diff --git a/.gitignore b/.gitignore
index 8df7f18..275485b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,11 +48,3 @@ x86_64
 /httpd-2.4.55.tar.bz2.asc
 /httpd-2.4.56.tar.bz2.asc
 /httpd-2.4.57.tar.bz2.asc
-/httpd-2.4.58.tar.bz2.asc
-/httpd-2.4.59.tar.bz2.asc
-/httpd-2.4.61.tar.bz2.asc
-/httpd-2.4.62.tar.bz2.asc
-/httpd-2.4.63.tar.bz2.asc
-/httpd-2.4.64.tar.bz2.asc
-/httpd-2.4.65.tar.bz2.asc
-/httpd-2.4.66.tar.bz2.asc
diff --git a/apachectl.xml b/apachectl.xml
index 217fbda..5e40832 100644
--- a/apachectl.xml
+++ b/apachectl.xml
@@ -5,7 +5,6 @@
 ]>
 <!--
  Copyright 2020 Red Hat, Inc.
- Copyright 2018 Frank Dana
 
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements. See the NOTICE file distributed with
@@ -71,7 +70,7 @@
 
       <para>The version of <command>apachectl</command> used on this
       system is a replacement script intended to be mostly (but not
-      completely) compatible with the version provided with
+      completely) compatible with version provided with
       <emphasis>Apache httpd</emphasis>.  This
       <command>apachectl</command> mostly acts as a wrapper around
       <command>systemctl</command> and manipulates the
@@ -161,7 +160,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term><option>configtest</option> | <option>-t</option></term>
+        <term><option>configtest</option></term>
         <listitem>
           <para>Run a configuration file syntax test. It parses the configuration
           files and either reports <literal>Syntax OK</literal>
@@ -173,8 +172,8 @@
   </refsect1>
 
   <refsect1 id='bugs'>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
+    <title>Bugs</title>
+    <para>Please report bugs by filing an issue in Bugzilla via <ulink url='https://bugzilla.redhat.com/'/>.</para>
   </refsect1>
 
     <refsect1>
diff --git a/gating.yaml b/gating.yaml
index fb11fa9..e4c04e7 100644
--- a/gating.yaml
+++ b/gating.yaml
@@ -14,14 +14,3 @@ decision_contexts: [bodhi_update_push_stable]
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
-
-#gating rhel
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional}
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
diff --git a/htcacheclean.service.xml b/htcacheclean.service.xml
index c2a98d1..01b68e4 100644
--- a/htcacheclean.service.xml
+++ b/htcacheclean.service.xml
@@ -106,11 +106,6 @@
     <filename>/etc/sysconfig/htcacheclean</filename></para>
   </refsect1>
 
-  <refsect1>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
-
   <refsect1>
     <title>See also</title>
 
diff --git a/httpd-2.4.43-apxs.patch b/httpd-2.4.43-apxs.patch
index 808d6a8..b1185b2 100644
--- a/httpd-2.4.43-apxs.patch
+++ b/httpd-2.4.43-apxs.patch
@@ -1,6 +1,3 @@
-
-Upstream-Status: local customisation
-
 diff --git a/support/apxs.in b/support/apxs.in
 index b2705fa..c331631 100644
 --- a/support/apxs.in
diff --git a/httpd-2.4.43-corelimit.patch b/httpd-2.4.43-corelimit.patch
index 8c9899c..dd4b874 100644
--- a/httpd-2.4.43-corelimit.patch
+++ b/httpd-2.4.43-corelimit.patch
@@ -1,6 +1,3 @@
-
-Upstream-Status: local customisation
-
 diff --git a/server/core.c b/server/core.c
 index 79b2a82..dc0f17a 100644
 --- a/server/core.c
diff --git a/httpd-2.4.43-deplibs.patch b/httpd-2.4.43-deplibs.patch
index 85b65dc..c60f5a5 100644
--- a/httpd-2.4.43-deplibs.patch
+++ b/httpd-2.4.43-deplibs.patch
@@ -1,6 +1,3 @@
-
-Upstream-Status: local customisation, not needed upstream
-
 diff --git a/configure.in b/configure.in
 index f8f9442..f276550 100644
 --- a/configure.in
diff --git a/httpd-2.4.64-mod_systemd.patch b/httpd-2.4.43-mod_systemd.patch
similarity index 78%
rename from httpd-2.4.64-mod_systemd.patch
rename to httpd-2.4.43-mod_systemd.patch
index cad4a01..8d7922e 100644
--- a/httpd-2.4.64-mod_systemd.patch
+++ b/httpd-2.4.43-mod_systemd.patch
@@ -1,12 +1,10 @@
 
 More verbose startup logging for mod_systemd.
 
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index 22482fd..b46d3ef 100644
---- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -34,11 +34,14 @@
- #endif
+--- httpd-2.4.43/modules/arch/unix/mod_systemd.c.mod_systemd
++++ httpd-2.4.43/modules/arch/unix/mod_systemd.c
+@@ -29,11 +29,14 @@
+ #include "mpm_common.h"
  
  #include "systemd/sd-daemon.h"
 +#include "systemd/sd-journal.h"
@@ -20,9 +18,9 @@ index 22482fd..b46d3ef 100644
  static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
                                apr_pool_t *ptemp)
  {
-@@ -63,6 +66,20 @@ static void log_selinux_context(void)
+@@ -44,6 +47,20 @@
+     return OK;
  }
- #endif
  
 +static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
 +{
@@ -41,17 +39,21 @@ index 22482fd..b46d3ef 100644
  /* Report the service is ready in post_config, which could be during
   * startup or after a reload.  The server could still hit a fatal
   * startup error after this point during ap_run_mpm(), so this is
-@@ -73,23 +90,52 @@ static void log_selinux_context(void)
- static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -51,19 +68,51 @@
+  * the TCP ports so new connections will not be rejected.  There will
+  * always be a possible async failure event simultaneous to the
+  * service reporting "ready", so this should be good enough. */
+-static int systemd_post_config(apr_pool_t *p, apr_pool_t *plog,
++static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
                                 apr_pool_t *ptemp, server_rec *main_server)
  {
 +    ap_listen_rec *lr;
 +    apr_size_t plen = sizeof describe_listeners;
 +    char *p = describe_listeners;
 +
-     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-         return OK;
- 
++    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
++        return OK;
++
 +    for (lr = ap_listeners; lr; lr = lr->next) {
 +        char *s = dump_listener(lr, ptemp);
 +
@@ -72,10 +74,6 @@ index 22482fd..b46d3ef 100644
 +        }
 +    }
 +
- #ifdef HAVE_SELINUX
-     log_selinux_context();
- #endif
- 
      sd_notify(0, "READY=1\n"
                "STATUS=Configuration loaded.\n");
 +
diff --git a/httpd-2.4.43-r1861793+.patch b/httpd-2.4.43-r1861793+.patch
new file mode 100644
index 0000000..08e96cb
--- /dev/null
+++ b/httpd-2.4.43-r1861793+.patch
@@ -0,0 +1,271 @@
+diff --git a/configure.in b/configure.in
+index cb43246..0bb6b0d 100644
+--- httpd-2.4.43/configure.in.r1861793+
++++ httpd-2.4.43/configure.in
+@@ -465,6 +465,28 @@
+ AC_SEARCH_LIBS(crypt, crypt)
+ CRYPT_LIBS="$LIBS"
+ APACHE_SUBST(CRYPT_LIBS)
++
++if test "$ac_cv_search_crypt" != "no"; then
++   # Test crypt() with the SHA-512 test vector from https://akkadia.org/drepper/SHA-crypt.txt
++   AC_CACHE_CHECK([whether crypt() supports SHA-2], [ap_cv_crypt_sha2], [
++    AC_RUN_IFELSE([AC_LANG_PROGRAM([[
++#include <crypt.h>
++#include <stdlib.h>
++#include <string.h>
++
++#define PASSWD_0 "Hello world!"
++#define SALT_0 "\$6\$saltstring"
++#define EXPECT_0 "\$6\$saltstring\$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" \
++               "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"
++]], [char *result = crypt(PASSWD_0, SALT_0);
++     if (!result) return 1;
++     if (strcmp(result, EXPECT_0)) return 2;
++])], [ap_cv_crypt_sha2=yes], [ap_cv_crypt_sha2=no])])
++   if test "$ap_cv_crypt_sha2" = yes; then
++     AC_DEFINE([HAVE_CRYPT_SHA2], 1, [Define if crypt() supports SHA-2 hashes])
++   fi
++fi
++
+ LIBS="$saved_LIBS"
+ 
+ dnl See Comment #Spoon
+--- httpd-2.4.43/docs/man/htpasswd.1.r1861793+
++++ httpd-2.4.43/docs/man/htpasswd.1
+@@ -27,16 +27,16 @@
+ .SH "SYNOPSIS"
+  
+ .PP
+-\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
++\fB\fBhtpasswd\fR [ -\fBc\fR ] [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
++\fB\fBhtpasswd\fR -\fBb\fR [ -\fBc\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] [ -\fBD\fR ] [ -\fBv\fR ] \fIpasswdfile\fR \fIusername\fR \fIpassword\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
++\fB\fBhtpasswd\fR -\fBn\fR [ -\fBi\fR ] [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR\fR
+  
+ .PP
+-\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
++\fB\fBhtpasswd\fR -\fBnb\fR [ -\fBm\fR | -\fBB\fR | -\fB2\fR | -\fB5\fR | -\fBd\fR | -\fBs\fR | -\fBp\fR ] [ -\fBr\fR \fIrounds\fR ] [ -\fBC\fR \fIcost\fR ] \fIusername\fR \fIpassword\fR\fR
+  
+ 
+ .SH "SUMMARY"
+@@ -48,7 +48,7 @@
+ Resources available from the Apache HTTP server can be restricted to just the users listed in the files created by \fBhtpasswd\fR\&. This program can only manage usernames and passwords stored in a flat-file\&. It can encrypt and display password information for use in other types of data stores, though\&. To use a DBM database see dbmmanage or htdbm\&.
+  
+ .PP
+-\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA1, or the system's \fBcrypt()\fR routine\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
++\fBhtpasswd\fR encrypts passwords using either bcrypt, a version of MD5 modified for Apache, SHA-1, or the system's \fBcrypt()\fR routine\&. SHA-2-based hashes (SHA-256 and SHA-512) are supported for \fBcrypt()\fR\&. Files managed by \fBhtpasswd\fR may contain a mixture of different encoding types of passwords; some user records may have bcrypt or MD5-encrypted passwords while others in the same file may have passwords encrypted with \fBcrypt()\fR\&.
+  
+ .PP
+ This manual page only lists the command line arguments\&. For details of the directives necessary to configure user authentication in httpd see the Apache manual, which is part of the Apache distribution or can be found at http://httpd\&.apache\&.org/\&.
+@@ -73,17 +73,26 @@
+ \fB-m\fR
+ Use MD5 encryption for passwords\&. This is the default (since version 2\&.2\&.18)\&.  
+ .TP
++\fB-2\fR
++Use SHA-256 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
++.TP
++\fB-5\fR
++Use SHA-512 \fBcrypt()\fR based hashes for passwords\&. This is supported on most Unix platforms\&.  
++.TP
+ \fB-B\fR
+ Use bcrypt encryption for passwords\&. This is currently considered to be very secure\&.  
+ .TP
+ \fB-C\fR
+ This flag is only allowed in combination with \fB-B\fR (bcrypt encryption)\&. It sets the computing time used for the bcrypt algorithm (higher is more secure but slower, default: 5, valid: 4 to 17)\&.  
+ .TP
++\fB-r\fR
++This flag is only allowed in combination with \fB-2\fR or \fB-5\fR\&. It sets the number of hash rounds used for the SHA-2 algorithms (higher is more secure but slower; the default is 5,000)\&.  
++.TP
+ \fB-d\fR
+ Use \fBcrypt()\fR encryption for passwords\&. This is not supported by the httpd server on Windows and Netware\&. This algorithm limits the password length to 8 characters\&. This algorithm is \fBinsecure\fR by today's standards\&. It used to be the default algorithm until version 2\&.2\&.17\&.  
+ .TP
+ \fB-s\fR
+-Use SHA encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
++Use SHA-1 (160-bit) encryption for passwords\&. Facilitates migration from/to Netscape servers using the LDAP Directory Interchange Format (ldif)\&. This algorithm is \fBinsecure\fR by today's standards\&.  
+ .TP
+ \fB-p\fR
+ Use plaintext passwords\&. Though \fBhtpasswd\fR will support creation on all platforms, the httpd daemon will only accept plain text passwords on Windows and Netware\&.  
+@@ -152,10 +161,13 @@
+ When using the \fBcrypt()\fR algorithm, note that only the first 8 characters of the password are used to form the password\&. If the supplied password is longer, the extra characters will be silently discarded\&.
+  
+ .PP
+-The SHA encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
++The SHA-1 encryption format does not use salting: for a given password, there is only one encrypted representation\&. The \fBcrypt()\fR and MD5 formats permute the representation by prepending a random salt string, to make dictionary attacks against the passwords more difficult\&.
++ 
++.PP
++The SHA-1 and \fBcrypt()\fR formats are insecure by today's standards\&.
+  
+ .PP
+-The SHA and \fBcrypt()\fR formats are insecure by today's standards\&.
++The SHA-2-based \fBcrypt()\fR formats (SHA-256 and SHA-512) are supported on most modern Unix systems, and follow the specification at https://www\&.akkadia\&.org/drepper/SHA-crypt\&.txt\&.
+  
+ .SH "RESTRICTIONS"
+  
+--- httpd-2.4.43/support/htpasswd.c.r1861793+
++++ httpd-2.4.43/support/htpasswd.c
+@@ -109,17 +109,21 @@
+             "for it." NL
+         " -i  Read password from stdin without verification (for script usage)." NL
+         " -m  Force MD5 encryption of the password (default)." NL
+-        " -B  Force bcrypt encryption of the password (very secure)." NL
++        " -2  Force SHA-256 crypt() hash of the password (very secure)." NL
++        " -5  Force SHA-512 crypt() hash of the password (very secure)." NL
++        " -B  Force bcrypt encryption of the password (very secure)." NL
+         " -C  Set the computing time used for the bcrypt algorithm" NL
+         "     (higher is more secure but slower, default: %d, valid: 4 to 17)." NL
++        " -r  Set the number of rounds used for the SHA-256, SHA-512 algorithms" NL
++        "     (higher is more secure but slower, default: 5000)." NL
+         " -d  Force CRYPT encryption of the password (8 chars max, insecure)." NL
+-        " -s  Force SHA encryption of the password (insecure)." NL
++        " -s  Force SHA-1 encryption of the password (insecure)." NL
+         " -p  Do not encrypt the password (plaintext, insecure)." NL
+         " -D  Delete the specified user." NL
+         " -v  Verify password for the specified user." NL
+         "On other systems than Windows and NetWare the '-p' flag will "
+             "probably not work." NL
+-        "The SHA algorithm does not use a salt and is less secure than the "
++        "The SHA-1 algorithm does not use a salt and is less secure than the "
+             "MD5 algorithm." NL,
+         BCRYPT_DEFAULT_COST
+     );
+@@ -178,7 +182,7 @@
+     if (rv != APR_SUCCESS)
+         exit(ERR_SYNTAX);
+ 
+-    while ((rv = apr_getopt(state, "cnmspdBbDiC:v", &opt, &opt_arg)) == APR_SUCCESS) {
++    while ((rv = apr_getopt(state, "cnmspdBbDi25C:r:v", &opt, &opt_arg)) == APR_SUCCESS) {
+         switch (opt) {
+         case 'c':
+             *mask |= APHTP_NEWFILE;
+--- httpd-2.4.43/support/passwd_common.c.r1861793+
++++ httpd-2.4.43/support/passwd_common.c
+@@ -179,16 +179,21 @@
+ int mkhash(struct passwd_ctx *ctx)
+ {
+     char *pw;
+-    char salt[16];
++    char salt[17];
+     apr_status_t rv;
+     int ret = 0;
+ #if CRYPT_ALGO_SUPPORTED
+     char *cbuf;
+ #endif
++#ifdef HAVE_CRYPT_SHA2
++    const char *setting;
++    char method;
++#endif
+ 
+-    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT) {
++    if (ctx->cost != 0 && ctx->alg != ALG_BCRYPT
++        && ctx->alg != ALG_CRYPT_SHA256 && ctx->alg != ALG_CRYPT_SHA512 ) {
+         apr_file_printf(errfile,
+-                        "Warning: Ignoring -C argument for this algorithm." NL);
++                        "Warning: Ignoring -C/-r argument for this algorithm." NL);
+     }
+ 
+     if (ctx->passwd == NULL) {
+@@ -246,6 +251,34 @@
+         break;
+ #endif /* CRYPT_ALGO_SUPPORTED */
+ 
++#ifdef HAVE_CRYPT_SHA2
++    case ALG_CRYPT_SHA256:
++    case ALG_CRYPT_SHA512:
++        ret = generate_salt(salt, 16, &ctx->errstr, ctx->pool);
++        if (ret != 0)
++            break;
++
++        method = ctx->alg == ALG_CRYPT_SHA256 ? '5': '6';
++
++        if (ctx->cost) 
++            setting = apr_psprintf(ctx->pool, "$%c$rounds=%d$%s",
++                                   method, ctx->cost, salt);
++        else
++            setting = apr_psprintf(ctx->pool, "$%c$%s",
++                                   method, salt);
++
++        cbuf = crypt(pw, setting);
++        if (cbuf == NULL) {
++            rv = APR_FROM_OS_ERROR(errno);
++            ctx->errstr = apr_psprintf(ctx->pool, "crypt() failed: %pm", &rv);
++            ret = ERR_PWMISMATCH;
++            break;
++        }
++
++        apr_cpystrn(ctx->out, cbuf, ctx->out_len - 1);
++        break;
++#endif /* HAVE_CRYPT_SHA2 */
++
+ #if BCRYPT_ALGO_SUPPORTED
+     case ALG_BCRYPT:
+         rv = apr_generate_random_bytes((unsigned char*)salt, 16);
+@@ -294,6 +327,19 @@
+     case 's':
+         ctx->alg = ALG_APSHA;
+         break;
++#ifdef HAVE_CRYPT_SHA2
++    case '2':
++        ctx->alg = ALG_CRYPT_SHA256;
++        break;
++    case '5':
++        ctx->alg = ALG_CRYPT_SHA512;
++        break;
++#else
++    case '2':
++    case '5':
++        ctx->errstr = "SHA-2 crypt() algorithms are not supported on this platform.";
++        return ERR_ALG_NOT_SUPP;
++#endif
+     case 'p':
+         ctx->alg = ALG_PLAIN;
+ #if !PLAIN_ALGO_SUPPORTED
+@@ -324,11 +370,12 @@
+         return ERR_ALG_NOT_SUPP;
+ #endif
+         break;
+-    case 'C': {
++    case 'C':
++    case 'r': {
+             char *endptr;
+             long num = strtol(opt_arg, &endptr, 10);
+             if (*endptr != '\0' || num <= 0) {
+-                ctx->errstr = "argument to -C must be a positive integer";
++                ctx->errstr = "argument to -C/-r must be a positive integer";
+                 return ERR_SYNTAX;
+             }
+             ctx->cost = num;
+--- httpd-2.4.43/support/passwd_common.h.r1861793+
++++ httpd-2.4.43/support/passwd_common.h
+@@ -28,6 +28,8 @@
+ #include "apu_version.h"
+ #endif
+ 
++#include "ap_config_auto.h"
++
+ #define MAX_STRING_LEN 256
+ 
+ #define ALG_PLAIN 0
+@@ -35,6 +37,8 @@
+ #define ALG_APMD5 2
+ #define ALG_APSHA 3
+ #define ALG_BCRYPT 4
++#define ALG_CRYPT_SHA256 5
++#define ALG_CRYPT_SHA512 6
+ 
+ #define BCRYPT_DEFAULT_COST 5
+ 
+@@ -84,7 +88,7 @@
+     apr_size_t      out_len;
+     char            *passwd;
+     int             alg;
+-    int             cost;
++    int             cost; /* cost for bcrypt, rounds for SHA-2 */
+     enum {
+         PW_PROMPT = 0,
+         PW_ARG,
diff --git a/httpd-2.4.43-socket-activation.patch b/httpd-2.4.43-socket-activation.patch
new file mode 100644
index 0000000..511f476
--- /dev/null
+++ b/httpd-2.4.43-socket-activation.patch
@@ -0,0 +1,300 @@
+diff --git a/server/listen.c b/server/listen.c
+index 5242c2a..e2e028a 100644
+--- a/server/listen.c
++++ b/server/listen.c
+@@ -34,6 +34,10 @@
+ #include <unistd.h>
+ #endif
+ 
++#ifdef HAVE_SYSTEMD
++#include <systemd/sd-daemon.h>
++#endif
++
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -59,9 +63,12 @@ static int ap_listenbacklog;
+ static int ap_listencbratio;
+ static int send_buffer_size;
+ static int receive_buffer_size;
++#ifdef HAVE_SYSTEMD
++static int use_systemd = -1;
++#endif
+ 
+ /* TODO: make_sock is just begging and screaming for APR abstraction */
+-static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
++static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen)
+ {
+     apr_socket_t *s = server->sd;
+     int one = 1;
+@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+         return stat;
+     }
+ 
+-#if APR_HAVE_IPV6
+-    if (server->bind_addr->family == APR_INET6) {
+-        stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
+-        if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
+-            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
+-                          "make_sock: for address %pI, apr_socket_opt_set: "
+-                          "(IPV6_V6ONLY)",
+-                          server->bind_addr);
+-            apr_socket_close(s);
+-            return stat;
+-        }
+-    }
+-#endif
+-
+     /*
+      * To send data over high bandwidth-delay connections at full
+      * speed we must force the TCP window to open wide enough to keep the
+@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+     }
+ #endif
+ 
+-    if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
+-                      "make_sock: could not bind to address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
+-    }
++    if (do_bind_listen) {
++#if APR_HAVE_IPV6
++        if (server->bind_addr->family == APR_INET6) {
++            stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
++            if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
++                ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
++                              "make_sock: for address %pI, apr_socket_opt_set: "
++                              "(IPV6_V6ONLY)",
++                              server->bind_addr);
++                apr_socket_close(s);
++                return stat;
++            }
++        }
++#endif
+ 
+-    if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
+-                      "make_sock: unable to listen for connections "
+-                      "on address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
++        if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
++            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
++                          "make_sock: could not bind to address %pI",
++                          server->bind_addr);
++            apr_socket_close(s);
++            return stat;
++        }
++
++        if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
++            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
++                          "make_sock: unable to listen for connections "
++                          "on address %pI",
++                          server->bind_addr);
++            apr_socket_close(s);
++            return stat;
++        }
+     }
+ 
+ #ifdef WIN32
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
+ }
+ 
++#ifdef HAVE_SYSTEMD
++
++static int find_systemd_socket(process_rec * process, apr_port_t port) {
++    int fdcount, fd;
++    int sdc = sd_listen_fds(0);
++
++    if (sdc < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
++                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
++                      sdc);
++        return -1;
++    }
++
++    if (sdc == 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
++                      "find_systemd_socket: At least one socket must be set.");
++        return -1;
++    }
++
++    fdcount = atoi(getenv("LISTEN_FDS"));
++    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
++        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
++            return fd;
++        }
++    }
++
++    return -1;
++}
++
++static apr_status_t alloc_systemd_listener(process_rec * process,
++                                           int fd, const char *proto,
++                                           ap_listen_rec **out_rec)
++{
++    apr_status_t rv;
++    struct sockaddr sa;
++    socklen_t len = sizeof(struct sockaddr);
++    apr_os_sock_info_t si;
++    ap_listen_rec *rec;
++    *out_rec = NULL;
++
++    memset(&si, 0, sizeof(si));
++
++    rv = getsockname(fd, &sa, &len);
++
++    if (rv != 0) {
++        rv = apr_get_netos_error();
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489)
++                      "getsockname on %d failed.", fd);
++        return rv;
++    }
++
++    si.os_sock = &fd;
++    si.family = sa.sa_family;
++    si.local = &sa;
++    si.type = SOCK_STREAM;
++    si.protocol = APR_PROTO_TCP;
++
++    rec = apr_palloc(process->pool, sizeof(ap_listen_rec));
++    rec->active = 0;
++    rec->next = 0;
++
++
++    rv = apr_os_sock_make(&rec->sd, &si, process->pool);
++    if (rv != APR_SUCCESS) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490)
++                      "apr_os_sock_make on %d failed.", fd);
++        return rv;
++    }
++
++    rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd);
++    if (rv != APR_SUCCESS) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491)
++                      "apr_socket_addr_get on %d failed.", fd);
++        return rv;
++    }
++
++    rec->protocol = apr_pstrdup(process->pool, proto);
++
++    *out_rec = rec;
++
++    return make_sock(process->pool, rec, 0);
++}
++
++static const char *set_systemd_listener(process_rec *process, apr_port_t port,
++                                        const char *proto)
++{
++    ap_listen_rec *last, *new;
++    apr_status_t rv;
++    int fd = find_systemd_socket(process, port);
++    if (fd < 0) {
++        return "Systemd socket activation is used, but this port is not "
++                "configured in systemd";
++    }
++
++    last = ap_listeners;
++    while (last && last->next) {
++        last = last->next;
++    }
++
++    rv = alloc_systemd_listener(process, fd, proto, &new);
++    if (rv != APR_SUCCESS) {
++        return "Failed to setup socket passed by systemd using socket activation";
++    }
++
++    if (last == NULL) {
++        ap_listeners = last = new;
++    }
++    else {
++        last->next = new;
++        last = new;
++    }
++
++    return NULL;
++}
++
++#endif /* HAVE_SYSTEMD */
++
+ static const char *alloc_listener(process_rec *process, const char *addr,
+                                   apr_port_t port, const char* proto,
+                                   void *slave)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
+                 }
+             }
+ #endif
+-            if (make_sock(pool, lr) == APR_SUCCESS) {
++            if (make_sock(pool, lr, 1) == APR_SUCCESS) {
+                 ++num_open;
+             }
+             else {
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+         }
+     }
+ 
+-    if (open_listeners(s->process->pool)) {
+-        return 0;
++#ifdef HAVE_SYSTEMD
++    if (use_systemd) {
++        const char *userdata_key = "ap_open_systemd_listeners";
++        void *data;
++        /* clear the enviroment on our second run
++        * so that none of our future children get confused.
++        */
++        apr_pool_userdata_get(&data, userdata_key, s->process->pool);
++        if (!data) {
++            apr_pool_userdata_set((const void *)1, userdata_key,
++                                apr_pool_cleanup_null, s->process->pool);
++        }
++        else {
++            sd_listen_fds(1);
++        }
++    }
++    else
++#endif
++    {
++        if (open_listeners(s->process->pool)) {
++            return 0;
++        }
+     }
+ 
+     for (lr = ap_listeners; lr; lr = lr->next) {
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+                             duplr->bind_addr);
+                 return stat;
+             }
+-            make_sock(p, duplr);
++            make_sock(p, duplr, 1);
+ #if AP_NONBLOCK_WHEN_MULTI_LISTEN
+             use_nonblock = (ap_listeners && ap_listeners->next);
+             stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     if (argc < 1 || argc > 2) {
+         return "Listen requires 1 or 2 arguments.";
+     }
++#ifdef HAVE_SYSTEMD
++    if (use_systemd == -1) {
++        use_systemd = sd_listen_fds(0) > 0;
++    }
++#endif
+ 
+     rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
+     if (rv != APR_SUCCESS) {
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+         ap_str_tolower(proto);
+     }
+ 
++#ifdef HAVE_SYSTEMD
++    if (use_systemd) {
++        return set_systemd_listener(cmd->server->process, port, proto);
++    }
++#endif
++
+     return alloc_listener(cmd->server->process, host, port, proto, NULL);
+ }
+ 
diff --git a/httpd-2.4.64-sslprotdefault.patch b/httpd-2.4.43-sslprotdefault.patch
similarity index 84%
rename from httpd-2.4.64-sslprotdefault.patch
rename to httpd-2.4.43-sslprotdefault.patch
index 6d97935..d089823 100644
--- a/httpd-2.4.64-sslprotdefault.patch
+++ b/httpd-2.4.43-sslprotdefault.patch
@@ -1,8 +1,8 @@
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 8fae1f8..c5dce7f 100644
+index 27e7a53..b53f3f8 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
-@@ -127,7 +127,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
      mctx->ticket_key          = NULL;
  #endif
  
