CHANGES

     [Stefan Eissing]

  *) mod_http2: Fixed flushing of last GOAWAY frame. Previously, that frame
     did not always reach the client, causing some to fail the next request.
     Fixed calculation of last stream id accepted as described in rfc7540. 
     Reading in KEEPALIVE state now correctly shown in scoreboard. 
     Fixed possible race in connection shutdown after review by Ylavic. 
     Fixed segfault on connection shutdown, callback ran into a semi dismantled session. 
     [Stefan Eissing]

  *) mod_http2: Added support for experimental accept-push-policy draft
     (https://tools.ietf.org/html/draft-ruellan-http-accept-push-policy-00). Clients
     may now influence server pushes by sending accept-push-policy headers.
     [Stefan Eissing]

  *) mod_http2: new r->subprocess_env variables HTTP2 and H2PUSH, set to "on"
     when available for request.
     [Stefan Eissing]

  *) mod_http2: fixed bug in input window size calculation by moving chunked
     request body encoding into later stage of processing. Fixes PR 58825.
     [Stefan Eissing]

  *) core: new hook "pre_close_connection" which is run before the lingering
     close of connections is started. This gives protocol handlers one last
     chance to use a connection before it goes down.
     [Stefan Eissing]

  *) mod_status/scoreboard: showing connection protocol in new column, new 
     ap_update_child_status methods for updating server/description. mod_ssl
     sets vhost negotiated by servername directly.
     [Stefan Eissing]

Changes with Apache 2.4.18

  *) mod_ssl: for all ssl_engine_vars.c lookups, fall back to master connection
     if conn_rec itself holds no valid SSLConnRec*. Fixes PR58666.
     [Stefan Eissing]

  *) mod_http2: connection level window for flow control is set to protocol
     maximum of 2GB-1, preventing window exhaustion when sending data on many
     streams with higher cumulative window size. 
     Reducing write frequency unless push promises need to be flushed.
     [Stefan Eissing]

  *) mod_http2: required minimum version of libnghttp2 is 1.2.1
     [Stefan Eissing]

  *) mod_proxy_fdpass: Fix AH01153 error when using the default configuration.
     In earlier version of httpd, you can explicitelly set the 'flusher' parameter
     to 'flush' as a workaround. (i.e. flusher=flush)
     Add documentation for the 'flusher' parameter when defining a proxy worker.
     [Christophe Jaillet]

  *) mod_ssl: For the "SSLStaplingReturnResponderErrors off" case, make sure
     to only staple responses with certificate status "good". [Kaspar Brand]

  *) mod_http2: new directive 'H2PushPriority' to allow priority specifications
     on server pushed streams according to their content-type. 
     [Stefan Eissing]

  *) mod_http2: fixes crash on connection abort for a busy connection.
     fixes crash on a request that did not produce any response.
     [Stefan Eissing]

  *) mod_http2: trailers are sent after response body if set in request_rec
     trailers_out before the end-of-request bucket is sent through the 
     output filters. [Stefan Eissing]

  *) mod_http2: incoming trailers (headers after request body) are properly
     forwarded to the processing engine. [Stefan Eissing]

  *) mod_http2: new directive 'H2Push' to en-/disable HTTP/2 server
     pushes a server/virtual host. Pushes are initiated by the presence
     of 'Link:' headers with relation 'preload' on a response. [Stefan Eissing]

  *) mod_http2: write performance of http2 improved for larger resources,
     especially static files. [Stefan Eissing]

  *) core: if the first HTTP/1.1 request on a connection goes to a server that
     prefers different protocols, these protocols are announced in a Upgrade:
     header on the response, mentioning the preferred protocols.
     [Stefan Eissing]

  *) mod_http2: new directives 'H2TLSWarmUpSize' and 'H2TLSCoolDownSecs'
     to control TLS record sizes during connection lifetime.
     [Stefan Eissing]

  *) mod_http2: new directive 'H2ModernTLSOnly' to enforce security
     requirements of RFC 7540 on TLS connections. [Stefan Eissing]

  *) core: add ap_get_protocol_upgrades() to retrieve the list of protocols
     that a client could possibly upgrade to. Use in first request on a 
     connection to announce protocol choices. [Stefan Eissing]

  *) mod_http2: reworked deallocation on connection shutdown and worker
     abort. Separate parent pool for all workers. worker threads are joined
     on planned worker shutdown. [Yann Ylavic, Stefan Eissing]

  *) mod_ssl: when receiving requests for other virtual hosts than the handshake
     server, the SSL parameters are checked for equality. With equal 
     configuration, requests are passed for processing. Any change will trigger
     the old behaviour of "421 Misdirected Request".
     SSL now remembers the cipher suite that was used for the last handshake.
     This is compared against for any vhost/directory cipher specification. 
     Detailed examination of renegotiation is only done when these do not
     match.
     Renegotiation is 403ed when a master connection is present. Exact reason
     is given additionally in a request note. [Stefan Eissing]

  *) mod_ssl: Make the output filter more friendly with deferred write and
     response pipelining. [Yann Ylavic, Joe Orton]

  *) core: Fix scoreboard crash (SIGBUS) on hardware requiring strict 64bit
     alignment (SPARC64, PPC64).  [Yann Ylavic]

  *) mod_cache: Accept HT (Horizontal Tab) when parsing cache related header
     fields as described in RFC7230. [Christophe Jaillet]

  *) core/util_script: making REDIRECT_URL a full URL is now opt-in
     via new 'QualifyRedirectURL' directive.

