-*- coding: utf-8 -*-

Changes with Apache 2.5.1

* mod_ssl: Add support for OpenSSL provider based certificate

stores. [Graham Leggett]

*) mod_proxy_beacon: Back-end reverse proxy servers can announce

themselves and be auto-added to their front-end proxy balancer.

[Jim Jagielski]

*) support: Add in Python versions of various Perl-based support

scripts - apxs-ng, dbmmanage-ng, log_server_status-ng,

logresolve.py, phf_abuse_log-ng.cgi and split-logfile-ng.

[Jim Jagielski]

*) mpm_motorz, mod_http2: Rework the MotorZ MPM with

multi-poller scale-out (new PollersPerChild directive) and async

keep-alive/HTTP/2 handoff, plus concurrency hardening and bug

fixes. Includes a required mod_http2 fix so a client's graceful

GOAWAY does not drop an in-flight response under async MPMs, and

a self-contained motorz test suite. [Jim Jagielski]

*) mod_http2: improved early cleanup of streams.

[Stefan Eissing]

*) mod_proxy_fcgi: Don't re-encode SCRIPT_FILENAME when set via SetHandler.

PR 69203. [Yann Ylavic]

*) mod_proxy_http2: improved error handling on connection errors while

response is already underway.

[Stefan Eissing]

*) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for

"balancer:" URLs set via SetHandler, also allowing for "unix:" sockets

with BalancerMember(s). PR 69168. [Yann Ylavic]

*) mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.

PR 69197. [Yann Ylavic, Eric Covener]

*) mod_tls: update version of rustls-ffi to v0.13.0.

[Daniel McCarney (@cpu}]

*) mod_xml2enc: Tolerate libxml2 2.12.0 and later.

[ttachi <tachihara AT hotmail.com>]

*) mod_alias: Add AliasPreservePath directive to map the full

path after the alias in a location. [Graham Leggett]

*) mod_rewrite, mod_proxy: mod_proxy to canonicalize rewritten [P] URLs,

including "unix:" ones. PR 69235, PR 69260. [Yann Ylavic, Ruediger Pluem]

*) mod_http2: fixed a bug that could lead to a crash in main connection

output handling. This occured only when the last request on a HTTP/2

connection had been processed and the session decided to shut down.

This could lead to an attempt to send a final GOAWAY while the previous

write was still in progress. See PR 66646.

[Stefan Eissing]

*) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.

Fixed PR66752.

[Stefan Eissing]

*) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as

described in RFC 8441. A new directive 'H2WebSockets on|off' has been

added. The feature is by default not enabled.

As also discussed in the manual, this feature should work for setups

using "ProxyPass backend-url upgrade=websocket" without further changes.

Special server modules for WebSockets will have to be adapted,

most likely, as the handling if IO events is different with HTTP/2.

HTTP/2 WebSockets are supported on platforms with native pipes. This

excludes Windows.

[Stefan Eissing]

*) mod_proxy: Fix DNS requests and connections closed before the

configured addressTTL. BZ 69126. [Yann Ylavic]

*) apxs: Fix -i in some cases where -n is not used.

[Jan Pazdziora <jpazdziora redhat.com>]

*) worker, event: Avoid possible hangs and crashes during shutdown of

child processes that fail to start their configured threads.

[Yann Ylavic, Eric Covener]

*) mod_ssl: Restore support for loading PKCS#11 keys via ENGINE

without "SSLCryptoDevice" configured. [Joe Orton]

*) mod_rewrite: Fix a recent regression where a rule with both a trailing

'?' and the [QSA] flag did not have the query appended. PR66672

Frank Meier <frank.meier ergon.ch>

*) core: On Linux, log the real thread ID in error logs. [Joe Orton]

*) mod_http2: fixed a bug in flushing pending data on an already closed

connection that could lead to a busy loop, preventing the HTTP/2 session

to close down successfully. Fixed PR 66624.

[Stefan Eissing]

*) mod_http2: v2.0.15 with the following fixes and improvements

- New directive 'H2EarlyHint name value' to add headers to a response,

picked up already when a "103 Early Hints" response is sent. 'name' and

'value' must comply to the HTTP field restrictions.

This directive can be repeated several times and header fields of the

same names add. Sending a 'Link' header with 'preload' relation will

also cause a HTTP/2 PUSH if enabled and supported by the client.

- Fixed an issue where requests were not logged and accounted in a timely

fashion when the connection returns to "keepalive" handling, e.g. when

the request served was the last outstanding one.

This led to late appearance in access logs with wrong duration times

reported.

- Accurately report the bytes sent for a request in the '%O' Log format.

This addresses #203, a long outstanding issue where mod_h2 has reported

numbers over-eagerly from internal buffering and not what has actually

been placed on the connection.

The numbers are now the same with and without H2CopyFiles enabled.

[Stefan Eissing]

*) mod_md:

- Using OCSP stapling information to trigger certificate renewals. Proposed

by @frasertweedale.

- Added directive `MDCheckInterval` to control how often the server checks

for detected revocations. Added proposals for configurations in the

README.md chapter "Revocations".

- OCSP stapling: accept OCSP responses without a `nextUpdate` entry which is

allowed in RFC 6960. Treat those as having an update interval of 12 hours.

Added by @frasertweedale.

- Adapt OpenSSL usage to changes in their API. By Yann Ylavic.

*) mod_proxy_http2: fix retry handling to not leak temporary errors.

