Académique Documents
Professionnel Documents
Culture Documents
16
*) http: Fix LimitRequestBody checks when there is no more bytes to read.
[Michael Kaufmann <mail michael-kaufmann.ch>]
*) mod_alias: Revert expression parser support for Alias, ScriptAlias
and Redirect due to a regression (introduced in 2.4.13, not released).
*) mod_reqtimeout: Don't let pipelining checks and keep-alive times interfere
with the timeouts computed for subsequent requests. PR 56729.
[Eric Covener, Yann Ylavic]
*) core: Avoid a possible truncation of the faulty header included in the
HTML response when LimitRequestFieldSize is reached. [Yann Ylavic]
*) mod_ldap: In some case, LDAP_NO_SUCH_ATTRIBUTE could be returned instead
of an error during a compare operation. [Eric Covener]
Changes with Apache 2.4.15
*) mod_ext_filter, mod_charset_lite: Avoid inadvertent filtering of protocol
data during read of chunked request bodies. PR 58049.
[Edward Lu <Chaosed0 gmail.com>]
*) mod_ldap: Stop leaking LDAP connections when 'LDAPConnectionPoolTTL 0'
is configured. PR 58037. [Ted Phelps <phelps gnusto.com>]
*) core: Allow spaces after chunk-size for compatibility with implementations
using a pre-filled buffer. [Yann Ylavic, Jeff Trawick]
*) mod_ssl: Remove deprecated SSLCertificateChainFile warning.
[Yann Ylavic]
Changes with Apache 2.4.14
*) SECURITY: CVE-2015-3183 (cve.mitre.org)
core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from
the HTTP_IN filter, parse chunks in a single pass with zero copy.
Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
authorized characters. [Graham Leggett, Yann Ylavic]
*) SECURITY: CVE-2015-3185 (cve.mitre.org)
Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
with new ap_some_authn_required and ap_force_authn hook. [Ben Reser]
Changes with Apache 2.4.13
*) SECURITY: CVE-2015-0253 (cve.mitre.org)
core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
with the INCLUDES filter active, introduced in 2.4.11. PR 57531.
[Yann Ylavic]
*) SECURITY: CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.
[Edward Lu <Chaosed0 gmail.com>]
*) mod_proxy: Don't put the worker in error state for 500 or 503 errors
returned by the backend unless failonstatus is configured to. PR 56925.
[Yann Ylavic]
*) core: Don't lowercase the argument to SetHandler if it begins with
"proxy:unix". PR 57968. [Eric Covener]
*) mod_ssl OCSP Stapling: Don't block initial handshakes while refreshing
the OCSP response for a different certificate. mod_ssl has an additional
global mutex, "ssl-stapling-refresh". PR 57131 (partial fix).
[Jeff Trawick]
*) mod_authz_dbm: Fix crashes when "dbm-file-group" is used and
authz modules were loaded in the "wrong" order. [Joe Orton]
*) mod_authn_dbd, mod_authz_dbd, mod_session_dbd, mod_rewrite: Fix lifetime
of DB lookup entries independently of the selected DB engine. PR 46421.
[Steven whitson <steven.whitson gmail com>, Jan Kaluza, Yann Ylavic].
*) In alignment with RFC 7525, the default recommended SSLCipherSuite
and SSLProxyCipherSuite now exclude RC4 as well as MD5. Also, the
default recommended SSLProtocol and SSLProxyProtocol directives now
exclude SSLv3. Existing configurations must be adjusted by the
administrator. [William Rowe]
*) mod_ssl: Add support for extracting subjectAltName entries of type
rfc822Name and dNSName into SSL_{CLIENT,SERVER}_SAN_{Email,DNS}_n
environment variables. Also addresses PR 57207. [Kaspar Brand]
*) dav_validate_request: avoid validating locks and ETags when there are
no If headers providing them on a resource we aren't modifying.
[Ben Reser]
*) mod_proxy_scgi: ProxySCGIInternalRedirect now allows an alternate
response header to be used by the application, for when the application
or framework is unable to return Location in the internal-redirect
form. [Jeff Trawick]
*) core: Cleanup the request soon/even if some output filter fails to
handle the EOR bucket. [Yann Ylavic]
*) mpm_event: Allow for timer events duplicates. [Jim Jagielski, Yann Ylavic]
*) mod_proxy, mod_ssl, mod_cache_socache, mod_socache_*: Support machine
readable server-status produced when using the "?auto" query string.
