mod_cache_socache: avoid pool to heap reallocation.

Below some threshold, the previous code tried free (sub-)pooled memory ASAP by
moving small buffers (< capacity / 2) to a heap bucket. But this is not really
an optimization because first it requires at some point to allocate more than
the configured capacity, and second since this happens during response handling
the pool is about to be destroyed soon anymay.

This commit simply keeps the data in the subpool and uses a pool bucket for the
output brigade to take care of the lifetime until it's consumed (or not).


Follow up to r1853874: CHANGES entry.
Submitted by: ylavic
Reviewed by: ylavic, icing, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1855407 13f79535-47bb-0310-9956-ffa450edef68

mod_http2: enable re-use of slave connections again.


mod_http2: fixed slave connection keepalives counter.

Submitted by: icing
Reviewed by: icing, ylavic, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1855406 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1855393 13f79535-47bb-0310-9956-ffa450edef68

  *) http: Fix possible empty response with mod_ratelimit for HEAD requests.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1855391 13f79535-47bb-0310-9956-ffa450edef68

MPMs unix: bind the bucket number of each child to its slot number

We need not remember each child's bucket number in SHM for restarts, for the
lifetime of the httpd main process the bucket number can be bound to the slot
number such that: bucket = slot % num_buckets.

This both simplifies the logic and helps children maintenance per bucket in
threaded MPMs, where previously perform_idle_server_maintenance() could create
or kill children processes for the buckets it was not in charge of.

Submitted by: ylavic
Reviewed by: ylavic, rpluem, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1855378 13f79535-47bb-0310-9956-ffa450edef68

Fix a race condition.  Authentication with valid credentials could be
refused in case of concurrent accesses from different users.

PR: 63124
Submitted by: Simon Kappel <simon.kappel axis.com>
Reviewed by: jailletc36, icing, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1855298 13f79535-47bb-0310-9956-ffa450edef68

   * mod_proxy_wstunnel: Fix websocket proxy over UDS.

PR: 62932
Submitted by: <pavel dcmsys.com>
Reviewed by: jailletc36 (by inspection), jim, ylavic
Backported by: jailletc36

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1853653 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1853203 13f79535-47bb-0310-9956-ffa450edef68

mod_ssl: Don't unset FIPS mode on restart unless it's forced by
     configuration (SSLFIPS on) and not active by default in OpenSSL. PR 63136.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1853197 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851837 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851570 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851567 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851561 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851559 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851550 13f79535-47bb-0310-9956-ffa450edef68

Clear retry flags before aborting on client-initiated reneg.

PR: 63052
Backports: r1850946
Submitted by: Joe Orton
Reviewed by: wrowe, jorton, rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851471 13f79535-47bb-0310-9956-ffa450edef68

per https://tools.ietf.org/html/rfc7231#section-3.1.3.1  

PR: 39730
Backports: r1850989
Submitted by: jailletc36
Reviewed by: jailletc36, wrowe, jim



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851468 13f79535-47bb-0310-9956-ffa450edef68

Backport r1850947 from trunk
Submitted by: hwibell
Reviewed by: hwibell, covener, wrowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851409 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1851342 13f79535-47bb-0310-9956-ffa450edef68

  *) mod_md: incorrect behaviour when synchronizing ongoing ACME challenges
     have been fixed. [Michael Kaufmann, Stefan Eissing]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1849176 13f79535-47bb-0310-9956-ffa450edef68

I only tested, added a test case and proposed for backport.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1848980 13f79535-47bb-0310-9956-ffa450edef68

core: Fix incorrect substitution of env vars in directives containing multiple env vars.

In ap_resolve_env(), the string returned from getenv() should be copied since
the returned string may be statically allocated.

This fixes an issue where the value for the last env var is substituted for all
env vars in a directive containing multiple env vars.