@@ -11,7 +11,7 @@ index 8fae1f8..c5dce7f 100644
      mctx->protocol_set        = 0;
  
      mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
-@@ -268,6 +268,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
      if (add->protocol_set) {
          mrg->protocol_set = 1;
          mrg->protocol = add->protocol;
@@ -19,19 +19,20 @@ index 8fae1f8..c5dce7f 100644
      }
      else {
          mrg->protocol_set = base->protocol_set;
+
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 4e265b3..2fbd076 100644
+index bfad47a..b0fcf81 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -638,6 +638,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
      char *cp;
      int protocol = mctx->protocol;
 +    int protocol_set = mctx->protocol_set;
      SSLSrvConfigRec *sc = mySrvConfig(s);
  #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-     /* default is highest supported version, will be overridden below */
-@@ -652,12 +653,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     int prot;
+@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
       *  Create the new per-server SSL context
       */
      if (protocol == SSL_PROTOCOL_NONE) {
@@ -55,7 +56,7 @@ index 4e265b3..2fbd076 100644
  #ifndef OPENSSL_NO_SSL3
                       (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
  #endif
-@@ -670,7 +677,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
  #endif
  #endif
                       NULL);
@@ -65,7 +66,7 @@ index 4e265b3..2fbd076 100644
  
      ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
                   "Creating new SSL context (protocols: %s)", cp);
-@@ -776,13 +784,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
  #endif
      } else {
@@ -87,7 +88,7 @@ index 4e265b3..2fbd076 100644
  