  *) core: Limit to ten the number of tolerated empty lines between request,
     and consume them before the pipelining check to avoid possible response
     delay when reading the next request without flushing.  [Yann Ylavic]

  *) mod_ssl: Extend expression parser registration to support ssl variables
     in any expression using mod_rewrite syntax "%{SSL:VARNAME}" or function
     syntax "ssl(VARNAME)". [Rainer Jung]

Changes with Apache 2.4.17

  *) mod_http2: added donated HTTP/2 implementation via core module. Similar
     configuration options to mod_ssl. [Stefan Eissing]

  *) mod_proxy: don't recyle backend announced "Connection: close" connections
     to avoid reusing it should the close be effective after some new request
     is ready to be sent.  [Yann Ylavic]

  *) mod_substitute: Allow to configure the patterns merge order with the new
     SubstituteInheritBefore on|off directive.  PR 57641
     [Marc.Stern <Marc.Stern approach.be>, Yann Ylavic, William Rowe]

  *) mod_proxy: Fix ProxySourceAddress binding failure with AH00938.
     PR 56687.  [Arne de Bruijn <apache arbruijn.dds.nl>

  *) mod_ssl: Support compilation against libssl built with OPENSSL_NO_SSL3,
     and change the compiled-in default for SSL[Proxy]Protocol to "all -SSLv3",
     in accordance with RFC 7568. PR 58349, PR 57120. [Kaspar Brand]

  *) mod_ssl: append :!aNULL:!eNULL:!EXP to the cipher string settings,
     instead of prepending !aNULL:!eNULL:!EXP: (as was the case in 2.4.7
     and later). Enables support for configuring the SUITEB* cipher
     strings introduced in OpenSSL 1.0.2. PR 58213. [Kaspar Brand]

  *) mod_ssl: Add support for extracting the msUPN and dnsSRV forms
     of subjectAltName entries of type "otherName" into
     SSL_{CLIENT,SERVER}_SAN_OTHER_{msUPN,dnsSRV}_n environment
     variables. Addresses PR 58020. [Jan Pazdziora <jpazdziora redhat.com>,
     Kaspar Brand]

  *) mod_logio: Fix logging of %^FB (time to first byte) on the first request on
     an SSL connection.  PR 58454.  
     [Konstantin J. Chernov <k.j.chernov gmail.com>]

  *) mod_cache: r->err_headers_out is not merged into
     r->headers when mod_cache is enabled and the response
     is cached for the first time. [Edward Lu]

  *) mod_slotmem_shm: Fix slots/SHM files names on restart for systems that
     can't create new (clear) slots while previous children gracefully stopping
     still use the old ones (e.g. Windows, OS2). mod_proxy_balancer failed to
     restart whenever the number of configured balancers/members changed during
     restart.  PR 58024.  [Yann Ylavic]

  *) core/util_script: make REDIRECT_URL a full URL.  PR 57785. [Nick Kew]

  *) MPMs: Support SO_REUSEPORT to create multiple duplicated listener
     records for scalability. [Yingqi Lu <yingqi.lu@intel.com>,
     Jeff Trawick, Jim Jagielski, Yann Ylavic]

  *) mod_alias: Introduce expression parser support for Alias, ScriptAlias
     and Redirect. Limit Redirect expressions to directory (Location) context
     and redirect statuses (implicit or explicit).
     [Graham Leggett, Yann Ylavic, Ruediger Pluem]

  *) mod_proxy: Fix a race condition that caused a failed worker to be retried
     before the retry period is over. [Ruediger Pluem]

  *) mod_autoindex: Allow autoindexes when neither mod_dir nor mod_mime are
     loaded. [Eric Covener]

  *) mod_rewrite:  Allow cookies set by mod_rewrite to contain ':' by accepting
     ';' as an alternate separator.  PR47241. 
     [<bugzilla schermesser com>, Eric Covener]

  *) apxs: Add HTTPD_VERSION and HTTPD_MMN to the variables available with 
     apxs -q. PR58202. [Daniel Shahaf <danielsh apache.org>]

  *) mod_rewrite: Avoid a crash when lacking correct DB access permissions
     when using RewriteMap with MapType dbd or fastdbd.  [Christophe Jaillet]

  *) mod_authz_dbd: Avoid a crash when lacking correct DB access permissions.
     PR 57868. [Jose Kahan <jose w3.org>, Yann Ylavic]

  *) mod_socache_memcache: Add the 'MemcacheConnTTL' directive to control how 
     long to keep idle connections with the memcache server(s).
     Change default value from 600 usec (!) to 15 sec. PR 58091
     [Christophe Jaillet]

  *) mod_dir: Prevent the internal identifier "httpd/unix-directory" from
     appearing as a Content-Type response header when requests for a directory
     are rewritten by mod_rewrite. [Eric Covener]

Changes with Apache 2.4.16

  *) http: Fix LimitRequestBody checks when there is no more bytes to read.
     [Michael Kaufmann <mail michael-kaufmann.ch>]

  *) mod_alias: Revert expression parser support for Alias, ScriptAlias
     and Redirect due to a regression (introduced in 2.4.13, not released).

  *) mod_reqtimeout: Don't let pipelining checks and keep-alive times interfere
     with the timeouts computed for subsequent requests.  PR 56729.
     [Eric Covener, Yann Ylavic]

  *) core: Avoid a possible truncation of the faulty header included in the
     HTML response when LimitRequestFieldSize is reached.  [Yann Ylavic]

  *) mod_ldap: In some case, LDAP_NO_SUCH_ATTRIBUTE could be returned instead
     of an error during a compare operation. [Eric Covener]

Changes with Apache 2.4.15 (not released)

  *) mod_ext_filter, mod_charset_lite: Avoid inadvertent filtering of protocol
     data during read of chunked request bodies. PR 58049. 
     [Edward Lu <Chaosed0 gmail.com>]

  *) mod_ldap: Stop leaking LDAP connections when 'LDAPConnectionPoolTTL 0' 
     is configured.  PR 58037.  [Ted Phelps <phelps gnusto.com>]

  *) core: Allow spaces after chunk-size for compatibility with implementations
     using a pre-filled buffer.  [Yann Ylavic, Jeff Trawick]

  *) mod_ssl: Remove deprecated SSLCertificateChainFile warning.
     [Yann Ylavic]

