_hcheck: Don't pile up health checks if the previous one did
not finish before hcinterval. PR 63010. [Yann Ylavic]
*) core: Adding SSL related inquiry functions to the server API.
These function are always available, even when no module providing
SSL is loaded. They provide their own "shadowing" implementation for
the optional functions of similar name that mod_ssl and impersonators
of mod_ssl provide.
This enables loading of several SSL providing modules when all but
one of them registers itself into the new hooks. Two old-style SSL
modules will not work, as they replace the others optional functions
with their own.
Modules using the old-style optional functions will continue to work
as core supplies its own versions of those.
The following has been added so far:
- ap_ssl_conn_is_ssl() to query if a connection is using SSL.
- ap_ssl_var_lookup() to query SSL related variables for a
server/connection/request.
- Hooks for 'ssl_conn_is_ssl' and 'ssl_var_lookup' where modules
providing SSL can install their own value supplying functions.
- ap_ssl_add_cert_files() to enable other modules like mod_md to provide
certificate and keys for an SSL module like mod_ssl.
- ap_ssl_add_fallback_cert_files() to enable other modules like mod_md to
provide a fallback certificate in case no 'proper' certificate is
available for an SSL module like mod_ssl.
- ap_ssl_answer_challenge() to enable other modules like mod_md to
provide a certificate as used in the RFC 8555 'tls-alpn-01' challenge
for the ACME protocol for an SSL module like mod_ssl. The function
and its hook provide PEM encoded data instead of file names.
- Hooks for 'ssl_add_cert_files', 'ssl_add_fallback_cert_files' and
'ssl_answer_challenge' where modules like mod_md can provide providers
to the above mentioned functions.
[Stefan Eissing]
*) mod_http2: new option 'H2OutputBuffering on/off' which controls the
buffering of stream output. The default is on, which is the behaviour of
previous mod-h2 versions. When off, all bytes are made available immediately
to the main connection for sending them out to the client. This fixes interop
issues with certain flavours of gRPC. [Stefan Eissing]
*) mod_authnz_ldap: Prevent authentications with empty passwords for the
initial bind to fail with status 500. [Ruediger Pluem]
*) mod_http2: Fixed reporting of transferred bytes for mod_logio for
modifiers %O (and %S) to report the number of transferred header and
body lengths. This is still only an approximation of the bytes on the
connection. The data is subject to header compression and h2 framing
afterwards. [Stefan Eissing]
*) mod_cgid: Intercept and log stderr output correctly on Unix systems
supporting fd passing. PR 54221. [Joe Orton]
*) mod_auth_digest: Fast validation of the nonce's base64 to fail early if
the format can't match anyway. [Yann Ylavic]
*) mod_xml2enc: Update check to match MIME types matching
"+xml" rather than anything containing "xml", avoiding
corruption of Microsoft OOXML formats. PR 64339.
[Joseph Heenan <joseph.heenan fintechlabs.io>]
*) mod_proxy_wstunnel: Leave Upgrade requests handling to mod_proxy_http,
allowing for (non-)Upgrade negotiation with the origin server.
[Yann Ylavic]
*) mod_ssl: SSLProxyMachineCertificateFile/Path may reference files
which include CA certificates; those CA certs are treated as if
configured with SSLProxyMachineCertificateChainFile. [Joe Orton]
*) mpm_event: don't reset connections after lingering close, restoring prior
to 2.4.28 behaviour. [Yann Ylavic]
*) mod_dav_fs: Improve logging output when failing to open files for
writing. PR 64413. [Bingyu Shen <ahshenbingyu gmail.com>]
*) mod_proxy: Add optional third argument for ProxyRemote, which
configures Basic authentication credentials to pass to the remote
proxy. PR 37355. [Joe Orton]
*) mod_proxy_http: Fix 100-continue deadlock for spooled request bodies,
leading to Request Timeout (408). PR 63855. [Yann Ylavic]
*) http: Allow unknown response status' lines returned in the form of
"HTTP/x.x xxx Status xxx". [Yann Ylavic]
*) mod_proxy_fcgi: Honor "SetEnv proxy-sendcl" to forward a chunked
Transfer-Encoding from the client, spooling the request body when needed
to provide a Content-Length to the backend. PR 57087. [Yann Ylavic]
*) mpm_event: kill connections in keepalive state only when there is no more
workers available, not when the maximum number of connections is reached,
restoring prior to 2.4.30 behaviour. [Yann Ylavic]
*) mod_allowmethods: Allow methods to be added/removed with +/- prefix. PR64785.
