Newer
Older
*) mod_ssl: add experimental support for TLSv1.3 (tested with OpenSSL v1.1.1-pre9.
SSL(Proxy)CipherSuite now has an optional first parameter for the protocol the ciphers are for.
Directive "SSLVerifyClient" now triggers certificate retrieval from the client.
Verifying the client fails exactly the same for HTTP/2 connections for all SSL protocols,
as this would need to trigger the master connection thread - which we do not support
right now.
Renegotiation of ciphers is intentionally ignored for TLSv1.3 connections. "SSLCipherSuite"
does not allow to specify TLSv1.3 ciphers in a directory context (because it cannot work) and
TLSv1.2 or lower ciphers are not relevant for 1.3, as cipher suites are completely separate.
Sites which make use of such TLSv1.2 feature need to evaluate carefully if or how they
can match their needs onto the TLSv1.3 protocol.
[Yann Ylavic, Stefan Eissing]
*) mod_status: Cumulate CPU time of exited child processes in the
"cu" and "cs" values. Add CPU time of the parent process to the
"c" and "s" values.
[Rainer Jung]
*) mod_proxy: Improve the balancer member data shown in mod_status when
"ProxyStatus" is "On": add "busy" count and show byte counts in
auto mode always in units of kilobytes. [Rainer Jung]
*) mod_status: Add cumulated response duration time in milliseconds.
*) mod_status: Complete the data shown for async MPMs in "auto" mode.
Added number of processes, number of stopping processes and number
of busy and idle workers. [Rainer Jung]
*) mod_ratelimit: Don't interfere with "chunked" encoding, fixing regression
introduced in 2.4.34. PR 62568. [Yann Ylavic]
*) Allow the argument to <IfFile>, <IfDefine>, <IfSection>, <IfDirective>,
and <IfModule> to be quoted. This is primarily for the benefit of
<IfFile>. [Eric Covener]
Jim Jagielski
committed
*) mod_watchdog: Correct some log messages. [Rainer Jung]
*) mod_md: When the last domain name from an MD is moved to another one,
that now empty MD gets moved to the store archive. PR 62572.
[Stefan Eissing]
*) mod_ssl: Fix merging of SSLOCSPOverrideResponder. [Jeff Trawick,
[Frank Meier <frank meier ergon.ch>]
*) mod_proxy_balancer: Restore compatibility with APR 1.4. [Joe Orton]
*) SECURITY: CVE-2018-8011 (cve.mitre.org)
mod_md: DoS via Coredumps on specially crafted requests
*) SECURITY: CVE-2018-1333 (cve.mitre.org)
mod_http2: DoS for HTTP/2 connections by specially crafted requests
*) Introduce zh-cn and zh-tw (simplified and traditional Chinese) error
document translations. [CodeingBoy, popcorner]
*) event: avoid possible race conditions with modules on the child pool.
*) mod_proxy: Fix a corner case where the ProxyPassReverseCookieDomain or
ProxyPassReverseCookiePath directive could fail to update correctly
'domain=' or 'path=' in the 'Set-Cookie' header. PR 61560.
[Christophe Jaillet]
*) mod_ratelimit: fix behavior when proxing content. PR 62362.
[Luca Toscano, Yann Ylavic]
*) core: Re-allow '_' (underscore) in hostnames.
[Eric Covener]
*) mod_authz_core: If several parameters are used in a AuthzProviderAlias
directive, if these parameters are not enclosed in quotation mark, only
the first one is handled. The other ones are silently ignored.
Add a message to warn about such a spurious configuration.
PR 62469 [Hank Ibell <hwibell gmail.com>, Christophe Jaillet]
*) mod_md: improvements and bugfixes
- MDNotifyCmd now takes additional parameter that are passed on to the called command.
- ACME challenges have better checks for interference with other modules
- ACME challenges are only handled for domains managed by the module, allowing
other ACME clients to operate for other domains in the server.
*) mod_proxy_wstunnel: Add default schema ports for 'ws' and 'wss'.
PR 62480. [Lubos Uhliarik <luhliari redhat.com>}
*) logging: Some early logging-related startup messages could be lost
when using syslog for the global ErrorLog. [Eric Covener]
*) mod_cache: Handle case of an invalid Expires header value RFC compliant
like the case of an Expires time in the past: allow to overwrite the
non-caching decision using CacheStoreExpired and respect Cache-Control
"max-age" and "s-maxage". [Rainer Jung]
*) mod_xml2enc: Fix forwarding of error metadata/responses. PR 62180.