[Rainer Jung]
*) mod_status: Add more data to machine readable server-status produced
when using the "?auto" query string. [Rainer Jung]
*) mod_ssl: Check for the Entropy Gathering Daemon (EGD) availability at
configure time (RAND_egd), and complain if SSLRandomSeed requires using
it otherwise. [Bernard Spil <pil.oss gmail com>, Stefan Sperling,
Kaspar Brand]
*) mod_ssl: make sure to consistently output SSLCertificateChainFile
deprecation warnings, when encountered in a VirtualHost block.
[Falco Schwarz <hiding falco.me>]
*) mod_log_config: Add "%{UNIT}T" format to output request duration in
t]
[Eric Covener]
*) mod_lua: Redesign how request record table access behaves,
in order to utilize the request record from within these tables.
[Daniel Gruno]
*) mod_lua: Add r:wspeek for peeking at WebSocket frames. [Daniel Gruno]
*) mod_lua: Log an error when the initial parsing of a Lua file fails.
[Daniel Gruno, Felipe Daragon <filipe syhunt com>]
*) mod_lua: Reformat and escape script error output.
[Daniel Gruno, Felipe Daragon <filipe syhunt com>]
*) mod_lua: URL-escape cookie keys/values to prevent tainted cookie data
from causing response splitting.
[Daniel Gruno, Felipe Daragon <filipe syhunt com>]
*) mod_lua: Disallow newlines in table values inside the request_rec,
to prevent HTTP Response Splitting via tainted headers.
[Daniel Gruno, Felipe Daragon <filipe syhunt com>]
*) mod_lua: Remove the non-working early/late arguments for
LuaHookCheckUserID. [Daniel Gruno]
*) mod_lua: Change IVM storage to use shm [Daniel Gruno]
*) mod_lua: More verbose error logging when a handler function cannot be
found. [Daniel Gruno]
Changes with Apache 2.4.9
*) mod_ssl: Work around a bug in some older versions of OpenSSL that
would cause a crash in SSL_get_certificate for servers where the
certificate hadn't been sent. [Stephen Henson]
*) mod_lua: Add a fixups hook that checks if the original request is intended
for LuaMapHandler. This fixes a bug where FallbackResource invalidates the
LuaMapHandler directive in certain cases by changing the URI before the map
.
handler code executes [Daniel Gruno, Daniel Ferradal <dferradal gmail com>]
s.
ng
all workers are busy, don't accept new connections in that process.
[Stefan Fritsch]
*) mpm_event: Process lingering close asynchronously instead of tying up
worker threads. [Jeff Trawick, Stefan Fritsch]
*) mpm_event: If MaxMemFree is set, limit the number of pools that is kept
around. [Stefan Fritsch]
*) mpm_event: Fix graceful restart aborting connections. PR 43359.
[Takashi Sato <takashi lans-tv com>]
*) mod_ssl: Disable AECDH ciphers in example config. PR 51363.
[Rob Stradling <rob comodo com>]
*) core: Introduce new function ap_get_conn_socket() to access the socket of
a connection. [Stefan Fritsch]
*) mod_data: Introduce a filter to support RFC2397 data URLs. [Graham
Leggett]
*) mod_userdir/mod_alias/mod_vhost_alias: Correctly set DOCUMENT_ROOT,
CONTEXT_DOCUMENT_ROOT, CONTEXT_PREFIX. PR 26052. PR 46198.
[Stefan Fritsch]
*) core: Allow to override document_root on a per-request basis. Introduce
new context_document_root and context_prefix which provide information
about non-global URI-to-directory mappings (from e.g. mod_userdir or
mod_alias) to scripts. PR 49705. [Stefan Fritsch]
*) core: Add <ElseIf> and <Else> to complement <If> sections.
[Stefan Fritsch]
*) mod_ext_filter: Remove DebugLevel option in favor of per-module loglevel.
[Stefan Fritsch]
*) mod_include: Make the "#if expr" element use the new "ap_expr" expression
parser. The old parser can still be used by setting the new directive
SSILegacyExprParser. [Stefan Fritsch]
*) core: Add some features to ap_expr for use by mod_include: a restricted
mode that does not allow to bypass request access restrictions; new
variables DOCUMENT_URI (alias for REQUEST_URI), LAST_MODIFIED; -A as an
alias for -U; an additional data entry in ap_expr_eval_ctx_t for use by
the consumer; an extensible ap_expr_exec_ctx() API that allows to use that
data entry. [Stefan Fritsch]
*) mod_include: Merge directory configs instead of one SSI* config directive
causing all other per-directory SSI* config directives to be reset.