On detecting that that an existing connection was shutdown by the other

side, a 503 response leaked even though the request was retried on a

fresh connection.

[Stefan Eissing]

*) mod_rewrite: Add server directory to include path as mod_rewrite requires

test_char.h. PR 66571 [Valeria Petrov <valeria.petrov@spinetix.com>]

*) Add an option to specify a source address. PR32524

[Daniel Rench <gauze omnimental tmetic com>]

*) http/1.1: For a chunked response body, ensure the last-chunk

terminator is flushed if necessary. [Joe Orton]

*) mod_rewrite: Don't require [UNC] flag to preserve a leading //

added by applying the perdir prefix to the substitution.

[Ruediger Pluem, Eric Covener]

*) mod_http2: new directive `H2ProxyRequests on|off` to enable handling

of HTTP/2 requests in a forward proxy configuration.

General forward proxying is enabled via `ProxyRequests`. If the

HTTP/2 protocol is also enabled for such a server/host, this new

directive is needed in addition.

[Stefan Eissing]

*) core: add `final_resp_passed` flag to request_rec to allow

ap_die() to judge if it can send out a response. Bump mmn.

Enable test cases that check errors during response body to

appear as error on client side.

[Stefan Eissing]

*) mod_ldap: HTML-escape data in the ldap-status handler.

[Eric Covener, Chamal De Silva]

*) htcacheclean: In -a/-A mode, list all files per subdirectory

rather than only one. PR 65091.

[Artem Egorenkov <aegorenkov.91 gmail.com>]

*) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not

fail on literal '%' when doing the encoding of the backend URL.

PR 66580 [Ruediger Pluem]

*) mpm_worker: Fix possible warning (AH00045) about children processes not

terminating timely. [Yann Ylavic]

* mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend

connection when sending data on the frontend one. This caused crashes

or infinite loops in rare situations.

* mod_proxy_http2: fixed a bug in retry/response handling that could lead

to wrong status codes or HTTP messages send at the end of response bodies

exceeding the announced content-length.

* mod_proxy_http2: fix retry handling to not leak temporary errors.

On detecting that that an existing connection was shutdown by the other

side, a 503 response leaked even though the request was retried on a

fresh connection.

* mod_http2: fixed a bug that did cleanup of consumed and pending buckets in

the wrong order when a bucket_beam was destroyed.

[Stefan Eissing]

*) mod_ssl: Add support for loading certs/keys from pkcs11: URIs

via OpenSSL 3.x providers. [Ingo Franzki <ifranzki linux.ibm.com>]

*) mod_proxy: Allow to set a TTL for how long DNS resolutions to backend

systems are cached. [Yann Ylavic]

*) mod_http2: v2.0.26 with the following fixes:

- Fixed `Date` header on requests upgraded from HTTP/1.1 (h2c). Fixes

<https://github.com/icing/mod_h2/issues/272>.

- Fixed small memory leak in h2 header bucket free. Thanks to

Michael Kaufmann for finding this and providing the fix.

*) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0.

[Ruediger Pluem, Yann Ylavic]

*) mod_http2: avoid double chunked-encoding on internal redirects.

PR 66597 [Yann Ylavic, Stefan Eissing]

*) mod_cgi/mod_cgid: Reject CGI output with a Transfer-Encoding

header to avoid unexpected or corrupted responses. PR 68970.

[Joe Orton]

*) Windows: Restore the ability to "Include" configuration files on UNC

paths. PR69313 [Eric Covener]

*) mod_http2: Fix reporting of `Total Accesses` in server-status to not count

HTTP/2 requests twice. Fixes PR 66801.

[Stefan Eissing]

*) mod_slotmem_shm: Use ap_os_is_path_absolute() to make it portable.

[Jean-Frederic Clere]

*) Optimise handling LDAP authorization where LDAP was not used

previously for LDAP authentication. [Yann Ylavic]

*) mod_macro: Return an error if the expanded line would exceed the

maximum line length. PR 69258.

[Marc Stern <marc.stern approach-cyber.com>]

* mod_http2: fixed a bug in handling of stream timeouts.

[Stefan Eissing]

*) mod_systemd: Log the SELinux context at startup if available and

enabled. [Joe Orton]

*) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.

PR 69160 [Yann Ylavic]

*) mod_dav_fs: Add DavLockDBType directive. [Joe Orton]

*) mod_ssl: Disable the OpenSSL ENGINE API when OPENSSL_NO_ENGINE is set.

Allow for "SSLCryptoDevice builtin" if the ENGINE API is not available,

notably with OpenSSL >= 3. PR 68080. [Yann Ylavic, Joe Orton]

*) mod_headers: Fix a possible infinite recursion with the edit* action and

empty matches. [Yann Ylavic]

*) mod_tls: updating to rustls-ffi version 0.9.2 or higher.

Checking in configure for proper version installed. Code

fixes for changed clienthello member name.

[Stefan Eissing]

* mod_md:

- New directive `MDMatchNames all|servernames` to allow more control over how

MDomains are matched to VirtualHosts.

- New directive `MDChallengeDns01Version`. Setting this to `2` will provide

the command also with the challenge value on `teardown` invocation. In version

1, the default, only the `setup` invocation gets this parameter.

Refs #312. Thanks to @domrim for the idea.

