CHANGES revision 8c94893229334f5b79636e4ec53a992a0b9f9828
5cd4555ad444fd391002ae32450572054369fd42Rob Austein -*- coding: utf-8 -*-
5cd4555ad444fd391002ae32450572054369fd42Rob AusteinChanges with Apache 2.5.0
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington *) SECURITY: CVE-2015-0228 (cve.mitre.org)
f428e385a4f7a42196b53de8e134909e8c488258Automatic Updater mod_lua: A maliciously crafted websockets PING after a script
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews calls r:wsupgrade() can cause a child process crash.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington [Edward Lu <Chaosed0 gmail.com>]
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington *) mod_proxy_connect/wstunnel: If both client and backend sides get readable
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington at the same time, don't lose errors occuring while forwarding on the first
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington side when none occurs next on the other side, and abort. [Yann Ylavic]
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews *) mod_lua: After a r:wsupgrade(), mod_lua was not properly
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews responding to a websockets PING but instead invoking the specified
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews script. PR57524. [Edward Lu <Chaosed0 gmail.com>]
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews *) mod_macro: Clear macros before initialization to avoid use-after-free
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews on startup or restart when the module is linked statically. PR 57525
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington [apache.org tech.futurequest.net, Yann Ylavic]
f428e385a4f7a42196b53de8e134909e8c488258Automatic Updater *) mod_proxy_http: Don't establish or reuse a backend connection before pre-
b5ad6dfea4cc3e7d1d322ac99f1e5a31096837c4Mark Andrews fetching the request body, so to minimize the delay between it is supposed
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to be alive and the first bytes sent: this is a best effort to prevent the
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington backend from closing because of idle or keepalive timeout in the meantime.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Also, handle a new "proxy-flushall" environment variable which allows to
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington flush any forwarded body data immediately. PR 56541+37920. [Yann Ylavic]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: Define and UnDefine are no longer permitted in
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington directory context. Previously they would always be evaulated
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington as the configuration was read without regard for the directory
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington context. [Eric Covener]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) config: For directives that do not expect any arguments, enforce
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington that none are specified in the configuration file.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Joachim Zobel <jzobel heute-morgen.de>, Eric Covener]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_ssl: 'SSLProtocol ALL' was being ignored in virtual host context.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein PR 57100. [Michael Kaufmann <apache-bugzilla michael-kaufmann.ch>,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Yann Ylavic]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_alias: Introduce expression parser support for Alias, ScriptAlias
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews and Redirect. [Graham Leggett]
dde8659175c5798267fb0fdefd7576e4efe271b3Automatic Updater *) mod_rewrite: Improve 'bad flag delimeters' startup error by showing
f428e385a4f7a42196b53de8e134909e8c488258Automatic Updater how the input was tokenized. PR 56528. [Edward Lu <Chaosed0 gmail.com>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_ssl: Add support for extracting subjectAltName entries of type
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein rfc822Name and dNSName into SSL_{CLIENT,SERVER}_SAN_{Email,DNS}_n
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein environment variables. Also addresses PR 57207. [Kaspar Brand]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy: Don't put non balancer-member workers in error state by
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein default for connection or 500/503 errors, and honor status=+I for
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews any error. PR 48388. [Yann Ylavic]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_socache_memcache: Pass expiration time through to memcached. PR 55445.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [Faidon Liambotis <paravoid debian.org>, Joe Orton]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) split-logfile: Fix perl error: 'Can't use string ("example.org:80")
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington as a symbol ref while "strict refs"'. PR 56329.
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt [Holger Mauermann <mauermann gmail.com>]
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt *) mod_proxy_fcgi: Enable opt-in to TCP connection reuse by explicitly
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt setting proxy option disablereuse=off. [Eric Covener] PR 57378.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_http: Fix incorrect If-Match handling. PR 57358.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Kunihiko Sakamoto <ksakamoto google.com>]
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont *) mod_ssl: Fix renegotiation failures redirected to an ErrorDocument.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington PR 57334. [Yann Ylavic].
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt *) core: Fix -D[efined] or <Define>[d] variables lifetime accross restarts.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington PR 57328. [Armin Abfalterer <a.abfalterer gmail.com>, Yann Ylavic].