      /* Next we scan for the minimal protocol version we should provide,
       * but we do not allow holes between max and min */
-@@ -806,7 +816,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
          prot = SSL3_VERSION;
      }
  #endif
diff --git a/httpd-2.4.46-htcacheclean-dont-break.patch b/httpd-2.4.46-htcacheclean-dont-break.patch
new file mode 100644
index 0000000..e52318a
--- /dev/null
+++ b/httpd-2.4.46-htcacheclean-dont-break.patch
@@ -0,0 +1,13 @@
+diff --git a/support/htcacheclean.c b/support/htcacheclean.c
+index 958ba6d..0a7fe3c 100644
+--- a/support/htcacheclean.c
++++ b/support/htcacheclean.c
+@@ -557,8 +557,6 @@ static int list_urls(char *path, apr_pool_t *pool, apr_off_t round)
+                                         }
+                                     }
+                                 }
+-
+-                                break;
+                             }
+                         }
+                     }
diff --git a/httpd-2.4.48-r1828172+.patch b/httpd-2.4.48-r1828172+.patch
new file mode 100644
index 0000000..37f1855
--- /dev/null
+++ b/httpd-2.4.48-r1828172+.patch
@@ -0,0 +1,2371 @@
+
+https://github.com/apache/httpd/pull/209
+
+diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
+new file mode 100644
+index 0000000000..69df73ce68
+--- /dev/null
++++ b/modules/generators/cgi_common.h
+@@ -0,0 +1,629 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++#include "apr.h"
++#include "apr_strings.h"
++#include "apr_buckets.h"
++#include "apr_lib.h"
++#include "apr_poll.h"
++
++#define APR_WANT_STRFUNC
++#define APR_WANT_MEMFUNC
++#include "apr_want.h"
++
++#include "httpd.h"
++#include "util_filter.h"
++
++static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
++static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
++
++/* These functions provided by mod_cgi.c/mod_cgid.c still. */
++static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
++                      char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
++                      apr_file_t *script_err);
++static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
++                                apr_bucket_brigade *bb, char *s);
++static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
++                                apr_bucket_brigade *bb, const char *command);
++
++/* Read and discard all output from the brigade.  Note that with the
++ * CGI bucket, the brigade will become empty once the script's stdout
++ * is closed (or on error/timeout), but the stderr output may not have
++ * been entirely captured at this point. */
++static void discard_script_output(apr_bucket_brigade *bb)
++{
++    apr_bucket *e;
++    const char *buf;
++    apr_size_t len;
++
++    for (e = APR_BRIGADE_FIRST(bb);
++         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
++         e = APR_BRIGADE_FIRST(bb))
++    {
++        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
++            break;
++        }
++        apr_bucket_delete(e);
++    }
++}
++
++static int log_scripterror(request_rec *r, cgi_server_conf *conf, int ret,
++                           apr_status_t rv, const char *logno,
++                           const char *error)
++{
++    apr_file_t *f = NULL;
++    apr_finfo_t finfo;
++    char time_str[APR_CTIME_LEN];
++
++    /* Intentional no APLOGNO */
++    /* Callee provides APLOGNO in error text */
++    ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
++                  "%sstderr from %s: %s", logno ? logno : "", r->filename, error);
++
++    /* XXX Very expensive mainline case! Open, then getfileinfo! */
++    if (!conf->logname ||
++        ((apr_stat(&finfo, conf->logname,
++                   APR_FINFO_SIZE, r->pool) == APR_SUCCESS) &&
++         (finfo.size > conf->logbytes)) ||
++        (apr_file_open(&f, conf->logname,
++                       APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT,
++                       r->pool) != APR_SUCCESS)) {
++        return ret;
++    }
++
++    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */
++    apr_ctime(time_str, apr_time_now());
++    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
++                    r->args ? "?" : "", r->args ? r->args : "", r->protocol);
++    /* "%% 500 /usr/local/apache/cgi-bin */
++    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
++
++    apr_file_printf(f, "%%error\n%s\n", error);
++
++    apr_file_close(f);
++    return ret;
++}
++
++/* Soak up stderr from a script and redirect it to the error log.
++ */
++static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
++{
++    char argsbuffer[HUGE_STRING_LEN];
++    char *newline;
++    apr_status_t rv;
++    cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module);
++
++    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
++                               script_err)) == APR_SUCCESS) {
++
++        newline = strchr(argsbuffer, '\n');
++        if (newline) {
++            char *prev = newline - 1;
++            if (prev >= argsbuffer && *prev == '\r') {
++                newline = prev;
++            }
++
++            *newline = '\0';
++        }
++        log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer);
++    }
++
++    return rv;
++}
++
++static apr_status_t cgi_handle_exec(include_ctx_t *ctx, ap_filter_t *f,
++                                    apr_bucket_brigade *bb)
++{
++    char *tag = NULL;
++    char *tag_val = NULL;
++    request_rec *r = f->r;
++    char *file = r->filename;
++    char parsed_string[MAX_STRING_LEN];
++
++    if (!ctx->argc) {
++        ap_log_rerror(APLOG_MARK,
++                      (ctx->flags & SSI_FLAG_PRINTING)
++                          ? APLOG_ERR : APLOG_WARNING,
++                      0, r, APLOGNO(03195)
++                      "missing argument for exec element in %s", r->filename);
++    }
++
++    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
++        return APR_SUCCESS;
++    }
++
++    if (!ctx->argc) {
++        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++        return APR_SUCCESS;
++    }
++
++    if (ctx->flags & SSI_FLAG_NO_EXEC) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed "
++                      "in %s", r->filename);
++        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++        return APR_SUCCESS;
++    }
++
++    while (1) {
++        cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
++        if (!tag || !tag_val) {
++            break;
++        }
++
++        if (!strcmp(tag, "cmd")) {
++            apr_status_t rv;
++
++            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
++                       SSI_EXPAND_LEAVE_NAME);
++
++            rv = include_cmd(ctx, f, bb, parsed_string);
++            if (rv != APR_SUCCESS) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure "
++                              "for parameter \"%s\" to tag exec in file %s",
++                              tag, r->filename);
++                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++                break;
++            }
++        }
++        else if (!strcmp(tag, "cgi")) {
++            apr_status_t rv;
++
++            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
++                       SSI_EXPAND_DROP_NAME);
++
++            rv = include_cgi(ctx, f, bb, parsed_string);
++            if (rv != APR_SUCCESS) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref "
++                              "\"%s\" in %s", tag_val, file);
++                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++                break;
++            }
++        }
++        else {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter "
++                          "\"%s\" to tag exec in %s", tag, file);
++            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
++            break;
++        }
++    }
++
++    return APR_SUCCESS;
++}
++
++/* Hook to register exec= handling with mod_include. */
++static void cgi_optfns_retrieve(void)
++{
++    APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi;
++
++    cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
++    cgi_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
++    cgi_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
++
++    if (cgi_pfn_reg_with_ssi && cgi_pfn_gtv && cgi_pfn_ps) {
++        /* Required by mod_include filter. This is how mod_cgi registers
++         *   with mod_include to provide processing of the exec directive.
++         */
++        cgi_pfn_reg_with_ssi("exec", cgi_handle_exec);
++    }
++}
++
++#ifdef WANT_CGI_BUCKET
++/* A CGI bucket type is needed to catch any output to stderr from the
++ * script; see PR 22030. */
++static const apr_bucket_type_t bucket_type_cgi;
++
++struct cgi_bucket_data {
++    apr_pollset_t *pollset;
++    request_rec *r;
++    apr_interval_time_t timeout;
++};
++
++/* Create a CGI bucket using pipes from script stdout 'out'
++ * and stderr 'err', for request 'r'. */
++static apr_bucket *cgi_bucket_create(request_rec *r,
++                                     apr_interval_time_t timeout,
++                                     apr_file_t *out, apr_file_t *err,
++                                     apr_bucket_alloc_t *list)
++{
++    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
++    apr_status_t rv;
++    apr_pollfd_t fd;
++    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
++
++    /* Disable APR timeout handling since we'll use poll() entirely. */
++    apr_file_pipe_timeout_set(out, 0);
++    apr_file_pipe_timeout_set(err, 0);
++    
++    APR_BUCKET_INIT(b);
++    b->free = apr_bucket_free;
++    b->list = list;
++    b->type = &bucket_type_cgi;
++    b->length = (apr_size_t)(-1);
++    b->start = -1;
++
++    /* Create the pollset */
++    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
++    if (rv != APR_SUCCESS) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
++                     "apr_pollset_create(); check system or user limits");
++        return NULL;
++    }
++
++    fd.desc_type = APR_POLL_FILE;
++    fd.reqevents = APR_POLLIN;
++    fd.p = r->pool;
++    fd.desc.f = out; /* script's stdout */
++    fd.client_data = (void *)1;
++    rv = apr_pollset_add(data->pollset, &fd);
++    if (rv != APR_SUCCESS) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
++                     "apr_pollset_add(); check system or user limits");
++        return NULL;
++    }
++
++    fd.desc.f = err; /* script's stderr */
++    fd.client_data = (void *)2;
++    rv = apr_pollset_add(data->pollset, &fd);
++    if (rv != APR_SUCCESS) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
++                     "apr_pollset_add(); check system or user limits");
++        return NULL;
++    }
++
++    data->r = r;
++    data->timeout = timeout;
++    b->data = data;
++    return b;
++}
++
++/* Create a duplicate CGI bucket using given bucket data */
++static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
++                                  apr_bucket_alloc_t *list)
++{
++    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
++    APR_BUCKET_INIT(b);
++    b->free = apr_bucket_free;
++    b->list = list;
++    b->type = &bucket_type_cgi;
++    b->length = (apr_size_t)(-1);
++    b->start = -1;
++    b->data = data;
++    return b;
++}
++
++/* Handle stdout from CGI child.  Duplicate of logic from the _read
++ * method of the real APR pipe bucket implementation. */
++static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
++                                    const char **str, apr_size_t *len)
++{
++    char *buf;
++    apr_status_t rv;
++
++    *str = NULL;
++    *len = APR_BUCKET_BUFF_SIZE;
++    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
++
++    rv = apr_file_read(out, buf, len);
++
++    if (rv != APR_SUCCESS && rv != APR_EOF) {
++        apr_bucket_free(buf);
++        return rv;
++    }
++
++    if (*len > 0) {
++        struct cgi_bucket_data *data = a->data;
++        apr_bucket_heap *h;
++
++        /* Change the current bucket to refer to what we read */
++        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
++        h = a->data;
++        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
++        *str = buf;
++        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
++    }
++    else {
++        apr_bucket_free(buf);
++        a = apr_bucket_immortal_make(a, "", 0);
++        *str = a->data;
++    }
++    return rv;
++}
++
++/* Read method of CGI bucket: polls on stderr and stdout of the child,
++ * sending any stderr output immediately away to the error log. */
++static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
++                                    apr_size_t *len, apr_read_type_e block)
++{
++    struct cgi_bucket_data *data = b->data;
++    apr_interval_time_t timeout = 0;
++    apr_status_t rv;
++    int gotdata = 0;
++
++    if (block != APR_NONBLOCK_READ) {
++        timeout = data->timeout > 0 ? data->timeout : data->r->server->timeout;
++    }
++
++    do {
++        const apr_pollfd_t *results;
++        apr_int32_t num;
++
++        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
++        if (APR_STATUS_IS_TIMEUP(rv)) {
++            if (timeout) {
++                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
++                              "Timeout waiting for output from CGI script %s",
++                              data->r->filename);
++                return rv;
++            }
++            else {
++                return APR_EAGAIN;
++            }
++        }
++        else if (APR_STATUS_IS_EINTR(rv)) {
++            continue;
++        }
++        else if (rv != APR_SUCCESS) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
++                          "poll failed waiting for CGI child");
++            return rv;
++        }
++
++        for (; num; num--, results++) {
++            if (results[0].client_data == (void *)1) {
++                /* stdout */
++                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
++                if (APR_STATUS_IS_EOF(rv)) {
++                    rv = APR_SUCCESS;
++                }
++                gotdata = 1;
++            } else {
++                /* stderr */
++                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
++                if (APR_STATUS_IS_EOF(rv2)) {
++                    apr_pollset_remove(data->pollset, &results[0]);
++                }
++            }
++        }
++
++    } while (!gotdata);
++
++    return rv;
++}
++
++static const apr_bucket_type_t bucket_type_cgi = {
++    "CGI", 5, APR_BUCKET_DATA,
++    apr_bucket_destroy_noop,
++    cgi_bucket_read,
++    apr_bucket_setaside_notimpl,
++    apr_bucket_split_notimpl,
++    apr_bucket_copy_notimpl
++};
++
++#endif /* WANT_CGI_BUCKET */
++
++/* Handle the CGI response output, having set up the brigade with the
++ * CGI or PIPE bucket as appropriate. */
++static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb,
++                               apr_interval_time_t timeout, cgi_server_conf *conf,
++                               char *logdata, apr_file_t *script_err)
++{
++    apr_status_t rv;
++    
++    /* Handle script return... */
++    if (!nph) {
++        const char *location;
++        char sbuf[MAX_STRING_LEN];
++        int ret;
++
++        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
++                                                        APLOG_MODULE_INDEX)))
++        {
++            /* In the case of a timeout reading script output, clear
++             * the brigade to avoid a second attempt to read the
++             * output. */
++            if (ret == HTTP_GATEWAY_TIME_OUT) {
++                apr_brigade_cleanup(bb);
++            }
++
++            ret = log_script(r, conf, ret, logdata, sbuf, bb, script_err);
++
++            /*
++             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
++             * does not set an explicit status and ap_meets_conditions, which
++             * is called by ap_scan_script_header_err_brigade, detects that
++             * the conditions of the requests are met and the response is
++             * not modified.
++             * In this case set r->status and return OK in order to prevent
++             * running through the error processing stack as this would
++             * break with mod_cache, if the conditions had been set by
++             * mod_cache itself to validate a stale entity.
++             * BTW: We circumvent the error processing stack anyway if the
++             * CGI script set an explicit status code (whatever it is) and
++             * the only possible values for ret here are:
++             *
++             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
++             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
++             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
++             * processing of the response of the CGI script, e.g broken headers
++             * or a crashed CGI process).
++             */
++            if (ret == HTTP_NOT_MODIFIED) {
++                r->status = ret;
++                return OK;
++            }
++
++            return ret;
++        }
++
++        location = apr_table_get(r->headers_out, "Location");
++
++        if (location && r->status == 200) {
++            /* For a redirect whether internal or not, discard any
++             * remaining stdout from the script, and log any remaining
++             * stderr output, as normal. */
++            discard_script_output(bb);
++            apr_brigade_destroy(bb);
++
++            if (script_err) {
++                apr_file_pipe_timeout_set(script_err, timeout);
++                log_script_err(r, script_err);
++            }
++        }
++
++        if (location && location[0] == '/' && r->status == 200) {
++            /* This redirect needs to be a GET no matter what the original
++             * method was.
++             */
++            r->method = "GET";
++            r->method_number = M_GET;
++
++            /* We already read the message body (if any), so don't allow
++             * the redirected request to think it has one.  We can ignore
++             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
++             */
++            apr_table_unset(r->headers_in, "Content-Length");
++
++            ap_internal_redirect_handler(location, r);
++            return OK;
++        }
++        else if (location && r->status == 200) {
++            /* XXX: Note that if a script wants to produce its own Redirect
++             * body, it now has to explicitly *say* "Status: 302"
++             */
++            discard_script_output(bb);
++            apr_brigade_destroy(bb);
++            return HTTP_MOVED_TEMPORARILY;
++        }
++
++        rv = ap_pass_brigade(r->output_filters, bb);
++    }
++    else /* nph */ {
++        struct ap_filter_t *cur;
++
++        /* get rid of all filters up through protocol...  since we
++         * haven't parsed off the headers, there is no way they can
++         * work
++         */
++
++        cur = r->proto_output_filters;
++        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
++            cur = cur->next;
++        }
++        r->output_filters = r->proto_output_filters = cur;
++
++        rv = ap_pass_brigade(r->output_filters, bb);
++    }
++
++    /* don't soak up script output if errors occurred writing it
++     * out...  otherwise, we prolong the life of the script when the
++     * connection drops or we stopped sending output for some other
++     * reason */
++    if (script_err && rv == APR_SUCCESS && !r->connection->aborted) {
++        apr_file_pipe_timeout_set(script_err, timeout);
++        log_script_err(r, script_err);
++    }
++
++    if (script_err) apr_file_close(script_err);
++
++    return OK;                      /* NOT r->status, even if it has changed. */
++}
++
++/* Read the request body and write it to fd 'script_out', using 'bb'
++ * as temporary bucket brigade.  If 'logbuf' is non-NULL, the first
++ * logbufbytes of stdout are stored in logbuf. */
++static apr_status_t cgi_handle_request(request_rec *r, apr_file_t *script_out,
++                                       apr_bucket_brigade *bb,
++                                       char *logbuf, apr_size_t logbufbytes)
++{
++    int seen_eos = 0;
++    int child_stopped_reading = 0;
++    apr_status_t rv;
++    int dbpos = 0;
++
++    do {
++        apr_bucket *bucket;
++
++        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
++                            APR_BLOCK_READ, HUGE_STRING_LEN);
++
++        if (rv != APR_SUCCESS) {
++            return rv;
++        }
++
++        for (bucket = APR_BRIGADE_FIRST(bb);
++             bucket != APR_BRIGADE_SENTINEL(bb);
++             bucket = APR_BUCKET_NEXT(bucket))
++        {
++            const char *data;
++            apr_size_t len;
++
++            if (APR_BUCKET_IS_EOS(bucket)) {
++                seen_eos = 1;
++                break;
++            }
++
++            /* We can't do much with this. */
++            if (APR_BUCKET_IS_FLUSH(bucket)) {
++                continue;
++            }
++
++            /* If the child stopped, we still must read to EOS. */
++            if (child_stopped_reading) {
++                continue;
++            }
++
++            /* read */
++            rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
++            if (rv) {
++                return rv;
++            }
++
++            if (logbufbytes && dbpos < logbufbytes) {
++                int cursize;
++
++                if ((dbpos + len) > logbufbytes) {
++                    cursize = logbufbytes - dbpos;
++                }
++                else {
++                    cursize = len;
++                }
++                memcpy(logbuf + dbpos, data, cursize);
++                dbpos += cursize;
++            }
++
++            /* Keep writing data to the child until done or too much time
++             * elapses with no progress or an error occurs.
++             */
++            rv = apr_file_write_full(script_out, data, len, NULL);
++
++            if (rv != APR_SUCCESS) {
++                /* silly script stopped reading, soak up remaining message */
++                child_stopped_reading = 1;
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(02651)
++                              "Error writing request body to script %s", 
++                              r->filename);
++            }
++        }
++        apr_brigade_cleanup(bb);
++    }
++    while (!seen_eos);
++
++    if (logbuf) {
++        logbuf[dbpos] = '\0';
++    }
++
++    return APR_SUCCESS;
++}
+diff --git a/modules/generators/config5.m4 b/modules/generators/config5.m4
+index bf295217e0..086355353b 100644
+--- a/modules/generators/config5.m4
++++ b/modules/generators/config5.m4
+@@ -78,4 +78,15 @@ fi
+ 
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
++AC_ARG_ENABLE(cgid-fdpassing,
++  [APACHE_HELP_STRING(--enable-cgid-fdpassing,Enable experimental mod_cgid support for fd passing)],
++  [if test "$enableval" = "yes"; then
++     AC_CHECK_DECL(CMSG_DATA,
++       [AC_DEFINE([HAVE_CGID_FDPASSING], 1, [Enable FD passing support in mod_cgid])],
++       [AC_MSG_ERROR([cannot support mod_cgid fd-passing on this system])], [
++#include <sys/types.h>
++#include <sys/socket.h>])
++  fi
++])
++
+ APACHE_MODPATH_FINISH
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 7e4b126c10..421124a0cb 100644
+--- a/modules/generators/mod_cgi.c
++++ b/modules/generators/mod_cgi.c
+@@ -61,9 +61,6 @@
+ 
+ module AP_MODULE_DECLARE_DATA cgi_module;
+ 
+-static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgi_pfn_reg_with_ssi;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
+ static APR_OPTIONAL_FN_TYPE(ap_cgi_build_command) *cgi_build_command;
+ 
+ /* Read and discard the data in the brigade produced by a CGI script */
+@@ -92,6 +89,15 @@ typedef struct {
+     apr_size_t  bufbytes;
+ } cgi_server_conf;
+ 
++typedef struct {
++    apr_interval_time_t timeout;
++} cgi_dirconf;
++
++#if APR_FILES_AS_SOCKETS
++#define WANT_CGI_BUCKET
++#endif
++#include "cgi_common.h"
++
+ static void *create_cgi_config(apr_pool_t *p, server_rec *s)
+ {
+     cgi_server_conf *c =
+@@ -112,6 +118,12 @@ static void *merge_cgi_config(apr_pool_t *p, void *basev, void *overridesv)
+     return overrides->logname ? overrides : base;
+ }
+ 
++static void *create_cgi_dirconf(apr_pool_t *p, char *dummy)
++{
++    cgi_dirconf *c = (cgi_dirconf *) apr_pcalloc(p, sizeof(cgi_dirconf));
++    return c;
++}
++
+ static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
+ {
+     server_rec *s = cmd->server;
+@@ -150,6 +162,17 @@ static const char *set_scriptlog_buffer(cmd_parms *cmd, void *dummy,
+     return NULL;
+ }
+ 
++static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    cgi_dirconf *dc = dummy;
++
++    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) {
++        return "CGIScriptTimeout has wrong format";
++    }
++
++    return NULL;
++}
++
+ static const command_rec cgi_cmds[] =
+ {
+ AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
+@@ -158,67 +181,12 @@ AP_INIT_TAKE1("ScriptLogLength", set_scriptlog_length, NULL, RSRC_CONF,
+      "the maximum length (in bytes) of the script debug log"),
+ AP_INIT_TAKE1("ScriptLogBuffer", set_scriptlog_buffer, NULL, RSRC_CONF,
+      "the maximum size (in bytes) to record of a POST request"),
++AP_INIT_TAKE1("CGIScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
++     "The amount of time to wait between successful reads from "
++     "the CGI script, in seconds."),
+     {NULL}
+ };
+ 
+-static int log_scripterror(request_rec *r, cgi_server_conf * conf, int ret,
+-                           apr_status_t rv, char *logno, char *error)
+-{
+-    apr_file_t *f = NULL;
+-    apr_finfo_t finfo;
+-    char time_str[APR_CTIME_LEN];
+-    int log_flags = rv ? APLOG_ERR : APLOG_ERR;
+-
+-    /* Intentional no APLOGNO */
+-    /* Callee provides APLOGNO in error text */
+-    ap_log_rerror(APLOG_MARK, log_flags, rv, r,
+-                  "%s%s: %s", logno ? logno : "", error, r->filename);
+-
+-    /* XXX Very expensive mainline case! Open, then getfileinfo! */
+-    if (!conf->logname ||
+-        ((apr_stat(&finfo, conf->logname,
+-                   APR_FINFO_SIZE, r->pool) == APR_SUCCESS) &&
+-         (finfo.size > conf->logbytes)) ||
+-        (apr_file_open(&f, conf->logname,
+-                       APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT,
+-                       r->pool) != APR_SUCCESS)) {
+-        return ret;
+-    }
+-
+-    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgi-bin/printenv HTTP/1.0" */
+-    apr_ctime(time_str, apr_time_now());
+-    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
+-                    r->args ? "?" : "", r->args ? r->args : "", r->protocol);
+-    /* "%% 500 /usr/local/apache/cgi-bin */
+-    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
+-
+-    apr_file_printf(f, "%%error\n%s\n", error);
+-
+-    apr_file_close(f);
+-    return ret;
+-}
+-
+-/* Soak up stderr from a script and redirect it to the error log.
+- */
+-static apr_status_t log_script_err(request_rec *r, apr_file_t *script_err)
+-{
+-    char argsbuffer[HUGE_STRING_LEN];
+-    char *newline;
+-    apr_status_t rv;
+-    cgi_server_conf *conf = ap_get_module_config(r->server->module_config, &cgi_module);
+-
+-    while ((rv = apr_file_gets(argsbuffer, HUGE_STRING_LEN,
+-                               script_err)) == APR_SUCCESS) {
+-        newline = strchr(argsbuffer, '\n');
+-        if (newline) {
+-            *newline = '\0';
+-        }
+-        log_scripterror(r, conf, r->status, 0, APLOGNO(01215), argsbuffer);
+-    }
+-
+-    return rv;
+-}
+-
+ static int log_script(request_rec *r, cgi_server_conf * conf, int ret,
+                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
+                       apr_file_t *script_err)
+@@ -466,23 +434,26 @@ static apr_status_t run_cgi_child(apr_file_t **script_out,
+                           apr_filepath_name_get(r->filename));
+         }
+         else {
++            cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
++            apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
++
+             apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT);
+ 
+             *script_in = procnew->out;
+             if (!*script_in)
+                 return APR_EBADF;
+-            apr_file_pipe_timeout_set(*script_in, r->server->timeout);
++            apr_file_pipe_timeout_set(*script_in, timeout);
+ 
+             if (e_info->prog_type == RUN_AS_CGI) {
+                 *script_out = procnew->in;
+                 if (!*script_out)
+                     return APR_EBADF;
+-                apr_file_pipe_timeout_set(*script_out, r->server->timeout);
++                apr_file_pipe_timeout_set(*script_out, timeout);
+ 
+                 *script_err = procnew->err;
+                 if (!*script_err)
+                     return APR_EBADF;
+-                apr_file_pipe_timeout_set(*script_err, r->server->timeout);
++                apr_file_pipe_timeout_set(*script_err, timeout);
+             }
+         }
+     }
+@@ -536,234 +507,30 @@ static apr_status_t default_build_command(const char **cmd, const char ***argv,
+     return APR_SUCCESS;
+ }
+ 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+-         e = APR_BRIGADE_FIRST(bb))
+-    {
+-        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
+-            break;
+-        }
+-        apr_bucket_delete(e);
+-    }
+-}
+-
+-#if APR_FILES_AS_SOCKETS
+-
+-/* A CGI bucket type is needed to catch any output to stderr from the
+- * script; see PR 22030. */
+-static const apr_bucket_type_t bucket_type_cgi;
+-
+-struct cgi_bucket_data {
+-    apr_pollset_t *pollset;
+-    request_rec *r;
+-};
+-
+-/* Create a CGI bucket using pipes from script stdout 'out'
+- * and stderr 'err', for request 'r'. */
+-static apr_bucket *cgi_bucket_create(request_rec *r,
+-                                     apr_file_t *out, apr_file_t *err,
+-                                     apr_bucket_alloc_t *list)
+-{
+-    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
+-    apr_status_t rv;
+-    apr_pollfd_t fd;
+-    struct cgi_bucket_data *data = apr_palloc(r->pool, sizeof *data);
+-
+-    APR_BUCKET_INIT(b);
+-    b->free = apr_bucket_free;
+-    b->list = list;
+-    b->type = &bucket_type_cgi;
+-    b->length = (apr_size_t)(-1);
+-    b->start = -1;
+-
+-    /* Create the pollset */
+-    rv = apr_pollset_create(&data->pollset, 2, r->pool, 0);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01217)
+-                     "apr_pollset_create(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    fd.desc_type = APR_POLL_FILE;
