new version 2.4.66

mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
required for VirtualHost matching.

.gitignore

@@ -54,3 +54,5 @@ x86_64
 /httpd-2.4.62.tar.bz2.asc
 /httpd-2.4.63.tar.bz2.asc
 /httpd-2.4.64.tar.bz2.asc
+/httpd-2.4.65.tar.bz2.asc
+/httpd-2.4.66.tar.bz2.asc

httpd-2.4.64-r1927270.patch

@@ -1,25 +0,0 @@
-From 6e59b124221014bd1c23053e9bb63fb3362387d9 Mon Sep 17 00:00:00 2001
-From: Eric Covener <covener@apache.org>
-Date: Wed, 16 Jul 2025 17:33:21 +0000
-Subject: [PATCH] rc already is set by result of expression eval
-
-git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1927270 13f79535-47bb-0310-9956-ffa450edef68
----
- modules/mappers/mod_rewrite.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index a6c35a0be1f..a71110bc76e 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -4283,9 +4283,6 @@ static cond_return_type apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ct
-                             p->pattern - p->pskip, err);
-                 rc = COND_RC_NOMATCH;
-             }
--            else {
--                rc = COND_RC_MATCH;
--            }
-             /* update briRC backref info */
-             if (rc && !(p->flags & CONDFLAG_NOTMATCH)) {
-                 ctx->briRC.source = source;
-

httpd-2.4.65-hcheck-stuck.patch

@@ -0,0 +1,66 @@
+--- a/modules/proxy/mod_proxy_hcheck.c
++++ b/modules/proxy/mod_proxy_hcheck.c
+@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
+     sctx_t *ctx = (sctx_t *)data;
+     server_rec *s = ctx->s;
+     proxy_server_conf *conf;
++    proxy_worker **workers;
++    proxy_worker *worker;
++    apr_time_t now;
++    int i, n;
+ 
++    conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
++    balancer = (proxy_balancer *)conf->balancers->elts;
++
+     switch (state) {
+         case AP_WATCHDOG_STATE_STARTING:
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
+                          "%s watchdog started.",
+                          HCHECK_WATHCHDOG_NAME);
++            /* set last update time for all workers */
++            now = apr_time_now();
++            for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
++                workers = (proxy_worker **)balancer->workers->elts;
++                for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
++                    worker = *workers;
++                    if (worker->s->updated == 0) {
++                        worker->s->updated = now;
++                    }
++                }
++            }
+ #if HC_USE_THREADS
+             if (tpsize && hctp == NULL) {
+                 rv =  apr_thread_pool_create(&hctp, tpsize,
+@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
+ 
+         case AP_WATCHDOG_STATE_RUNNING:
+             /* loop thru all workers */
+-            if (s) {
+-                int i;
+-                conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
+-                balancer = (proxy_balancer *)conf->balancers->elts;
+-                ctx->s = s;
++            {
++                now = apr_time_now();
+                 for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
+-                    int n;
+-                    apr_time_t now;
+-                    proxy_worker **workers;
+-                    proxy_worker *worker;
+                     /* Have any new balancers or workers been added dynamically? */
+                     ap_proxy_sync_balancer(balancer, s, conf);
+                     workers = (proxy_worker **)balancer->workers->elts;
+-                    now = apr_time_now();
+-                    for (n = 0; n < balancer->workers->nelts; n++) {
++                    for (n = 0; n < balancer->workers->nelts; n++, workers++) {
+                         worker = *workers;
+                         if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
+                             (worker->s->method != NONE) &&
+@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
+                                 hc_check(NULL, baton);
+                             }
+                         }
+-                        workers++;
+                     }
+                 }
+             }

httpd-ssl-gencerts

@@ -33,7 +33,7 @@ sscg -q                                                             \
      --cert-file           /etc/pki/tls/certs/localhost.crt         \
      --cert-key-file       /etc/pki/tls/private/localhost.key       \
      --ca-file             /etc/pki/tls/certs/localhost.crt         \
-     --dhparams-file       /tmp/dhparams.pem                        \
+     --no-dhparams-file                                             \
      --lifetime            365                                      \
      --hostname            $FQDN                                    \
      --email               root@$FQDN

httpd.conf

@@ -199,6 +199,7 @@ LogLevel warn
     # a CustomLog directive (see below).
     #
     LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
     LogFormat "%h %l %u %t \"%r\" %>s %b" common
 
     <IfModule logio_module>
@@ -216,10 +217,11 @@ LogLevel warn
     #CustomLog "logs/access_log" common
 
     #
-    # If you prefer a logfile with access, agent, and referer information
-    # (Combined Logfile Format) you can use the following directive.
+    # If you prefer a logfile with access, agent, referer, and process/thread
+    # information (an extended Combined Logfile Format), you can use the
+    # following directive.
     #
-    CustomLog "logs/access_log" combined
+    CustomLog "logs/access_log" combined_ext
 </IfModule>
 
 <IfModule alias_module>

httpd.spec

@@ -30,8 +30,8 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.64
-Release: 3%{?dist}
+Version: 2.4.66
+Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -103,8 +103,7 @@ Patch30: httpd-2.4.64-separate-systemd-fns.patch
 # Bug fixes
 # https://bugzilla.redhat.com/show_bug.cgi?id=1397243
 Patch60: httpd-2.4.43-enable-sslv3.patch
-# https://bz.apache.org/bugzilla/show_bug.cgi?id=69745
-Patch61: httpd-2.4.64-r1927270.patch
+Patch61: httpd-2.4.65-hcheck-stuck.patch
 
 # Security fixes
 # Patch200: ...
@@ -847,6 +846,26 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Tue Dec 09 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.66-1
+- new version 2.4.66
+
+* Thu Nov 27 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-5
+- Improve default httpd LogFormats for better support diagnostics
+
+* Wed Nov 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-3
+- mod_ssl: SSLVHostSNIPolicy - Fix handling of STRICT mode
+
+* Tue Nov 04 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-2
+- mod_ssl: Add SSLVHostSNIPolicy directive to set the compatibility level
+  required for VirtualHost matching.
+
+* Sat Oct 18 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.65-1
+- new version 2.4.65
+- mod_proxy_hcheck: reschedule health checks after child process restart
+
+* Mon Sep 08 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.64-4
+- Add tmpfiles.d rules for /var directories (bootc compatibility)
+
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.64-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 

httpd.tmpfiles

@@ -1,2 +1,9 @@
 d /run/httpd   710 root apache
 d /run/httpd/htcacheclean   700 apache apache
+d /var/log/httpd 700 root root -
+d /var/www       755 root root -
+d /var/www/html  755 root root -
+d /var/www/cgi-bin 755 root root -
+d /var/lib/httpd 700 apache apache -
+d /var/cache/httpd 700 apache apache -
+d /var/cache/httpd/proxy 700 apache apache -

sources

@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.64.tar.bz2) = 299cb0d87a7e0e0a99d22bba7349b6b07c69222897410f9670af29896288d1f4e1da81d22ac9e1d8d6ea096e88044ab1dd34555b40a4b1b1cb3fd4b1d1897a7a
-SHA512 (httpd-2.4.64.tar.bz2.asc) = 1a28214c8468288477f706422ab3419e186ef37dc1eb55760a7e951605e08e295230b6d828948693a9d5ba247e352b205254c999763fa6845dab2f703152e1d8
+SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
+SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192