- For Managed Domain in "manual" mode, the checks if all used ServerName and

ServerAlias are part of the MDomain now reports a warning instead of an error

(AH10040) when not all names are present.

- MDChallengeDns01 can now be configured for individual domains.

Using PR from Jérôme Billiras (@bilhackmac) and adding test case and fixing proper working

- Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge

teardown not being invoked as it should.

*) mod_ssl: Fix a regression that causes the default DH parameters for a key

no longer set and thus effectively disabling DH ciphers when no explicit

DH parameters are set. PR 68863 [Ruediger Pluem]

*) mod_dav: Update redirect-carefully example BrowserMatch config

to match more recent client versions. PR 66148, 67039.

[Michal Maloszewski <michal.maloszewski canonical.com>,

Romain Tartière <romain blogreen.org>]

*) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs

in <Location> (incomplete fix in 2.4.62). PR 69160. [Yann Ylavic]

*) mod_ssl: Add SSL_HANDSHAKE_RTT environment variable.

[Charles Smutz <csmutz gmail.com>]

*) mod_md: fixed passing of the server environment variables to programs

started via MDMessageCmd and MDChallengeDns01 on *nix system.

See <https://github.com/icing/mod_md/issues/319>.

[Stefan Eissing]

*) mod_proxy: Honor parameters of ProxyPassMatch workers with substitution

in the host name or port. PR 69233. [Yann Ylavic]

*) mod_md: Fix the reported "until" validity of a certificate in the status

handler. [Rainer Jung]

*) mod_md: Fix possible NULL deref when logging the error that an

authentication resource could not be retrieved from the ACME server.

[Stefan Eissing]

*) mod_ssl: Improve compatibility with OpenSSL 3, fix build warnings about

deprecated ENGINE_ API, honor OPENSSL_API_COMPAT setting while defaulting

to compatibitily with version 1.1.1 (including ENGINEs / SSLCryptoDevice).

[Yann Ylavic]

*) core: Add "multipathtcp" Listen option. PR 69292.

[Anthony Doeraene <anthony.doeraene hotmail.com>]

*) mod_proxy: Add "multipathtcp" worker parameter. PR 69292.

[Anthony Doeraene <anthony.doeraene hotmail.com>]

*) mod_authnz_ldap.c: Make sure the authentication variables are set in

all cases where another module is the source of the authentication,

and that authenticated user is looked up in LDAP. [Graham Leggett]

*) mod_autht_jwt: New module to handle RFC 7519 JWT tokens within

bearer tokens, both as part of the aaa framework, and as a way to

generate tokens and pass them to backend servers and services.

[Graham Leggett]

*) mod_auth_bearer: New module to handle RFC 6750 Bearer tokens, using

the token_checker hook. [Graham Leggett]

*) mod_autht_core: New module to handle provider aliases for token

authentication. [Graham Leggett]

*) core: Add the token_checker hook, that allows authentication to take

place using mechanisms other than username/password, such as bearer

tokens. [Graham Leggett]

*) mod_alias: When an alias is declared inside a Location, make sure

the balance of the URL is preserved to match the alias declared

outside a location. Fixes an error where all requests are mapped

to the root of the location. [Graham Leggett]

*) core: Be explicit if an enclosing directive contains a path or a

regex. [Graham Leggett]

*) mod_http2: fixed a crash during connection termination. See PR 66539.

[Stefan Eissing]

*) mod_mime: Do not match the extention against possible query string

parameters in case ProxyPass was used with the nocanon option.

[Ruediger Pluem]

*) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not

double encode encoded slashes in the URL sent by the reverse proxy to the

backend. [Ruediger Pluem]

*) mod_rewrite: Add BCTLS flag similar to B, but only escaping the characters

checked by 2.4.56 in the query string. [Eric Covener]

*) mod_md:

- Enabling ED25519 support and certificate transparency information when

building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.

- MDChallengeDns01 can now be configured for individual domains.

Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.

- Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge

teardown not being invoked as it should.

[Stefan Eissing]

*) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make

sure that if the format is configured early enough it applies to every log

line. PR 62161. [Yann Ylavic]

*) mod_proxy: Check before forwarding that a nocanon path has not been

rewritten with spaces during processing. [Yann Ylavic]

*) mod_rewrite: Re-allow some proxy and redirect substitutions flagged as

403 errors in 2.4.56. [Eric Covener]

*) mod_rewrite: Fix a 2.4.56 regression for substitutions ending

in a question mark. [Eric Covener]

*) Add a SSL_SHARED_CIPHER environment variable with the list of

client/server permitted ciphers. [Dirk-Willem van Gulik]

*) mod_http2: field values (headers and trailers) are stripped of

leading/trailing whitespace (space +htab) before being processed

or send in a response. This is compatible behaviour to HTTP/1.1

parsers that strip incoming headers of such characters.

[Stefan Eissing]

*) build: Use 'command -v' instead of 'which' which is more portable.

PR 66130 [Sam James <sam@gentoo.org>]

*) mod_dav: Allow to disable lock discovery via an DAVLockDiscovery

expression (per-request). PR 66313. [Emmanuel Dreyfus <manu netbsd.org>]

*) mod_ssl: when a proxy connection had handled a request using SSL, an

error was logged when "SSLProxyEngine" was only configured in the

location/proxy section and not the overall server. The connection

continued to work, the error log was in error. Fixed PR66190.

