Change default for SSLCompression to off, as compression
causes security issues in most setups

Submitted by: sf
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1400962 13f79535-47bb-0310-9956-ffa450edef68

Allow forced setting of TLS1.1 and TLS1.2 protocols with
the -f command-line switch, and adapt the output to more accurately
report what SSL/TLS protocol was negotiated (use SSL_get_version()
instead of SSL_CIPHER_get_version()).

PR: 53916
Submitted by: Nicolás Pernas Maradei <nico emutex com>
Reviewed/amended by: Kaspar Brand

Submitted by: kbrand
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1400946 13f79535-47bb-0310-9956-ffa450edef68

core: ErrorDocument now works for requests without a Host header.

PR: 48357

Submitted by: trawick
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1394035 13f79535-47bb-0310-9956-ffa450edef68

* server/mpm/prefork/prefork.c (child_main): Don't log errors for an
  apr_pollset_add() failure if a graceful-stop has been signalled.

follow up to r1387633: use the right exit code depending on the error scenario

Submitted by: jorton, trawick
Reviewed by: trawick, minfrin, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1393382 13f79535-47bb-0310-9956-ffa450edef68

trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1386576
             http://svn.apache.org/viewvc?view=revision&revision=1386578
2.4.x patch: trunk patch works
+1: jim, druggeri, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1393199 13f79535-47bb-0310-9956-ffa450edef68

stale content because of a proxy error. PR 53539. Correction to r1361153.
trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1373447
2.4.x patch: trunk patch works.
+1: rjung, jim, minfrin


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1393191 13f79535-47bb-0310-9956-ffa450edef68

Fix crash in packet dump code of mod_proxy_ajp when
logging with LogLevel trace7 or trace8.

PR 53730

Submitted by: rjung
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1390510 13f79535-47bb-0310-9956-ffa450edef68

Revert r1371878 --  default configuration changes that drop the DNT
header from IE10.

See:
  Message-ID: <CALK=YjMGPNHBqNiad-ghzcEzxDovQgYOpjpSSyXmN=r74v43qg@mail.gmail.com>
  PR 53845



Keep this in, but commented out: also provide a little
more background/rationale. This, hopefully, satisfies both
ends of the debate: we don't "assume" that everyone who
uses this browser didn't make the specific choice, but
we allow for admins who care about DNT and want to either
  1. Make a statement
  2. Force adherence to the standard
to easily do so.
Submitted by: covener, jim
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1389261 13f79535-47bb-0310-9956-ffa450edef68

Apply the same length limit when logging Status header values
as used when logging invalid header lines.

Application of a limit on logged header data suggested by Jeff Trawick.


Catch up change log with r1376695.

Submitted by: chrisd
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1389260 13f79535-47bb-0310-9956-ffa450edef68

Avoid the overhead of creating and grabbing a uuid for
the balancer nonce if we're never going to use it.
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1388549 13f79535-47bb-0310-9956-ffa450edef68

* modules/ssl/ssl_engine_io.c (ssl_io_filter_handshake): Add a
  wildcard common name match.

PR: 53006

Submitted by: jorton
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1388547 13f79535-47bb-0310-9956-ffa450edef68

which display information about the server configuration (backport r1374428).
Submitted by: trawick
Reviewed/backported by: gsmith, fuankg


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1386956 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1375509 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374367 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374364 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374300 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374264 13f79535-47bb-0310-9956-ffa450edef68

  *) mod_authnz_ldap: Don't try a potentially expensive nested groups
     search before exhausting all AuthLDAPGroupAttribute checks on the
     current group. PR52464



whitespace only: shift a block refactored in r1231255 over 8 spaces.


Submitted by: covener
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374256 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374253 13f79535-47bb-0310-9956-ffa450edef68

Add new directive LuaAuthzProvider to allow implementing an
authorization provider in lua


There is only one global provider name space, therefore allow
LuaAuthzProvider only in global scope.

Remove unnecessary server config field.

Submitted by: sf
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374252 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373668 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373443 13f79535-47bb-0310-9956-ffa450edef68

in some 32 bit builds, especially on Solaris Sparc.

PR 53040.

Backport of r1373270 from trunk.

Submitted by: rjung
Reviewed by: rpluem, trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373439 13f79535-47bb-0310-9956-ffa450edef68

changes.

The trunk patches for these all have some configuration breakage
as 2.4.x interprets the individual directive or API parameter as
relative to ServerRoot whereas trunk interprets everything
relative to DefaultRuntimeDir.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373168 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373163 13f79535-47bb-0310-9956-ffa450edef68

Merge r1361153 from trunk:

* Set content type in case we return stale content.
Submitted by: rpluem
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373115 13f79535-47bb-0310-9956-ffa450edef68

Windows: Fix SSL failures on windows with AcceptFilter https none.

The now-stray apr_socket_opt_set(APR_SO_NONBLOCK=On) call was 
originally added with r327872.  The call was harmless on Unix
due to APR's use of non-blocking sockets when implementing timeouts
on that platform, but harmful on Windows since it collided with
APR's different implementation of timeouts on that platform.

PR: 52476

Submitted by: trawick
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373108 13f79535-47bb-0310-9956-ffa450edef68

mod_lbmethod_heartbeat, mod_heartmonitor: Respect DefaultRuntimeDir/
DEFAULT_REL_RUNTIMEDIR for the heartbeat storage file.


core: Respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR for the
scoreboard (ScoreBoardFile).