+-    fd.reqevents = APR_POLLIN;
+-    fd.p = r->pool;
+-    fd.desc.f = out; /* script's stdout */
+-    fd.client_data = (void *)1;
+-    rv = apr_pollset_add(data->pollset, &fd);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01218)
+-                     "apr_pollset_add(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    fd.desc.f = err; /* script's stderr */
+-    fd.client_data = (void *)2;
+-    rv = apr_pollset_add(data->pollset, &fd);
+-    if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01219)
+-                     "apr_pollset_add(); check system or user limits");
+-        return NULL;
+-    }
+-
+-    data->r = r;
+-    b->data = data;
+-    return b;
+-}
+-
+-/* Create a duplicate CGI bucket using given bucket data */
+-static apr_bucket *cgi_bucket_dup(struct cgi_bucket_data *data,
+-                                  apr_bucket_alloc_t *list)
+-{
+-    apr_bucket *b = apr_bucket_alloc(sizeof(*b), list);
+-    APR_BUCKET_INIT(b);
+-    b->free = apr_bucket_free;
+-    b->list = list;
+-    b->type = &bucket_type_cgi;
+-    b->length = (apr_size_t)(-1);
+-    b->start = -1;
+-    b->data = data;
+-    return b;
+-}
+-
+-/* Handle stdout from CGI child.  Duplicate of logic from the _read
+- * method of the real APR pipe bucket implementation. */
+-static apr_status_t cgi_read_stdout(apr_bucket *a, apr_file_t *out,
+-                                    const char **str, apr_size_t *len)
+-{
+-    char *buf;
+-    apr_status_t rv;
+-
+-    *str = NULL;
+-    *len = APR_BUCKET_BUFF_SIZE;
+-    buf = apr_bucket_alloc(*len, a->list); /* XXX: check for failure? */
+-
+-    rv = apr_file_read(out, buf, len);
+-
+-    if (rv != APR_SUCCESS && rv != APR_EOF) {
+-        apr_bucket_free(buf);
+-        return rv;
+-    }
+-
+-    if (*len > 0) {
+-        struct cgi_bucket_data *data = a->data;
+-        apr_bucket_heap *h;
+-
+-        /* Change the current bucket to refer to what we read */
+-        a = apr_bucket_heap_make(a, buf, *len, apr_bucket_free);
+-        h = a->data;
+-        h->alloc_len = APR_BUCKET_BUFF_SIZE; /* note the real buffer size */
+-        *str = buf;
+-        APR_BUCKET_INSERT_AFTER(a, cgi_bucket_dup(data, a->list));
+-    }
+-    else {
+-        apr_bucket_free(buf);
+-        a = apr_bucket_immortal_make(a, "", 0);
+-        *str = a->data;
+-    }
+-    return rv;
+-}
+-
+-/* Read method of CGI bucket: polls on stderr and stdout of the child,
+- * sending any stderr output immediately away to the error log. */
+-static apr_status_t cgi_bucket_read(apr_bucket *b, const char **str,
+-                                    apr_size_t *len, apr_read_type_e block)
+-{
+-    struct cgi_bucket_data *data = b->data;
+-    apr_interval_time_t timeout;
+-    apr_status_t rv;
+-    int gotdata = 0;
+-
+-    timeout = block == APR_NONBLOCK_READ ? 0 : data->r->server->timeout;
+-
+-    do {
+-        const apr_pollfd_t *results;
+-        apr_int32_t num;
+-
+-        rv = apr_pollset_poll(data->pollset, timeout, &num, &results);
+-        if (APR_STATUS_IS_TIMEUP(rv)) {
+-            if (timeout) {
+-                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, data->r, APLOGNO(01220)
+-                              "Timeout waiting for output from CGI script %s",
+-                              data->r->filename);
+-                return rv;
+-            }
+-            else {
+-                return APR_EAGAIN;
+-            }
+-        }
+-        else if (APR_STATUS_IS_EINTR(rv)) {
+-            continue;
+-        }
+-        else if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, data->r, APLOGNO(01221)
+-                          "poll failed waiting for CGI child");
+-            return rv;
+-        }
+-
+-        for (; num; num--, results++) {
+-            if (results[0].client_data == (void *)1) {
+-                /* stdout */
+-                rv = cgi_read_stdout(b, results[0].desc.f, str, len);
+-                if (APR_STATUS_IS_EOF(rv)) {
+-                    rv = APR_SUCCESS;
+-                }
+-                gotdata = 1;
+-            } else {
+-                /* stderr */
+-                apr_status_t rv2 = log_script_err(data->r, results[0].desc.f);
+-                if (APR_STATUS_IS_EOF(rv2)) {
+-                    apr_pollset_remove(data->pollset, &results[0]);
+-                }
+-            }
+-        }
+-
+-    } while (!gotdata);
+-
+-    return rv;
+-}
+-
+-static const apr_bucket_type_t bucket_type_cgi = {
+-    "CGI", 5, APR_BUCKET_DATA,
+-    apr_bucket_destroy_noop,
+-    cgi_bucket_read,
+-    apr_bucket_setaside_notimpl,
+-    apr_bucket_split_notimpl,
+-    apr_bucket_copy_notimpl
+-};
+-
+-#endif
+-
+ static int cgi_handler(request_rec *r)
+ {
+     int nph;
+-    apr_size_t dbpos = 0;
++    apr_size_t dbufsize;
+     const char *argv0;
+     const char *command;
+     const char **argv;
+     char *dbuf = NULL;
+     apr_file_t *script_out = NULL, *script_in = NULL, *script_err = NULL;
+-    apr_bucket_brigade *bb;
++    conn_rec *c = r->connection;
++    apr_bucket_brigade *bb = apr_brigade_create(r->pool, c->bucket_alloc);
+     apr_bucket *b;
+     int is_included;
+-    int seen_eos, child_stopped_reading;
+     apr_pool_t *p;
+     cgi_server_conf *conf;
+     apr_status_t rv;
+     cgi_exec_info_t e_info;
+-    conn_rec *c;
++    cgi_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgi_module);
++    apr_interval_time_t timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+ 
+     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+         return DECLINED;
+     }
+ 
+-    c = r->connection;
+-
+     is_included = !strcmp(r->protocol, "INCLUDED");
+ 
+     p = r->main ? r->main->pool : r->pool;
+@@ -832,83 +599,24 @@ static int cgi_handler(request_rec *r)
+         return HTTP_INTERNAL_SERVER_ERROR;
+     }
+ 
+-    /* Transfer any put/post args, CERN style...
+-     * Note that we already ignore SIGPIPE in the core server.
+-     */
+-    bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-    seen_eos = 0;
+-    child_stopped_reading = 0;
++    /* Buffer for logging script stdout. */
+     if (conf->logname) {
+-        dbuf = apr_palloc(r->pool, conf->bufbytes + 1);
+-        dbpos = 0;
++        dbufsize = conf->bufbytes;
++        dbuf = apr_palloc(r->pool, dbufsize + 1);
+     }
+-    do {
+-        apr_bucket *bucket;
+-
+-        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
+-                            APR_BLOCK_READ, HUGE_STRING_LEN);
+-
+-        if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225)
+-                          "Error reading request entity data");
+-            return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+-        }
+-
+-        for (bucket = APR_BRIGADE_FIRST(bb);
+-             bucket != APR_BRIGADE_SENTINEL(bb);
+-             bucket = APR_BUCKET_NEXT(bucket))
+-        {
+-            const char *data;
+-            apr_size_t len;
+-
+-            if (APR_BUCKET_IS_EOS(bucket)) {
+-                seen_eos = 1;
+-                break;
+-            }
+-
+-            /* We can't do much with this. */
+-            if (APR_BUCKET_IS_FLUSH(bucket)) {
+-                continue;
+-            }
+-
+-            /* If the child stopped, we still must read to EOS. */
+-            if (child_stopped_reading) {
+-                continue;
+-            }
+-
+-            /* read */
+-            apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
+-
+-            if (conf->logname && dbpos < conf->bufbytes) {
+-                int cursize;
+-
+-                if ((dbpos + len) > conf->bufbytes) {
+-                    cursize = conf->bufbytes - dbpos;
+-                }
+-                else {
+-                    cursize = len;
+-                }
+-                memcpy(dbuf + dbpos, data, cursize);
+-                dbpos += cursize;
+-            }
+-
+-            /* Keep writing data to the child until done or too much time
+-             * elapses with no progress or an error occurs.
+-             */
+-            rv = apr_file_write_full(script_out, data, len, NULL);
+-
+-            if (rv != APR_SUCCESS) {
+-                /* silly script stopped reading, soak up remaining message */
+-                child_stopped_reading = 1;
+-            }
+-        }
+-        apr_brigade_cleanup(bb);
++    else {
++        dbufsize = 0;
++        dbuf = NULL;
+     }
+-    while (!seen_eos);
+ 
+-    if (conf->logname) {
+-        dbuf[dbpos] = '\0';
++    /* Read the request body. */
++    rv = cgi_handle_request(r, script_out, bb, dbuf, dbufsize);
++    if (rv) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01225)
++                      "Error reading request entity data");
++        return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+     }
++
+     /* Is this flush really needed? */
+     apr_file_flush(script_out);
+     apr_file_close(script_out);
+@@ -916,10 +624,7 @@ static int cgi_handler(request_rec *r)
+     AP_DEBUG_ASSERT(script_in != NULL);
+ 
+ #if APR_FILES_AS_SOCKETS
+-    apr_file_pipe_timeout_set(script_in, 0);
+-    apr_file_pipe_timeout_set(script_err, 0);
+-
+-    b = cgi_bucket_create(r, script_in, script_err, c->bucket_alloc);
++    b = cgi_bucket_create(r, dc->timeout, script_in, script_err, c->bucket_alloc);
+     if (b == NULL)
+         return HTTP_INTERNAL_SERVER_ERROR;
+ #else
+@@ -929,111 +634,7 @@ static int cgi_handler(request_rec *r)
+     b = apr_bucket_eos_create(c->bucket_alloc);
+     APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-    /* Handle script return... */
+-    if (!nph) {
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && r->status == 200) {
+-            /* For a redirect whether internal or not, discard any
+-             * remaining stdout from the script, and log any remaining
+-             * stderr output, as normal. */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            apr_file_pipe_timeout_set(script_err, r->server->timeout);
+-            log_script_err(r, script_err);
+-        }
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one.  We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-    else /* nph */ {
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-    }
+-
+-    /* don't soak up script output if errors occurred writing it
+-     * out...  otherwise, we prolong the life of the script when the
+-     * connection drops or we stopped sending output for some other
+-     * reason */
+-    if (rv == APR_SUCCESS && !r->connection->aborted) {
+-        apr_file_pipe_timeout_set(script_err, r->server->timeout);
+-        log_script_err(r, script_err);
+-    }
+-
+-    apr_file_close(script_err);
+-
+-    return OK;                      /* NOT r->status, even if it has changed. */
++    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
+ }
+ 
+ /*============================================================================
+@@ -1147,107 +748,9 @@ static apr_status_t include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
+-                                apr_bucket_brigade *bb)
+-{
+-    char *tag = NULL;
+-    char *tag_val = NULL;
+-    request_rec *r = f->r;
+-    char *file = r->filename;
+-    char parsed_string[MAX_STRING_LEN];
+-
+-    if (!ctx->argc) {
+-        ap_log_rerror(APLOG_MARK,
+-                      (ctx->flags & SSI_FLAG_PRINTING)
+-                          ? APLOG_ERR : APLOG_WARNING,
+-                      0, r, APLOGNO(03195)
+-                      "missing argument for exec element in %s", r->filename);
+-    }
+-
+-    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
+-        return APR_SUCCESS;
+-    }
+-
+-    if (!ctx->argc) {
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    if (ctx->flags & SSI_FLAG_NO_EXEC) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01228) "exec used but not allowed "
+-                      "in %s", r->filename);
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    while (1) {
+-        cgi_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
+-        if (!tag || !tag_val) {
+-            break;
+-        }
+-
+-        if (!strcmp(tag, "cmd")) {
+-            apr_status_t rv;
+-
+-            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                       SSI_EXPAND_LEAVE_NAME);
+-
+-            rv = include_cmd(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01229) "execution failure "
+-                              "for parameter \"%s\" to tag exec in file %s",
+-                              tag, r->filename);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else if (!strcmp(tag, "cgi")) {
+-            apr_status_t rv;
+-
+-            cgi_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                       SSI_EXPAND_DROP_NAME);
+-
+-            rv = include_cgi(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01230) "invalid CGI ref "
+-                              "\"%s\" in %s", tag_val, file);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01231) "unknown parameter "
+-                          "\"%s\" to tag exec in %s", tag, file);
+-            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-            break;
+-        }
+-    }
+-
+-    return APR_SUCCESS;
+-}
+-
+-
+-/*============================================================================
+- *============================================================================
+- * This is the end of the cgi filter code moved from mod_include.
+- *============================================================================
+- *============================================================================*/
+-
+-
+ static int cgi_post_config(apr_pool_t *p, apr_pool_t *plog,
+                                 apr_pool_t *ptemp, server_rec *s)
+ {
+-    cgi_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
+-    cgi_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
+-    cgi_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
+-
+-    if ((cgi_pfn_reg_with_ssi) && (cgi_pfn_gtv) && (cgi_pfn_ps)) {
+-        /* Required by mod_include filter. This is how mod_cgi registers
+-         *   with mod_include to provide processing of the exec directive.
+-         */
+-        cgi_pfn_reg_with_ssi("exec", handle_exec);
+-    }
+-
+     /* This is the means by which unusual (non-unix) os's may find alternate
+      * means to run a given command (e.g. shebang/registry parsing on Win32)
+      */
+@@ -1263,12 +766,13 @@ static void register_hooks(apr_pool_t *p)
+     static const char * const aszPre[] = { "mod_include.c", NULL };
+     ap_hook_handler(cgi_handler, NULL, NULL, APR_HOOK_MIDDLE);
+     ap_hook_post_config(cgi_post_config, aszPre, NULL, APR_HOOK_REALLY_FIRST);
++    ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE);
+ }
+ 
+ AP_DECLARE_MODULE(cgi) =
+ {
+     STANDARD20_MODULE_STUFF,
+-    NULL,                        /* dir config creater */
++    create_cgi_dirconf,          /* dir config creater */
+     NULL,                        /* dir merger --- default is to override */
+     create_cgi_config,           /* server config */
+     merge_cgi_config,            /* merge server config */
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index 2258a683b7..dddfb25254 100644
+--- a/modules/generators/mod_cgid.c
++++ b/modules/generators/mod_cgid.c
+@@ -80,11 +80,6 @@ module AP_MODULE_DECLARE_DATA cgid_module;
+ 
+ static int cgid_start(apr_pool_t *p, server_rec *main_server, apr_proc_t *procnew);
+ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *main_server);
+-static int handle_exec(include_ctx_t *ctx, ap_filter_t *f, apr_bucket_brigade *bb);
+-
+-static APR_OPTIONAL_FN_TYPE(ap_register_include_handler) *cgid_pfn_reg_with_ssi;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgid_pfn_gtv;
+-static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgid_pfn_ps;
+ 
+ static apr_pool_t *pcgi = NULL;
+ static pid_t daemon_pid;
+@@ -220,6 +215,15 @@ typedef struct {
+ #endif
+ } cgid_req_t;
+ 
++#define cgi_server_conf cgid_server_conf
++#define cgi_module cgid_module
++
++#ifdef HAVE_CGID_FDPASSING
++/* Pull in CGI bucket implementation. */
++#define WANT_CGI_BUCKET
++#endif
++#include "cgi_common.h"
++
+ /* This routine is called to create the argument list to be passed
+  * to the CGI script.  When suexec is enabled, the suexec path, user, and
+  * group are the first three arguments to be passed; if not, all three
+@@ -342,15 +346,19 @@ static apr_status_t close_unix_socket(void *thefd)
+     return close(fd);
+ }
+ 
+-/* deal with incomplete reads and signals
+- * assume you really have to read buf_size bytes
+- */
+-static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
++/* Read from the socket dealing with incomplete messages and signals.
++ * Returns 0 on success or errno on failure.  Stderr fd passed as
++ * auxiliary data from other end is written to *errfd, or else stderr
++ * fileno if not present. */
++static apr_status_t sock_readhdr(int fd, int *errfd, void *vbuf, size_t buf_size)
+ {
+-    char *buf = vbuf;
+     int rc;
++#ifndef HAVE_CGID_FDPASSING
++    char *buf = vbuf;
+     size_t bytes_read = 0;
+ 
++    if (errfd) *errfd = 0;
++    
+     do {
+         do {
+             rc = read(fd, buf + bytes_read, buf_size - bytes_read);
+@@ -365,9 +373,60 @@ static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
+         }
+     } while (bytes_read < buf_size);
+ 
++   
++#else /* with FD passing */
++    struct msghdr msg = {0};
++    struct iovec vec = {vbuf, buf_size};
++    struct cmsghdr *cmsg;
++    union {  /* union to ensure alignment */
++        struct cmsghdr cm;
++        char buf[CMSG_SPACE(sizeof(int))];
++    } u;
++    
++    msg.msg_iov = &vec;
++    msg.msg_iovlen = 1;
++
++    if (errfd) {
++        msg.msg_control = u.buf;
++        msg.msg_controllen = sizeof(u.buf);
++        *errfd = 0;
++    }
++    
++    /* use MSG_WAITALL to skip loop on truncated reads */
++    do {
++        rc = recvmsg(fd, &msg, MSG_WAITALL);
++    } while (rc < 0 && errno == EINTR);
++
++    if (rc == 0) {
++        return ECONNRESET;
++    }
++    else if (rc < 0) {
++        return errno;
++    }
++    else if (rc != buf_size) {
++        /* MSG_WAITALL should ensure the recvmsg blocks until the
++         * entire length is read, but let's be paranoid. */
++        return APR_INCOMPLETE;
++    }
++
++    if (errfd
++        && (cmsg = CMSG_FIRSTHDR(&msg)) != NULL
++        && cmsg->cmsg_len == CMSG_LEN(sizeof(*errfd))
++        && cmsg->cmsg_level == SOL_SOCKET
++        && cmsg->cmsg_type == SCM_RIGHTS) {
++        *errfd = *((int *) CMSG_DATA(cmsg));
++    }
++#endif
++    
+     return APR_SUCCESS;
+ }
+ 
++/* As sock_readhdr but without auxiliary fd passing. */
++static apr_status_t sock_read(int fd, void *vbuf, size_t buf_size)
++{
++    return sock_readhdr(fd, NULL, vbuf, buf_size);
++}
++
+ /* deal with signals
+  */
+ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+@@ -384,7 +443,7 @@ static apr_status_t sock_write(int fd, const void *buf, size_t buf_size)
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
++static apr_status_t sock_writev(int fd, int auxfd, request_rec *r, int count, ...)
+ {
+     va_list ap;
+     int rc;
+@@ -399,9 +458,39 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+     }
+     va_end(ap);
+ 
++#ifndef HAVE_CGID_FDPASSING
+     do {
+         rc = writev(fd, vec, count);
+     } while (rc < 0 && errno == EINTR);
++#else
++    {
++        struct msghdr msg = { 0 };
++        struct cmsghdr *cmsg;
++        union { /* union for alignment */
++            char buf[CMSG_SPACE(sizeof(int))];
++            struct cmsghdr align;
++        } u;
++
++        msg.msg_iov = vec;
++        msg.msg_iovlen = count;
++
++        if (auxfd) {
++            msg.msg_control = u.buf;
++            msg.msg_controllen = sizeof(u.buf);
++
++            cmsg = CMSG_FIRSTHDR(&msg);
++            cmsg->cmsg_level = SOL_SOCKET;
++            cmsg->cmsg_type = SCM_RIGHTS;
++            cmsg->cmsg_len = CMSG_LEN(sizeof(int));
++            *((int *) CMSG_DATA(cmsg)) = auxfd;
++        }
++
++        do {
++            rc = sendmsg(fd, &msg, 0);
++        } while (rc < 0 && errno == EINTR);
++    }
++#endif
++    
+     if (rc < 0) {
+         return errno;
+     }
+@@ -410,7 +499,7 @@ static apr_status_t sock_writev(int fd, request_rec *r, int count, ...)
+ }
+ 
+ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+-                            cgid_req_t *req)
++                            int *errfd, cgid_req_t *req)
+ {
+     int i;
+     char **environ;
+@@ -421,7 +510,7 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+     r->server = apr_pcalloc(r->pool, sizeof(server_rec));
+ 
+     /* read the request header */
+-    stat = sock_read(fd, req, sizeof(*req));
++    stat = sock_readhdr(fd, errfd, req, sizeof(*req));
+     if (stat != APR_SUCCESS) {
+         return stat;
+     }
+@@ -431,6 +520,14 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+         return APR_SUCCESS;
+     }
+ 
++    /* Sanity check the structure received. */
++    if (req->env_count < 0 || req->uri_len == 0
++        || req->filename_len > APR_PATH_MAX || req->filename_len == 0
++        || req->argv0_len > APR_PATH_MAX || req->argv0_len == 0
++        || req->loglevel > APLOG_TRACE8) {
++        return APR_EINVAL;
++    }
++    
+     /* handle module indexes and such */
+     rconf = (void **)ap_create_request_config(r->pool);
+ 
+@@ -479,14 +576,15 @@ static apr_status_t get_req(int fd, request_rec *r, char **argv0, char ***env,
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+-                             int req_type)
++static apr_status_t send_req(int fd, apr_file_t *errpipe, request_rec *r,
++                             const char *argv0, char **env, int req_type)
+ {
+     int i;
+     cgid_req_t req = {0};
+     apr_status_t stat;
+     ap_unix_identity_t * ugid = ap_run_get_suexec_identity(r);
+     core_dir_config *core_conf = ap_get_core_module_config(r->per_dir_config);
++    int errfd;
+ 
+ 
+     if (ugid == NULL) {
+@@ -507,16 +605,21 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+     req.args_len = r->args ? strlen(r->args) : 0;
+     req.loglevel = r->server->log.level;
+ 
++    if (errpipe)
++        apr_os_file_get(&errfd, errpipe);
++    else
++        errfd = 0;
++    
+     /* Write the request header */
+     if (req.args_len) {
+-        stat = sock_writev(fd, r, 5,
++        stat = sock_writev(fd, errfd, r, 5,
+                            &req, sizeof(req),
+                            r->filename, req.filename_len,
+                            argv0, req.argv0_len,
+                            r->uri, req.uri_len,
+                            r->args, req.args_len);
+     } else {
+-        stat = sock_writev(fd, r, 4,
++        stat = sock_writev(fd, errfd, r, 4,
+                            &req, sizeof(req),
+                            r->filename, req.filename_len,
+                            argv0, req.argv0_len,
+@@ -531,7 +634,7 @@ static apr_status_t send_req(int fd, request_rec *r, char *argv0, char **env,
+     for (i = 0; i < req.env_count; i++) {
+         apr_size_t curlen = strlen(env[i]);
+ 
+-        if ((stat = sock_writev(fd, r, 2, &curlen, sizeof(curlen),
++        if ((stat = sock_writev(fd, 0, r, 2, &curlen, sizeof(curlen),
+                                 env[i], curlen)) != APR_SUCCESS) {
+             return stat;
+         }
+@@ -582,20 +685,34 @@ static void daemon_signal_handler(int sig)
+     }
+ }
+ 
++/* Callback executed in the forked child process if exec of the CGI
++ * script fails.  For the fd-passing case, output to stderr goes to
++ * the client (request handling thread) and is logged via
++ * ap_log_rerror there.  For the non-fd-passing case, the "fake"
++ * request_rec passed via userdata is used to log. */
+ static void cgid_child_errfn(apr_pool_t *pool, apr_status_t err,
+                              const char *description)
+ {
+-    request_rec *r;
+     void *vr;
+ 
+     apr_pool_userdata_get(&vr, ERRFN_USERDATA_KEY, pool);
+-    r = vr;
+-
+-    /* sure we got r, but don't call ap_log_rerror() because we don't
+-     * have r->headers_in and possibly other storage referenced by
+-     * ap_log_rerror()
+-     */
+-    ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
++    if (vr) {
++        request_rec *r = vr;
++        
++        /* sure we got r, but don't call ap_log_rerror() because we don't
++         * have r->headers_in and possibly other storage referenced by
++         * ap_log_rerror()
++         */
++        ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server, APLOGNO(01241) "%s", description);
++    }
++    else {
++        const char *logstr;
++        
++        logstr = apr_psprintf(pool, APLOGNO(01241) "error spawning CGI child: %s (%pm)\n",
++                              description, &err);
++        fputs(logstr, stderr);
++        fflush(stderr);
++    }
+ }
+ 
+ static int cgid_server(void *data)
+@@ -670,7 +787,7 @@ static int cgid_server(void *data)
+     }
+ 
+     while (!daemon_should_exit) {
+-        int errfileno = STDERR_FILENO;
++        int errfileno;
+         char *argv0 = NULL;
+         char **env = NULL;
+         const char * const *argv;
+@@ -710,7 +827,7 @@ static int cgid_server(void *data)
+         r = apr_pcalloc(ptrans, sizeof(request_rec));
+         procnew = apr_pcalloc(ptrans, sizeof(*procnew));
+         r->pool = ptrans;
+-        stat = get_req(sd2, r, &argv0, &env, &cgid_req);
++        stat = get_req(sd2, r, &argv0, &env, &errfileno, &cgid_req);
+         if (stat != APR_SUCCESS) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, stat,
+                          main_server, APLOGNO(01248)
+@@ -742,6 +859,16 @@ static int cgid_server(void *data)
+             continue;
+         }
+ 
++        if (errfileno == 0) {
++            errfileno = STDERR_FILENO;
++        }
++        else {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, main_server,
++                          "using passed fd %d as stderr", errfileno);
++            /* Limit the received fd lifetime to pool lifetime */
++            apr_pool_cleanup_register(ptrans, (void *)((long)errfileno),
++                                      close_unix_socket, close_unix_socket);
++        }
+         apr_os_file_put(&r->server->error_log, &errfileno, 0, r->pool);
+         apr_os_file_put(&inout, &sd2, 0, r->pool);
+ 
+@@ -801,7 +928,10 @@ static int cgid_server(void *data)
+             close(sd2);
+         }
+         else {
+-            apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
++            if (errfileno == STDERR_FILENO) {
++                /* Used by cgid_child_errfn without fd-passing. */
++                apr_pool_userdata_set(r, ERRFN_USERDATA_KEY, apr_pool_cleanup_null, ptrans);
++            }
+ 
+             argv = (const char * const *)create_argv(r->pool, NULL, NULL, NULL, argv0, r->args);
+ 
+@@ -946,16 +1076,6 @@ static int cgid_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp,
+         if (ret != OK ) {
+             return ret;
+         }
+-        cgid_pfn_reg_with_ssi = APR_RETRIEVE_OPTIONAL_FN(ap_register_include_handler);
+-        cgid_pfn_gtv          = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_get_tag_and_value);
+-        cgid_pfn_ps           = APR_RETRIEVE_OPTIONAL_FN(ap_ssi_parse_string);
+-
+-        if ((cgid_pfn_reg_with_ssi) && (cgid_pfn_gtv) && (cgid_pfn_ps)) {
+-            /* Required by mod_include filter. This is how mod_cgid registers
+-             *   with mod_include to provide processing of the exec directive.
+-             */
+-            cgid_pfn_reg_with_ssi("exec", handle_exec);
+-        }
+     }
+     return ret;
+ }
+@@ -1066,41 +1186,6 @@ static const command_rec cgid_cmds[] =
+     {NULL}
+ };
+ 
+-static int log_scripterror(request_rec *r, cgid_server_conf * conf, int ret,
+-                           apr_status_t rv, char *error)
+-{
+-    apr_file_t *f = NULL;
+-    struct stat finfo;
+-    char time_str[APR_CTIME_LEN];
+-    int log_flags = rv ? APLOG_ERR : APLOG_ERR;
+-
+-    /* Intentional no APLOGNO */
+-    /* Callee provides APLOGNO in error text */
+-    ap_log_rerror(APLOG_MARK, log_flags, rv, r,
+-                "%s: %s", error, r->filename);
+-
+-    /* XXX Very expensive mainline case! Open, then getfileinfo! */
+-    if (!conf->logname ||
+-        ((stat(conf->logname, &finfo) == 0)
+-         && (finfo.st_size > conf->logbytes)) ||
+-         (apr_file_open(&f, conf->logname,
+-                  APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, r->pool) != APR_SUCCESS)) {
+-        return ret;
+-    }
+-
+-    /* "%% [Wed Jun 19 10:53:21 1996] GET /cgid-bin/printenv HTTP/1.0" */
+-    apr_ctime(time_str, apr_time_now());
+-    apr_file_printf(f, "%%%% [%s] %s %s%s%s %s\n", time_str, r->method, r->uri,
+-            r->args ? "?" : "", r->args ? r->args : "", r->protocol);
+-    /* "%% 500 /usr/local/apache/cgid-bin */
+-    apr_file_printf(f, "%%%% %d %s\n", ret, r->filename);
+-
+-    apr_file_printf(f, "%%error\n%s\n", error);
+-
+-    apr_file_close(f);
+-    return ret;
+-}
+-
+ static int log_script(request_rec *r, cgid_server_conf * conf, int ret,
+                       char *dbuf, const char *sbuf, apr_bucket_brigade *bb,
+                       apr_file_t *script_err)
+@@ -1221,7 +1306,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+         ++connect_tries;
+         if ((sd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
+             return log_scripterror(r, conf, HTTP_INTERNAL_SERVER_ERROR, errno,
+-                                   APLOGNO(01255) "unable to create socket to cgi daemon");
++                                   APLOGNO(01255), "unable to create socket to cgi daemon");
+         }
+         if (connect(sd, (struct sockaddr *)server_addr, server_addr_len) < 0) {
+             /* Save errno for later */
+@@ -1242,7 +1327,7 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+             }
+             else {
+                 close(sd);
+-                return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257)
++                return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, errno, APLOGNO(01257),
+                                        "unable to connect to cgi daemon after multiple tries");
+             }
+         }
+@@ -1258,13 +1343,15 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+         if (connect_errno == ENOENT &&
+             apr_time_sec(apr_time_now() - ap_scoreboard_image->global->restart_time) > 
+                 DEFAULT_CONNECT_STARTUP_DELAY) {
+-            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, 
+-                                   apr_pstrcat(r->pool, APLOGNO(02833) "ScriptSock ", sockname, " does not exist", NULL));