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt *) mod_proxy_ajp: Fix client connection errors handling and logged status
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews when it occurs. PR 56823. [Yann Ylavic]
cc3aafe737334d444781f8a34ffaf459e075bb9aMark Andrews *) ap_expr: Add filemod function for checking file modification dates
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Daniel Gruno]
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews *) core: Add CGIPassAuth directive to control whether HTTP authorization
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt headers are passed to scripts as CGI variables. PR 56855. [Jeff
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_rewrite: Improve relative substitutions in per-directory/htaccess
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington context for directories found by mod_userdir and mod_alias. These no
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington longer require RewriteBase to be specified. [Eric Covener]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_authnz_ldap: Resolve crashes with LDAP authz and non-LDAP authn since
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington r1608202. [Eric Covener]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: Support custom ErrorDocuments for HTTP 501 and 414 status codes.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington PR 57167 [Edward Lu <Chaosed0 gmail.com>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy_connect: Don't issue AH02447 on sockets hangups, let the read
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein determine whether it is a normal close or a real error. PR 57168. [Yann
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_buffer: Forward flushed input data immediatly and avoid (unlikely)
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington access to freed memory. [Yann Ylavic, Christophe Jaillet]
41eeb37b516d1bac073781b6ec50a39a669987dfEvan Hunt *) mod_proxy: Use the correct server name for SNI in case the backend
41eeb37b516d1bac073781b6ec50a39a669987dfEvan Hunt SSL connection itself is established via a proxy server.
41eeb37b516d1bac073781b6ec50a39a669987dfEvan Hunt PR 57139 [Szabolcs Gyurko <szabolcs gyurko.org>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: Ensure that httpd exits with an error status when the MPM fails
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to run. [Yann Ylavic]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) apreq: Content-Length header should be always interpreted as a decimal.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Leading 0 could be erroneously considered as an octal value. PR 56598.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Chris Card <ctcard hotmail com>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_proxy: Now allow for 191 character worker names, with non-fatal
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein errors if name is truncated. PR53218. [Jim Jagielski]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_ssl: Add optional function "ssl_get_tls_cb" to allow support
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt for channel bindings. [Simo Sorce <simo redhat.com>]
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt *) mod_proxy_wstunnel: Concurrent websockets messages could be
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt lost or delayed with ProxyWebsocketAsync enabled.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Edward Lu <Chaosed0 gmail.com>]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) core, mod_info: Add compiled and loaded PCRE versions to version
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt number display. [Rainer Jung]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mpm_winnt: Accept utf-8 (Unicode) service names and descriptions for
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt internationalization. [William Rowe]
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt *) mpm_winnt: Normalize the error and status messages emitted by service.c,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the service control interface for Windows. [William Rowe]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_authnz_ldap: Return LDAP connections to the pool before the handler
6098d364b690cb9dabf96e9664c4689c8559bd2eMark Andrews is run, instead of waiting until the end of the request. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_ldap: Be more conservative with the last-used time for
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein LDAPConnectionPoolTTL. PR54587 [Eric Covener]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_deflate: Don't fail when flushing inflated data to the user-agent
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein and that coincides with the end of stream ("Zlib error flushing inflate
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein buffer"). PR 56196. [Christoph Fausak <christoph fausak glueckkanja.com>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_proxy: Don't limit the size of the connectable Unix Domain Socket
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington paths. [Christophe Jaillet, Yann Ylavic]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_ssl: dump SSL IO/state for the write side of the connection(s),
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein like reads (level TRACE4). [Yann Ylavic]
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt *) mod_proxy: Shutdown (eg. close notify) the backend connection before
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt closing. [Yann Ylavic]
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt *) mpm_event[opt]: Send the SSL close notify alert when the KeepAliveTimeout
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein expires. PR54998. [Yann Ylavic]
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt *) mod_ssl: Ensure that the SSL close notify alert is flushed to the client.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt PR54998. [Tim Kosse <tim.kosse filezilla-project.org>, Yann Ylavic]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_log_config: Add GlobalLog to allow a globally defined log to
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt be inherited by virtual hosts that define a CustomLog.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Edward Lu <Chaosed0 gmail.com>]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) MPMs: Support SO_REUSEPORT to create multiple duplicated listener
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt records for scalability. [Yingqi Lu <yingqi.lu@intel.com>,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Jeff Trawick, Jim Jagielski]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_proxy_html: support automatic detection of doctype and processing
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington of FPIs. PR56285 [Micha Lenk <micha lenk info>, Nick Kew]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy_html: skip documents shorter than 4 bytes
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein PR 56286 [Micha Lenk <micha lenk info>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy_fdpass: Fix computation of the size of 'struct sockaddr_un'
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein when passed to 'connect()'.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [Graham Dumpleton <grahamd apache org>]
bf45f72ed319628eebce60c368177320943d001fMark Andrews *) core: Add ap_mpm_resume_suspended() API to allow a suspended connection
bf45f72ed319628eebce60c368177320943d001fMark Andrews to resume. PR56333
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [Artem <artemciy gmail.com>, Edward Lu <Chaosed0 gmail.com>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: Add ap_mpm_register_socket_callback_timeout() API. [Eric Covener]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_proxy_wstunnel: Honor ProxyWebsocketIdleTimeout in asynchronous
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt processing mode. [Eric Covener]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_authnz_ldap: Fail explicitly when the filter is too long. Remove
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt unnecessary apr_pstrdup() and strlen(). [Graham Leggett]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) Add the ldap-search option to mod_authnz_ldap, allowing authorization
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt to be based on arbitrary expressions that do not include the username.