The Pidfile directive and ap_log_pid()/ap_remove_pid()/ap_read_pid()
now respect DefaultRuntimeDir


Mutex directive: finish support of DefaultRuntimeDir

a partial conversion was made in r1299718, but I'm not
sure when that change is effective


mod_socache_shmcb and mod_socache_dbm: finish support of
DefaultRuntimeDir

a partial conversion was made in r1299718, affecting cases
where no filename was specified


mod_slotmem_plain: make the "filename" key relative to
DefaultRuntimeDir if not absolute

mod_slotmem_plain does not externalize or check the full path
in any way, so this change is just for consistency with other
modules which build paths to run-time artifacts.


make LDAPSharedCacheFile relative to DefaultRuntimeDir

Submitted by: trawick
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373105 13f79535-47bb-0310-9956-ffa450edef68

When -B is specified, search for a host address in the
same family as the specified outbound interface.  If 
impossible, fail at name resolution instead of bind().


ab: Fix read failure when targeting SSL server.

Submitted by: trawick
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373084 13f79535-47bb-0310-9956-ffa450edef68

mod_auth_digest now respects DefaultRuntimeDir
Submitted by: trawick
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1373081 13f79535-47bb-0310-9956-ffa450edef68

Also switch to the non-deprecated APR_FOPEN_* flags.
PR: 45923

Backport of r1369618 from trunk.

Submitted by: sf
Reviewed by: rjung, trawick, humbedooh
Backported by: rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1372373 13f79535-47bb-0310-9956-ffa450edef68

Use apr_pcalloc for rewritemap_entry struct, to avoid uninitialized entries.

PR: 53663
Submitted by: Mikhail T. <mi apache aldan algebra com>


remove now unecessary assignment


Add changes entry for r1369995, r1369999

Submitted by: sf
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1371208 13f79535-47bb-0310-9956-ffa450edef68

TLS-level compression.

PR 53219.

Backport of r1345319 and r1348656 from trunk.

Submitted by: Bjoern Jacke <bjoern j3e de>, sf
Reviewed by: rjung, trawick
Backported by: rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1369585 13f79535-47bb-0310-9956-ffa450edef68

r1201460: Add some todos from apachecon notes.
          Submitted by: covener

r1351012: Change prototype of vm_construct, to work around gcc bug which
          causes a segfault.  PR: 52779
          Submitted by: Dick Snippe <Dick Snippe tech omroep nl>

r1351013: Allow tail call optimization in log methods, remove foo method.
          Submitted by: sf

r1351014: Add a few missing request_rec fields. Rename remote_ip to
          client_ip to match conn_rec.
          Submitted by: sf

r1351017: Change various strings from char * to const char *.
          Submitted by: sf

r1351018: Factor common code into utility function.
          Also improve logging a bit and adjust some log levels.
          Submitted by: sf

r1351019: Use macro to make definition of integer fields more compact.
          Submitted by: sf

Reviewed by: humbedooh, covener, sf
Backported by: humbedooh, rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1369494 13f79535-47bb-0310-9956-ffa450edef68

- Keep track of the number of clogged, lingering, and suspended connections.
- Don't count connections in lingering close state when calculating
  how many additional connections may be accepted

Backport of r1361773 and r 1361778 from trunk.

Submitted by: sf
Reviewed by: rjung, jim
Backported by: rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1369473 13f79535-47bb-0310-9956-ffa450edef68

the main error log, pointing to the appropriate virtual host error log.

Backport of r1348660 from trunk.

Submitted by: sf
Reviewed by: rjung, covener
Backported by: rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1369464 13f79535-47bb-0310-9956-ffa450edef68

Use short lived pool to avoid memory leaks

Remove the comment about binding upstream and downstream connections. It
seems to be obsolete since r104604, r104605, r105108.

Also avoid allocating memory if we are not handling the connection.

PR: 52275
Submitted by: Naohiro Ooiwa <naohiro ooiwa miraclelinux com>, Stefan Fritsch

Submitted by: sf
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1368450 13f79535-47bb-0310-9956-ffa450edef68

        trunk patch: http://svn.apache.org/viewvc?rev=1365001&view=rev and
                          http://svn.apache.org/viewvc?rev=1365020&view=rev and
                                            http://svn.apache.org/viewvc?rev=1365029&view=rev
                                                 2.4.x patch: http://people.apache.org/~jorton/ap_proxyblock-24x-v2.diff [avoids major MMN bump]
                                                      +1: jorton, rjung, jim



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1366693 13f79535-47bb-0310-9956-ffa450edef68

mod_proxy_balancer: Restore balancing after a failed worker has
recovered when using lbmethod_bybusyness.

PR: 48735

Markus Stoll and Adam C both submitted patches against 2.2.x
to bug 48735.  Compared with those two, this solution

1. resets the busy field in the error-ed worker at the end of
   the request instead of at recovery time
2. leaves the lbstatus field alone
3. covers all possible scenarios where the busy field in the
   error-ed worker needs to be adjusted, since a cleanup to
   perform the decrement is registered at the point of the
   increment

Submitted by: trawick
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1366691 13f79535-47bb-0310-9956-ffa450edef68

during startup This should save some memory, especially with .htaccess

Backport of r1343099.

Submitted by: sf
Reviewed by: rjung, jim
Backported by: rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1365774 13f79535-47bb-0310-9956-ffa450edef68