[Marcel Montes <spiceman gmail.com>]
*) mod_unique_id: Use base64url encoding for UNIQUE_ID variable,
avoiding the use of '@'. PR 57044.
[Michael Kaufmann <apache-bugzilla michael-kaufmann.ch>]
*) core: add ReadBufferSize, FlushMaxThreshold and FlushMaxPipelined
directives. [Yann Ylavic]
*) mod_md: lowered the required minimal libcurl version from 7.50 to 7.29
as proposed by <alexander.gerasimov@codeit.pro>.
*) mod_http2: Log requests and sent the configured error response in case of
early detected errors like too many or too long headers.
[Ruediger Pluem, Stefan Eissing]
*) mod_proxy_uwsgi: Fix a crash when sending environment variables with no
value. PR 64598 [Ruediger Pluem]
*) mod_cgi/mod_cgid: Avoid a second read from a CGI script after a
timeout, which effectively doubled the configured timeout setting.
PR 64709. [Joe Orton]
*) core: handle headers when replying a 304 following RFC7234.
[Giovanni Bechis]
*) mod_http2: remove support for abandoned http-wg draft
<https://datatracker.ietf.org/doc/draft-kazuho-h2-cache-digest/>.
[Stefan Eissing]
*) mod_proxy_uwsgi: Error out on HTTP header larger than 16K (hard
protocol limit). [Yann Ylavic]
*) mod_dav: Some DAV extensions, like CalDAV, specify both document
elements and property elements that need to be taken into account
when generating a property. The document element and property element
are made available in the dav_liveprop_elem structure under the
DAV_PROP_ELEMENT key in the resource pool. [Graham Leggett]
*) mod_dav: Add utility functions dav_validate_root_ns(),
dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() and
dav_find_attr() so that other modules get to play too.
[Graham Leggett]
*) mod_http2:
Fixes <https://github.com/icing/mod_h2/issues/200>:
"LimitRequestFields 0" now disables the limit, as documented.
Fixes <https://github.com/icing/mod_h2/issues/201>:
Do not count repeated headers with same name against the field
count limit. The are merged internally, as if sent in a single HTTP/1 line.
[Stefan Eissing]
*) mod_http2: Avoid segfaults in case of handling certain responses for
already aborted connections. [Stefan Eissing, Ruediger Pluem]
*) core: Remove support for the Content-MD5 header, removed in RFC7231.
Functions ap_md5digest() and ap_md5contextTo64() removed, and
ContentDigest directive. [Graham Leggett]
*) mod_dav: Allow other DAV modules to use dav_get_resource().
[Graham Leggett]
*) mpm_common: remove ap_mpm_unregister_poll_callback() and
mpm_unregister_poll_callback hook. [Yann Ylavic]
*) mod_proxy_http: add asynchronous handling of Upgrade(d) protocols,
where idle connections are returned to the MPM and rescheduled on
another thread when ready. [Yann Ylavic]
*) mod_dav: Add method_precondition hook. WebDAV extensions define
conditions that must exist before a WebDAV method can be executed.
This hook allows a WebDAV extension to verify these preconditions.
[Graham Leggett]
*) Add hooks deliver_report and gather_reports to mod_dav.h. Allows other
modules apart from versioning implementations to handle the REPORT method.
[Graham Leggett]
*) Add dav_get_provider(), dav_open_lockdb() and dav_close_lockdb() mod_dav.h.
[Graham Leggett]
*) "[mod_dav_fs etag handling] should really honor the FileETag setting".
- It now does.
- Add "Digest" to FileETag directive, allowing a strong ETag to be
generated using a file digest.
- Add ap_make_etag_ex() and ap_set_etag_fd() to allow full control over
ETag generation.
- Add concept of "binary notes" to request_rec, allowing packed bit flags
to be added to a request.
- First binary note - AP_REQUEST_STRONG_ETAG - allows modules to force
the ETag to a strong ETag to comply with RFC requirements, such as those
mandated by various WebDAV extensions.
[Graham Leggett]
*) mod_ssl: Fix a race condition and possible crash when using a proxy client
certificate (SSLProxyMachineCertificateFile).
[Armin Abfalterer <a.abfalterer gmail.com>]
*) mod_proxy: recognize parameters from ProxyPassMatch workers with dollar
substitution, such that they apply to the backend connection. Note that
connection reuse is disabled by default to avoid compatibility issues.