cc6cddfd94e8f0c58c290317b0853dac30b1b895Evan Hunt [Graham Leggett]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) Add the ldap function to the expression API, allowing LDAP filters and
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt distinguished names based on expressions to be escaped correctly to
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt guard against LDAP injection. [Graham Leggett]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) Add module mod_ssl_ct, which provides an implementation of Certificate
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Transparency (RFC 6962) for httpd. [Jeff Trawick]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_proxy: Preserve original request headers even if they differ
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt from the ones to be forwarded to the backend. PR 45387.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Yann Ylavic]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_remoteip: Prevent an external proxy from presenting an internal
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt proxy. PR 55962. [Mike Rumph]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_ssl: Add hooks to allow other modules to perform processing at
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt several stages of initialization and connection handling. See
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_proxy_wstunnel: Avoid sending error responses down an upgraded
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington websockets connection as it is being close down. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy_wstunnel: Allow the administrator to cap the amount
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein of time a synchronous websockets connection stays idle with
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein ProxyWebsocketIdleTimeout. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy_wstunnel: Change to opt-in for asynchronous support, adding
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington directives ProxyWebsocketAsync and ProxyWebsocketAsyncDelay.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Eric Covener]
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont *) mod_proxy_wstunnel: Stop leaking websockets backend connections under
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont event MPM (trunk-only). [Eric Covener]
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont *) mod_proxy_http: Add detach_backend hook (potentially usable
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont in other proxy scheme handlers). [Jeff Trawick]
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont *) mod_deflate: Add DeflateAlterETag to control how the ETag
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont is modified. The 'NoChange' parameter mimics 2.2.x behavior.
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont PR 45023, PR 39727. [Eric Covener]
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont *) mod_rewrite: Add 'BNF' (backreferences-no-plus) flag to RewriteRule to
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington allow spaces in backreferences to be encoded as %20 instead of '+'.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_rewrite: Support an optional list of characters to escape in the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein argument for the 'B' (escape backreferences) flag. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_dir: Default to 2.2-like behavior and skip execution when method is
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington neither GET nor POST, such as for DAV requests. PR 54914. [Chris Darroch]
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews *) mod_rewrite: Rename the handler that does per-directory internal
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews redirects to "rewrite-redirect-handler" from "redirect-handler" so
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein it is less ambiguous and less likely to be reused. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_rewrite: Protect against looping with the [N] flag by enforcing a
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt default limit of 10000 iterations, and allowing each rule to change its
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein limit. [Eric Covener]
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews *) mod_ssl: Fix config merging of SSLOCSPEnable and SSLOCSPOverrideResponder.
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews [Jeff Trawick]
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt *) Add HttpContentLengthHeadZero and HttpExpectStrict directives.
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt [Yehuda Sadeh <yehuda inktank com>, Justin Erenkrantz]
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt *) mod_ssl: Add -t -DDUMP_CA_CERTS option which dumps the filenames of all
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt configured SSL CA certificates to stdout the same way as DUMP_CERTS does.