[Stefan Eissing]

*) mod_proxy: Ignore (and warn about) enablereuse=on for ProxyPassMatch when

some dollar substitution (backreference) happens in the hostname or port

part of the URL. [Yann Ylavic]

*) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be

truncated without the initial logfile being truncated. [Eric Covener]

*) mod_md: a new directive `MDStoreLocks` can be used on cluster

setups with a shared file system for `MDStoreDir` to order

activation of renewed certificates when several cluster nodes are

restarted at the same time. Store locks are not enabled by default.

Restored curl_easy cleanup behaviour from v2.4.14 and refactored

the use of curl_multi for OCSP requests to work with that.

Fixes <https://github.com/icing/mod_md/issues/293>.

*) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number

of headers. [Ruediger Pluem]

*) mod_proxy_http2: apply the standard httpd content type handling

to responses from the backend, as other proxy modules do. Fixes PR 66391.

Thanks to Jérôme Billiras for providing the patch.

[Stefan Eissing]

*) mod_http2: fixed trailer handling. Empty response bodies

prevented trailers from being sent to a client. See

<https://github.com/icing/mod_h2/issues/233> for how

this affected gRPC use.

[Stefan Eissing]

*) mod_proxy_http2: use only the ':authority' header to forward 'Host'

information to a backend. Deduce ':authority' from what the client

sent when 'ProxyPreserveHost' is on.

[Stefan Eissing]

*) core: Improve the AH00124 error message about too many redirects by logging

the URI of the request. PR 66403 [Ruediger Pluem]

*) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.

[Yann Ylavic]

*) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum

amount of response body bytes put into a single HTTP/2 DATA frame.

Setting this to 0 places no limit (but the max size allowed by the

protocol is observed).

The module, by default, tries to use the maximum size possible, which is

somewhat around 16KB. This sets the maximum. When less response data is

available, smaller frames will be sent.

*) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors

reported in access logs and error documents. The processing of the

reset was correct, only unneccesary reporting was caused.

[Stefan Eissing]

*) mod_proxy: Fix double encoding of the uri-path of the request forwarded

to the origin server, when using mapping=encoded|servlet. [Yann Ylavic]

*) mod_dav: Open the lock database read-only when possible.

PR 36636 [Wilson Felipe <wfelipe gmail.com>, manu]

*) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to

allow connections of any age to be reused. Up to now, a negative value

was handled as an error when parsing the configuration file. PR 66421.

[nailyk <bzapache nailyk.fr>, Christophe Jaillet]

*) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.

[Alessandro Cavaliere <alessandro.cavalier7 unibo.it>]

*) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.

[Alessandro Cavaliere <alessandro.cavalier7 unibo.it>]

*) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests

using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]

*) mod_md: a bug was fixed that caused very large MDomains

with the combined DNS names exceeding ~7k to fail, as

request bodies would contain partially wrong data from

uninitialized memory. This would have appeared as failure

in signing-up/renewing such configurations.

[Stefan Eissing, Ronald Crane (Zippenhop LLC)]

*) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.

PR 65666. [Yann Ylavic]

*) mod_ssl: SSLFIPS compatible with OpenSSL 3.0. PR 66063.

[Petr Sumbera <petr.sumbera oracle.com>, Yann Ylavic]

*) core: the conf/mime.types has been updated in conformance with RFC 9239:

- .js moved from 'application/javascript' to 'text/javascript'

- .mjs was added as 'text/javascript'

[Mathias Bynens <@mathiasbynens> via PR 318]

*) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of

an ACME CA. This gives a failover for renewals when several consecutive attempts

to get a certificate failed.

A new directive was added: `MDRetryDelay` sets the delay of retries.

A new directive was added: `MDRetryFailover` sets the number of errored

attempts before an alternate CA is selected for certificate renewals.

[Stefan Eissing]

*) mod_heartmonitor: Set the documented default value

"10" for HeartbeatMaxServers instead of "0". With "0"

no shared memory slotmem was initialized. [Rainer Jung]

*) mod_md: fixed a bug leading to failed transfers for OCSP

stapling information when more than 6 certificates needed

updates in the same run. [Stefan Eissing]

*) mod_http2: use the new REQUEST buckets to forward request

on secondary connections. Use the now generic

ap_process_connection() in h2 workers to process those.

[Stefan Eissing]

*) Implement full auto status ("key: value" type status output).

Especially not only status summary counts for certificates and

OCSP stapling but also lists. Auto status format is similar to

what was used for mod_proxy_balancer.

[Rainer Jung]

*) core/mod_http: use REQUEST meta buckets and a new HTTP/1.x specific

input filter to separate the handling for HTTP requests from the

handling of HTTP/1.x request parsing and checks.

A new HTTP1_REQUEST_IN filter installs itself on http/1.1 connections

before a request is being read. It generates either a REQUEST meta

bucket on success or an ERROR bucket with the proposed response status.

The core connection processing, relying on ap_read_request(), now expects

a REQUEST or ERROR bucket from the input filters and is agnostic to

specific HTTP versions and how they bring requests into the server.

[Stefan Eissing]

*) mod_http2: remove unused and insecure code. Fixes PR66037.

Thanks to Ronald Crane (Zippenhop LLC) for reporting this.

[Stefan Eissing]

*) mod_md: added support for managing certificates via a

local tailscale demon for users of that secure networking.

This gives trusted certificates for tailscale assigned

domain names in the *.ts.net space.