[Takashi Sato, Jan Kaluza, Eric Covener, Yann Ylavic, Jean-Frederic Clere]
*) mod_proxy_http: remove proxy-sendchunked and proxy-sendchunks
handling, the default behaviour being now to stream the request body
using Content-Length when the length is known and fall back to chunked
Transfer-Encoding otherwise (unless proxy-sendcl is set thus requiring
that the request body be spooled to memory or filesystem). [Yann Ylavic]
*) mod_ldap: Avoid performance overhead of APR-util rebind cache for
OpenLDAP 2.2+. PR 64414. [Joe Orton]
*) mod_proxy_http: flush spooled request body in one go to avoid
leaking (or long lived) temporary file. PR 64452. [Yann Ylavic]
*) mod_proxy_fcgi: ProxyFCGISetEnvIf unsets variables when expression
evaluates to false. PR64365. [Michael König <mail ikoenig.net>]
*) mod_proxy_http: handle Upgrade request, 101 (Switching Protocol) response
and switched protocol forwarding. [Yann Ylavic]
*) mod_ssl: The "ssl_var_lookup" optional function API now takes a
const char *name argument and returns a const char * string
value. The pool argument must now be non-NULL. [Joe Orton]
*) mod_ssl: With OpenSSL 1.1.1 and later, SSLRandomSeed is now
ignored. OpenSSL must be configured with a suitable entropy
source, or mod_ssl will fail to start up. [Joe Orton]
*) mod_ssl: With OpenSSL 1.1.1 and later, client-initiated
renegotiation in TLSv1.2 and earlier is blocked at SSL library
level (with a TLS warning alert sent), rather than by aborting
the connection inside mod_ssl. [Joe Orton]
*) core: Add optional "options=" argument to Listen. Supported
keywords are "freebind", "reuseport" and "v6only". PR 61865.
[Jan Kaluza, Lubos Uhliarik <luhliari redhat.com>, Joe Orton]
*) config: Allow for environment variable substitution with default value,
for when the variable is not defined, using format ${VAR?=default value}.
[Yann Ylavic]
*) htcacheclean: Empty directories in CacheRoot are still present even after
using "-t". PR64313 [Petros Marios Prokopiou <pprokopi redhat.com>,
Ruediger Pluem, Jean-Frederic Clere]
*) mod_reqtimeout: Cannot override default Virtualhost's mod_reqtimeout.
PR64295 [Jean-Frederic Clere]
*) mod_proxy: Allow ProxyErrorOverride to be restricted to specific status
codes. PR63628. [Martin Drößler <mail martindroessler.de>]
*) configtest: Issue a warning for non-existent directories in <Directory> config
sections. PR63079. [Stephane Blondon <stephane.blondon gmail.com>].
*) mod_proxy_http: Fix random memory-corruption in case of an error while
reading a response from the backend.
PR 64234 [Ruediger Pluem, Barnim Dzwillo <dzwillo@strato.de>]
*) core: Use a temporary file when writing the pid file, avoiding
startup failure if an empty pidfile is left over from a
previous crashed or aborted invocation of httpd. PR 63140.
[Nicolas Carrier <carrier.nicolas0 gmail.com>, Joe Orton]
*) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
identifier under load, see <https://github.com/icing/mod_h2/issues/195>.
[Michael Kaufmann, Stefan Eissing]
*) mod_session_cookie: Add SessionCookieMaxAge to allow the mod_session
cookie to be sent as a "session cookie" with no expiration even when the
SessionMaxAge will be enforced on the server. PR56040 [Eric Covener]
*) mod_session: Fix an issue that blocked new sessions being created after
session expiration or other session errors. PR56052 [Eric Covener]
*) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
PR64140. [Renier Velazco <renier.velazco upr.edu>]
*) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
*) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
PR64172.
*) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
to allow customization of the usertrack cookie. PR64077.
[Prashant Keshvani <prashant2400 gmail.com>, Eric Covener]
*) mpm_event: avoid possible KeepAlveTimeout off by -100 ms.
[Eric Covener, Yann Ylavic]
*) mod_md:
- Prefer MDContactEmail directive to ServerAdmin for registration. New directive
thanks to Timothe Litt (@tlhackque).
- protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
check all matching virtual hosts for protocol support. Thanks to @mkauf.
- Corrected a check when OCSP stapling was configured for hosts
where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
- Softening the restrictions where mod_md configuration directives may appear. This should
allow for use in <If> and <Macro> sections. If all possible variations lead to the configuration
you wanted in the first place, is another matter.