[Stefan Fritsch]
*) mod_charset_lite: Remove DebugLevel option in favour of per-module
loglevel. [Stefan Fritsch]
*) core: Add ap_regexec_len() function that works with non-null-terminated
strings. PR 51231. [Yehezkel Horowitz <horowity checkpoint com>]
*) mod_authnz_ldap: If the LDAP server returns constraint violation,
don't treat this as an error but as "auth denied". [Stefan Fritsch]
[Joe Orton]
*) core: Apply <If> sections to all requests, not only to file base requests.
Allow to use <If> inside <Directory>, <Location>, and <Files> sections.
The merging of <If> sections now happens after the merging of <Location>
sections, even if an <If> section is embedded inside a <Directory> or
<Files> section. [Stefan Fritsch]
*) mod_proxy: Refactor usage of shared data by dropping the scoreboard
and using slotmem. Create foundation for dynamic growth/changes of
members within a balancer. Remove BalancerNonce in favor of a
per-balancer 'nonce' parameter. [Jim Jagielski]
*) mod_status: Don't show slots which are disabled by MaxClients as open.
PR 47022 [Jordi Prats <jordi prats gmail com>, Stefan Fritsch]
*) mpm_prefork: Fix ap_mpm_query results for AP_MPMQ_MAX_DAEMONS and
AP_MPMQ_MAX_THREADS.
*) mod_authz_core: Fix bug in merging logic if user-based and non-user-based
authorization directives were mixed. [Stefan Fritsch]
*) mod_authn_socache: change directive name from AuthnCacheProvider
to AuthnCacheProvideFor. The term "provider" is overloaded in
this module, and we should avoid confusion between the provider
of a backend (AuthnCacheSOCache) and the authn provider(s) for
which this module provides cacheing (AuthnCacheProvideFor).
[Nick Kew]
*) mod_proxy_http: Allocate the fake backend request from a child pool
of the backend connection, instead of misusing the pool of the frontend
request. Fixes a thread safety issue where buckets set aside in the
backend connection leak into other threads, and then disappear when
the frontend request is cleaned up, in turn causing corrupted buckets
to make other threads spin. [Graham Leggett]
*) mod_ssl: Change the format of the SSL_{CLIENT,SERVER}_{I,S}_DN variables
to be RFC 2253 compatible, convert non-ASCII characters to UTF8, and
escape other special characters with backslashes. The old format can
still be used with the LegacyDNStringFormat argument to SSLOptions.
*) core, mod_rewrite: Make the REQUEST_SCHEME variable available to
scripts and mod_rewrite. [Stefan Fritsch]
*) mod_rewrite: Allow to use arbitrary boolean expressions (ap_expr) in
RewriteCond. [Stefan Fritsch]
*) mod_rewrite: Allow to unset environment variables using E=!VAR.
PR 49512. [Mark Drayton <mark markdrayton info>, Stefan Fritsch]
*) mod_headers: Restore the 2.3.8 and earlier default for the first
argument of the Header directive ("onsuccess"). [Eric Covener]
*) core: Disallow the mixing of relative and absolute Options PR 33708.
[Snke Tesch <st kino-fahrplan.de>]
*) core: When exporting request headers to HTTP_* environment variables,
drop variables whose names contain invalid characters. Describe in the
docs how to restore the old behaviour. [Malte S. Stretz <mss apache org>]
*) core: When selecting an IP-based virtual host, favor an exact match for
the port over a wildcard (or omitted) port instead of favoring the one
that came first in the configuration file. [Eric Covener]
*) core: Overlapping virtual host address/port combinations now implicitly
enable name-based virtual hosting for that address. The NameVirtualHost
directive has no effect, and _default_ is interpreted the same as "*".
[Eric Covener]
*) core: In the absence of any Options directives, the default is now
"FollowSymlinks" instead of "All". [Igor Gali ]
*) rotatelogs: Add -e option to write logs through to stdout for optional
further processing. [Graham Leggett]
*) mod_ssl: Correctly read full lines in input filter when the line is
incomplete during first read. PR 50481. [Ruediger Pluem]
*) mod_authz_core: Add AuthzSendForbiddenOnFailure directive to allow
sending '403 FORBIDDEN' instead of '401 UNAUTHORIZED' if authorization
fails for an authenticated user. PR 40721. [Stefan Fritsch]
Changes with Apache 2.3.10
*) mod_rewrite: Don't implicitly URL-escape the original query string
when no substitution has changed it. PR 50447. [Eric Covener]
*) core: Honor 'AcceptPathInfo OFF' during internal redirects,
such as per-directory mod_rewrite substitutions. PR 50349.