Changes with Apache 2.4.14 (not released)

  *) SECURITY: CVE-2015-3183 (cve.mitre.org)
     core: Fix chunk header parsing defect.
     Remove apr_brigade_flatten(), buffering and duplicated code from
     the HTTP_IN filter, parse chunks in a single pass with zero copy.
     Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
     authorized characters.  [Graham Leggett, Yann Ylavic]

  *) SECURITY: CVE-2015-3185 (cve.mitre.org)
     Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
     with new ap_some_authn_required and ap_force_authn hook.  [Ben Reser]

Changes with Apache 2.4.13 (not released)

  *) SECURITY: CVE-2015-0253 (cve.mitre.org)
     core: Fix a crash with ErrorDocument 400 pointing to a local URL-path 
     with the INCLUDES filter active, introduced in 2.4.11. PR 57531. 
     [Yann Ylavic]

  *) SECURITY: CVE-2015-0228 (cve.mitre.org)
     mod_lua: A maliciously crafted websockets PING after a script
     calls r:wsupgrade() can cause a child process crash. 
     [Edward Lu <Chaosed0 gmail.com>]

  *) mod_proxy: Don't put the worker in error state for 500 or 503 errors
     returned by the backend unless failonstatus is configured to.  PR 56925.
     [Yann Ylavic]

  *) core: Don't lowercase the argument to SetHandler if it begins with
     "proxy:unix". PR 57968. [Eric Covener]

  *) mod_ssl OCSP Stapling: Don't block initial handshakes while refreshing
     the OCSP response for a different certificate.  mod_ssl has an additional
     global mutex, "ssl-stapling-refresh".  PR 57131 (partial fix).
     [Jeff Trawick]

  *) mod_authz_dbm: Fix crashes when "dbm-file-group" is used and
     authz modules were loaded in the "wrong" order.  [Joe Orton]

  *) mod_authn_dbd, mod_authz_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
     of DB lookup entries independently of the selected DB engine.  PR 46421.
     [Steven whitson <steven.whitson gmail com>, Jan Kaluza, Yann Ylavic].

  *) In alignment with RFC 7525, the default recommended SSLCipherSuite
     and SSLProxyCipherSuite now exclude RC4 as well as MD5. Also, the
     default recommended SSLProtocol and SSLProxyProtocol directives now
     exclude SSLv3. Existing configurations must be adjusted by the
     administrator. [William Rowe]

  *) mod_ssl: Add support for extracting subjectAltName entries of type
     rfc822Name and dNSName into SSL_{CLIENT,SERVER}_SAN_{Email,DNS}_n
     environment variables. Also addresses PR 57207. [Kaspar Brand]

  *) dav_validate_request: avoid validating locks and ETags when there are
     no If headers providing them on a resource we aren't modifying.
     [Ben Reser]

  *) mod_proxy_scgi: ProxySCGIInternalRedirect now allows an alternate
     response header to be used by the application, for when the application
     or framework is unable to return Location in the internal-redirect
     form.  [Jeff Trawick]

  *) core: Cleanup the request soon/even if some output filter fails to
     handle the EOR bucket.  [Yann Ylavic]

  *) mpm_event: Allow for timer events duplicates. [Jim Jagielski, Yann Ylavic]

  *) mod_proxy, mod_ssl, mod_cache_socache, mod_socache_*: Support machine
     readable server-status produced when using the "?auto" query string.
     [Rainer Jung]

  *) mod_status: Add more data to machine readable server-status produced
     when using the "?auto" query string.  [Rainer Jung]

  *) mod_ssl: Check for the Entropy Gathering Daemon (EGD) availability at
     configure time (RAND_egd), and complain if SSLRandomSeed requires using
     it otherwise.  [Bernard Spil <pil.oss gmail com>, Stefan Sperling,
     Kaspar Brand]

  *) mod_ssl: make sure to consistently output SSLCertificateChainFile
     deprecation warnings, when encountered in a VirtualHost block.
     [Falco Schwarz <hiding falco.me>]

  *) mod_log_config: Add "%{UNIT}T" format to output request duration in
     seconds, milliseconds or microseconds depending on UNIT ("s", "ms", "us").
     [Ben Reser, Rainer Jung]

  *) Allow FallbackResource to work when a directory is requested and
     there is no autoindex nor DirectoryIndex. 
     [Jack <tjerk.meesters gmail.com>, Eric Covener]

  *) mod_proxy_wstunnel: Bypass the handler while the connection is not
     upgraded to WebSocket, so that other modules can possibly take over
     the leading HTTP requests.  [Yann Ylavic]

  *) mod_http: Fix incorrect If-Match handling. PR 57358
     [Kunihiko Sakamoto <ksakamoto google.com>]

  *) mod_ssl: Add a warning if protocol given in SSLProtocol or SSLProxyProtocol
     will override other parameters given in the same directive. This could be
     a missing + or - prefix.  PR 52820 [Christophe Jaillet]

  *) core, modules: Avoid error response/document handling by the core if some
     handler or input filter already did it while reading the request (causing
     a double response body).  [Yann Ylavic]

  *) mod_proxy_ajp: Fix client connection errors handling and logged status
     when it occurs.  PR 56823.  [Yann Ylavic]

  *) mod_proxy: Use the correct server name for SNI in case the backend
     SSL connection itself is established via a proxy server.
     PR 57139 [Szabolcs Gyurko <szabolcs gyurko.org>]

  *) mod_ssl: Fix possible crash when loading server certificate constraints.
     PR 57694. [Paul Spangler <paul.spangler ni com>, Yann Ylavic]

  *) build: Don't load both mod_cgi and mod_cgid in the default configuration
     if they're both built.  [olli hauer <ohauer gmx.de>]

  *) mod_logio: Add LogIOTrackTTFB and %^FB logformat to log the time 
     taken to start writing response headers. [Eric Covener]