[Michael Kaufmann <mail michael-kaufmann.ch>, Timothe Litt (@tlhackque),
Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
*) core: ap_method_mask_t type added for method bitmasks, changed
from apr_int64_t and used for the method_mask field in
ap_method_list_t, AP_METHOD_BIT, allowed field of request_rec,
limited field of cmd_parms. PR 63885. [Joe Orton]
*) mod_ssl: Do not keep connections to OCSP responders alive when doing
OCSP requests. PR 64135. [Ruediger Pluem]
*) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
[Michael Kaufmann <mail michael-kaufmann.ch>, Stefan Eissing]
*) mod_rewrite: Extend the [CO] (cookie) flag of RewriteRule to accept a
SameSite attribute. [Eric Covener]
*) Update DOCTYPE tags in server-generated HTML. PR62989.
[Andra Farkas <deepbluemistake gmail.com>, Giovanni Bechis <giovanni paclan.it>]
*) mod_setenvif: Passing an env-variable parameter of "--early" in non-perdir
context runs directives from this module before `RequestHeader ... early`
are evaluated. This allows results of SetEnvIf conditionals to be used
to modify request headers in early mode. [Eric Covener]
*) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
[Giovanni Bechis <giovanni paclan.it>, Jim Jagielski]
*) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
r:notes_table, r:subprocess_env_table as read-only native table alternatives
that can be iterated over. [Eric Covener]
*) configure: Add manualdir and proxycachedir to the APR_ENABLE_LAYOUT macro call.
[Graham Leggett]
*) Add support for cross compiling to apxs. If apxs is being executed from somewhere
other than its target location, add that prefix to includes and library directories.
Without this, apxs would fail to find config_vars.mk and exit. [Graham Leggett]
*) Add a config layout for OpenWRT. [Graham Leggett]
*) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
[Yann Ylavic, Stefan Eissing]
*) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
r.headers_out, etc) to remove the key from the table. PR63971.
[Eric Covener]
*) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
always `on`, regardless of configuration. Found and reported by
<Armin.Abfalterer@united-security-providers.ch> and
<Marcial.Rion@united-security-providers.ch>. [Stefan Eissing]
*) mod_http2: Multiple field length violations in the same request no longer cause
several log entries to be written. [@mkauf]
*) mod_md: v2.2.4 from github, Fixes a compile time issue with OpenSSL 1.0.2 in
the new OCSP code. Skips port checks for domain server_rec selection when "tls-alpn-01"
is configured explicitly (related to #133). [@mkauf, Stefan Eissing]
*) mod_ssl: Support logging private key material for use with
wireshark via log file given by SSLKEYLOGFILE environment
variable. Requires OpenSSL 1.1.1. PR 63391. [Joe Orton]
*) mod_proxy: Improve tunneling loop to support half closed connections and
pending data draining (for protocols like rsync). PR 61616. [Yann Ylavic]
*) mod_proxy: Add proxy check_trans hook for proxy modules to possibly
decline request handling at early stage. [Yann Ylavic]
*) mod_proxy: Put mod_proxy_{connect,wstunnel} tunneling code in common in
proxy_util. [Yann Ylavic]
*) mod_proxy_http: Fix the forwarding of requests with content body when a
balancer member is unavailable; the retry on the next member was issued
with an empty body (regression introduced in 2.4.41). [Yann Ylavic]
*) mod_ssl: negotiate the TLS protocol version per name based vhost
configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
SSLProtocol (from the first vhost declared on the IP:port) is now only
relevant if no SSLProtocol is declared for the vhost or globally,
otherwise the vhost or global value apply. [Yann Ylavic]
*) mod_proxy_http: Fix 100-continue deadlock for spooled request bodies,
leading to Request Timeout (408). PR 63855. [Yann Ylavic]
*) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
means 'foo' is "not acceptable". PR 58158 [Chistophe Jaillet]
*) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
[Ruediger Pluem, Eric Covener]
*) core: On Windows, fix a start-up crash if <IfFile ...> is used with a path that is not
valid (For example, testing for a file on a flash drive that is not mounted)
[Christophe Jaillet]
*) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
protection. PR63688. [Armin Abfalterer <a.abfalterer gmail.com>]
*) mod_authn_socache: Increase the maximum length of strings that can be cached by
the module from 100 to 256. PR 62149 [<thorsten.meinl knime.com>]
*) mod_ssl: reverting a 2.4.40 change where a superfluous SSLCertificateChainFile configuration
for a domain managed by mod_md caused a startup error. This happened when mod_md installed
its fallback certificate, before it got the first real certificate from Lets Encrypt.