++            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno,
++                                   APLOGNO(02833),
++                                   apr_pstrcat(r->pool,
++                                               "ScriptSock ", sockname, " does not exist", NULL));
+         }
+ 
+         /* gotta try again, but make sure the cgid daemon is still around */
+         if (connect_errno != ENOENT && kill(daemon_pid, 0) != 0) {
+-            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258)
++            return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, connect_errno, APLOGNO(01258),
+                                    "cgid daemon is gone; is Apache terminating?");
+         }
+     }
+@@ -1272,23 +1359,6 @@ static int connect_to_daemon(int *sdptr, request_rec *r,
+     return OK;
+ }
+ 
+-static void discard_script_output(apr_bucket_brigade *bb)
+-{
+-    apr_bucket *e;
+-    const char *buf;
+-    apr_size_t len;
+-
+-    for (e = APR_BRIGADE_FIRST(bb);
+-         e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e);
+-         e = APR_BRIGADE_FIRST(bb))
+-    {
+-        if (apr_bucket_read(e, &buf, &len, APR_BLOCK_READ)) {
+-            break;
+-        }
+-        apr_bucket_delete(e);
+-    }
+-}
+-
+ /****************************************************************
+  *
+  * Actual cgid handling...
+@@ -1374,7 +1444,9 @@ static apr_status_t get_cgi_pid(request_rec *r,  cgid_server_conf *conf, pid_t *
+         return stat;
+     }
+ 
+-    if (pid == 0) {
++    /* Don't accept zero as a pid here, calling kill(0, SIGTERM) etc
++     * later is unpleasant. */
++    if (*pid == 0) {
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01261)
+                       "daemon couldn't find CGI process for connection %lu",
+                       r->connection->id);
+@@ -1393,19 +1465,21 @@ static apr_status_t cleanup_script(void *vptr)
+ 
+ static int cgid_handler(request_rec *r)
+ {
+-    int retval, nph, dbpos;
++    conn_rec *c = r->connection;
++    int retval, nph;
+     char *argv0, *dbuf;
+-    apr_bucket_brigade *bb;
++    apr_size_t dbufsize;
++    apr_bucket_brigade *bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+     apr_bucket *b;
+     cgid_server_conf *conf;
+     int is_included;
+-    int seen_eos, child_stopped_reading;
+     int sd;
+     char **env;
+-    apr_file_t *tempsock;
++    apr_file_t *tempsock, *script_err, *errpipe_out;
+     struct cleanup_script_info *info;
+     apr_status_t rv;
+     cgid_dirconf *dc;
++    apr_interval_time_t timeout;
+ 
+     if (strcmp(r->handler, CGI_MAGIC_TYPE) && strcmp(r->handler, "cgi-script")) {
+         return DECLINED;
+@@ -1414,7 +1488,7 @@ static int cgid_handler(request_rec *r)
+     conf = ap_get_module_config(r->server->module_config, &cgid_module);
+     dc = ap_get_module_config(r->per_dir_config, &cgid_module);
+ 
+-    
++    timeout = dc->timeout > 0 ? dc->timeout : r->server->timeout;
+     is_included = !strcmp(r->protocol, "INCLUDED");
+ 
+     if ((argv0 = strrchr(r->filename, '/')) != NULL) {
+@@ -1429,12 +1503,12 @@ static int cgid_handler(request_rec *r)
+     argv0 = r->filename;
+ 
+     if (!(ap_allow_options(r) & OPT_EXECCGI) && !is_scriptaliased(r)) {
+-        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262)
++        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01262),
+                 "Options ExecCGI is off in this directory");
+     }
+ 
+     if (nph && is_included) {
+-        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263)
++        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01263),
+                 "attempt to include NPH CGI script");
+     }
+ 
+@@ -1443,12 +1517,12 @@ static int cgid_handler(request_rec *r)
+ #error at mod_cgi.c for required code in this path.
+ #else
+     if (r->finfo.filetype == APR_NOFILE) {
+-        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264)
++        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01264),
+                 "script not found or unable to stat");
+     }
+ #endif
+     if (r->finfo.filetype == APR_DIR) {
+-        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265)
++        return log_scripterror(r, conf, HTTP_FORBIDDEN, 0, APLOGNO(01265),
+                 "attempt to invoke directory as script");
+     }
+ 
+@@ -1456,7 +1530,7 @@ static int cgid_handler(request_rec *r)
+         r->path_info && *r->path_info)
+     {
+         /* default to accept */
+-        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266)
++        return log_scripterror(r, conf, HTTP_NOT_FOUND, 0, APLOGNO(01266),
+                                "AcceptPathInfo off disallows user's path");
+     }
+     /*
+@@ -1467,6 +1541,17 @@ static int cgid_handler(request_rec *r)
+     }
+     */
+ 
++#ifdef HAVE_CGID_FDPASSING
++    rv = apr_file_pipe_create(&script_err, &errpipe_out, r->pool);
++    if (rv) {
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10176),
++                               "could not create pipe for stderr");
++    }
++#else
++    script_err = NULL;
++    errpipe_out = NULL;
++#endif
++    
+     /*
+      * httpd core function used to add common environment variables like
+      * DOCUMENT_ROOT. 
+@@ -1479,24 +1564,28 @@ static int cgid_handler(request_rec *r)
+         return retval;
+     }
+ 
+-    rv = send_req(sd, r, argv0, env, CGI_REQ);
++    rv = send_req(sd, errpipe_out, r, argv0, env, CGI_REQ);
+     if (rv != APR_SUCCESS) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01268)
+-                     "write to cgi daemon process");
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10245),
++                               "could not send request to cgi daemon");
+     }
+ 
++    /* The write-end of the pipe is only used by the server, so close
++     * it here. */
++    if (errpipe_out) apr_file_close(errpipe_out);
++    
+     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
+     info->conf = conf;
+     info->r = r;
+     rv = get_cgi_pid(r, conf, &(info->pid));
+ 
+-    if (APR_SUCCESS == rv){  
++    if (rv == APR_SUCCESS) {
+         apr_pool_cleanup_register(r->pool, info,
+-                              cleanup_script,
+-                              apr_pool_cleanup_null);
++                                  cleanup_script, apr_pool_cleanup_null);
+     }
+     else { 
+-        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, "error determining cgi PID");
++        return log_scripterror(r, conf, HTTP_SERVICE_UNAVAILABLE, rv, APLOGNO(10246),
++                               "failed reading PID from cgi daemon");
+     }
+ 
+     /* We are putting the socket discriptor into an apr_file_t so that we can
+@@ -1506,95 +1595,25 @@ static int cgid_handler(request_rec *r)
+      */
+ 
+     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
+-    if (dc->timeout > 0) { 
+-        apr_file_pipe_timeout_set(tempsock, dc->timeout);
+-    }
+-    else { 
+-        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
+-    }
++    apr_file_pipe_timeout_set(tempsock, timeout);
+     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
+ 
+-    /* Transfer any put/post args, CERN style...
+-     * Note that we already ignore SIGPIPE in the core server.
+-     */
+-    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+-    seen_eos = 0;
+-    child_stopped_reading = 0;
+-    dbuf = NULL;
+-    dbpos = 0;
++    /* Buffer for logging script stdout. */
+     if (conf->logname) {
+-        dbuf = apr_palloc(r->pool, conf->bufbytes + 1);
++        dbufsize = conf->bufbytes;
++        dbuf = apr_palloc(r->pool, dbufsize + 1);
+     }
+-    do {
+-        apr_bucket *bucket;
+-
+-        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_READBYTES,
+-                            APR_BLOCK_READ, HUGE_STRING_LEN);
+-
+-        if (rv != APR_SUCCESS) {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270)
+-                          "Error reading request entity data");
+-            return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+-        }
+-
+-        for (bucket = APR_BRIGADE_FIRST(bb);
+-             bucket != APR_BRIGADE_SENTINEL(bb);
+-             bucket = APR_BUCKET_NEXT(bucket))
+-        {
+-            const char *data;
+-            apr_size_t len;
+-
+-            if (APR_BUCKET_IS_EOS(bucket)) {
+-                seen_eos = 1;
+-                break;
+-            }
+-
+-            /* We can't do much with this. */
+-            if (APR_BUCKET_IS_FLUSH(bucket)) {
+-                continue;
+-            }
+-
+-            /* If the child stopped, we still must read to EOS. */
+-            if (child_stopped_reading) {
+-                continue;
+-            }
+-
+-            /* read */
+-            apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
+-
+-            if (conf->logname && dbpos < conf->bufbytes) {
+-                int cursize;
+-
+-                if ((dbpos + len) > conf->bufbytes) {
+-                    cursize = conf->bufbytes - dbpos;
+-                }
+-                else {
+-                    cursize = len;
+-                }
+-                memcpy(dbuf + dbpos, data, cursize);
+-                dbpos += cursize;
+-            }
+-
+-            /* Keep writing data to the child until done or too much time
+-             * elapses with no progress or an error occurs.
+-             */
+-            rv = apr_file_write_full(tempsock, data, len, NULL);
+-
+-            if (rv != APR_SUCCESS) {
+-                /* silly script stopped reading, soak up remaining message */
+-                child_stopped_reading = 1;
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,  APLOGNO(02651)
+-                              "Error writing request body to script %s", 
+-                              r->filename);
+-
+-            }
+-        }
+-        apr_brigade_cleanup(bb);
++    else {
++        dbuf = NULL;
++        dbufsize = 0;
+     }
+-    while (!seen_eos);
+ 
+-    if (conf->logname) {
+-        dbuf[dbpos] = '\0';
++    /* Read the request body. */
++    rv = cgi_handle_request(r, tempsock, bb, dbuf, dbufsize);
++    if (rv) {
++        ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01270)
++                      "Error reading request entity data");
++        return ap_map_http_request_error(rv, HTTP_BAD_REQUEST);
+     }
+ 
+     /* we're done writing, or maybe we didn't write at all;
+@@ -1603,125 +1622,22 @@ static int cgid_handler(request_rec *r)
+      */
+     shutdown(sd, 1);
+ 
+-    /* Handle script return... */
+-    if (!nph) {
+-        conn_rec *c = r->connection;
+-        const char *location;
+-        char sbuf[MAX_STRING_LEN];
+-        int ret;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
+-            ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL);
+-
+-            /*
+-             * ret could be HTTP_NOT_MODIFIED in the case that the CGI script
+-             * does not set an explicit status and ap_meets_conditions, which
+-             * is called by ap_scan_script_header_err_brigade, detects that
+-             * the conditions of the requests are met and the response is
+-             * not modified.
+-             * In this case set r->status and return OK in order to prevent
+-             * running through the error processing stack as this would
+-             * break with mod_cache, if the conditions had been set by
+-             * mod_cache itself to validate a stale entity.
+-             * BTW: We circumvent the error processing stack anyway if the
+-             * CGI script set an explicit status code (whatever it is) and
+-             * the only possible values for ret here are:
+-             *
+-             * HTTP_NOT_MODIFIED          (set by ap_meets_conditions)
+-             * HTTP_PRECONDITION_FAILED   (set by ap_meets_conditions)
+-             * HTTP_INTERNAL_SERVER_ERROR (if something went wrong during the
+-             * processing of the response of the CGI script, e.g broken headers
+-             * or a crashed CGI process).
+-             */
+-            if (ret == HTTP_NOT_MODIFIED) {
+-                r->status = ret;
+-                return OK;
+-            }
+-
+-            return ret;
+-        }
+-
+-        location = apr_table_get(r->headers_out, "Location");
+-
+-        if (location && location[0] == '/' && r->status == 200) {
+-
+-            /* Soak up all the script output */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            /* This redirect needs to be a GET no matter what the original
+-             * method was.
+-             */
+-            r->method = "GET";
+-            r->method_number = M_GET;
+-
+-            /* We already read the message body (if any), so don't allow
+-             * the redirected request to think it has one. We can ignore
+-             * Transfer-Encoding, since we used REQUEST_CHUNKED_ERROR.
+-             */
+-            apr_table_unset(r->headers_in, "Content-Length");
+-
+-            ap_internal_redirect_handler(location, r);
+-            return OK;
+-        }
+-        else if (location && r->status == 200) {
+-            /* XXX: Note that if a script wants to produce its own Redirect
+-             * body, it now has to explicitly *say* "Status: 302"
+-             */
+-            discard_script_output(bb);
+-            apr_brigade_destroy(bb);
+-            return HTTP_MOVED_TEMPORARILY;
+-        }
+-
+-        rv = ap_pass_brigade(r->output_filters, bb);
+-        if (rv != APR_SUCCESS) { 
+-            ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r,
+-                          "Failed to flush CGI output to client");
+-        }
+-    }
+-
+-    if (nph) {
+-        conn_rec *c = r->connection;
+-        struct ap_filter_t *cur;
+-
+-        /* get rid of all filters up through protocol...  since we
+-         * haven't parsed off the headers, there is no way they can
+-         * work
+-         */
+-
+-        cur = r->proto_output_filters;
+-        while (cur && cur->frec->ftype < AP_FTYPE_CONNECTION) {
+-            cur = cur->next;
+-        }
+-        r->output_filters = r->proto_output_filters = cur;
+-
+-        bb = apr_brigade_create(r->pool, c->bucket_alloc);
+-        b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        b = apr_bucket_eos_create(c->bucket_alloc);
+-        APR_BRIGADE_INSERT_TAIL(bb, b);
+-        ap_pass_brigade(r->output_filters, bb);
+-    }
++    bb = apr_brigade_create(r->pool, c->bucket_alloc);
++#ifdef HAVE_CGID_FDPASSING
++    b = cgi_bucket_create(r, dc->timeout, tempsock, script_err, c->bucket_alloc);
++    if (b == NULL)
++        return HTTP_INTERNAL_SERVER_ERROR; /* should call log_scripterror() w/ _UNAVAILABLE? */
++#else
++    b = apr_bucket_pipe_create(tempsock, c->bucket_alloc);
++#endif
++    APR_BRIGADE_INSERT_TAIL(bb, b);
++    b = apr_bucket_eos_create(c->bucket_alloc);
++    APR_BRIGADE_INSERT_TAIL(bb, b);
+ 
+-    return OK; /* NOT r->status, even if it has changed. */
++    return cgi_handle_response(r, nph, bb, timeout, conf, dbuf, script_err);
+ }
+ 
+-
+-
+-
+-/*============================================================================
+- *============================================================================
+- * This is the beginning of the cgi filter code moved from mod_include. This
+- *   is the code required to handle the "exec" SSI directive.
+- *============================================================================
+- *============================================================================*/
++/* Handling include= for mod_include. */
+ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+                                 apr_bucket_brigade *bb, char *s)
+ {
+@@ -1806,7 +1722,7 @@ static void add_ssi_vars(request_rec *r)
+ }
+ 
+ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+-                       apr_bucket_brigade *bb, char *command)
++                       apr_bucket_brigade *bb, const char *command)
+ {
+     char **env;
+     int sd;
+@@ -1827,7 +1743,7 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+         return retval;
+     }
+ 
+-    send_req(sd, r, command, env, SSI_REQ);
++    send_req(sd, NULL, r, command, env, SSI_REQ);
+ 
+     info = apr_palloc(r->pool, sizeof(struct cleanup_script_info));
+     info->conf = conf;
+@@ -1872,91 +1788,6 @@ static int include_cmd(include_ctx_t *ctx, ap_filter_t *f,
+     return APR_SUCCESS;
+ }
+ 
+-static apr_status_t handle_exec(include_ctx_t *ctx, ap_filter_t *f,
+-                                apr_bucket_brigade *bb)
+-{
+-    char *tag     = NULL;
+-    char *tag_val = NULL;
+-    request_rec *r = f->r;
+-    char *file = r->filename;
+-    char parsed_string[MAX_STRING_LEN];
+-
+-    if (!ctx->argc) {
+-        ap_log_rerror(APLOG_MARK,
+-                      (ctx->flags & SSI_FLAG_PRINTING)
+-                          ? APLOG_ERR : APLOG_WARNING,
+-                      0, r, APLOGNO(03196)
+-                      "missing argument for exec element in %s", r->filename);
+-    }
+-
+-    if (!(ctx->flags & SSI_FLAG_PRINTING)) {
+-        return APR_SUCCESS;
+-    }
+-
+-    if (!ctx->argc) {
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    if (ctx->flags & SSI_FLAG_NO_EXEC) {
+-        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01271) "exec used but not allowed "
+-                      "in %s", r->filename);
+-        SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-        return APR_SUCCESS;
+-    }
+-
+-    while (1) {
+-        cgid_pfn_gtv(ctx, &tag, &tag_val, SSI_VALUE_DECODED);
+-        if (!tag || !tag_val) {
+-            break;
+-        }
+-
+-        if (!strcmp(tag, "cmd")) {
+-            apr_status_t rv;
+-
+-            cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                        SSI_EXPAND_LEAVE_NAME);
+-
+-            rv = include_cmd(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01272)
+-                              "execution failure for parameter \"%s\" "
+-                              "to tag exec in file %s", tag, r->filename);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else if (!strcmp(tag, "cgi")) {
+-            apr_status_t rv;
+-
+-            cgid_pfn_ps(ctx, tag_val, parsed_string, sizeof(parsed_string),
+-                        SSI_EXPAND_DROP_NAME);
+-
+-            rv = include_cgi(ctx, f, bb, parsed_string);
+-            if (rv != APR_SUCCESS) {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01273) "invalid CGI ref "
+-                              "\"%s\" in %s", tag_val, file);
+-                SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-                break;
+-            }
+-        }
+-        else {
+-            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01274) "unknown parameter "
+-                          "\"%s\" to tag exec in %s", tag, file);
+-            SSI_CREATE_ERROR_BUCKET(ctx, f, bb);
+-            break;
+-        }
+-    }
+-
+-    return APR_SUCCESS;
+-}
+-/*============================================================================
+- *============================================================================
+- * This is the end of the cgi filter code moved from mod_include.
+- *============================================================================
+- *============================================================================*/
+-
+-
+ static void register_hook(apr_pool_t *p)
+ {
+     static const char * const aszPre[] = { "mod_include.c", NULL };
+@@ -1964,6 +1795,7 @@ static void register_hook(apr_pool_t *p)
+     ap_hook_pre_config(cgid_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
+     ap_hook_post_config(cgid_init, aszPre, NULL, APR_HOOK_MIDDLE);
+     ap_hook_handler(cgid_handler, NULL, NULL, APR_HOOK_MIDDLE);
++    ap_hook_optional_fn_retrieve(cgi_optfns_retrieve, NULL, NULL, APR_HOOK_MIDDLE);
+ }
+ 
+ AP_DECLARE_MODULE(cgid) = {
diff --git a/httpd-2.4.48-r1842929+.patch b/httpd-2.4.48-r1842929+.patch
index c1837e7..f83a21d 100644
--- a/httpd-2.4.48-r1842929+.patch
+++ b/httpd-2.4.48-r1842929+.patch
@@ -1,6 +1,3 @@
-
-Upstream-Status: in trunk, not proposed for 2.4.x
-
 diff --git a/Makefile.in b/Makefile.in
 index 6747aea..40c7076 100644
 --- a/Makefile.in
diff --git a/httpd-2.4.48-r1878890.patch b/httpd-2.4.48-r1878890.patch
new file mode 100644
index 0000000..7f8ca57
--- /dev/null
+++ b/httpd-2.4.48-r1878890.patch
@@ -0,0 +1,116 @@
+diff --git a/include/util_ldap.h b/include/util_ldap.h
+index 28e0760..edb8a81 100644
+--- a/include/util_ldap.h
++++ b/include/util_ldap.h
+@@ -32,7 +32,6 @@
+ #if APR_MAJOR_VERSION < 2
+ /* The LDAP API is currently only present in APR 1.x */
+ #include "apr_ldap.h"
+-#include "apr_ldap_rebind.h"
+ #else
+ #define APR_HAS_LDAP 0
+ #endif
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index 120f268..a5f7995 100644
+--- a/modules/ldap/util_ldap.c
++++ b/modules/ldap/util_ldap.c
+@@ -140,6 +140,38 @@ static int util_ldap_handler(request_rec *r)
+     return OK;
+ }
+ 
++/* For OpenLDAP with the 3-arg version of ldap_set_rebind_proc(), use
++ * a simpler rebind callback than the implementation in APR-util.
++ * Testing for API version >= 3001 appears safe although OpenLDAP
++ * 2.1.x (API version = 2004) also has the 3-arg API. */
++#if APR_HAS_OPENLDAP_LDAPSDK && defined(LDAP_API_VERSION) && LDAP_API_VERSION >= 3001
++
++#define uldap_rebind_init(p) APR_SUCCESS /* noop */
++
++static int uldap_rebind_proc(LDAP *ld, const char *url, ber_tag_t request,
++                             ber_int_t msgid, void *params)
++{
++    util_ldap_connection_t *ldc = params;
++
++    return ldap_bind_s(ld, ldc->binddn, ldc->bindpw, LDAP_AUTH_SIMPLE);
++}
++
++static apr_status_t uldap_rebind_add(util_ldap_connection_t *ldc)
++{
++    ldap_set_rebind_proc(ldc->ldap, uldap_rebind_proc, ldc);
++    return APR_SUCCESS;
++}
++
++#else /* !APR_HAS_OPENLDAP_LDAPSDK */
++
++#define USE_APR_LDAP_REBIND
++#include <apr_ldap_rebind.h>
++
++#define uldap_rebind_init(p) apr_ldap_rebind_init(p)
++#define uldap_rebind_add(ldc) apr_ldap_rebind_add((ldc)->rebind_pool, \
++                                                  (ldc)->ldap, (ldc)->binddn, \
++                                                  (ldc)->bindpw)
++#endif
+ 
+ 
+ /* ------------------------------------------------------------------ */
+@@ -181,6 +213,13 @@ static apr_status_t uldap_connection_unbind(void *param)
+     util_ldap_connection_t *ldc = param;
+ 
+     if (ldc) {
++#ifdef USE_APR_LDAP_REBIND
++        /* forget the rebind info for this conn */
++        if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
++            apr_pool_clear(ldc->rebind_pool);
++        }
++#endif
++
+         if (ldc->ldap) {
+             if (ldc->r) { 
+                 ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, ldc->r, "LDC %pp unbind", ldc); 
+@@ -189,12 +228,6 @@ static apr_status_t uldap_connection_unbind(void *param)
+             ldc->ldap = NULL;
+         }
+         ldc->bound = 0;
+-
+-        /* forget the rebind info for this conn */
+-        if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
+-            apr_ldap_rebind_remove(ldc->ldap);
+-            apr_pool_clear(ldc->rebind_pool);
+-        }
+     }
+ 
+     return APR_SUCCESS;
+@@ -330,7 +363,7 @@ static int uldap_connection_init(request_rec *r,
+ 
+     if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
+         /* Now that we have an ldap struct, add it to the referral list for rebinds. */
+-        rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw);
++        rc = uldap_rebind_add(ldc);
+         if (rc != APR_SUCCESS) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, rc, r->server, APLOGNO(01277)
+                     "LDAP: Unable to add rebind cross reference entry. Out of memory?");
+@@ -856,6 +889,7 @@ static util_ldap_connection_t *
+         /* whether or not to keep this connection in the pool when it's returned */
+         l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;
+ 
++#ifdef USE_APR_LDAP_REBIND
+         if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
+             if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) {
+                 ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, APLOGNO(01286)
+@@ -867,6 +901,7 @@ static util_ldap_connection_t *
+             }
+             apr_pool_tag(l->rebind_pool, "util_ldap_rebind");
+         }
++#endif
+ 
+         if (p) {
+             p->next = l;
+@@ -3054,7 +3089,7 @@ static int util_ldap_post_config(apr_pool_t *p, apr_pool_t *plog,
+     }
+ 
+     /* Initialize the rebind callback's cross reference list. */
+-    apr_ldap_rebind_init (p);
++    (void) uldap_rebind_init(p);
+ 
+ #ifdef AP_LDAP_OPT_DEBUG
+     if (st->debug_level > 0) {
diff --git a/httpd-2.4.51-r1894152.patch b/httpd-2.4.51-r1894152.patch
new file mode 100644
index 0000000..95f5081
--- /dev/null
+++ b/httpd-2.4.51-r1894152.patch
@@ -0,0 +1,36 @@
+# ./pullrev.sh 1894152
+http://svn.apache.org/viewvc?view=revision&revision=1894152
+
+--- httpd-2.4.51/modules/filters/mod_deflate.c.r1894152
++++ httpd-2.4.51/modules/filters/mod_deflate.c
+@@ -835,6 +835,7 @@
+     while (!APR_BRIGADE_EMPTY(bb))
+     {
+         apr_bucket *b;
++        apr_status_t rv;
+ 
+         /*
+          * Optimization: If we are a HEAD request and bytes_sent is not zero
+@@ -914,8 +915,6 @@
+         }
+ 
+         if (APR_BUCKET_IS_FLUSH(e)) {
+-            apr_status_t rv;
+-
+             /* flush the remaining data from the zlib buffers */
+             zRC = flush_libz_buffer(ctx, c, f->c->bucket_alloc, deflate,
+                                     Z_SYNC_FLUSH, NO_UPDATE_CRC);
+@@ -947,7 +946,12 @@
+         }
+ 
+         /* read */
+-        apr_bucket_read(e, &data, &len, APR_BLOCK_READ);
++        rv = apr_bucket_read(e, &data, &len, APR_BLOCK_READ);
++        if (rv) {
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(10298)
++                          "failed reading from %s bucket", e->type->name);
++            return rv;
++        }
+         if (!len) {
+             apr_bucket_delete(e);
+             continue;
diff --git a/httpd-2.4.53-export.patch b/httpd-2.4.53-export.patch
index db5606e..d240360 100644
--- a/httpd-2.4.53-export.patch
+++ b/httpd-2.4.53-export.patch
@@ -1,6 +1,3 @@
-
-Upstream-Status: r1861685 in trunk, not proposed for 2.4.x
-
 diff --git a/Makefile.in b/Makefile.in
 index bd8045c..d6733a5 100644
 --- a/Makefile.in
diff --git a/httpd-2.4.53-separate-systemd-fns.patch b/httpd-2.4.53-separate-systemd-fns.patch
new file mode 100644
index 0000000..88b99ff
--- /dev/null
+++ b/httpd-2.4.53-separate-systemd-fns.patch
@@ -0,0 +1,286 @@
+diff --git a/acinclude.m4 b/acinclude.m4
+index 05abe18..97484c9 100644
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -631,7 +631,6 @@ case $host in
+       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+         AC_MSG_WARN([Your system does not support systemd.])
+       else
+-        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+       fi
+    fi
+diff --git a/include/ap_listen.h b/include/ap_listen.h
+index 58c2574..d5ed968 100644
+--- a/include/ap_listen.h
++++ b/include/ap_listen.h
+@@ -29,6 +29,7 @@
+ #include "apr_network_io.h"
+ #include "httpd.h"
+ #include "http_config.h"
++#include "apr_optional.h"
+ 
+ #ifdef __cplusplus
+ extern "C" {
+@@ -143,6 +144,15 @@ AP_DECLARE_NONSTD(const char *) ap_set_receive_buffer_size(cmd_parms *cmd,
+                                                            void *dummy,
+                                                            const char *arg);
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
++#endif
++
++
+ #define LISTEN_COMMANDS \
+ AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \
+   "Maximum length of the queue of pending connections, as used by listen(2)"), \
+diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
+index eda1272..fc059fc 100644
+--- a/modules/arch/unix/mod_systemd.c
++++ b/modules/arch/unix/mod_systemd.c
+@@ -35,6 +35,15 @@
+ #include <unistd.h>
+ #endif
+ 
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_find_systemd_socket, (process_rec *, apr_port_t));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_listen_fds, (int));
++
++APR_DECLARE_OPTIONAL_FN(int,
++                        ap_systemd_journal_stream_fd, (const char *, int, int));
++
+ static char describe_listeners[30];
+ 
+ static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+@@ -145,8 +154,47 @@ static int systemd_monitor(apr_pool_t *p, server_rec *s)
+     return DECLINED;
+ }
+ 
++static int ap_find_systemd_socket(process_rec * process, apr_port_t port) {
++    int fdcount, fd;
++    int sdc = sd_listen_fds(0);
++
++    if (sdc < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
++                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
++                      sdc);
++        return -1;
++    }
++
++    if (sdc == 0) {
++        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
++                      "find_systemd_socket: At least one socket must be set.");
++        return -1;
++    }
++
++    fdcount = atoi(getenv("LISTEN_FDS"));
++    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
++        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
++            return fd;
++        }
++    }
++
++    return -1;
++}
++
++static int ap_systemd_listen_fds(int unset_environment){
++    return sd_listen_fds(unset_environment);
++}
++
++static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
++    return sd_journal_stream_fd("httpd", priority, 0);
++}
++
+ static void systemd_register_hooks(apr_pool_t *p)
+ {
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
++    APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
++    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++
+     /* Enable ap_extended_status. */
+     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
+     /* Signal service is ready. */
+diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
+index 0848d2e..8af2299 100644
+--- a/modules/loggers/config.m4
++++ b/modules/loggers/config.m4
+@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
+ APACHE_MODPATH_INIT(loggers)
+ 	
+ APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
+-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
+ 
+ APACHE_MODULE(log_debug, configurable debug logging, , , most)
+ APACHE_MODULE(log_forensic, forensic logging)
+diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
+index 0b11f60..c3f0a51 100644
+--- a/modules/loggers/mod_log_config.c
++++ b/modules/loggers/mod_log_config.c
+@@ -172,10 +172,6 @@
+ #include <limits.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-journal.h>
+-#endif
+-
+ #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
+ 
+ module AP_MODULE_DECLARE_DATA log_config_module;