  *) mod_ssl: Avoid compilation errors with LibreSSL related to
     the use of ENGINE_CTRL_CHIL_SET_FORKCHECK. 
     [Stuart Henderson <sthen openbsd.org>]

  *) mod_proxy_http: Use the "Connection: close" header for requests to
     backends not recycling connections (disablereuse), including the default
     reverse and forward proxies.  [Yann Ylavic]

  *) mod_proxy: Add ap_connection_reusable() for checking if a connection
     is reusable as of this point in processing.  [Jeff Trawick]

  *) mod_proxy_wstunnel: Avoid an empty response by failing with 502 (Bad
     Gateway) when no response is ever received from the backend.
     [Jan Kaluza]

  *) core_filters: Restore/disable TCP_NOPUSH option after non-blocking
     sendfile.  [Yann Ylavic]

  *) mod_buffer: Forward flushed input data immediately and avoid (unlikely)
     access to freed memory. [Yann Ylavic, Christophe Jaillet]

  *) core: Add CGIPassAuth directive to control whether HTTP authorization
     headers are passed to scripts as CGI variables.  PR 56855.  [Jeff 
     Trawick]

  *) core: Initialize scoreboard's used optional functions on graceful restarts
     to avoid a crash when relocation occurs.  PR 57177.  [Yann Ylavic]

  *) mod_dav: Avoid a potential integer underflow in the lock timeout value sent
     back to a client. The answer to a LOCK request could be an extremly large
     integer if the time needed to lock the resource was longer that the
     requested timeout given in the LOCK request. In such a case, we now answer
     "Second-0".  PR55420
     [Christophe Jaillet]

  *) mod_cgid: Within the first minute of a server start or restart, 
     allow mod_cgid to retry connecting to its daemon process. Previously,
     'No such file or directory: unable to connect to cgi daemon...' could
     be logged without an actual retry. PR57685. 
     [Edward Lu <Chaosed0 gmail.com>]

  *) mod_proxy: Use the original (non absolute) form of the request-line's URI
     for requests embedded in CONNECT payloads used to connect SSL backends via
     a ProxyRemote forward-proxy.  PR 55892.  [Hendrik Harms <hendrik.harms
     gmail com>, William Rowe, Yann Ylavic]

  *) http: Make ap_die() robust against any HTTP error code and not modify
     response status (finally logged) when nothing is to be done. PR 56035.
     [Yann Ylavic]

  *) mod_proxy_connect/wstunnel: If both client and backend sides get readable
     at the same time, don't lose errors occurring while forwarding on the first
     side when none occurs next on the other side, and abort.  [Yann Ylavic]

  *) mod_rewrite: Improve relative substitutions in per-directory/htaccess
     context for directories found by mod_userdir and mod_alias.  These no
     longer require RewriteBase to be specified. [Eric Covener]

  *) mod_proxy_http: Don't expect the backend to ack the "Connection: close" to
     finally close those not meant to be kept alive by SetEnv proxy-nokeepalive
     or force-proxy-request-1.0.  [Yann Ylavic]

  *) core: If explicitly configured, use the KeepaliveTimeout value of the
     virtual host which handled the latest request on the connection, or by
     default the one of the first virtual host bound to the same IP:port.
     PR56226.  [Yann Ylavic]

  *) mod_lua: After a r:wsupgrade(), mod_lua was not properly
     responding to a websockets PING but instead invoking the specified 
     script. PR57524. [Edward Lu <Chaosed0 gmail.com>]

  *) mod_ssl: Add the SSL_CLIENT_CERT_RFC4523_CEA variable, which provides
     a combination of certificate serialNumber and issuer as defined by
     CertificateExactMatch in RFC4523. [Graham Leggett]

  *) core: Add expression support to ErrorDocument. Switch from a fixed
     sized 664 byte array per merge to a hash table. [Graham Leggett]

  *) ab: Add missing longest request (100%) to CSV export.
     [Marcin Fabrykowski <bugzilla fabrykowski.pl>] 

  *) mod_macro: Clear macros before initialization to avoid use-after-free
     on startup or restart when the module is linked statically. PR 57525
     [apache.org tech.futurequest.net, Yann Ylavic]

  *) mod_alias: Introduce expression parser support for Alias, ScriptAlias
     and Redirect. [Graham Leggett]

  *) mod_ssl: 'SSLProtocol ALL' was being ignored in virtual host context. 
     PR 57100.  [Michael Kaufmann <apache-bugzilla michael-kaufmann.ch>,
     Yann Ylavic]

  *) mpm_event: Avoid access to the scoreboard from the connection while
     it is suspended (waiting for events).  [Eric Covener, Jeff Trawick]

  *) mod_ssl: Fix renegotiation failures redirected to an ErrorDocument.
     PR 57334.  [Yann Ylavic].

  *) mod_deflate: A misplaced check prevents limiting small bodies with the
     new inflate limits. PR56872. [Edward Lu, Eric Covener, Yann Ylavic]

  *) mod_proxy_ajp: Forward SSL protocol name (SSLv3, TLSv1.1 etc.) as a
     request attribute to the backend. Recent Tomcat versions will extract
     it and provide it as a servlet request attribute named
     "org.apache.tomcat.util.net.secure_protocol_version". [Rainer Jung]

  *) core: Optimize string concatenation in expression parser when evaluating
     a string expression. [Rainer Jung]

  *) acinclude.m4: Generate #LoadModule directive in default httpd.conf for
     every --enable-mpms-shared. PR 53882.  [olli hauer <ohauer gmx.de>,
     Yann Ylavic]

  *) mod_authn_dbd: Fix the error message logged in case of error while querying
     the database. This is associated to AH01656 and AH01661. [Christophe Jaillet]

  *) mod_authz_groupfile: Reduce the severity of AH01667 from ERROR to DEBUG,
     because it may be evaluated inside <RequireAny>. PR55523. [Eric Covener] 

  *) mod_ssl: Fix small memory leak during initialization when ECDH is used.
     [Jan Kaluza]

Changes with Apache 2.4.12

  *) mpm_winnt: Accept utf-8 (Unicode) service names and descriptions for
     internationalization.  [William Rowe]

  *) mpm_winnt: Normalize the error and status messages emitted by service.c,
     the service control interface for Windows.  [William Rowe]

  *) configure: Fix --enable-v4-mapped configuration on *BSD. PR 53824.
     [ olli hauer <ohauer gmx.de>, Yann Ylavic ]

  *) Reverted <DirectoryMatch > behavior regression introduced in 2.4.11
     (not released).