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt [Jan Kaluza]
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt *) mod_ssl: Don't flush when an EOS is received. Prepares mod_ssl
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt to support write completion. [Graham Leggett]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: Add parse_errorlog_arg callback to ap_errorlog_provider
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein to allow providers to check the ErrorLog argument. [Jan Kaluza]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_cgid: Use the servers Timeout for each read from a CGI script,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein allow override with new CGIDRequestTimeout directive. PR43494
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [Eric Covener, Toshikuni Fukaya <toshikuni-fukaya cybozu co jp>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) core: ensure any abnormal exit is reported to stderr if it's a tty.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein PR 55670 [Nick Kew]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_lua: Let the Inter-VM get/set functions work with a global
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington shared memory pool instead of a per-process pool. [Daniel Gruno]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) ldap: Support ldaps when using the Microsoft LDAP SDK.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein PR 54626. [Jean-Frederic Clere]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy: Add ap_connection_reusable() for checking if a connection
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is reusable as of this point in processing. [Jeff Trawick]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) mod_authnz_ldap: Change default value of AuthLDAPMaxSubGroupDepth to 0
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to avoid performance problems when subgroups aren't in use. [Eric Covener]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_syslog: New module implementing syslog ap_error_log provider.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Previously, this code was part of core, now it's in separate module.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Jan Kaluza]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) core: Add ap_errorlog_provider to make ErrorLog logging modular. Move
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt syslog support from core to new mod_syslog. [Jan Kaluza]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_status, mod_echo: Fix the display of client addresses.
cc3aafe737334d444781f8a34ffaf459e075bb9aMark Andrews They were truncated to 31 characters which is not enough for IPv6 addresses.
cc3aafe737334d444781f8a34ffaf459e075bb9aMark Andrews PR 54848 [Bernhard Schmidt <berni birkenwald de>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) core: Add ap_log_data(), ap_log_rdata(), etc. for logging buffers.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Jeff Trawick]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_unique_id: Use output of the PRNG rather than IP address and
cc3aafe737334d444781f8a34ffaf459e075bb9aMark Andrews pid, avoiding sleep() call and possible DNS issues at startup,
cc3aafe737334d444781f8a34ffaf459e075bb9aMark Andrews plus improving randomness for IPv6-only hosts.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Jan Kaluza <jkaluza redhat.com>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_authnz_ldap: Support primitive LDAP servers that do not accept
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein filters, such as "SDBM-backed LDAP" on z/OS, by allowing a special
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein filter "none" to be specified in AuthLDAPURL. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_file_cache: mod_file_cache should be able to serve files that
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein haven't had a Content-Type set via e.g. mod_mime. [Eric Covener]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) core: merge AllowEncodedSlashes from the base configuration into
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington virtual hosts. [Eric Covener]
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews *) AIX: Install DSO's with "cp" instead of "install" in instdso.sh
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews [Eric Covener]
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews *) mod_ldap: Don't keep retrying if a new LDAP connection times out.
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews [Eric Covener]
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews *) mod_deflate: permit compilation of mod_deflate against a zlib that has
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews been configured with -D Z_PREFIX, which redefines the token "deflate".
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews [Eric Covener]
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews *) mod_auth_digest: Use the secret when generating nonces in all cases and
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews not only when AuthName is used in .htaccess files (this change may cause
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews problems if used with round robin load balancers). Don't regenerate the
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews secret on graceful restarts. PR 54637 [Stefan Fritsch]
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews *) core: Remove apr_brigade_flatten(), buffering and duplicated code
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews from the HTTP_IN filter, parse chunks in a single pass with zero copy.
c6d2578fd67bc1a427d13fd0699b25a187feec8aMark Andrews Reduce memory usage by 48 bytes per request. [Graham Leggett]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: Stop the HTTP_IN filter from attempting to write error buckets
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to the output filters, which is bogus in the proxy case. Create a
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein clean mapping from APR codes to HTTP status codes, and use it where
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein needed. [Graham Leggett]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_proxy: Ensure network errors detected by the proxy are returned as
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein 504 Gateway Timout as opposed to 502 Bad Gateway, in order to be
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein compliant with RFC2616 14.9.4 Cache Revalidation and Reload Controls.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [Basant Kumar Kukreja <basant.kukreja sun.com>, Alejandro Alvarez
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_ldap: LDAP connections used for authentication were not respecting
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein LDAPConnectionPoolTimeout. PR 54587
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: ap_rgetline_core now pulls from r->proto_input_filters.
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews *) mod_proxy_html: process parsed comments immediately.