[Stefan Eissing]
*) core, mod_rewrite: Set PCRE_DOTALL by default. Revert via
RegexDefaultOptions -DOTALL [Yann Ylavic]
*) core: Remove request details from built-in error documents [Eric Covener]
*) mod_http2: core setting "LimitRequestFieldSize" is not additionally checked on
merged header fields, just as HTTP/1.1 does. [Stefan Eissing, Michael Kaufmann]
*) mod_http2: fixed a bug that prevented proper stream cleanup when connection
throttling was in place. Stream resets by clients on streams initiated by them
are counted as possible trigger for throttling. [Stefan Eissing]
*) mod_http2/mpm_event: Fixes the behaviour when a HTTP/2 connection has nothing
more to write with streams ongoing (flow control block). The timeout waiting
for the client to send WINODW_UPDATE was incorrectly KeepAliveTimeout and not
Timeout as it should be. Fixes PR 63534. [Yann Ylavic, Stefan Eissing]
*) mod_ssl/mod_md: reversing dependency by letting mod_ssl offer hooks for
adding certificates and keys to a virtual host. An additional hook allows
answering special TLS connections as used in ACME challenges.
Adding 2 new hooks for init/get of OCSP stapling status information when
other modules want to provide those. Falls back to own implementation with
same behaviour as before.
[Stefan Eissing]
*) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
[Graham Leggett]
*) mod_proxy_http2: adding support for handling trailers in both directions. PR 63502.
[Stefan Eissing]
*) mod_reqtimeout: Fix default rates missing (not applied) in 2.4.39.
PR 63325. [Yann Ylavic]
*) mod_ldap: Avoid potential crashes in util_ldap_cache_module_kill() or other
LDAP related functions during graceful restart of a busy server. PR63305.
[Martin Fúsek <mfusek newps.cz>]
*) mod_cache: Fix parsing of quoted Cache-Control token arguments.
PR 63288. [Yann Ylavic]
*) mod_md: Store permissions are enforced on file creation, enforcing restrictions in
spite of umask. Fixes <https://github.com/icing/mod_md/issues/117>. [Stefan Eissing]
*) mod_ssl: Correctly restore SSL verify state after TLSv1.3 PHA failure.
[Michael Kaufmann <mail michael-kaufmann.ch>]
*) Merge consecutive slashes in URL's. Opt-out with `MergeSlashes OFF`.
[Eric Covener]
*) mod_proxy/ssl: Cleanup per-request SSL configuration anytime a backend
connection is recycled/reused to avoid a possible crash with some SSLProxy
configurations in <Location> or <Proxy> context. PR 63256. [Yann Ylavic]
*) mod_mime: Add `MimeOptions` directive to allow Content-Type or all metadata
detection to use only the last (right-most) file extension or to be
disabled per-dir. [Eric Covener]
*) MPMs unix: bind the bucket number of each child to its slot number, for a
more efficient per bucket maintenance. [Yann Ylavic]
*) http: Fix possible empty response with mod_ratelimit for HEAD requests.
PR 63192. [Yann Ylavic]
*) mod_cache_socache: Avoid reallocations and be safe with outgoing data
lifetime. [Yann Ylavic]
*) mod_reqtimeout: Allow to configure (TLS-)handshake timeouts.
PR 61310. [Yann Ylavic]
*) mod_auth_digest: Fix a race condition. Authentication with valid credentials could be
refused in case of concurrent accesses from different users.
PR 63124 [Simon Kappel <simon.kappel axis.com>]
*) mod_ssl: Don't unset FIPS mode on restart unless it's forced by
configuration (SSLFIPS on) and not active by default in OpenSSL.
PR 63136. [Yann Ylavic]
*) mod_ssl: give mod_md the chance to override certificate after ALPN protocol
negotiation. [Stefan Eissing]
*) mod_proxy_wstunnel: Fix websocket proxy over UDS.
PR 62932 <pavel dcmsys.com>
*) mod_negociation: LanguagePriority should be case-insensitive in order to
match AddLanguage behavior. PR 39730 [Christophe Jaillet]
*) mod_session: Always decode session attributes early. [Hank Ibell]
*) core: Incorrect values for environment variables are substituted when
multiple environment variables are specified in a directive. [Hank Ibell]
*) core: Split out the ability to parse wildcard files and directories
from the Include/IncludeOptional directives into a generic set of
functions ap_dir_nofnmatch() and ap_dir_fnmatch(). [Graham Leggett]
*) mod_ssl: Fix mod_authz provider for "require ssl" directive to check correctly