+@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
+ {
+ #ifdef HAVE_SYSTEMD
+     int fd;
++    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
++    
++    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
++    if (systemd_journal_stream_fd == NULL) {
++        return APR_ENOTIMPL;
++    }
+ 
+-    fd = sd_journal_stream_fd("httpd", priority, 0);
++    fd = systemd_journal_stream_fd("httpd", priority, 0);
++    
+     if (fd < 0) return fd;
+ 
+     /* This is an AF_UNIX socket fd so is more pipe-like than
+diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
+index 877a593..bd52a98 100644
+--- a/modules/loggers/mod_log_config.h
++++ b/modules/loggers/mod_log_config.h
+@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
+  */
+ APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
+ 
++#ifdef HAVE_SYSTEMD
++APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
++#endif
++
+ #endif /* MOD_LOG_CONFIG */
+ /** @} */
+ 
+diff --git a/server/listen.c b/server/listen.c
+index e2e028a..5d1c0e1 100644
+--- a/server/listen.c
++++ b/server/listen.c
+@@ -34,10 +34,6 @@
+ #include <unistd.h>
+ #endif
+ 
+-#ifdef HAVE_SYSTEMD
+-#include <systemd/sd-daemon.h>
+-#endif
+-
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -325,34 +321,6 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+ }
+ 
+ #ifdef HAVE_SYSTEMD
+-
+-static int find_systemd_socket(process_rec * process, apr_port_t port) {
+-    int fdcount, fd;
+-    int sdc = sd_listen_fds(0);
+-
+-    if (sdc < 0) {
+-        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
+-                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
+-                      sdc);
+-        return -1;
+-    }
+-
+-    if (sdc == 0) {
+-        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
+-                      "find_systemd_socket: At least one socket must be set.");
+-        return -1;
+-    }
+-
+-    fdcount = atoi(getenv("LISTEN_FDS"));
+-    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
+-        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
+-            return fd;
+-        }
+-    }
+-
+-    return -1;
+-}
+-
+ static apr_status_t alloc_systemd_listener(process_rec * process,
+                                            int fd, const char *proto,
+                                            ap_listen_rec **out_rec)
+@@ -412,6 +380,14 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+ {
+     ap_listen_rec *last, *new;
+     apr_status_t rv;
++    APR_OPTIONAL_FN_TYPE(ap_find_systemd_socket) *find_systemd_socket;
++
++    find_systemd_socket = APR_RETRIEVE_OPTIONAL_FN(ap_find_systemd_socket);
++
++    if (!find_systemd_socket)
++       return "Systemd socket activation is used, but mod_systemd is probably "
++               "not loaded";
++
+     int fd = find_systemd_socket(process, port);
+     if (fd < 0) {
+         return "Systemd socket activation is used, but this port is not "
+@@ -438,7 +414,6 @@ static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+ 
+     return NULL;
+ }
+-
+ #endif /* HAVE_SYSTEMD */
+ 
+ static const char *alloc_listener(process_rec *process, const char *addr,
+@@ -707,6 +682,9 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+     int num_listeners = 0;
+     const char* proto;
+     int found;
++#ifdef HAVE_SYSTEMD
++    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
++#endif
+ 
+     for (ls = s; ls; ls = ls->next) {
+         proto = ap_get_server_protocol(ls);
+@@ -746,7 +724,10 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+                                 apr_pool_cleanup_null, s->process->pool);
+         }
+         else {
+-            sd_listen_fds(1);
++            systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
++            if (systemd_listen_fds != NULL) {
++                systemd_listen_fds(1);
++            }
+         }
+     }
+     else
+@@ -963,6 +944,9 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     apr_port_t port;
+     apr_status_t rv;
+     const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++#ifdef HAVE_SYSTEMD
++    APR_OPTIONAL_FN_TYPE(ap_systemd_listen_fds) *systemd_listen_fds;
++#endif
+ 
+     if (err != NULL) {
+         return err;
+@@ -973,7 +957,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     }
+ #ifdef HAVE_SYSTEMD
+     if (use_systemd == -1) {
+-        use_systemd = sd_listen_fds(0) > 0;
++        systemd_listen_fds = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_listen_fds);
++        if (systemd_listen_fds != NULL) {
++            use_systemd = systemd_listen_fds(0) > 0;
++        } else {
++            use_systemd = 0;
++        }
+     }
+ #endif
+ 
diff --git a/httpd-2.4.54-gettid.patch b/httpd-2.4.54-gettid.patch
new file mode 100644
index 0000000..dfc447b
--- /dev/null
+++ b/httpd-2.4.54-gettid.patch
@@ -0,0 +1,91 @@
+From d4e5b6e1e5585d341d1e51f1ddc637c099111076 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@redhat.com>
+Date: Tue, 7 Jul 2020 09:48:01 +0100
+Subject: [PATCH] Check and use gettid() directly with glibc 2.30+.
+
+* configure.in: Check for gettid() and define HAVE_SYS_GETTID if
+  gettid() is only usable via syscall().
+
+* server/log.c (log_tid): Use gettid() directly if available.
+---
+ configure.in | 14 +++++++++-----
+ server/log.c |  8 ++++++--
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index 423d58d4b9a..60cbf7b7f81 100644
+--- httpd-2.4.54/configure.in.gettid
++++ httpd-2.4.54/configure.in
+@@ -502,22 +502,26 @@
+ timegm \
+ getpgid \
+ fopen64 \
+-getloadavg
++getloadavg \
++gettid
+ )
+ 
+ dnl confirm that a void pointer is large enough to store a long integer
+ APACHE_CHECK_VOID_PTR_LEN
+ 
+-AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
++if test $ac_cv_func_gettid = no; then
++  # On Linux before glibc 2.30, gettid() is only usable via syscall()
++  AC_CACHE_CHECK([for gettid() via syscall], ap_cv_gettid,
+ [AC_TRY_RUN(#define _GNU_SOURCE
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ int main(int argc, char **argv) {
+ pid_t t = syscall(SYS_gettid); return t == -1 ? 1 : 0; },
+-[ac_cv_gettid=yes], [ac_cv_gettid=no], [ac_cv_gettid=no])])
+-if test "$ac_cv_gettid" = "yes"; then
+-    AC_DEFINE(HAVE_GETTID, 1, [Define if you have gettid()])
++  [ap_cv_gettid=yes], [ap_cv_gettid=no], [ap_cv_gettid=no])])
++  if test "$ap_cv_gettid" = "yes"; then
++      AC_DEFINE(HAVE_SYS_GETTID, 1, [Define if you have gettid() via syscall()])
++  fi
+ fi
+ 
+ dnl ## Check for the tm_gmtoff field in struct tm to get the timezone diffs
+--- httpd-2.4.54/server/log.c.gettid
++++ httpd-2.4.54/server/log.c
+@@ -55,7 +55,7 @@
+ #include "ap_mpm.h"
+ #include "ap_listen.h"
+ 
+-#if HAVE_GETTID
++#if HAVE_SYS_GETTID
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ #endif
+@@ -627,14 +627,18 @@
+ #if APR_HAS_THREADS
+     int result;
+ #endif
+-#if HAVE_GETTID
++#if defined(HAVE_GETTID) || defined(HAVE_SYS_GETTID)
+     if (arg && *arg == 'g') {
++#ifdef HAVE_GETTID
++        pid_t tid = gettid();
++#else
+         pid_t tid = syscall(SYS_gettid);
++#endif
+         if (tid == -1)
+             return 0;
+         return apr_snprintf(buf, buflen, "%"APR_PID_T_FMT, tid);
+     }
+-#endif
++#endif /* HAVE_GETTID || HAVE_SYS_GETTID */
+ #if APR_HAS_THREADS
+     if (ap_mpm_query(AP_MPMQ_IS_THREADED, &result) == APR_SUCCESS
+         && result != AP_MPMQ_NOT_SUPPORTED)
+@@ -968,7 +972,7 @@
+ #if APR_HAS_THREADS
+         field_start = len;
+         len += cpystrn(buf + len, ":tid ", buflen - len);
+-        item_len = log_tid(info, NULL, buf + len, buflen - len);
++        item_len = log_tid(info, "g", buf + len, buflen - len);
+         if (!item_len)
+             len = field_start;
+         else
diff --git a/httpd-2.4.54-selinux.patch b/httpd-2.4.54-selinux.patch
new file mode 100644
index 0000000..4d66bd8
--- /dev/null
+++ b/httpd-2.4.54-selinux.patch
@@ -0,0 +1,61 @@
+diff --git a/configure.in b/configure.in
+index 74015ca..8c0ee10 100644
+--- httpd-2.4.54/modules/arch/unix/config5.m4.selinux
++++ httpd-2.4.54/modules/arch/unix/config5.m4
+@@ -23,6 +23,11 @@
+     AC_MSG_WARN([Your system does not support systemd.])
+     enable_systemd="no"
+   else
++    AC_CHECK_LIB(selinux, is_selinux_enabled, [
++      AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
++      APR_ADDTO(MOD_SYSTEMD_LDADD, [-lselinux])
++    ])
++  
+     APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
+   fi
+ ])
+--- httpd-2.4.54/modules/arch/unix/mod_systemd.c.selinux
++++ httpd-2.4.54/modules/arch/unix/mod_systemd.c
+@@ -35,6 +35,10 @@
+ #include <unistd.h>
+ #endif
+ 
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
+ APR_DECLARE_OPTIONAL_FN(int,
+                         ap_find_systemd_socket, (process_rec *, apr_port_t));
+ 
+@@ -70,6 +74,20 @@
+     return apr_psprintf(p, "%s port %u", addr, sa->port);
+ }
+ 
++#ifdef HAVE_SELINUX
++static void log_selinux_context(void)
++{
++    char *con;
++
++    if (is_selinux_enabled() && getcon(&con) == 0) {
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
++                     "SELinux policy enabled; "
++                     "httpd running as context %s", con);
++        freecon(con);
++    }
++}
++#endif
++
+ /* Report the service is ready in post_config, which could be during
+  * startup or after a reload.  The server could still hit a fatal
+  * startup error after this point during ap_run_mpm(), so this is
+@@ -87,6 +105,10 @@
+     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+         return OK;
+ 
++#ifdef HAVE_SELINUX
++    log_selinux_context();
++#endif
++    
+     for (lr = ap_listeners; lr; lr = lr->next) {
+         char *s = dump_listener(lr, ptemp);
+ 
diff --git a/httpd-2.4.63-r1912477+.patch b/httpd-2.4.63-r1912477+.patch
deleted file mode 100644
index 35e5866..0000000
--- a/httpd-2.4.63-r1912477+.patch
+++ /dev/null
@@ -1,383 +0,0 @@
-# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438
-http://svn.apache.org/viewvc?view=revision&revision=1912477
-http://svn.apache.org/viewvc?view=revision&revision=1912571
-http://svn.apache.org/viewvc?view=revision&revision=1912718
-http://svn.apache.org/viewvc?view=revision&revision=1913654
-http://svn.apache.org/viewvc?view=revision&revision=1914438
-
-Upstream-Status: in trunk, not proposed for 2.4.x
-
-diff --git a/modules/dav/fs/config6.m4 b/modules/dav/fs/config6.m4
-index dd26ec8..72fff9a 100644
---- a/modules/dav/fs/config6.m4
-+++ b/modules/dav/fs/config6.m4
-@@ -20,4 +20,10 @@ esac
- 
- APACHE_MODULE(dav_fs, DAV provider for the filesystem.  --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav)
- 
-+if test "x$enable_dav_fs" = "xshared"; then
-+    # The only symbol which needs to be exported is the module
-+    # structure, so ask libtool to hide everything else:
-+    APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module])
-+fi
-+
- APACHE_MODPATH_FINISH
-diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c
-index 39ab4ad..4551f70 100644
---- a/modules/dav/fs/dbm.c
-+++ b/modules/dav/fs/dbm.c
-@@ -47,6 +47,10 @@
- #include "http_log.h"
- #include "http_main.h"      /* for ap_server_conf */
- 
-+#ifndef DEFAULT_PROPDB_DBM_TYPE
-+#define DEFAULT_PROPDB_DBM_TYPE "default"
-+#endif
-+
- APLOG_USE_MODULE(dav_fs);
- 
- struct dav_db {
-@@ -129,10 +133,10 @@ void dav_fs_ensure_state_dir(apr_pool_t * p, const char *dirname)
- /* dav_dbm_open_direct:  Opens a *dbm database specified by path.
-  *    ro = boolean read-only flag.
-  */
--dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
--                                dav_db **pdb)
-+dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
-+                                const char *dbmtype, int ro, dav_db **pdb)
- {
--#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-+#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-     const apr_dbm_driver_t *driver;
-     const apu_err_t *err;
- #endif
-@@ -141,11 +145,12 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
- 
-     *pdb = NULL;
- 
--#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
--    if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) {
-+#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-+    if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) {
-+
-         ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289)
--                     "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
--                             err->reason, err->msg);
-+                     "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s",
-+                     err->reason, dbmtype, err->msg);
-         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
-                 "Could not load library for database.");
-     }
-@@ -156,7 +161,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
-         return dav_fs_dbm_error(NULL, p, status);
-     }
- #else
--    if ((status = apr_dbm_open(&file, pathname,
-+    if ((status = apr_dbm_open_ex(&file, dbmtype, pathname,
-                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
-                                APR_OS_DEFAULT, p))
-                 != APR_SUCCESS
-@@ -206,7 +211,7 @@ static dav_error * dav_dbm_open(apr_pool_t * p, const dav_resource *resource,
- 
-     /* ### do we need to deal with the umask? */
- 
--    return dav_dbm_open_direct(p, pathname, ro, pdb);
-+    return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb);
- }
- 
- void dav_dbm_close(dav_db *db)
-diff --git a/modules/dav/fs/lock.c b/modules/dav/fs/lock.c
-index ef18c4a..29d167d 100644
---- a/modules/dav/fs/lock.c
-+++ b/modules/dav/fs/lock.c
-@@ -181,8 +181,7 @@ struct dav_lockdb_private
- {
-     request_rec *r;                  /* for accessing the uuid state */
-     apr_pool_t *pool;                /* a pool to use */
--    const char *lockdb_path;         /* where is the lock database? */
--
-+    const dav_fs_server_conf *conf;  /* lock database config & metadata */
-     int opened;                      /* we opened the database */
-     dav_db *db;                      /* if non-NULL, the lock database */
- };
-@@ -292,6 +291,19 @@ static int dav_fs_compare_locktoken(
-     return dav_compare_locktoken(lt1, lt2);
- }
- 
-+static apr_status_t dav_fs_lockdb_cleanup(void *data)
-+{
-+    dav_lockdb *lockdb = data;
-+
-+    apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
-+
-+    if (lockdb->info->db) {
-+        dav_dbm_close(lockdb->info->db);
-+    }
-+    
-+    return APR_SUCCESS;
-+}
-+
- /*
- ** dav_fs_really_open_lockdb:
- **
-@@ -300,15 +312,27 @@ static int dav_fs_compare_locktoken(
- static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
- {
-     dav_error *err;
-+    apr_status_t rv;
- 
-     if (lockdb->info->opened)
-         return NULL;
- 
-+    rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex);
-+    if (rv) {
-+        return dav_new_error(lockdb->info->pool,
-+                             HTTP_INTERNAL_SERVER_ERROR,
-+                             DAV_ERR_LOCK_OPENDB, rv,
-+                             "Could not lock mutex for lock database.");
-+    }
-+    
-     err = dav_dbm_open_direct(lockdb->info->pool,
--                              lockdb->info->lockdb_path,
-+                              lockdb->info->conf->lockdb_path,
-+                              lockdb->info->conf->lockdb_type,
-                               lockdb->ro,
-                               &lockdb->info->db);
-     if (err != NULL) {
-+        apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
-+        
-         return dav_push_error(lockdb->info->pool,
-                               HTTP_INTERNAL_SERVER_ERROR,
-                               DAV_ERR_LOCK_OPENDB,
-@@ -316,6 +340,10 @@ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
-                               err);
-     }
- 
-+    apr_pool_cleanup_register(lockdb->info->pool, lockdb,
-+                              dav_fs_lockdb_cleanup,
-+                              dav_fs_lockdb_cleanup);
-+
-     /* all right. it is opened now. */
-     lockdb->info->opened = 1;
- 
-@@ -341,9 +369,9 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
-     comb->pub.info = &comb->priv;
-     comb->priv.r = r;
-     comb->priv.pool = r->pool;
--
--    comb->priv.lockdb_path = dav_get_lockdb_path(r);
--    if (comb->priv.lockdb_path == NULL) {
-+    comb->priv.conf = dav_fs_get_server_conf(r);
-+    
-+    if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) {
-         return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
-                              DAV_ERR_LOCK_NO_DB, 0,
-                              "A lock database was not specified with the "
-@@ -369,8 +397,8 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
- */
- static void dav_fs_close_lockdb(dav_lockdb *lockdb)
- {
--    if (lockdb->info->db != NULL)
--        dav_dbm_close(lockdb->info->db);
-+    apr_pool_cleanup_run(lockdb->info->pool, lockdb,
-+                         dav_fs_lockdb_cleanup);
- }
- 
- /*
-diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
-index 2389f8f..4bf6c51 100644
---- a/modules/dav/fs/mod_dav_fs.c
-+++ b/modules/dav/fs/mod_dav_fs.c
-@@ -14,31 +14,35 @@
-  * limitations under the License.
-  */
- 
-+#if !defined(_MSC_VER) && !defined(NETWARE)
-+#include "ap_config_auto.h"
-+#endif
-+
- #include "httpd.h"
- #include "http_config.h"
-+#include "http_core.h"
-+#include "http_log.h"
- #include "apr_strings.h"
- 
- #include "mod_dav.h"
- #include "repos.h"
- 
--/* per-server configuration */
--typedef struct {
--    const char *lockdb_path;
--
--} dav_fs_server_conf;
--
- extern module AP_MODULE_DECLARE_DATA dav_fs_module;
- 
- #ifndef DEFAULT_DAV_LOCKDB
- #define DEFAULT_DAV_LOCKDB "davlockdb"
- #endif
-+#ifndef DEFAULT_DAV_LOCKDB_TYPE
-+#define DEFAULT_DAV_LOCKDB_TYPE "default"
-+#endif
- 
--const char *dav_get_lockdb_path(const request_rec *r)
--{
--    dav_fs_server_conf *conf;
-+static const char dav_fs_mutexid[] = "dav_fs-lockdb";
- 
--    conf = ap_get_module_config(r->server->module_config, &dav_fs_module);
--    return conf->lockdb_path;
-+static apr_global_mutex_t *dav_fs_lockdb_mutex;
-+
-+const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r)
-+{
-+    return ap_get_module_config(r->server->module_config, &dav_fs_module);
- }
- 
- static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
-@@ -57,15 +61,50 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
- 
-     newconf->lockdb_path =
-         child->lockdb_path ? child->lockdb_path : parent->lockdb_path;
-+    newconf->lockdb_type =
-+        child->lockdb_type ? child->lockdb_type : parent->lockdb_type;
- 
-     return newconf;
- }
- 
-+static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
-+{
-+    if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0))
-+        return !OK;
-+    return OK;
-+}
-+
-+static void dav_fs_child_init(apr_pool_t *p, server_rec *s)
-+{
-+    apr_status_t rv;
-+    
-+    rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex,
-+                                     apr_global_mutex_lockfile(dav_fs_lockdb_mutex),
-+                                     p);
-+    if (rv) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
-+                     APLOGNO(10488) "child init failed for mutex");
-+    }                     
-+}
-+
- static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
-                                        apr_pool_t *ptemp, server_rec *base_server)
- {
-     server_rec *s;
--
-+    apr_status_t rv;
-+
-+    /* Ignore first pass through the config. */
-+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-+        return OK;
-+
-+    rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL,
-+                                base_server, p, 0);
-+    if (rv) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server,
-+                     APLOGNO(10489) "could not create lock mutex");
-+        return !OK;
-+    }                     
-+    
-     for (s = base_server; s; s = s->next) {
-         dav_fs_server_conf *conf;
- 
-@@ -74,6 +113,13 @@ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
-         if (!conf->lockdb_path) {
-             conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
-         }
-+        if (!conf->lockdb_type) {
-+            conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE;
-+        }
-+
-+        /* Mutex is common across all vhosts, but could have one per
-+         * vhost if required. */
-+        conf->lockdb_mutex = dav_fs_lockdb_mutex;
-     }
- 
-     return OK;
-@@ -98,19 +144,36 @@ static const char *dav_fs_cmd_davlockdb(cmd_parms *cmd, void *config,
-     return NULL;
- }
- 
-+/*
-+ * Command handler for the DAVLockDBType directive, which is TAKE1
-+ */
-+static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config,
-+                                        const char *arg1)
-+{
-+    dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config,
-+                                                    &dav_fs_module);
-+    conf->lockdb_type = arg1;
-+
-+    return NULL;
-+}
-+
- static const command_rec dav_fs_cmds[] =
- {
-     /* per server */
-     AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF,
-                   "specify a lock database"),
-+    AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF,
-+                  "specify a lock database DBM type"),
- 
-     { NULL }
- };
- 
- static void register_hooks(apr_pool_t *p)
- {
-+    ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
-     ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
--
-+    ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE);
-+    
-     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
-                              APR_HOOK_MIDDLE);
-     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
-diff --git a/modules/dav/fs/repos.h b/modules/dav/fs/repos.h
-index b164611..d3a55a5 100644
---- a/modules/dav/fs/repos.h
-+++ b/modules/dav/fs/repos.h
-@@ -25,6 +25,8 @@
- #ifndef _DAV_FS_REPOS_H_
- #define _DAV_FS_REPOS_H_
- 
-+#include "util_mutex.h"
-+
- /* the subdirectory to hold all DAV-related information for a directory */
- #define DAV_FS_STATE_DIR                ".DAV"
- #define DAV_FS_STATE_FILE_FOR_DIR       ".state_for_dir"
-@@ -53,8 +55,8 @@ dav_error * dav_fs_get_locknull_members(const dav_resource *resource,
- /* DBM functions used by the repository and locking providers */
- extern const dav_hooks_db dav_hooks_db_dbm;
- 
--dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
--                                dav_db **pdb);
-+dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
-+                                const char *dbmtype, int ro, dav_db **pdb);
- void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname,
-                             const char **state1, const char **state2);
- dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key);
-@@ -64,8 +66,15 @@ void dav_dbm_freedatum(dav_db *db, apr_datum_t data);
- int dav_dbm_exists(dav_db *db, apr_datum_t key);
- void dav_dbm_close(dav_db *db);
- 
--/* where is the lock database located? */
--const char *dav_get_lockdb_path(const request_rec *r);
-+/* Per-server configuration. */
-+typedef struct {
-+    const char *lockdb_path;
-+    const char *lockdb_type;
-+    apr_global_mutex_t *lockdb_mutex;
-+} dav_fs_server_conf;
-+
-+/* Returns server configuration for the request. */
-+const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r);
- 
- const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r);
- const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r);
diff --git a/httpd-2.4.64-separate-systemd-fns.patch b/httpd-2.4.64-separate-systemd-fns.patch
deleted file mode 100644
index 6947ee6..0000000
--- a/httpd-2.4.64-separate-systemd-fns.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 05abe18..97484c9 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -631,7 +631,6 @@ case $host in
-       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-         AC_MSG_WARN([Your system does not support systemd.])
-       else
--        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
-         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-       fi
-    fi
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index af68249..7232a45 100644
---- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -40,6 +40,9 @@
- #include <unistd.h>
- #endif
- 
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_journal_stream_fd, (const char *, int, int));
-+
- static char describe_listeners[30];
- 
- static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-@@ -217,10 +220,15 @@ static int ap_systemd_listen_fds(int unset_environment){
-     return sd_listen_fds(unset_environment);
- }
- 
-+static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
-+    return sd_journal_stream_fd("httpd", priority, 0);
-+}
-+
- static void systemd_register_hooks(apr_pool_t *p)
- {
-     APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
-     APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
-+    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
- 
-     /* Enable ap_extended_status. */
-     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
-diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
-index 0848d2e..8af2299 100644
---- a/modules/loggers/config.m4
-+++ b/modules/loggers/config.m4
-@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
- APACHE_MODPATH_INIT(loggers)
- 	
- APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
--APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
- 
- APACHE_MODULE(log_debug, configurable debug logging, , , most)
- APACHE_MODULE(log_forensic, forensic logging)
-diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
-index 694f447..a65b982 100644
---- a/modules/loggers/mod_log_config.c
-+++ b/modules/loggers/mod_log_config.c
-@@ -172,10 +172,6 @@
- #include <limits.h>
- #endif
- 
--#ifdef HAVE_SYSTEMD
--#include <systemd/sd-journal.h>
--#endif
--
- #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
- 
- module AP_MODULE_DECLARE_DATA log_config_module;
-@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
- {
- #ifdef HAVE_SYSTEMD
-     int fd;
-+    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
-+    
-+    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
-+    if (systemd_journal_stream_fd == NULL) {
-+        return APR_ENOTIMPL;
-+    }
- 
--    fd = sd_journal_stream_fd("httpd", priority, 0);
-+    fd = systemd_journal_stream_fd("httpd", priority, 0);
-+    
-     if (fd < 0) return fd;
- 
-     /* This is an AF_UNIX socket fd so is more pipe-like than
-diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
-index 877a593..bd52a98 100644
---- a/modules/loggers/mod_log_config.h
-+++ b/modules/loggers/mod_log_config.h
-@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
-  */
- APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
- 
-+#ifdef HAVE_SYSTEMD
-+APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
-+#endif
-+
- #endif /* MOD_LOG_CONFIG */
- /** @} */
- 
diff --git a/httpd-2.4.65-hcheck-stuck.patch b/httpd-2.4.65-hcheck-stuck.patch
deleted file mode 100644
index 315b9c2..0000000
--- a/httpd-2.4.65-hcheck-stuck.patch
+++ /dev/null
@@ -1,66 +0,0 @@
---- a/modules/proxy/mod_proxy_hcheck.c
-+++ b/modules/proxy/mod_proxy_hcheck.c
-@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
-     sctx_t *ctx = (sctx_t *)data;
-     server_rec *s = ctx->s;
-     proxy_server_conf *conf;
-+    proxy_worker **workers;
-+    proxy_worker *worker;
-+    apr_time_t now;
-+    int i, n;
- 
-+    conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
-+    balancer = (proxy_balancer *)conf->balancers->elts;
-+
-     switch (state) {
-         case AP_WATCHDOG_STATE_STARTING:
-             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
-                          "%s watchdog started.",
-                          HCHECK_WATHCHDOG_NAME);
-+            /* set last update time for all workers */
-+            now = apr_time_now();
-+            for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
-+                workers = (proxy_worker **)balancer->workers->elts;
-+                for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
-+                    worker = *workers;
-+                    if (worker->s->updated == 0) {
-+                        worker->s->updated = now;
-+                    }
-+                }
-+            }
- #if HC_USE_THREADS
-             if (tpsize && hctp == NULL) {
-                 rv =  apr_thread_pool_create(&hctp, tpsize,
-@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
- 
-         case AP_WATCHDOG_STATE_RUNNING:
-             /* loop thru all workers */
--            if (s) {
--                int i;
--                conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
--                balancer = (proxy_balancer *)conf->balancers->elts;
--                ctx->s = s;
-+            {
-+                now = apr_time_now();
-                 for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
--                    int n;
--                    apr_time_t now;
--                    proxy_worker **workers;
--                    proxy_worker *worker;
-                     /* Have any new balancers or workers been added dynamically? */
-                     ap_proxy_sync_balancer(balancer, s, conf);
-                     workers = (proxy_worker **)balancer->workers->elts;
--                    now = apr_time_now();
--                    for (n = 0; n < balancer->workers->nelts; n++) {
-+                    for (n = 0; n < balancer->workers->nelts; n++, workers++) {
-                         worker = *workers;
-                         if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
-                             (worker->s->method != NONE) &&
-@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
-                                 hc_check(NULL, baton);
-                             }
-                         }
--                        workers++;
-                     }
-                 }
-             }
diff --git a/httpd-ssl-gencerts b/httpd-ssl-gencerts
index 5a3d8ed..5c271f7 100755
--- a/httpd-ssl-gencerts
+++ b/httpd-ssl-gencerts
@@ -33,7 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
-     --no-dhparams-file                                             \
+     --dhparams-file       /tmp/dhparams.pem                        \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN
diff --git a/httpd.conf b/httpd.conf
index ad5c7ee..609b2e2 100644
--- a/httpd.conf
+++ b/httpd.conf
@@ -151,7 +151,7 @@ DocumentRoot "/var/www/html"
     #
     # AllowOverride controls what directives may be placed in .htaccess files.
     # It can be "All", "None", or any combination of the keywords:
-    #   AllowOverride FileInfo AuthConfig Limit
+    #   Options FileInfo AuthConfig Limit
     #
     AllowOverride None
 