[Micha Lenk <micha lenk.info>, Yann Ylavic]
Yann Ylavic
committed
*) mod_proxy_http: Fix response header thrown away after the previous one
was considered too large and truncated. PR 62196. [Yann Ylavic]
*) core: Add and handle AP_GETLINE_NOSPC_EOL flag for ap_getline() family
of functions to consume the end of line when the buffer is exhausted.
PR 62198. [Yann Ylavic]
*) mod_proxy_http: Add new worker parameter 'responsefieldsize' to
allow maximum HTTP response header size to be increased past 8192
Yann Ylavic
committed
*) mod_ssl: Extend SSLOCSPEnable with mode 'leaf' that only checks the leaf
of a certificate chain. PR62112.
[Ricardo Martin Camarero <rickyepoderi yahoo.es>]
*) http: Fix small memory leak per request when handling persistent
connections. [Ruediger Pluem, Joe Orton]
*) mod_proxy_html: Fix variable interpolation and memory allocation failure
in ProxyHTMLURLMap. [Ewald Dieterich <ewald mailbox.org>]
*) mod_remoteip: Fix RemoteIP{Trusted,Internal}ProxyList loading broken by 2.4.30.
PR 62220. [Chritophe Jaillet, Yann Ylavic]
*) mod_remoteip: When overriding the useragent address from X-Forwarded-For,
zero out what had been initialized as the connection-level port. PR59931.
[Hank Ibell <hwibell gmail.com>]
*) core: In ONE_PROCESS/debug mode, cleanup everything when exiting.
[Yann Ylavic]
*) mod_proxy_balancer: Add hot spare member type and corresponding flag (R).
Hot spare members are used as drop-in replacements for unusable workers
in the same load balancer set. This differs from hot standbys which are
only used when all workers in a set are unusable. PR 61140. [Jim Riggs]
Jim Jagielski
committed
*) suexec: Add --enable-suexec-capabilites support on Linux, to use
setuid/setgid capability bits rather than a setuid root binary.
[Joe Orton]
*) suexec: Add support for logging to syslog as an alternative to
logging to a file; use --without-suexec-logfile --with-suexec-syslog.
[Joe Orton]
*) mod_ssl: Restore 2.4.29 behaviour in SSL vhost merging/enabling
which broke some rare but previously-working configs. [Joe Orton]
*) core, log: improve sanity checks for the ErrorLog's syslog config, and
explicitly allow only lowercase 'syslog' settings. PR 62102
[Luca Toscano, Jim Riggs, Christophe Jaillet]
*) mod_http2: accurate reporting of h2 data input/output per request via
mod_logio. Fixes an issue where output sizes where counted n-times on
reused slave connections. [Stefan Eissing]
*) mod_http2: Fix unnecessary timeout waits in case streams are aborted.
[Stefan Eissing]
*) mod_http2: restoring the v1.10.16 keepalive timeout behaviour of mod_http2.
[Stefan Eissing]
Yann Ylavic
committed
*) mod_proxy: Do not restrict the maximum pool size for backend connections
any longer by the maximum number of threads per process and use a better
default if mod_http2 is loaded.
[Yann Ylavic, Ruediger Pluem, Stefan Eissing, Gregg Smith]
*) mod_slotmem_shm: Add generation number to shm filename to fix races
with graceful restarts. PRs 62044 and 62308. [Jim Jagielski, Yann Ylavic]
*) core: Preserve the original HTTP request method in the '%<m' LogFormat
when an path-based ErrorDocument is used. PR 62186.
*) mod_remoteip: make proxy-protocol work on slave connections, e.g. in
HTTP/2 requests. [Stefan Eissing]
See also https://github.com/roadrunner2/mod-proxy-protocol/issues/6
*) mod_ssl: Fix merging of proxy SSL context outside <Proxy> sections,
regression introduced in 2.4.30. PR 62232. [Rainer Jung, Yann Ylavic]
*) mod_md: Fix compilation with OpenSSL before version 1.0.2. [Rainer Jung]
*) mod_dumpio: do nothing below log level TRACE7. [Yann Ylavic]
*) mod_remoteip: Restore compatibility with APR 1.4 (apr_sockaddr_is_wildcard).
[Eric Covener]
*) core: On ECBDIC platforms, some errors related to oversized headers
may be misreported or be logged as ASCII escapes. PR 62200
*) mod_ssl: Fix cmake-based build. PR 62266. [Rainer Jung]
*) core: Add <IfFile>, <IfDirective> and <IfSection> conditional
section containers. [Eric Covener, Joe Orton]
Loading full blame...