[Eric Covener]
*) mod_rewrite: Add 'RewriteOptions InheritBefore' to put the base
rules/conditions before the overridden rules/conditions. PR 39313.
[Jrme Grandjanny <jerome.grandjanny cea.fr>]
*) mod_autoindex: add IndexIgnoreReset to reset the list of IndexIgnored
filenames in higher precedence configuration sections. PR 24243.
[Eric Covener]
*) mod_cgid: RLimit* directive support for mod_cgid. PR 42135
[Eric Covener]
*) core: Fail startup when the argument to ServerName looks like a glob
or a regular expression instead of a hostname (*?[]). PR 39863
[Rahul Nair <rahul.g.nair gmail.com>]
*) mod_userdir: Add merging of enable, disable, and filename arguments
to UserDir directive, leaving enable/disable of userlists unmerged.
PR 44076 [Eric Covener]
*) httpd: When no -k option is provided on the httpd command line, the server
was starting without checking for an existing pidfile. PR 50350
[Eric Covener]
*) mod_proxy: Put the worker in error state if the SSL handshake with the
backend fails. PR 50332.
[Daniel Ruggeri <DRuggeri primary.net>, Ruediger Pluem]
*) mod_cache_disk: Fix Windows build which was broken after renaming
the module. [Gregg L. Smith]
[Eric Covener]
*) mod_rewrite: Add END flag for RewriteRule to prevent further rounds
of rewrite processing when a per-directory substitution occurs.
[Eric Covener]
*) mod_ssl: Make sure to always log an error if loading of CA certificates
fails. PR 40312. [Paul Tiemann <issues apache org ourdetour com>]
*) mod_dav: Send 501 error if unknown Content-* header is received for a PUT
request (RFC 2616 9.6). PR 42978. [Stefan Fritsch]
*) mod_dav: Send 400 error if malformed Content-Range header is received for
a put request (RFC 2616 14.16). PR 49825. [Stefan Fritsch]
*) mod_proxy: Release the backend connection as soon as EOS is detected,
so the backend isn't forced to wait for the client to eventually
acknowledge the data. [Graham Leggett]
*) mod_proxy: Optimise ProxyPass within a Location so that it is stored
per-directory, and chosen during the location walk. Make ProxyPass
work correctly from within a LocationMatch. [Graham Leggett]
*) core: Fix segfault if per-module LogLevel is on virtual host
scope. PR 50117. [Stefan Fritsch]
*) mod_proxy: Move the ProxyErrorOverride directive to have per
directory scope. [Graham Leggett]
*) mod_allowmethods: New module to deny certain HTTP methods without
interfering with authentication/authorization. [Paul Querna,
Igor Gali , Stefan Fritsch]
*) mod_ssl: Log certificate information and improve error message if client
cert verification fails. PR 50093, PR 50094. [Lassi Tuura <lat cern ch>,
Stefan Fritsch]
*) htcacheclean: Teach htcacheclean to limit cache size by number of
inodes in addition to size of files. Prevents a cache disk from
running out of space when many small files are cached.
[Graham Leggett]
*) core: Rename MaxRequestsPerChild to MaxConnectionsPerChild, which
describes more accurately what the directive does. The old name
still works but logs a warning. [Stefan Fritsch]
*) mod_cache: Optionally serve stale data when a revalidation returns a
5xx response, controlled by the CacheStaleOnError directive.
[Graham Leggett]
*) htcacheclean: Allow the listing of valid URLs within the cache, with
the option to list entry metadata such as sizes and times. [Graham
Leggett]
*) mod_cache: correctly parse quoted strings in cache headers.
PR 50199 [Nick Kew]
*) mod_cache: Allow control over the base URL of reverse proxied requests
using the CacheKeyBaseURL directive, so that the cache key can be
calculated from the endpoint URL instead of the server URL. [Graham
Leggett]
*) mod_cache: CacheLastModifiedFactor, CacheStoreNoStore, CacheStorePrivate,
CacheStoreExpired, CacheIgnoreNoLastMod, CacheDefaultExpire,
CacheMinExpire and CacheMaxExpire can be set per directory/location.
[Graham Leggett]
*) mod_disk_cache: CacheMaxFileSize, CacheMinFileSize, CacheReadSize and
CacheReadTime can be set per directory/location. [Graham Leggett]
*) core: Speed up config parsing if using a very large number of config
files. PR 50002 [andrew cloudaccess net]
*) mod_cache: Support the caching of HEAD requests. [Graham Leggett]
*) htcacheclean: Allow the option to round up file sizes to a given
block size, improving the accuracy of disk usage. [Graham Leggett]
*) mod_ssl: Add authz providers for use with mod_authz_core and its
RequireAny/RequireAll containers: 'ssl' (equivalent to SSLRequireSSL),
'ssl-verify-client' (for use with 'SSLVerifyClient optional'), and
'ssl-require' (expressions with same syntax as SSLRequire).