@@ -199,7 +199,6 @@ LogLevel warn
     # a CustomLog directive (see below).
     #
     LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
     LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
     <IfModule logio_module>
@@ -217,11 +216,10 @@ LogLevel warn
     #CustomLog "logs/access_log" common
 
     #
-    # If you prefer a logfile with access, agent, referer, and process/thread
-    # information (an extended Combined Logfile Format), you can use the
-    # following directive.
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
     #
-    CustomLog "logs/access_log" combined_ext
+    CustomLog "logs/access_log" combined
 </IfModule>
 
 <IfModule alias_module>
@@ -265,15 +263,6 @@ LogLevel warn
     Require all granted
 </Directory>
 
-<IfModule headers_module>
-    #
-    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
-    # backend servers which have lingering "httpoxy" defects.
-    # 'Proxy' request header is undefined by the IETF, not listed by IANA
-    #
-    RequestHeader unset Proxy early
-</IfModule>
-
 <IfModule mime_module>
     #
     # TypesConfig points to the file containing the list of mappings from
@@ -351,13 +340,6 @@ AddDefaultCharset UTF-8
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #
 
-#
-# MaxRanges: Maximum number of Ranges in a request before
-# returning the entire resource, or one of the special
-# values 'default', 'none' or 'unlimited'.
-# Default setting is to accept 200 Ranges.
-#MaxRanges unlimited
-
 #
 # EnableMMAP and EnableSendfile: On systems that support it, 
 # memory-mapping or the sendfile syscall may be used to deliver
diff --git a/httpd.conf.xml b/httpd.conf.xml
index 5405017..13e5d69 100644
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@@ -241,11 +241,6 @@
       <filename>/etc/httpd/conf.modules.d</filename>
     </para>
   </refsect1>
-
-  <refsect1>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
   
   <refsect1>
     <title>See also</title>
diff --git a/httpd.service b/httpd.service
index b75e28c..c5b5e08 100644
--- a/httpd.service
+++ b/httpd.service
@@ -26,25 +26,8 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
-DevicePolicy=closed
-KeyringMode=private
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-OOMPolicy=continue
-PrivateDevices=yes
 PrivateTmp=true
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=read-only
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectSystem=yes
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native
+OOMPolicy=continue
 