[Stefan Eissing]

*) mod_md: a possible NULL pointer deref was fixed in

the JSON code for persisting time periods (start+end).

Fixes #282 on mod_md's github.

Thanks to @marcstern for finding this.

*) core: Avoid an overflow on large inputs in ap_is_matchexp. PR 66033

[Ruediger Pluem]

*) core/mod_http: use RESPONSE meta buckets and a new HTTP/1.x specific

filter to send responses through the output filter chain.

Specifically: the HTTP_HEADER output filter and ap_send_interim_response()

create a RESPONSE bucket and no longer are concerned with HTTP/1.x

serialization.

A new HTTP1_RESPONSE_OUT transcode filter writes the proper HTTP/1.x

bytes when dealing with a RESPONSE bucket. That filter installs itself

on the pre_read_request hook when the connection has protocol 'http/1.1'.

[Stefan Eissing]

*) MPM event: Restart children processes killed before idle maintenance.

PR 65769. [Yann Ylavic, Ruediger Pluem]

*) core: Disable TCP_NOPUSH optimization on OSX since it might introduce

transmission delays. PR 66019. [Yann Ylavic]

*) ab: Allow for TLSv1.3 when the SSL library supports it.

[abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]

*) ab: Add the -W option to use worker threads, allowing for multiple CPUs

to handle the load. [Yann Ylavic]

*) mod_substitute: Fix an integer overflow that can happen in very special

setups. PR 66034 [Ruediger Pluem]

*) core: make ap_escape_quotes() work correctly on strings

with more than MAX_INT/2 characters, counting quotes double.

Credit to <generalbugs@zippenhop.com> for finding this.

[Stefan Eissing]

*) core: adding a new hook and method to the API:

create_secondary_connection and ap_create_secondary_connection()

to setup connections related to a "master" one, as used in

the HTTP/2 protocol implementation.

*) mod_http2: using the new API calls to get rid of knowledge

about how the core handles conn_rec specifics.

Improvements in pollset stream handling to use less sets.

Using atomic read/writes instead of volatiles now.

Keeping a reserve of "transit" pools and bucket_allocs for

use on secondary connections to avoid repeated setup/teardowns.

*) mod_proxy: Set a status code of 502 in case the backend just closed the

connection in reply to our forwarded request. [Ruediger Pluem]

*) MPM event: Fix accounting of active/total processes on ungraceful restart,

PR 66004 (follow up to PR 65626 from 2.4.52). [Yann Ylavic]

*) mod_proxy: Add backend port to log messages to

ease identification of involved service. [Rainer Jung]

*) mod_systemd: Systemd socket activation can now be enabled at

build time but disabled at run time, if mod_systemd is not

loaded. [Lubos Uhliarik <luhliari redhat.com>]

*) ab: Add an optional ramp delay when starting concurrent connections so

as to not trigger denial of service protection in the network. Report

levels of concurrency achieved in cases where the test completes before

full concurrency is achieved. [Graham Leggett]

*) mod_http2: preserve the port number given in a HTTP/1.1

request that was Upgraded to HTTP/2. Fixes PR65881.

[Stefan Eissing]

*) mod_http2: :scheme pseudo-header values, not matching the

connection scheme, are forwarded via absolute uris to the

http protocol processing to preserve semantics of the request.

Checks on combinations of pseudo-headers values/absence

have been added as described in RFC 7540.

Fixes <https://github.com/icing/mod_h2/issues/230>.

[Stefan Eissing]

*) core/mpm: add hook 'child_stopped` that gets called when the MPM has

stopped all processing in a child process. This is when all running

threads shall be stopped and joined.

[Stefan Eissing]

*) core: Make sure and check that LimitXMLRequestBody fits in system memory.

[Ruediger Pluem, Yann Ylavic]

*) ab: Fix the detection for when the server performed a legitimate

connection close as per RFC7230 6.3.1. We must check whedther the

connection was previously kept alive, and not whether the current

closed request is keepalive. [Graham Leggett]

*) mod_rewrite: Make URI-to-filename rewrites work transparently with

proxy early mappings (mapping=servlet/decoded). [Yann Ylavic]

*) mod_md: do not interfere with requests to /.well-known/acme-challenge/

resources if challenge type 'http-01' is not configured for a domain.

Fixes <https://github.com/icing/mod_md/issues/279>.

[Stefan Eissing]

*) mod_proxy: Bump limit of proxy workers names to 384 characters. PR 53218

[Yann Ylavic]

*) core: Simpler connection close logic if discarding the request body fails.

[Yann Ylavic, Ruediger Pluem]

*) mod_proxy: Use the maxium of front end and backend timeouts instead of the

minimum when tunneling requests (websockets, CONNECT requests).

Backend timeouts can be configured more selectively (per worker if needed)

as front end timeouts and typically the backend timeouts reflect the

application requirements better. PR 65886 [Ruediger Pluem]

*) mod_watchdog: use the `child_stopping` and `child_stopped` hooks

to shutdown workers before pool destruction releases global

resources and libraries.

[Stefan Eissing]

*) ab: Respond appropriately to SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE.

Previously the correct event was polled for, but the response to the poll

would call write instead of read, and read instead of write. PR 55952

[Graham Leggett]

*) mod_md: the status description in MDomain's JSON, exposed in the

md-status handler (if configure) did sometimes not carry the correct

message when certificates needed renew.