Changes with Apache 2.4.11 (not released)

  *) SECURITY: CVE-2014-3583 (cve.mitre.org)
     mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with 
     response headers' size above 8K.  [Yann Ylavic, Jeff Trawick]

  *) SECURITY: CVE-2014-3581 (cve.mitre.org)
     mod_cache: Avoid a crash when Content-Type has an empty value.
     PR 56924.  [Mark Montague <mark catseye.org>, Jan Kaluza]

  *) SECURITY: CVE-2014-8109 (cve.mitre.org)
     mod_lua: Fix handling of the Require line when a LuaAuthzProvider is
     used in multiple Require directives with different arguments.
     PR57204 [Edward Lu <Chaosed0 gmail.com>]

  *) SECURITY: CVE-2013-5704 (cve.mitre.org)
     core: HTTP trailers could be used to replace HTTP headers
     late during request processing, potentially undoing or
     otherwise confusing modules that examined or modified
     request headers earlier.  Adds "MergeTrailers" directive to restore
     legacy behavior.  [Edward Lu, Yann Ylavic, Joe Orton, Eric Covener]

  *) mod_ssl: New directive SSLSessionTickets (On|Off).
     The directive controls the use of TLS session tickets (RFC 5077),
     default value is "On" (unchanged behavior).
     Session ticket creation uses a random key created during web
     server startup and recreated during restarts. No other key
     recreation mechanism is available currently. Therefore using session
     tickets without restarting the web server with an appropriate frequency
     (e.g. daily) compromises perfect forward secrecy. [Rainer Jung]

  *) mod_proxy_fcgi: Provide some basic alternate options for specifying 
     how PATH_INFO is passed to FastCGI backends by adding significance to
     the value of proxy-fcgi-pathinfo. PR 55329. [Eric Covener]

  *) mod_proxy_fcgi: Enable UDS backends configured with SetHandler/RewriteRule
     to opt-in to connection reuse and other Proxy options via explicitly
     declared "proxy workers" (<Proxy unix:... enablereuse=on max=...)
     [Eric Covener]

  *) mod_proxy: Add "enablereuse" option as the inverse of "disablereuse".
     [Eric Covener]

  *) mod_proxy_fcgi: Enable opt-in to TCP connection reuse by explicitly
     setting proxy option disablereuse=off. [Eric Covener] PR 57378.

  *) event: Update the internal "connection id" when requests
     move from thread to thread. Reuse can confuse modules like
     mod_cgid. PR 57435. [Michael Thorpe <mike gistnet.com>]

  *) mod_proxy_fcgi: Remove proxy:balancer:// prefix from SCRIPT_FILENAME
     passed to fastcgi backends. [Eric Covener]

  *) core: Configuration files with long lines and continuation characters
     are not read properly. PR 55910. [Manuel Mausz <manuel-as mausz.at>]

  *) mod_include: the 'env' function was incorrectly handled as 'getenv' if the
     leading 'e' was written in upper case in <!--#if expr="..." -->
     statements. [Christophe Jaillet]

  *) split-logfile: Fix perl error:  'Can't use string ("example.org:80") 
     as a symbol ref while "strict refs"'. PR 56329.
     [Holger Mauermann <mauermann gmail.com>]

  *) mod_proxy: Prevent ProxyPassReverse from doing a substitution when
     the URL parameter interpolates to an empty string. PR 56603.
     [<ajprout hotmail.com>]

  *) core: Fix -D[efined] or <Define>[d] variables lifetime across restarts. 
     PR 57328.  [Armin Abfalterer <a.abfalterer gmail.com>, Yann Ylavic].

  *) mod_proxy: Preserve original request headers even if they differ
     from the ones to be forwarded to the backend. PR 45387.
     [Yann Ylavic]

  *) mod_ssl: dump SSL IO/state for the write side of the connection(s),
     like reads (level TRACE4). [Yann Ylavic]

  *) mod_proxy_fcgi: Ignore body data from backend for 304 responses. PR 57198.
     [Jan Kaluza]

  *) mod_ssl: Do not crash when looking up SSL related variables during
     expression evaluation on non SSL connections. PR 57070  [Ruediger Pluem]

  *) mod_proxy_ajp: Fix handling of the default port (8009) in the
     ProxyPass and <Proxy> configurations.  PR 57259.  [Yann Ylavic]

  *) mpm_event: Avoid a possible use after free when notifying the end of
     connection during lingering close.  PR 57268.  [Eric Covener, Yann Ylavic]

  *) mod_ssl: Fix recognition of OCSP stapling responses that are encoded
     improperly or too large.  [Jeff Trawick]

  *) core: Add ap_log_data(), ap_log_rdata(), etc. for logging buffers.
     [Jeff Trawick]

  *) mod_proxy_fcgi, mod_authnz_fcgi: stop reading the response and issue an
     error when parsing or forwarding the response fails. [Yann Ylavic]

  *) mod_ssl: Fix a memory leak in case of graceful restarts with OpenSSL >= 0.9.8e
     PR 53435 [tadanori <tadanori2007 yahoo.com>, Sebastian Wiedenroth <wiedi frubar.net>]

  *) mod_proxy_connect: Don't issue AH02447 on sockets hangups, let the read
     determine whether it is a normal close or a real error. PR 57168. [Yann
     Ylavic]