 [Install]
 WantedBy=multi-user.target
diff --git a/httpd.service.xml b/httpd.service.xml
index 610b34c..c6bf865 100644
--- a/httpd.service.xml
+++ b/httpd.service.xml
@@ -175,7 +175,7 @@ Wants=network-online.target</programlisting>
       <para>System packages (including the httpd package itself) may
       restart the httpd service automatically after packages are
       upgraded, installed, or removed. This is done using the
-      <command>systemctl try-restart httpd.service</command> command, which
+      <command>systemctl try-restart httpd.service</command>, which
       stops then starts the service if it is running.</para>
 
       <para>To disable automatic restarts, create the file
@@ -183,9 +183,8 @@ Wants=network-online.target</programlisting>
       When <command>httpd</command> interfaces are added in an update,
       it may not be safe to <emphasis>reload</emphasis> a running
       service after upgrading, if updated modules require interfaces
-      only available in the updated <command>httpd</command> binary.
-      It is recommended to allow automatic restarts for this
-      reason.</para>
+      only available in the updated httpd.  It is recommended to allow
+      automatic restarts for this reason.</para>
     </refsect2>
 
     <refsect2>
@@ -231,16 +230,7 @@ Wants=network-online.target</programlisting>
     <refsect2>
       <title>Process policies and restrictions</title>
 
-      <para>The <command>httpd.service</command> unit enables a
-      variety of sandboxing options. Many of these prevent the service
-      from changing the system configuration or attributes of the
-      kernel - such as <emphasis>ProtectClock</emphasis> and
-      <emphasis>ProtectKernelModules</emphasis>. See
-      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      and
-      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      for more information on these options. Particular notice should
-      be taken of the following:
+      <para>The httpd service uses the following options:
 
       <itemizedlist>
         <listitem><para><emphasis>PrivateTmp</emphasis> is enabled by
@@ -256,21 +246,13 @@ Wants=network-online.target</programlisting>
         the policy to <emphasis>continue</emphasis>, httpd will
         continue to run (and recover) if a single child is terminated
         because of excess memory consumption.</para></listitem>
+      </itemizedlist>
 
-        <listitem><para><emphasis>ProtectHome</emphasis> is set to
-        <emphasis>read-only</emphasis> by default. CGI scripts run via
-        <emphasis>UserDir</emphasis> will not be able modify any
-        content in <filename>/home</filename> by
-        default.</para></listitem>
-
-        <listitem><para><emphasis>ProtectSystem</emphasis> is set to
-        <emphasis>yes</emphasis> by default; this mounts various
-        system paths like <filename>/usr</filename> and
-        <filename>/boot</filename> as read-only by
-        default.</para></listitem>
-
-      </itemizedlist></para>
-
+      See
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      and
+      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information.</para>
     </refsect2>
 
     <refsect2>
@@ -368,12 +350,7 @@ ReloadPropagatedFrom=httpd.service</programlisting>
     <filename>/usr/lib/systemd/system/httpd@.service</filename>,
     <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
   </refsect1>
-
-  <refsect1>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
-
+  
   <refsect1>
     <title>See also</title>
 
diff --git a/httpd.spec b/httpd.spec
index 45f21c9..8e8ee8b 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -4,7 +4,6 @@
 %define mmn 20120211
 %define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
 %define vstring %(source /etc/os-release; echo ${NAME})
-%define bugurl %(source /etc/os-release; echo ${BUG_REPORT_URL})
 %if 0%{?fedora} > 26 || 0%{?rhel} > 7
 %global mpm event
 %else
@@ -19,18 +18,12 @@
 %bcond_without pcre
 %endif
 
-%if 0%{?fedora} > 40 || 0%{?rhel} > 9
-%bcond_with engine
-%else
-%bcond_without engine
-%endif
-
 # Similar issue to https://bugzilla.redhat.com/show_bug.cgi?id=2043092
 %undefine _package_note_flags
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.66
+Version: 2.4.57
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -88,39 +81,37 @@ Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
 Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
-Patch20: httpd-2.4.48-r1842929+.patch
-Patch21: httpd-2.4.64-mod_systemd.patch
-Patch22: httpd-2.4.53-export.patch
-Patch23: httpd-2.4.43-corelimit.patch
-Patch24: httpd-2.4.54-icons.patch
-Patch25: httpd-2.4.43-cachehardmax.patch
-Patch26: httpd-2.4.43-sslciphdefault.patch
-Patch27: httpd-2.4.64-sslprotdefault.patch
-Patch28: httpd-2.4.43-logjournal.patch
-Patch29: httpd-2.4.63-r1912477+.patch
-Patch30: httpd-2.4.64-separate-systemd-fns.patch
+Patch21: httpd-2.4.48-r1842929+.patch
+Patch22: httpd-2.4.43-mod_systemd.patch
+Patch23: httpd-2.4.53-export.patch
+Patch24: httpd-2.4.43-corelimit.patch
+Patch25: httpd-2.4.54-selinux.patch
+Patch26: httpd-2.4.54-gettid.patch
+Patch27: httpd-2.4.54-icons.patch
+Patch30: httpd-2.4.43-cachehardmax.patch
+Patch34: httpd-2.4.43-socket-activation.patch
+Patch38: httpd-2.4.43-sslciphdefault.patch
+Patch39: httpd-2.4.43-sslprotdefault.patch
+Patch41: httpd-2.4.43-r1861793+.patch
+Patch42: httpd-2.4.48-r1828172+.patch
+Patch45: httpd-2.4.43-logjournal.patch
+Patch46: httpd-2.4.53-separate-systemd-fns.patch
 
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-Patch61: httpd-2.4.65-hcheck-stuck.patch
+Patch61: httpd-2.4.48-r1878890.patch
+Patch63: httpd-2.4.46-htcacheclean-dont-break.patch
+Patch65: httpd-2.4.51-r1894152.patch
 
 # Security fixes
-# Patch200: ...
-
-# Apache-2.0: everything
-# BSD-3-Clause: util_pcre.c, ap_regex.h
-# metamail AND HPND-sell-variant:: server/util_md5.c:
-# Spencer-94: modules/metadata/mod_mime_magic.c
-License: Apache-2.0 AND (BSD-3-Clause AND metamail AND HPND-sell-variant AND Spencer-94)
 
+License: ASL 2.0
 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
 BuildRequires: perl-interpreter, perl-generators, systemd-devel
 BuildRequires: zlib-devel, libselinux-devel, lua-devel, brotli-devel
 BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0
-BuildRequires: openldap-devel
 BuildRequires: systemd-rpm-macros
-BuildRequires: libxcrypt-devel
 %if %{with pcre2}
 BuildRequires: pcre2-devel
 %endif
@@ -146,22 +137,11 @@ Provides: mod_proxy_uwsgi = %{version}-%{release}
 Requires: /etc/mime.types
 Requires: httpd-tools = %{version}-%{release}
 Requires: httpd-filesystem = %{version}-%{release}
-%if 0%{?fedora} > 39 || 0%{?rhel} > 9
-Requires: apr-util-1(dbm)%{_isa}
-%endif
 Requires(pre): httpd-filesystem
 Conflicts: apr < 1.5.0-1
 Conflicts: httpd < 2.4.53-2
 Obsoletes: mod_proxy_uwsgi < 2.0.17.1-2
 
-# Compat symlinks for Requires in other packages.
-%if "%{_sbindir}" == "%{_bindir}"
-# We rely on filesystem to create the symlink for us.
-Requires:           filesystem(unmerged-sbin-symlinks)
-Provides:           /usr/sbin/apachectl
-Provides:           /usr/sbin/httpd
-%endif
-
 %description core
 The httpd-core package contains essential httpd binaries.
 
@@ -262,7 +242,32 @@ written in the Lua programming language.
 
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
-%autosetup -p1 -S gendiff
+%setup -q
+%patch2 -p1 -b .apxs
+%patch3 -p1 -b .deplibs
+
+%patch19 -p1 -b .detectsystemd
+
+%patch21 -p1 -b .r1842929+
+%patch22 -p1 -b .mod_systemd
+%patch23 -p1 -b .export
+%patch24 -p1 -b .corelimit
+%patch26 -p1 -b .gettid
+%patch27 -p1 -b .icons
+%patch30 -p1 -b .cachehardmax
+%patch34 -p1 -b .socketactivation
+%patch38 -p1 -b .sslciphdefault
+%patch39 -p1 -b .sslprotdefault
+%patch41 -p1 -b .r1861793+
+%patch42 -p1 -b .r1828172+
+%patch45 -p1 -b .logjournal
+%patch46 -p1 -b .separatesystemd
+%patch25 -p1 -b .selinux
+
+%patch60 -p1 -b .enable-sslv3
+%patch61 -p1 -b .r1878890
+%patch63 -p1 -b .htcacheclean-dont-break
+%patch65 -p1 -b .r1894152
 
 # Patch in the vendor string
 sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -270,12 +275,6 @@ sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
 # Prevent use of setcap in "install-suexec-caps" target.
 sed -i '/suexec/s,setcap ,echo Skipping setcap for ,' Makefile.in
 
-%if %{without engine}
-: Forcibly disable ENGINE support in mod_ssl
-sed -i.engine '/^#define MODSSL_HAVE_ENGINE_API/{s/1/0/}' modules/ssl/ssl_private.h
-! diff -u modules/ssl/ssl_private.h{.engine,}
-%endif
-
 # Example conf for instances
 cp $RPM_SOURCE_DIR/instance.conf .
 sed < $RPM_SOURCE_DIR/httpd.conf >> instance.conf '
@@ -301,20 +300,23 @@ cp %{SOURCE48} ./docs/icons/apache_pb3.png
 # Provide default layout
 cp $RPM_SOURCE_DIR/config.layout .
 
-for f in httpd.conf htcacheclean.service httpd.service apachectl; do
-   sed '
+sed '
 s,@MPM@,%{mpm},g
 s,@DOCROOT@,%{docroot},g
 s,@LOGDIR@,%{_localstatedir}/log/httpd,g
-s|@BUG_REPORT_URL@|%{bugurl}|g
-' < $RPM_SOURCE_DIR/${f}.xml > ${f}.xml
-   xmlto man ${f}.xml
-done
+' < $RPM_SOURCE_DIR/httpd.conf.xml \
+    > httpd.conf.xml
+
+xmlto man ./httpd.conf.xml
+xmlto man $RPM_SOURCE_DIR/htcacheclean.service.xml
+xmlto man $RPM_SOURCE_DIR/httpd.service.xml
+
+# apachectl.xml => apachectl.8
+xmlto man %{SOURCE47}
 
 : Building with MMN %{mmn}, MMN-ISA %{mmnisa}
 : Default MPM is %{mpm}, vendor string is '%{vstring}'
 : Regex Engine: PCRE=%{with pcre} PCRE2=%{with pcre2}
-: mod_ssl ENGINE support: %{with engine}
 
 %build
 # forcibly prevent use of bundled apr, apr-util, pcre
@@ -329,6 +331,16 @@ autoheader && autoconf || exit 1
 
 %set_build_flags
 
+# Hard-code path to links to avoid unnecessary builddep
+export LYNX_PATH=/usr/bin/links
+
+%ifarch aarch64
+# The configure check for epoll_create() is failing. httpd/apr only
+# actually uses epoll_create1() so this test could be smarter. Work
+# around it for now.
+export ac_cv_func_epoll_create=yes
+%endif
+
 # Build the daemon
 ./configure \
         --prefix=%{_sysconfdir}/httpd \
@@ -420,9 +432,8 @@ touch -r $RPM_SOURCE_DIR/00-mpm.conf \
 # install systemd override drop directory
 # Web application packages can drop snippets into this location if
 # they need ExecStart[pre|post].
-mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d \
-      $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/httpd.service.d
+mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.service.d
+mkdir $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d
 
 install -m 644 -p $RPM_SOURCE_DIR/10-listen443.conf \
       $RPM_BUILD_ROOT%{_unitdir}/httpd.socket.d/10-listen443.conf
@@ -591,7 +602,7 @@ cp -p $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk \
       $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk
 
 # Sanitize CFLAGS & LIBTOOL in standard config_vars.mk
-sed -e '/^[A-Z]*FLAGS = /s,-specs[^ ]*,,g' \
+sed -e '/^CFLAGS/s,=.*$,= -O2 -g -Wall,' \
     -e '/^LIBTOOL/s,/.*/libtool,%{_bindir}/libtool,' \
     -i $RPM_BUILD_ROOT%{_libdir}/httpd/build/config_vars.mk
 diff -u $RPM_BUILD_ROOT%{_libdir}/httpd/build/vendor_config_vars.mk \
@@ -737,8 +748,7 @@ exit $rv
 %dir %{_libexecdir}/initscripts/legacy-actions/httpd
 %{_libexecdir}/initscripts/legacy-actions/httpd/*
 
-%{_sbindir}/httpd
-%{_sbindir}/htcacheclean
+%{_sbindir}/ht*
 %{_sbindir}/fcgistarter
 %{_sbindir}/apachectl
 %{_sbindir}/rotatelogs
@@ -787,16 +797,10 @@ exit $rv
 %dir %{contentdir}/icons
 %attr(755,root,root) %dir %{_unitdir}/httpd.service.d
 %attr(755,root,root) %dir %{_unitdir}/httpd.socket.d
-%attr(755,root,root) %dir %{_sysconfdir}/systemd/system/httpd.service.d
 %{_sysusersdir}/httpd.conf
 
 %files tools
-%{_bindir}/ab
-%{_bindir}/htdbm
-%{_bindir}/htdigest
-%{_bindir}/httxt2dbm
-%{_bindir}/htpasswd
-%{_bindir}/logresolve
+%{_bindir}/*
 %{_mandir}/man1/*
 %doc LICENSE NOTICE
 %exclude %{_bindir}/apxs
@@ -846,124 +850,6 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Tue Dec 09 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.66-1
-- new version 2.4.66
-
-* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-5
-- Improve default httpd LogFormats for better support diagnostics
-
-* Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3
-- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
-
-* Tue Nov 04 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
-- mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
-  required for VirtualHost matching.
-
-* Sat Oct 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-1
-- new version 2.4.65
-- mod_proxy_hcheck: reschedule health checks after child process restart
-
-* Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-4
-- Add tmpfiles.d rules for /var directories (bootc compatibility)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.64-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Jul 17 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-2
-- Fix RewriteRule with inverted pattern and RewriteCond regression
-
-* Fri Jul 11 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-1
-- new version 2.4.64
-
-* Tue Jun 24 2025 Joe Orton  <jorton@redhat.com> - 2.4.63-4
-- mod_dav: add dav_get_base_path() API
-
-* Mon Feb 10 2025 Joe Orton <jorton@redhat.com> - 2.4.63-3
-- sync default httpd.conf with upstream
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 2.4.63-2
-- Add explicit BR: libxcrypt-devel
-
-* Fri Jan 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-1
-- new version 2.4.63
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.62-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.62-5
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Fri Oct 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
-- mod_rewrite: regression fixes
-
-* Thu Aug 01 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
-- Fix regression introduced by CVE-2024-38474 fix
-- added openldap-devel build dependency
-
-* Fri Jul 19 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1
-- new version 2.4.62
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.61-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.61-2
-- Rebuilt for the bin-sbin merge
-
-* Wed Jul 03 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.61-1
-- new version 2.4.61
-
-* Thu May 23 2024 Joe Orton <jorton@redhat.com> - 2.4.59-4
-- mod_ssl: add engine bcond, disable ENGINE support by default for F41+
-- mod_ssl: enable SSL_OP_NO_RENEGOTIATION (upstream PR#426)
-
-* Fri May  3 2024 Joe Orton <jorton@redhat.com> - 2.4.59-3
-- apachectl(8): use BUG_REPORT_URL from /etc/os-release
-- apachectl(8): fix grammar (#2278748)
-- httpd.service.xml(8): mention ProtectSystem= setting
-
-* Mon Apr 15 2024 Joe Orton <jorton@redhat.com> - 2.4.59-2
-- mod_ssl: add DH param handling fix (r1916863)
-
-* Fri Apr  5 2024 Joe Orton <jorton@redhat.com> - 2.4.59-1
-- update to 2.4.59
-
-* Thu Mar 28 2024 Joe Orton <jorton@redhat.com> - 2.4.58-8
-- rebuild to fix changelog ordering
-
-* Thu Mar 7 2024 Rahul Sundaram <sundaram@fedoraproject.org> - 2.4.58-7
-- Update Systemd security settings as part of https://fedoraproject.org/wiki/Changes/SystemdSecurityHardening
-- updated httpd.service(5) (Joe Orton)
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.58-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan  5 2024 Joe Orton <jorton@redhat.com> - 2.4.58-4
-- fix OpenSSL 3.0 deprecation warnings (r1913912, r1915067)
-- mod_ssl: move to provider API for pkcs11 support (#2253014)
-
-* Fri Dec  8 2023 Joe Orton <jorton@redhat.com> - 2.4.58-3
-- mod_dav_fs: add DAVLockDBType, use global lock around lockdb
-- fix build with libxml2 2.12
-
-* Thu Nov  2 2023 Joe Orton <jorton@redhat.com> - 2.4.58-2
-- add dependency on apr-util-1(dbm) so a DBM provider is present
-
-* Fri Oct 20 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.58-1
-- new version 2.4.58
-
-* Fri Oct 06 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-4
-- SPDX migration
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.57-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Wed Jul  5 2023 Joe Orton <jorton@redhat.com> - 2.4.57-2
-- package /etc/systemd/httpd/httpd.service.d
-- also sanitize LDFLAGS/CXXFLAGS in non-vendor config_vars.mk
-
 * Tue Apr 11 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
 - new version 2.4.57
 
diff --git a/httpd.tmpfiles b/httpd.tmpfiles
index a845ab5..f148886 100644
--- a/httpd.tmpfiles
+++ b/httpd.tmpfiles
@@ -1,9 +1,2 @@
 d /run/httpd   710 root apache
 d /run/httpd/htcacheclean   700 apache apache
-d /var/log/httpd 700 root root -
-d /var/www       755 root root -
-d /var/www/html  755 root root -
-d /var/www/cgi-bin 755 root root -
-d /var/lib/httpd 700 apache apache -
-d /var/cache/httpd 700 apache apache -
-d /var/cache/httpd/proxy 700 apache apache -
diff --git a/httpd@.service b/httpd@.service
index 8b20b90..84424fb 100644
--- a/httpd@.service
+++ b/httpd@.service
@@ -19,25 +19,8 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
-DevicePolicy=closed
-KeyringMode=private
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-OOMPolicy=continue
-PrivateDevices=yes
 PrivateTmp=true
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=read-only
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectSystem=yes
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native
+OOMPolicy=continue
 
 [Install]
 WantedBy=multi-user.target
diff --git a/pullrev.sh b/pullrev.sh
index a87d0dc..87b7cd7 100755
--- a/pullrev.sh
+++ b/pullrev.sh
@@ -6,8 +6,8 @@ if [ $# -lt 1 ]; then
 fi
 
 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=$(rpm -q --specfile httpd.spec --qf '%{VERSION}\n' | sed 1q)
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.51
 prefix="httpd-${ver}"
 suffix="${SUFFIX:-r$1${2:++}}"
 fn="${prefix}-${suffix}.patch"
@@ -43,9 +43,7 @@ for r in $*; do
         http*) curl -s "$r" | filterdiff --strip=3 ;;
         *) svn diff -c ${r} ${repo}  ;;
     esac | filterdiff --remove-timestamps --clean \
-                      -x 'CHANGES' -x 'changes-entries/*.txt' \
-                      -x '*/next-number' -x 'STATUS' -x '*.xml' \
-                      -x '.github/*' \
+                      -x 'CHANGES' -x '*/next-number' -x 'STATUS' -x '*.xml' \
                       --addprefix="${prefix}/" > ${this}
     next=`mktemp /tmp/pullrevXXXXXX`
     if ! combinediff -w ${prev} ${this} > ${next}; then
@@ -64,3 +62,4 @@ echo "+ git add ${fn}"
 git add "${fn}"
 echo "+ spec template:"
 echo "PatchN: ${fn}"
+echo "%patchN -p1 -b .${suffix}"
diff --git a/rpminspect.yaml b/rpminspect.yaml
index 7696d42..1b4f2fe 100644
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@@ -2,21 +2,5 @@
 badfuncs:
   # mod_proxy uses inet_ntoa (safely) for IPv4 address matching,
   # and APR interfaces for IPv6 addresses.
-  allowed:
-    /usr/lib*/httpd/modules/mod_proxy.so:
-      - inet_ntoa
-upstream:
   ignore:
-    - '*.xml'
-    - '*.service'
-    - '*.socket'
-    - '*.conf'
-    - '*.sysconf'
-    - '*.tmpfiles'
-    - 'README.*'
-    - '*.sysusers'
-    - '*.png'
-    - 'httpd-ssl-*'
-    - config.layout
-    - 'action*.sh'
-    - 'apachectl.*'
+    - /usr/lib*/httpd/modules/mod_proxy.so
diff --git a/sources b/sources
index d84ddb9..ceb40e4 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
-SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd
+SHA512 (httpd-2.4.57.tar.bz2) = 4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155
+SHA512 (httpd-2.4.57.tar.bz2.asc) = 3d40491da7610b91894ea24d011da213c0ba4c04dbf3d5dbefac704ba55d9a56acf375dd61363f50291a748ef5f14e7d2dcba96b15a8ce448267bfeb26bf7ecd
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192