[Stefan Eissing]

*) mod_tls: Fix a linkage issue with rustls when compiled

with rust 1.55, 1.56 or 1.57. This prevents the loading

of the module because of an undefined symbol: fmaf

See https://github.com/rustls/rustls-ffi/issues/133

[Christophe Jaillet]

*) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers

when an efficient TLS implementation is available. [Yann Ylavic]

*) mod_reqtimeout: Fix missing handshake= timeout enforcement. [Yann Ylavic]

*) mod_dav: Fix regression when gathering properties which could lead to huge

memory consumption proportional to the number of resources.

[Evgeny Kotkov, Ruediger Pluem]

*) mod_unixd: CoreDumpDirectory requires enabling tracing on FreeBSD 11+.

PR 65819. [David CARLIER <devnexen gmail.com>]

*) mpm_event: Fix a possible listener deadlock on heavy load when restarting

and/or reaching MaxConnectionsPerChild. PR 65769. [Yann Ylavic]

*) http: Enforce that fully qualified uri-paths not to be forward-proxied

have an http(s) scheme, and that the ones to be forward proxied have a

hostname, per HTTP specifications. [Ruediger Pluem, Yann Ylavic]

*) mod_http2: fixed a bug in v2.0.0 that could lead to an infinite

loop when clients close connections prematurely.

Enhanced the scoreboard status updates on h2 connections for

mod_status. 'server-status' now gives a better idea what the

connection is working on.

[Stefan Eissing]

*) mod_http: Correctly sent a 100 Continue status code when sending an interim

response as result of an Expect: 100-Continue in the request and not the

current status code of the request. PR 65725 [Ruediger Pluem]

*) mod_proxy_connect: Honor the smallest of the backend or client timeout

while tunneling. [Yann Ylavic]

*) mod_http2: a regression in v1.15.24 of the modules was fixed that

could lead to httpd child processes not being terminated on a

graceful reload or when reaching MaxConnectionsPerChild.

When unprocessed h2 requests were queued at the time, these could stall.

See <https://github.com/icing/mod_h2/issues/212>.

[@hansborr, @famzah, Stefan Eissing]

*) mod_proxy_uwsgi: Remove duplicate slashes at the beginning of PATH_INFO.

PR 65616. [Ruediger Pluem]

*) mod_md: Fix memory leak in case of failures to load the private key.

PR 65620 [ Filipe Casal <filipe.casal@trailofbits.com> ]

* mod_http2: the new pollset implementation is disabled when

compiling with an APR version less than 1.6.

*) mod_autoindex: Add "IndexForbiddenReturn404" to return 404 instead of a

403 when Options does not included "indexes". [Eric Covener]

*) mod_dir: Add "NotFound" option to "DirectorySlash" directive to return

404 instead of a DirectorySlash redirect. [Eric Covener]

*) mod_md: adding v2.4.8 with the following changes

- Added support for ACME External Account Binding (EAB).

Use the new directive `MDExternalAccountBinding` to provide the

server with the value for key identifier and hmac as provided by

your CA.

While working on some servers, EAB handling is not uniform

across CAs. First tests with a Sectigo Certificate Manager in

demo mode are successful. But ZeroSSL, for example, seems to

regard EAB values as a one-time-use-only thing, which makes them

fail if you create a seconde account or retry the creation of the

first account with the same EAB.

- The directive 'MDCertificateAuthority' now checks if its parameter

is a http/https url or one of a set of known names. Those are

'LetsEncrypt', 'LetsEncrypt-Test', 'Buypass' and 'Buypass-Test'

for now and they are not case-sensitive.

The default of LetsEncrypt is unchanged.

- `MDContactEmail` can now be specified inside a `<MDomain dnsname>`

section.

- Treating 401 HTTP status codes for orders like 403, since some ACME

servers seem to prefer that for accessing oders from other accounts.

- When retrieving certificate chains, try to read the repsonse even

if the HTTP Content-Type is unrecognized.

- Fixed a bug that reset the error counter of a certificate renewal

and prevented the increasing delays in further attempts.

- Fixed the renewal process giving up every time on an already existing

order with some invalid domains. Now, if such are seen in a previous

order, a new order is created for a clean start over again.

See <https://github.com/icing/mod_md/issues/268>

- Fixed a mixup in md-status handler when static certificate files

and renewal was configured at the same time.

*) mod_http2:

- Fixed an issue since 1.15.24 that "Server" headers in proxied requests

were overwritten instead of preserved. [PR by @daum3ns]

- Added directove 'H2StreamTimeout' to configure a separate value for HTTP/2

streams, overriding server's 'Timeout' configuration. [rpluem]

- HTTP/2 connections now use pollsets to monitor the status of the

ongoing streams and their main connection when host OS allows this.

- Removed work-arounds for older versions of libnghttp2 and checking

during configure that at least version 1.15.0 is present.

- The HTTP/2 connection state handler, based on an experiment and draft

at the IETF http working group (abandoned for some time), has been removed.

- H2SerializeHeaders no longer has an effect. A warning is logged when it is

set to "on". The switch enabled the internal writing of requests to be parsed

by the internal HTTP/1.1 protocol handler and was introduced to avoid

potential incompatibilities during the introduction of HTTP/2.

- Removed the abort/redo of tasks when mood swings lower the active limit.

[Ruediger Pluem, daum3ns, Stefan Eissing]

*) core: Be safe with ap_lingering_close() called with a socket NULL-ed by

a third-party module. PR 65627.