[Stefan Fritsch]
*) mod_ssl: Make the ssl expression parser thread-safe. It now requires
bison instead of yacc. [Stefan Fritsch]
*) mod_disk_cache: Change on-disk header file format to support the
link of the device/inode of the data file to the matching header
file, and to support the option of not writing a data file when
the data file is empty. [Graham Leggett]
*) core/mod_unique_id: Add generate_log_id hook to allow to use
the ID generated by mod_unique_id as error log ID for requests.
[Stefan Fritsch]
*) mod_cache: Make sure that we never allow a 304 Not Modified response
that we asked for to leak to the client should the 304 response be
uncacheable. PR45341 [Graham Leggett]
*) mod_cache: Add the cache_status hook to register the final cache
decision hit/miss/revalidate. Add optional support for an X-Cache
and/or an X-Cache-Detail header to add the cache status to the
response. PR48241 [Graham Leggett]
*) mod_authz_host: Add 'local' provider that matches connections originating
on the local host. PR 19938. [Stefan Fritsch]
*) Event MPM: Fix crash accessing pollset on worker thread when child
process is exiting. [Jeff Trawick]
*) core: For process invocation (cgi, fcgid, piped loggers and so forth)
pass the system library path (LD_LIBRARY_PATH or platform-specific
variables) along with the system PATH, by default. Both should be
overridden together as desired using PassEnv etc; see mod_env.
[William Rowe]
*) mod_cache: Introduce CacheStoreExpired, to allow administrators to
capture a stale backend response, perform If-Modified-Since requests
against the backend, and serving from the cache all 304 responses.
[Graham Leggett]
*) mod_deflate: avoid the risk of forwarding data before headers are set.
PR 49369 [Matthew Steele <mdsteele google.com>]
*) mod_authnz_ldap: Ensure nested groups are checked when the
top-level group doesn't have any direct non-group members
of attributes in AuthLDAPGroupAttribute. [Eric Covener]
*) mod_authnz_ldap: Search or Comparison during authorization phase
can use the credentials from the authentication phase
(AuthLDAPSearchAsUSer,AuthLDAPCompareAsUser).
PR 48340 [Domenico Rotiroti, Eric Covener]
*) mod_authnz_ldap: Allow the initial DN search during authentication
to use the HTTP username/pass instead of an anonymous or hard-coded
LDAP id (AuthLDAPInitialBindAsUser, AuthLDAPInitialBindPattern).
[Eric Covener]
*) mod_authnz_ldap: Publish requested LDAP data with an AUTHORIZE_ prefix
when this module is used for authorization. See AuthLDAPAuthorizePrefix.
PR 45584 [Eric Covener]
*) apxs -q: Stop filtering out ':' characters from the reported values.
PR 45343. [Bill Cole]
*) prefork MPM: Work around possible crashes on child exit in APR reslist
cleanup code. PR 43857. [Tom Donovan]
*) ab: fix number of requests sent by ab when keepalive is enabled. PR 48497.
[Bryn Dole <dole blekko.com>]
*) Log an error for failures to read a chunk-size, and return 408 instead of
413 when this is due to a read timeout. This change also fixes some cases
of two error documents being sent in the response for the same scenario.
[Eric Covener] PR49167
*) mod_proxy_balancer: Add new directive BalancerNonce to allow admin
to control/set the nonce used in the balancer-manager application.
[Jim Jagielski]
*) mod_proxy_connect: Support port ranges in AllowConnect. PR 23673.
[Stefan Fritsch]
*) Proxy balancer: support setting error status according to HTTP response
code from a backend. PR 48939. [Daniel Ruggeri <DRuggeri primary.net>]
*) htcacheclean: Introduce the ability to clean specific URLs from the
cache, if provided as an optional parameter on the command line.
[Graham Leggett]
*) core: Introduce the IncludeStrict directive, which explicitly fails
server startup if no files or directories match a wildcard path.
[Graham Leggett]
*) htcacheclean: Report additional statistics about entries deleted.
PR 48944. [Mark Drayton mark markdrayton.info]
*) Introduce SSLFIPS directive to support OpenSSL FIPS_mode; permits all
builds of mod_ssl to use 'SSLFIPS off' for portability, but the proper
ss