Submitted by: hwibell
Reviewed by: hwibell, covener, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1848686 13f79535-47bb-0310-9956-ffa450edef68

PR62311: only create the rewritelock when needed

Submitted By: Hank Ibell <hwibell gmail.com>
Committed By: covener



Submitted by: covener
Reviewed by: jailletc36, icing (by inspection), covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1848681 13f79535-47bb-0310-9956-ffa450edef68

   in the expression does NOT match. In this case val is NULL
   and we should just set the value for the environment variable
   like in the pattern case.
+1: jailletc36, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847292 13f79535-47bb-0310-9956-ffa450edef68

   an absolute URI on the request line
+1: jailletc36, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847290 13f79535-47bb-0310-9956-ffa450edef68

   trunk patch: http://svn.apache.org/r1843244
+1: elukey, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847288 13f79535-47bb-0310-9956-ffa450edef68

   just like worker.
+1: covener, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847286 13f79535-47bb-0310-9956-ffa450edef68

   connections, and PR 61519 where $HTTPS was incorrect for the
   "SSLEngine optional" case.
+1: jorton, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847284 13f79535-47bb-0310-9956-ffa450edef68

         not cleared beforehand.
+1: icing, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847280 13f79535-47bb-0310-9956-ffa450edef68

This messes-up error handling performed in 'ssl_io_filter_error()'
+1: ylavic, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1847278 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1846255 13f79535-47bb-0310-9956-ffa450edef68

If ProxyPassReverse is used for reverse mapping of relative redirects, subsequent ProxyPassReverse statements, whether they are relative or absolute, may fail.

PR 60408 [Peter Haworth <pmh1wheel gmail.com>]
Submitted by: jailletc36
Reviewed by: jailletc36, rpluem, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1846044 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1844248 13f79535-47bb-0310-9956-ffa450edef68

by SSLProxyMachineCertificate{File|Path}.

The certificates and keys loaded during configuration time got lost during
runtime if e.g. SSLProxyMachineCertificate{File|Path} was set on virtual host
level and there was an SSL directive at directory level, e.g. SSLRequire.

This fixes a regression likely introduced in r1740928 (backported in r1824187).

Backport of r1844002 from trunk.

Submitted by: rjung
Reviewed by: rjung, rpluem, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1844226 13f79535-47bb-0310-9956-ffa450edef68

down below.

This fixes a crash during SSL renegotiation with OptRenegotiate set,
when client certificates are available from the original handshake
but were originally not verified and should get verified now.
This is a regression in 2.4.36 (unreleased).

Backport of r1828793 from trunk.

Submitted by: rjung
Reviewed by: rjung, rpluem, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1844223 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1844069 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1843493 13f79535-47bb-0310-9956-ffa450edef68

mod_brotli, mod_deflate: Restore the separate handling of 304 Not Modified
responses allowing these modules to properly set or fix-up the response
headers such as Vary or ETag.

This change follows up on r1837056 that disabled that special handling and
thus resulted in a potential violation of RFC7232, 4.1:

   The server generating a 304 response MUST generate any of the following
   header fields that would have been sent in a 200 (OK) response to the
   same request: Cache-Control, Content-Location, Date, ETag, Expires,
   and Vary.)

References:
  https://lists.apache.org/thread.html/f5733ca6743757e8aa8b58a0cd9e27680971551c2a20f5606c66507e@%3Cdev.httpd.apache.org%3E
  https://tools.ietf.org/html/rfc7232#section-4.1
Submitted by: kotkov
Reviewed by: kotkov, ylavic, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1843469 13f79535-47bb-0310-9956-ffa450edef68

mod_http2: adding defensive code for stream EOS handling, in case the request handler
     missed to signal it the normal way (eos buckets). Addresses github issues 
     https://github.com/icing/mod_h2/issues/164, https://github.com/icing/mod_h2/issues/167
     and https://github.com/icing/mod_h2/issues/170. 


Submitted by: icing
Reviewed by: icing, ylavic, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1843468 13f79535-47bb-0310-9956-ffa450edef68

These need to be signed longs... cast as needed.


Add CHANGES entry
Submitted by: jim, jailletc36
Reviewed by: jailletc36 (by inspection), ylavic, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1843467 13f79535-47bb-0310-9956-ffa450edef68