[acmondor <bz.apache.org acmondor.ca>, Yann Ylavic]

*) mpm_event: Restart stopping of idle children after a load peak. PR 65626.

[Yann Ylavic, Ruediger Pluem]

*) mod_proxy: SetEnv proxy-nohalfclose (or alike) allows to disable TCP

half-close forwarding when tunneling protocols. [Yann Ylavic]

*) mod_tls: added mod_tls from abetterinternet, donated

by ISRG/Prossimo <https://github.com/abetterinternet/mod_tls>.

- adds font-/backend TLS (v1.2/v1.3) via the Rust rustls crate

and its rustls-ffi C binding <https://github.com/rustls/rustls-ffi>.

- documentation at <https://github.com/abetterinternet/mod_tls>

(adding to Apache's manual TBD)

- build support for Apache httpd configure on *nix platforms,

rustls is linked statically into mod_tls.

*) mod_md: values for External Account Binding (EAB) can

now also be configured to be read from a separate JSON

file. This allows to keep server configuration permissions

world readable without exposing secrets.

[Stefan Eissing]

*) core: Add ap_unescape_url_ex() for better decoding control, and deprecate

unused AP_NORMALIZE_DROP_PARAMETERS flag.

[Yann Ylavic, Ruediger Pluem, Stefan Eissing, Joe Orton]

*) core: AP_NORMALIZE_DECODE_UNRESERVED should normalize the second dot in

the uri-path when it's preceded by a dot. [Yann Ylavic]

*) mod_proxy: New tunnel_forward hooking mechanism allowing modules to handle

Upgrade(d) protocols data. [Yann Ylavic]

*) mod_dav: Correctly handle errors returned by dav providers on REPORT

requests. [Ruediger Pluem]

*) mod_rewrite: Fix UDS ("unix:") scheme for [P] rules. PR 57691 + 65590.

[Janne Peltonen <janne.peltonen sange.fi>]

*) mod_proxy: Handle UDS URIs with empty hostname ("unix:///...") as if they

had no hostname ("unix:/..."). [Yann Ylavic]

*) event mpm: Correctly count active child processes in parent process if

child process dies due to MaxConnectionsPerChild.

PR 65592 [Ruediger Pluem]

*) core: Add ap_pre_connection() as a wrapper to ap_run_pre_connection()

and use it to prevent that failures in running the pre_connection

hook cause crashes afterwards. [Ruediger Pluem]

*) mod_md: fixed a bug in handling multiple parallel OCSP requests. These could

run into an assertion which terminated (and restarted) the child process where

the task was running. Eventually, all OCSP responses were collected, but not

in the way that things are supposed to work.

See also <https://bz.apache.org/bugzilla/show_bug.cgi?id=65567>.

The bug was possibly triggered when more than one OCSP status needed updating

at the same time. For example for several renewed certificates after a server

reload.

*) mod_md: when MDMessageCmd for a 'challenge-setup:<type>:<dnsname>'

fails (!= 0 exit), the renewal process is aborted and an error is

reported for the MDomain. This provides scripts that distribute

information in a cluster to abort early with bothering an ACME

server to validate a dns name that will not work. The common

retry logic will make another attempt in the future, as with

other failures.

Fixed a bug when adding private key specs to an already working

MDomain, see <https://github.com/icing/mod_md/issues/260>.

[Stefan Eissing]

*) core: Add ap_create_connection() to create either a server or client/proxy

connection.

*) mod_http2: when a server is restarted gracefully, any idle h2 worker

threads are shut down immediately. [Stefan Eissing]

*) core: Initialize the request fields on read failure to avoid NULLs.

[Yann Ylavic]

*) mod_proxy: Do not canonicalize the proxied URL when both "nocanon" and

"ProxyPassInterpolateEnv On" are configured. PR 65549.

[Joel Self <joelself gmail.com>]

*) mpm_event: Fix children processes possibly not stopped on graceful

restart. PR 63169. [Joel Self <joelself gmail.com>]

*) mod_unique_id: Reduce the time window where duplicates may be generated

PR 65159

[Christophe Jaillet]

*) Revert "mod_unique_id: Fix potential duplicated ID generation under heavy load.

PR 65159" added in 2.4.47.

This causes issue on Windows.

[Christophe Jaillet]

*) mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker. [Yann Ylavic]

*) mod_md: Certificate/keys pairs are verified as matching before a renewal is accepted

as successful or a staged renewal is replacing the existing certificates.

This avoid potential mess ups in the md store file system to render the active

certificates non-working. [@mkauf]

*) mod_proxy: Fix a potential infinite loop when tunneling Upgrade(d)

protocols from mod_proxy_http, and a timeout triggering falsely when

using mod_proxy_wstunnel, mod_proxy_connect or mod_proxy_http with

upgrade= setting. PRs 65521 and 65519. [Yann Ylavic]

*) mod_proxy: Faster unix socket path parsing in the "proxy:" URL.

[Yann Ylavic]

*) mpm_event: Fix graceful stop/restart of children processes if connections

are in lingering close for too long. [Yann Ylavic]

*) mod_md: fixed a potential null pointer dereference if ACME/OCSP

server returned 2xx responses without content type. Reported by chuangwen.

[chuangwen, Stefan Eissing]

* core/mpm: add hook 'child_stopping` that gets called when the MPM is

stopping a child process. The additional `graceful` parameter allows

registered hooks to free resources early during a graceful shutdown.