  *) mod_proxy_wstunnel: abort backend connection on polling error to avoid
     further processing.  [Yann Ylavic]

  *) core: Support custom ErrorDocuments for HTTP 501 and 414 status codes.
     PR 57167 [Edward Lu <Chaosed0 gmail.com>]

  *) mod_proxy_connect: Fix ProxyRemote to https:// backends on EBCDIC 
     systems. PR 57092 [Edward Lu <Chaosed0 gmail.com>]

  *) mod_cache: Avoid a 304 response to an unconditional requst when an AH00752
     CacheLock error occurs during cache revalidation. [Eric Covener]

  *) mod_ssl: Move OCSP stapling information from a per-certificate store to
     a per-server hash. PR 54357, PR 56919. [Alex Bligh <alex alex.org.uk>,
     Yann Ylavic, Kaspar Brand]

  *) mod_cache_socache: Change average object size hint from 32 bytes to
     2048 bytes.  [Rainer Jung]

  *) mod_cache_socache: Add cache status to server-status.  [Rainer Jung]

  *) event: Fix worker-listener deadlock in graceful restart.
     PR 56960.

  *) Concat strings at compile time when possible. PR 53741.

  *) mod_substitute: Restrict configuration in .htaccess to
     FileInfo as documented.  [Rainer Jung]

  *) mod_substitute: Make maximum line length configurable.  [Rainer Jung]

  *) mod_substitute: Fix line length limitation in case of regexp plus flatten.
     [Rainer Jung]

  *) mod_proxy: Truncated character worker names are no longer fatal
     errors. PR53218. [Jim Jagielski]

  *) mod_dav: Set r->status_line in dav_error_response. PR 55426.

  *) mod_proxy_http, mod_cache: Avoid (unlikely) accesses to freed memory.
     [Yann Ylavic, Christophe Jaillet]

  *) http_protocol: fix logic in ap_method_list_(add|remove) in order:
       - to correctly reset bits
       - not to modify the 'method_mask' bitfield unnecessarily
     [Christophe Jaillet]

  *) mod_slotmem_shm: Increase log level for some originally debug messages.
     [Jim Jagielski]

  *) mod_ldap: In 2.4.10, some LDAP searches or comparisons might be done with
     the wrong credentials when a backend connection is reused.
     [Eric Covener]

  *) mod_macro: Add missing APLOGNO for some Warning log messages.
     [Christophe Jaillet]

  *) mod_cache: Avoid sending 304 responses during failed revalidations
     PR56881. [Eric Covener]

  *) mod_status: Honor client IP address using mod_remoteip. PR 55886.
     [Jim Jagielski]

  *) cmake-based build for Windows: Fix incompatibility with cmake 2.8.12
     and later.  PR 56615.  [Chuck Liu <cliu81 gmail.com>, Jeff Trawick]

  *) mod_ratelimit: Drop severity of AH01455 and AH01457 (ap_pass_brigade
     failed) messages from ERROR to TRACE1.  Other filters do not bother 
     re-reporting failures from lower level filters.  PR56832.  [Eric Covener]

  *) core: Avoid useless warning message when parsing a section guarded by
     <IfDefine foo> if $(foo) is used within the section.
     PR 56503 [Christophe Jaillet]

  *) mod_proxy_fcgi: Fix faulty logging of large amounts of stderr from the
     application.  PR 56858.  [Manuel Mausz <manuel-asf mausz.at>]

  *) mod_proxy_http: Proxy responses with error status and
     "ProxyErrorOverride On" hang until proxy timeout.
     PR53420 [Rainer Jung]

  *) mod_log_config: Allow three character log formats to be registered. For
     backwards compatibility, the first character of a three-character format
     must be the '^' (caret) character.  [Eric Covener]

  *) mod_lua: Don't quote Expires and Path values. PR 56734.
     [Keith Mashinter, <kmashint yahoo com>]

  *) mod_authz_core: Allow <AuthzProviderAlias>'es to be seen from auth
     stanzas under virtual hosts. PR 56870. [Eric Covener]

Changes with Apache 2.4.10

  *) SECURITY: CVE-2014-0117 (cve.mitre.org)
     mod_proxy: Fix crash in Connection header handling which allowed a denial
     of service attack against a reverse proxy with a threaded MPM.
     [Ben Reser]

  *) SECURITY: CVE-2014-3523 (cve.mitre.org)
     Fix a memory consumption denial of service in the WinNT MPM, used in all
     Windows installations. Workaround: AcceptFilter <protocol> {none|connect}
     [Jeff Trawick]

  *) SECURITY: CVE-2014-0226 (cve.mitre.org)
     Fix a race condition in scoreboard handling, which could lead to
     a heap buffer overflow.  [Joe Orton, Eric Covener]

  *) SECURITY: CVE-2014-0118 (cve.mitre.org)
     mod_deflate: The DEFLATE input filter (inflates request bodies) now
     limits the length and compression ratio of inflated request bodies to
     avoid denial of service via highly compressed bodies.  See directives
     DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
     and DeflateInflateRatioBurst. [Yann Ylavic, Eric Covener]

  *) SECURITY: CVE-2014-0231 (cve.mitre.org)
     mod_cgid: Fix a denial of service against CGI scripts that do
     not consume stdin that could lead to lingering HTTPD child processes
     filling up the scoreboard and eventually hanging the server.  By
     default, the client I/O timeout (Timeout directive) now applies to
     communication with scripts.  The CGIDScriptTimeout directive can be
     used to set a different timeout for communication with scripts.
     [Rainer Jung, Eric Covener, Yann Ylavic]

  *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions
     resumed by TLS session resumption (RFC 5077). [Rainer Jung]

  *) mod_deflate: Don't fail when flushing inflated data to the user-agent
     and that coincides with the end of stream ("Zlib error flushing inflate
     buffer"). PR 56196. [Christoph Fausak <christoph fausak glueckkanja.com>]