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews Fixes bug where parsed comments may be lost. [Nick Kew]
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews *) mod_proxy_html: introduce doctype for HTML 5 [Nick Kew]
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews *) mod_proxy_html: fix typo-bug processing "strict" vs "transitional"
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews *) core: Add option to add valgrind support. Use it to reduce false positive
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews warnings in mod_ssl. [Stefan Fritsch]
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews *) mod_authn_file, mod_authn_dbd, mod_authn_dbm, mod_authn_socache:
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews Cache the result of the most recent password hash verification for every
c6f4972c745f8903aba6dcca41f17a44c473db66Mark Andrews keep-alive connection. This saves some expensive calculations.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Stefan Fritsch]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) http: Remove support for Request-Range header sent by Navigator 2-3 and
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein MSIE 3. [Stefan Fritsch]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) core, http: Extend HttpProtocol with an option to enforce stricter HTTP
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein conformance or to only log the found problems. [Stefan Fritsch]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) core: Correctly parse an IPv6 literal host specification in an absolute
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington URL in the request line. [Stefan Fritsch]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) EventOpt MPM
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) core: Add LogLevelOverride directive that allows to override the
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt loglevel for clients from certain IPs. This also works for things
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt like the SSL handshake where <If> LogLevel ... </If> is evaluated
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt too late. [Stefan Fritsch]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) core: Add new directive Warning to issue warnings from a configuration
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt file. Both Warning and Error now generate a timestamped log message.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Fabien Coelho]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) ap_expr: Add SERVER_PROTOCOL_VERSION, ..._MAJOR, and ..._MINOR
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt variables. [Stefan Fritsch]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) core: New directive RegisterHttpMethod for registering non-standard
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt HTTP methods. [Stefan Fritsch]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) core: New directive HttpProtocol which allows to disable HTTP/0.9
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein support. [Stefan Fritsch]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_allowhandlers: New module to forbid specific handlers for specific
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein directories. [Stefan Fritsch]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) mod_systemd: New module, for integration with systemd on Linux.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [Jan Kaluza <jkaluza redhat.com>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington *) WinNT MPM: Store pid and generation for each thread in scoreboard
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to allow tracking of threads from exiting children via mod_status
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington or other such mechanisms. [Jeff Trawick]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - APIs: ap_log_pid(), ap_remove_pid, ap_read_pid()
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - core: the scoreboard (ScoreBoardFile), pid file (PidFile), and
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein mutexes (Mutex)
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - mod_cache: thundering herd lock directory
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - mod_lbmethod_heartbeat, mod_heartmonitor: heartbeat storage file
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - mod_ldap: shared memory cache
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - mod_socache_shmcb, mod_socache_dbm: shared memory or dbm for cache
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [Jeff Trawick]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) suexec: Add --enable-suexec-capabilites support on Linux, to use
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt setuid/setgid capability bits rather than a setuid root binary.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) suexec: Add support for logging to syslog as an alternative to logging
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt to a file; configure --without-suexec-logfile --with-suexec-syslog.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt *) mod_ssl: Add support for TLS Next Protocol Negotiation. PR 52210.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt [Matthew Steele <mdsteele google.com>]
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt *) cross-compile: allow to provide CC_FOR_BUILD so that gen_test_char will
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt be compiled by the build compiler instead of the host compiler.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Also set CC_FOR_BUILD to 'cc' when cross-compilation is detected.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt PR 51257. [Guenter Knauf]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) core: In maintainer mode, replace apr_palloc with a version that
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt initializes the allocated memory with non-zero values, except if
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt AP_DEBUG_NO_ALLOC_POISON is defined. [Stefan Fritsch]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_policy: Add a new testing module to help server administrators
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt enforce a configurable level of protocol compliance on their
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt servers and application servers behind theirs. [Graham Leggett]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_firehose: Add a new debugging module able to record traffic
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt passing through the server in such a way that connections and/or
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt requests be reconstructed and replayed. [Graham Leggett]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) mod_noloris
eec29cfd40361662b25bad50e1b94f7738a8fea0Jeremy Reed *) Simple MPM
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [Apache 2.5.0-dev includes those bug fixes and changes with the
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Apache 2.4.xx tree as documented below, except as noted.]
553ead32ff5b00284e574dcabc39115d4d74ec66Evan HuntChanges with Apache 2.4.x and later:
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup
553ead32ff5b00284e574dcabc39115d4d74ec66Evan HuntChanges with Apache 2.2.x and later:
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup
553ead32ff5b00284e574dcabc39115d4d74ec66Evan HuntChanges with Apache 2.0.x and later: