- updated to 2.4.37
* mod_ssl: Fix HTTP/2 failures when using OpenSSL 1.1.1. [Rainer Jung]
* mod_ssl: Fix crash during SSL renegotiation with OptRenegotiate set,
when client certificates are available from the original handshake
but were originally not verified and should get verified now.
This is a regression in 2.4.36 (unreleased). [Ruediger Pluem]
* mod_ssl: Correctly merge configurations that have client certificates set
by SSLProxyMachineCertificate{File|Path}. [Ruediger Pluem]
- updated to 2.4.36
* mod_brotli, mod_deflate: Restore the separate handling of 304 Not Modified
responses. Regression introduced in 2.4.35.
* mod_proxy_scgi, mod_proxy_uwsgi: improve error handling when sending the
body of the response. [Jim Jagielski]
* mod_http2: adding defensive code for stream EOS handling, in case the request handler
missed to signal it the normal way (eos buckets). Addresses github issues
https://github.com/icing/mod_h2/issues/164, https://github.com/icing/mod_h2/issues/167
and https://github.com/icing/mod_h2/issues/170. [Stefan Eissing]
* ab: Add client certificate support. [Graham Leggett]
* ab: Disable printing temp key for OpenSSL before
version 1.0.2. SSL_get_server_tmp_key is not available
there. [Rainer Jung]
* mod_ssl: Fix a regression that the configuration settings for verify mode
and verify depth were taken from the frontend connection in case of
connections by the proxy to the backend. PR 62769. [Ruediger Pluem]
* MPMs: Initialize all runtime/asynchronous objects on a dedicated pool and
before signals handling to avoid lifetime issues on restart or shutdown.
PR 62658. [Yann Ylavic]
* mod_ssl: Add support for OpenSSL 1.1.1 and TLSv1.3. TLSv1.3 has
behavioural changes compared to v1.2 and earlier; client and
configuration changes should be expected. SSLCipherSuite is
enhanced for TLSv1.3 ciphers, but applies at vhost level only.
[Stefan Eissing, Yann Ylavic, Ruediger Pluem, Joe Orton]
* mod_auth_basic: Be less tolerant when parsing the credencial. Only spaces
should be accepted after the authorization scheme. \t are also tolerated.
[Christophe Jaillet]
* mod_proxy_hcheck: Fix issues with interval determination. PR 62318
[Jim Jagielski]
* mod_proxy_hcheck: Fix issues with TCP health checks. PR 61499
[Dominik Stillhard <dominik.stillhard united-security-providers.ch>]
* mod_proxy_hcheck: take balancer's SSLProxy* directives into account.
[Jim Jagielski]
* mod_status, mod_echo: Fix the display of client addresses.
They were truncated to 31 characters which is not enough for IPv6 addresses.
This is done by deprecating the use of the 'client' field and using
the new 'client64' field in worker_score.
PR 54848 [Bernhard Schmidt <berni birkenwald de>, Jim Jagielski]
OBS-URL: https://build.opensuse.org/request/show/643030
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=571
- simplify find_mpm function from script-helpers
- /usr/sbin/httpd is now created depending on preference hardcoded
in find_mpm (script-helpers), not depending on alphabetical
order of MPMs
- simplify spec file a bit
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=569
*) Introduce zh-cn and zh-tw (simplified and traditional Chinese) error
document translations. [CodeingBoy, popcorner]
*) event: avoid possible race conditions with modules on the child pool.
[Stefan Fritsch]
*) mod_proxy: Fix a corner case where the ProxyPassReverseCookieDomain or
ProxyPassReverseCookiePath directive could fail to update correctly
'domain=' or 'path=' in the 'Set-Cookie' header. PR 61560.
[Christophe Jaillet]
*) mod_ratelimit: fix behavior when proxing content. PR 62362.
[Luca Toscano, Yann Ylavic]
*) core: Re-allow '_' (underscore) in hostnames.
[Eric Covener]
*) mod_authz_core: If several parameters are used in a AuthzProviderAlias
directive, if these parameters are not enclosed in quotation mark, only
the first one is handled. The other ones are silently ignored.
Add a message to warn about such a spurious configuration.
PR 62469 [Hank Ibell <hwibell gmail.com>, Christophe Jaillet]
*) mod_md: improvements and bugfixes
- MDNotifyCmd now takes additional parameter that are passed on to the called command.
- ACME challenges have better checks for interference with other modules
- ACME challenges are only handled for domains managed by the module, allowing
other ACME clients to operate for other domains in the server.
- better libressl integration
*) mod_proxy_wstunnel: Add default schema ports for 'ws' and 'wss'.
PR 62480. [Lubos Uhliarik <luhliari redhat.com>}
*) logging: Some early logging-related startup messages could be lost
when using syslog for the global ErrorLog. [Eric Covener]
*) mod_cache: Handle case of an invalid Expires header value RFC compliant
like the case of an Expires time in the past: allow to overwrite the
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=562
*) core: Fix request timeout logging and possible crash for error_log hooks.
[Yann Ylavic]
*) mod_slomem_shm: Fix failure to create balancers's slotmems in Windows MPM,
where children processes need to attach them instead since they are owned
by the parent process already. [Yann Ylavic]
*) ab: try all destination socket addresses returned by
apr_sockaddr_info_get instead of failing on first one when not available.
Needed for instance if localhost resolves to both ::1 and 127.0.0.1
e.g. if both are in /etc/hosts. [Jan Kaluza]
*) ab: Use only one connection to determine working destination socket
address. [Jan Kaluza]
*) ab: LibreSSL doesn't have or require Windows applink.c. [Gregg L. Smith]
*) htpasswd/htdigest: Disable support for bcrypt on EBCDIC platforms.
apr-util's bcrypt implementation doesn't tolerate EBCDIC. [Eric Covener]
*) htpasswd/htdbm: report the right limit when get_password() overflows.
[Yann Ylavic]
*) htpasswd: Don't fail in -v mode if password file is unwritable.
PR 61631. [Joe Orton]
*) htpasswd: don't point to (unused) stack memory on output
to make static analysers happy. PR 60634.
[Yann Ylavic, reported by shqking and Zhenwei Zou]
*) mod_access_compat: Fail if a comment is found in an Allow or Deny
directive. [Jan Kaluza]
*) mod_authz_host: Ignore comments after "Require host", logging a
warning, or logging an error if the line is otherwise empty.
[Jan Kaluza, Joe Orton]
*) rotatelogs: Fix expansion of %Z in localtime (-l) mode, and fix
Y2K38 bug. [Joe Orton]
*) mod_ssl: Support SSL DN raw variable extraction without conversion
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=555
*) mod_unique_id: Use output of the PRNG rather than IP address and
pid, avoiding sleep() call and possible DNS issues at startup,
plus improving randomness for IPv6-only hosts. [Jan Kaluza]
*) mod_rewrite, core: Avoid the 'Vary: Host' response header when HTTP_HOST
is used in a condition that evaluates to true. PR 58231 [Luca Toscano]
*) mod_http2: v0.10.12, removed optimization for mutex handling in bucket
beams that could lead to assertion failure in edge cases.
[Stefan Eissing]
*) mod_proxy: Fix regression for non decimal loadfactor parameter introduced
in 2.4.28. [Jim Jagielski]
*) mod_authz_dbd: fix a segmentation fault if AuthzDBDQuery is not set.
PR 61546. [Lubos Uhliarik <luhliari redhat.com>]
*) mod_rewrite: Add support for starting External Rewriting Programs
as non-root user on UNIX systems by specifying username and group
name as third argument of RewriteMap directive. [Jan Kaluza]
*) core: Rewrite the Content-Length filter to avoid excessive memory
consumption. Chunked responses will be generated in more cases
than in previous releases. PR 61222. [Joe Orton, Ruediger Pluem]
*) mod_ssl: Fix SessionTicket callback return value, which does seem to
matter with OpenSSL 1.1. [Yann Ylavic]
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=530
* set also SAN [bsc#1045159]
* drop -C argument, it was not mapped to CN actually
* consider also case when hostname does return empty string or
does not exist [bsc#1057406]
* do not consider environment ROOT variable
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=529
*) SECURITY: CVE-2017-9798 (cve.mitre.org)
Corrupted or freed memory access. <Limit[Except]> must now be used in the
main configuration file (httpd.conf) to register HTTP methods before the
.htaccess files. [Yann Ylavic]
*) event: Avoid possible blocking in the listener thread when shutting down
connections. PR 60956. [Yann Ylavic]
*) mod_speling: Don't embed referer data in a link in error page.
PR 38923 [Nick Kew]
*) htdigest: prevent a buffer overflow when a string exceeds the allowed max
length in a password file.
[Luca Toscano, Hanno Böck <hanno hboeck de>]
*) mod_proxy: loadfactor parameter can now be a decimal number (eg: 1.25).
[Jim Jagielski]
*) mod_proxy_wstunnel: Allow upgrade to any protocol dynamically.
PR 61142.
*) mod_watchdog/mod_proxy_hcheck: Time intervals can now be spefified
down to the millisecond. Supports 'mi' (minute), 'ms' (millisecond),
's' (second) and 'hr' (hour!) time suffixes. [Jim Jagielski]
*) mod_http2: Fix for stalling when more than 32KB are written to a
suspended stream. [Stefan Eissing]
*) build: allow configuration without APR sources. [Jacob Champion]
*) mod_ssl, ab: Fix compatibility with LibreSSL. PR 61184.
[Bernard Spil <brnrd freebsd.org>, Michael Schlenker <msc contact.de>,
Yann Ylavic]
*) core/log: Support use of optional "tag" in syslog entries.
PR 60525. [Ben Rubson <ben.rubson gmail.com>, Jim Jagielski]
*) mod_proxy: Fix ProxyAddHeaders merging. [Joe Orton]
*) core: Disallow multiple Listen on the same IP:port when listener buckets
are configured (ListenCoresBucketsRatio > 0), consistently with the single
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=527
*) COMPATIBILITY: mod_lua: Remove the undocumented exported 'apr_table'
global variable when using Lua 5.2 or later. This was exported as a
side effect from luaL_register, which is no longer supported as of
Lua 5.2 which deprecates pollution of the global namespace.
[Rainer Jung]
*) COMPATIBILITY: mod_http2: Disable and give warning when using Prefork.
The server will continue to run, but HTTP/2 will no longer be negotiated.
[Stefan Eissing]
*) COMPATIBILITY: mod_proxy_fcgi: Revert to 2.4.20 FCGI behavior for the
default ProxyFCGIBackendType, fixing a regression with PHP-FPM. PR 61202.
[Jacob Champion, Jim Jagielski]
*) mod_lua: Improve compatibility with Lua 5.1, 5.2 and 5.3.
PR58188, PR60831, PR61245. [Rainer Jung]
*) mod_http2: Simplify ready queue, less memory and better performance. Update
mod_http2 version to 1.10.7. [Stefan Eissing]
*) Allow single-char field names inadvertantly disallowed in 2.4.25.
PR 61220. [Yann Ylavic]
*) htpasswd / htdigest: Do not apply the strict permissions of the temporary
passwd file to a possibly existing passwd file. PR 61240. [Ruediger Pluem]
*) core: Avoid duplicate HEAD in Allow header.
This is a regression in 2.4.24 (unreleased), 2.4.25 and 2.4.26.
PR 61207. [Christophe Jaillet]
- drop upstreamed patch:
* httpd-2.4.12-lua-5.2.patch (see upstream's PR#58188 for details)
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=518