[Yann Ylavic, Stefan Eissing]

*) mod_proxy: Fix icomplete initialization of BalancerMember(s) from the

balancer-manager, which can lead to a crash. [Yann Ylavic]

*) mod_http2:

- Aborting requests via RST_STREAM no longer affect the available

resources of a connection when the first chunk of the response

body has been sent.

- H2Min/MaxWorkers behave as intended again. The module will initially

create H2MinWorkers threads and add up to H2MaxWorkers when needed. These

additional workers time out when idle after H2MaxWorkerIdleSeconds and

disappear again.

- Added a timeout to h2 worker cleanup to exit latest after 5 seconds of

waiting on idle workers to terminate. This happens after all connections

have been processed. a WARNING is logged in case workers lagged behind.

- When the shutdown of a child is detected (e.g. graceful shutdown), the

module will terminate all idle workers above H2MinWorkers right away.

This detection currently only happens when a HTTP/2 connection is active.

[Stefan Eissing]

*) mod_md:

- Domain names in `<MDomain ...>` can now appear in quoted form.

- Fixed a failure in ACME challenge selection that aborted further searches

when the tls-alpn-01 method did not seem to be suitable.

- Changed the tls-alpn-01 setup to only become unsuitable when none of the

dns names showed support for a configured 'Protocols ... acme-tls/1'. This

allows use of tls-alpn-01 for dns names that are not mapped to a VirtualHost.

[Stefan Eissing]

*) core/mod_proxy/mod_ssl:

Adding `outgoing` flag to conn_rec, indicating a connection is

initiated by the server to somewhere, in contrast to incoming

connections from clients.

Adding 'ap_ssl_bind_outgoing()` function that marks a connection

as outgoing and is used by mod_proxy instead of the previous

optional function `ssl_engine_set`. This enables other SSL

module to secure proxy connections.

The optional functions `ssl_engine_set`, `ssl_engine_disable` and

`ssl_proxy_enable` are now provided by the core to have backward

compatibility with non-httpd modules that might use them. mod_ssl

itself no longer registers these functions, but keeps them in its

header for backward compatibility.

The core provided optional function wrap any registered function

like it was done for `ssl_is_ssl`.

[Stefan Eissing]

*) mod_h2: Don't strip headers from 304 responses. [Yann Ylavic]

*) mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match worker instances

with others when their URLs contain a '$' substitution. PR 65419.

[Yann Ylavic]

*) mpm_prefork: Block signals for child_init hooks to prevent potential

threads created from there to catch MPM's signals.

[Ruediger Pluem, Yann Ylavic]

*) mod_ssl: tighten the handling of ALPN for outgoing (proxy)

connections. If ALPN protocols are provided and sent to the

remote server, the received protocol selected is inspected

and checked for a match. Without match, the peer handshake

fails.

An exception is the proposal of "http/1.1" where it is

accepted if the remote server did not answer ALPN with

a selected protocol. This accomodates for hosts that do

not observe/support ALPN and speak http/1.x be default.

* mod_log_config/mod_ssl: moved the log_handlers registered by mod_ssl

into mod_log_config itself. These now use the global `ap_ssl_var_lookup()`

functions and work for all running SSL modules.

The dependency from mod_ssl to mod_log_config and its header is removed.

mod_ssl now provides the content of "{errstr}c" as variable "SSL_CLIENT_VERIFY_ERRSTR".

This change should be fully compatible to all deployed configurations.

[Stefan Eissing]

*) dbm: Split the loading of a dbm driver from the opening of a dbm file. When

an attempt to load a dbm driver fails, log clearly which driver triggered

the error (not "default"), and what the error was. [Graham Leggett]

*) core: Fix a regression that stripped the ETag header from 304 responses.

PR 61820 [Ruediger Pluem, Roy T. Fielding]

*) core/mod_ssl/mod_md: adding OCSP response provisioning as core feature. This

allows modules to access and provide OCSP response data without being tied

of each other. The data is exchanged in standard, portable formats (PEM encoded

certificates and DER encoded responses), so that the actual SSL/crypto

implementations used by the modules are independant of each other.

Registration and retrieval happen in the context of a server (server_rec)

which modules may use to decide if they are configured for this or not.

The area of changes:

1. core: defines 2 functions in include/http_ssl.h, so that modules may

register a certificate, together with its issuer certificate for OCSP

response provisioning and ask for current response data (DER bytes) later.

Also, 2 hooks are defined that allow modules to implement this OCSP

provisioning.

2. mod_ssl uses the new functions, in addition to what it did already, to

register its certificates this way. If no one is interested in providing

OCSP, it falls back to its own (if configured) stapling implementation.

3. mod_md registers itself at the core hooks for OCSP provisioning. Depending

on configuration, it will accept registrations of its own certificates only,

all certificates or none.

[Stefan Eissing]

*) mod_proxy_wstunnel: Add ProxyWebsocketFallbackToProxyHttp to opt-out the

fallback to mod_proxy_http for WebSocket upgrade and tunneling.

[Yann Ylavic]

*) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic]

*) mod_lua: Add support to Lua 5.4 [Joe Orton, Giovanni Bechis, Ruediger Pluem]

*) mod_md: Tolerate a missing "revokeCert" or "keyChange" resource.

[Fraser Tweedale <ftweedal redhat.com>]