  *) mod_proxy_ajp: Forward local IP address as a custom request attribute
     like we already do for the remote port. [Rainer Jung]

  *) core: Include any error notes set by modules in the canned error
     response for 403 errors.  [Jeff Trawick]

  *) mod_ssl: Set an error note for requests rejected due to
     SSLStrictSNIVHostCheck.  [Jeff Trawick]

  *) mod_ssl: Fix issue with redirects to error documents when handling
     SNI errors.  [Jeff Trawick]

  *) mod_ssl: Fix tmp DH parameter leak, adjust selection to prefer
     larger keys and support up to 8192-bit keys.  [Ruediger Pluem,
     Joe Orton]

  *) mod_dav: Fix improper encoding in PROPFIND responses.  PR 56480.
     [Ben Reser]

  *) WinNT MPM: Improve error handling for termination events in child.
     [Jeff Trawick]

  *) mod_proxy: When ping/pong is configured for a worker, don't send or
     forward "100 Continue" (interim) response to the client if it does
     not expect one. [Yann Ylavic]

  *) mod_ldap: Be more conservative with the last-used time for
     LDAPConnectionPoolTTL. PR54587 [Eric Covener]

  *) mod_ldap: LDAP connections used for authn were not respecting
     LDAPConnectionPoolTTL. PR54587 [Eric Covener]

  *) mod_proxy_fcgi: Fix occasional high CPU when handling request bodies.
     [Jeff Trawick]

  *) event MPM: Fix possible crashes (third-party modules accessing c->sbh) 
     or occasional missed mod_status updates under load. PR 56639.
     [Edward Lu <Chaosed0 gmail com>]

  *) mod_authnz_ldap: Support primitive LDAP servers do not accept
     filters, such as "SDBM-backed LDAP" on z/OS, by allowing a special
     filter "none" to be specified in AuthLDAPURL. [Eric Covener]

  *) mod_deflate: Fix inflation of files larger than 4GB. PR 56062.
     [Lukas Bezdicka <social v3.sk>]

  *) mod_deflate: Handle Zlib header and validation bytes received in multiple
     chunks. PR 46146. [Yann Ylavic]

  *) mod_proxy: Allow reverse-proxy to be set via explicit handler.
     [ryo takatsuki <ryotakatsuki gmail com>]

  *) ab: support custom HTTP method with -m argument. PR 56604.
     [Roman Jurkov <winfinit gmail.com>]

  *) mod_proxy_balancer: Correctly encode user provided data in management
     interface. PR 56532 [Maksymilian, <max cert.cx>]

  *) mod_proxy: Don't limit the size of the connectable Unix Domain Socket
     paths. [Graham Dumpleton, Christophe Jaillet, Yann Ylavic]

  *) mod_proxy_fcgi: Support iobuffersize parameter.  [Jeff Trawick]

  *) event: Send the SSL close notify alert when the KeepAliveTimeout
     expires. PR54998. [Yann Ylavic] 

  *) mod_ssl: Ensure that the SSL close notify alert is flushed to the client.
     PR54998. [Tim Kosse <tim.kosse filezilla-project.org>, Yann Ylavic] 

  *) mod_proxy: Shutdown (eg. SSL close notify) the backend connection before
     closing. [Yann Ylavic] 

  *) mod_auth_form: Add a debug message when the fields on a form are not
     recognised. [Graham Leggett]

  *) mod_cache: Preserve non-cacheable headers forwarded from an origin 304
     response. PR 55547.  [Yann Ylavic]

  *) mod_proxy_wstunnel: Fix the use of SSL connections with the "wss:"
     scheme. PR55320. [Alex Liu <alex.leo.ca gmail.com>]

  *) mod_socache_shmcb: Correct counting of expirations for status display.
     Expirations happening during retrieval were not counted. [Rainer Jung]

  *) mod_cache: Retry unconditional request with the full URL (including the
     query-string) when the origin server's 304 response does not match the
     conditions used to revalidate the stale entry.  [Yann Ylavic].

  *) mod_alias: Stop setting CONTEXT_PREFIX and CONTEXT_DOCUMENT environment
     variables as a result of AliasMatch. [Eric Covener]

  *) mod_cache: Don't add cached/revalidated entity headers to a 304 response.
     PR 55547.  [Yann Ylavic]

  *) mod_proxy_scgi: Support Unix sockets.  ap_proxy_port_of_scheme():
     Support default SCGI port (4000).  [Jeff Trawick]

  *) mod_cache: Fix AH00784 errors on Windows when the the CacheLock directive
     is enabled.  [Eric Covener]

  *) mod_expires: don't add Expires header to error responses (4xx/5xx),
     be they generated or forwarded. PR 55669.  [Yann Ylavic]

  *) mod_proxy_fcgi: Don't segfault when failing to connect to the backend.
     (regression in 2.4.9 release) [Jeff Trawick]

  *) mod_authn_socache: Fix crash at startup in certain configurations.
     PR 56371. (regression in 2.4.7) [Jan Kaluza]

  *) mod_ssl: restore argument structure for "exec"-type SSLPassPhraseDialog
     programs to the form used in releases up to 2.4.7, and emulate
     a backwards-compatible behavior for existing setups. [Kaspar Brand]

  *) mod_ssl: Add SSLOCSPUseRequestNonce directive to control whether or not
     OCSP requests should use a nonce to be checked against the responder's
     one. PR 56233. [Yann Ylavic, Kaspar Brand]

  *) mod_ssl: "SSLEngine off" will now override a Listen-based default
     and does disable mod_ssl for the vhost.  [Joe Orton]

  *) mod_lua: Enforce the max post size allowed via r:parsebody()
     [Daniel Gruno]

  *) mod_lua: Use binary comparison to find boundaries for multipart 
     objects, as to not terminate our search prematurely when hitting
     a NULL byte. [Daniel Gruno]

  *) mod_ssl: add workaround for SSLCertificateFile when using OpenSSL
     versions before 0.9.8h and not specifying an SSLCertificateChainFile
     (regression introduced with 2.4.8). PR 56410. [Kaspar Brand]

  *) mod_ssl: bring SNI behavior into better conformance with RFC 6066:
     no longer send warning-level unrecognized_name(112) alerts,
     and limit startup warnings to cases where an OpenSSL version
     without TLS extension support is used. PR 56241. [Kaspar Brand]

  *) mod_proxy_html: Avoid some possible memory access violation in case of
     specially crafted files, when the ProxyHTMLMeta directive is turned on.
     Follow up of PR 56287 [Christophe Jaillet]

  *) mod_auth_form: Make sure the optional functions are loaded even when
     the AuthFormProvider isn't specified. [Graham Leggett]

  *) mod_ssl: avoid processing bogus SSLCertificateKeyFile values
     (and logging garbled file names). PR 56306. [Kaspar Brand]

  *) mod_ssl: fix merging of global and vhost-level settings with the
     SSLCertificateFile, SSLCertificateKeyFile, and SSLOpenSSLConfCmd
     directives. PR 56353. [Kaspar Brand]

  *) mod_headers: Allow the "value" parameter of Header and RequestHeader to 
     contain an ap_expr expression if prefixed with "expr=". [Eric Covener]

  *) rotatelogs: Avoid creation of zombie processes when -p is used on
     Unix platforms.  [Joe Orton]

  *) mod_authnz_fcgi: New module to enable FastCGI authorizer
     applications to authenticate and/or authorize clients.
     [Jeff Trawick]

  *) mod_proxy: Do not try to parse the regular expressions passed by
     ProxyPassMatch as URL as they do not follow their syntax.
     PR 56074. [Ruediger Pluem]

  *) mod_reqtimeout: Resolve unexpected timeouts on keepalive requests 
     under the Event MPM. PR56216.  [Frank Meier <frank meier ergon ch>]

  *) mod_proxy_fcgi: Fix sending of response without some HTTP headers
     that might be set by filters.  PR 55558. [Jim Riggs <jim riggs.me>]

  *) mod_proxy_html: Do not delete the wrong data from HTML code when a
     "http-equiv" meta tag specifies a Content-Type behind any other
     "http-equiv" meta tag. PR 56287 [Micha Lenk <micha lenk info>]

  *) mod_proxy: Don't reuse a SSL backend connection whose requested SNI
     differs. PR 55782.  [Yann Ylavic]

  *) Add suspend_connection and resume_connection hooks to notify modules
     when the thread/connection relationship changes.  (Should be implemented
     for any third-party async MPMs.)  [Jeff Trawick]

  *) mod_proxy_wstunnel: Don't issue AH02447 and log a 500 on routine 
     hangups from websockets origin servers. PR 56299
     [Yann Ylavic, Edward Lu <Chaosed0 gmail com>, Eric Covener] 

  *) mod_proxy_wstunnel: Don't pool backend websockets connections,
     because we need to handshake every time. PR 55890.
     [Eric Covener]

  *) mod_lua: Redesign how request record table access behaves,
     in order to utilize the request record from within these tables.
     [Daniel Gruno]

  *) mod_lua: Add r:wspeek for peeking at WebSocket frames. [Daniel Gruno]

  *) mod_lua: Log an error when the initial parsing of a Lua file fails.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

  *) mod_lua: Reformat and escape script error output.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

  *) mod_lua: URL-escape cookie keys/values to prevent tainted cookie data
     from causing response splitting.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

  *) mod_lua: Disallow newlines in table values inside the request_rec, 
     to prevent HTTP Response Splitting via tainted headers.
     [Daniel Gruno, Felipe Daragon <filipe syhunt com>]

  *) mod_lua: Remove the non-working early/late arguments for 
     LuaHookCheckUserID. [Daniel Gruno]

  *) mod_lua: Change IVM storage to use shm [Daniel Gruno]

  *) mod_lua: More verbose error logging when a handler function cannot be
     found. [Daniel Gruno]

Changes with Apache 2.4.9

  *) mod_ssl: Work around a bug in some older versions of OpenSSL that
     would cause a crash in SSL_get_certificate for servers where the
     certificate hadn't been sent. [Stephen Henson]

  *) mod_lua: Add a fixups hook that checks if the original request is intended 
     for LuaMapHandler. This fixes a bug where FallbackResource invalidates the 
     LuaMapHandler directive in certain cases by changing the URI before the map 
     handler code executes [Daniel Gruno, Daniel Ferradal <dferradal gmail com>].

Changes with Apache 2.4.8 (not released)

  *) SECURITY: CVE-2014-0098 (cve.mitre.org)
     Clean up cookie logging with fewer redundant string parsing passes.
     Log only cookies with a value assignment. Prevents segfaults when
     logging truncated cookies.
     [William Rowe, Ruediger Pluem, Jim Jagielski]

  *) SECURITY: CVE-2013-6438 (cve.mitre.org)
     mod_dav: Keep track of length of cdata properly when removing
     leading spaces. Eliminates a potential denial of service from
     specifically crafted DAV WRITE requests
     [Amin Tora <Amin.Tora neustar.biz>]

  *) core: Support named groups and backreferences within the LocationMatch,
     DirectoryMatch, FilesMatch and ProxyMatch directives. (Requires
     non-ancient PCRE library) [Graham Leggett]

  *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
     TE/CL conflicts. [Yann Ylavic, Jim Jagielski]

  *) core: Detect incomplete request and response bodies, log an error and
     forward it to the underlying filters. PR 55475 [Yann Ylavic]

  *) mod_dir: Add DirectoryCheckHandler to allow a 2.2-like behavior, skipping 
     execution when a handler is already set. PR53929. [Eric Covener]

  *) mod_ssl: Do not perform SNI / Host header comparison in case of a
     forward proxy request. [Ruediger Pluem]