mod_reqtimeout: fix default values regression (PR 63325)

new version 2.4.39
Resolves: #1652678 - TLS connection allowed while all protocols are forbidden
2019-05-03 10:02:09 +01:00 · 2019-04-02 17:16:12 +00:00 · 2018-11-26 12:03:39 +00:00
80 changed files with 2779 additions and 3088 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -31,28 +31,3 @@ x86_64
 /httpd-*.tar.bz2
 /httpd*.8
 /results_httpd
-/htcacheclean.service.8
-/httpd.conf.5
-/httpd-2.4.41.tar.bz2.asc
-/apachectl.8
-/httpd-2.4.43.tar.bz2.asc
-/KEYS
-/httpd-2.4.46.tar.bz2.asc
-/httpd-2.4.48.tar.bz2.asc
-/httpd-2.4.49.tar.bz2.asc
-/httpd-2.4.50.tar.bz2.asc
-/httpd-2.4.51.tar.bz2.asc
-/httpd-2.4.52.tar.bz2.asc
-/httpd-2.4.53.tar.bz2.asc
-/httpd-2.4.54.tar.bz2.asc
-/httpd-2.4.55.tar.bz2.asc
-/httpd-2.4.56.tar.bz2.asc
-/httpd-2.4.57.tar.bz2.asc
-/httpd-2.4.58.tar.bz2.asc
-/httpd-2.4.59.tar.bz2.asc
-/httpd-2.4.61.tar.bz2.asc
-/httpd-2.4.62.tar.bz2.asc
-/httpd-2.4.63.tar.bz2.asc
-/httpd-2.4.64.tar.bz2.asc
-/httpd-2.4.65.tar.bz2.asc
-/httpd-2.4.66.tar.bz2.asc
--- a/00-base.conf
+++ b/00-base.conf
@ -15,7 +15,6 @@ LoadModule authn_dbd_module modules/mod_authn_dbd.so
 LoadModule authn_dbm_module modules/mod_authn_dbm.so
 LoadModule authn_file_module modules/mod_authn_file.so
 LoadModule authn_socache_module modules/mod_authn_socache.so
-LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
 LoadModule authz_core_module modules/mod_authz_core.so
 LoadModule authz_dbd_module modules/mod_authz_dbd.so
 LoadModule authz_dbm_module modules/mod_authz_dbm.so
@ -24,6 +23,7 @@ LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_owner_module modules/mod_authz_owner.so
 LoadModule authz_user_module modules/mod_authz_user.so
 LoadModule autoindex_module modules/mod_autoindex.so
+LoadModule brotli_module modules/mod_brotli.so
 LoadModule cache_module modules/mod_cache.so
 LoadModule cache_disk_module modules/mod_cache_disk.so
 LoadModule cache_socache_module modules/mod_cache_socache.so
--- a/00-brotli.conf
+++ b/00-brotli.conf
@ -1 +0,0 @@
-LoadModule brotli_module modules/mod_brotli.so
--- a/00-mpm.conf
+++ b/00-mpm.conf
@ -1,5 +1,5 @@
 # Select the MPM module which should be used by uncommenting exactly
-# one of the following LoadModule lines.  See the httpd.conf(5) man
+# one of the following LoadModule lines.  See the httpd.service(8) man
 # page for more information on changing the MPM.

 # prefork MPM: Implements a non-threaded, pre-forking web server
--- a/01-cgi.conf
+++ b/01-cgi.conf
@ -2,7 +2,10 @@
 # which has been configured in 00-mpm.conf.  mod_cgid should be used
 # with a threaded MPM; mod_cgi with the prefork MPM.

-<IfModule !mpm_prefork_module>
+<IfModule mpm_worker_module>
+   LoadModule cgid_module modules/mod_cgid.so
+</IfModule>
+<IfModule mpm_event_module>
   LoadModule cgid_module modules/mod_cgid.so
 </IfModule>
 <IfModule mpm_prefork_module>
--- a/01-md.conf
+++ b/01-md.conf
@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so
--- a/README.confd
+++ b/README.confd
@ -5,5 +5,5 @@ processed as httpd configuration files.  The directory is used in
 addition to the directory /etc/httpd/conf.modules.d/, which contains
 configuration files necessary to load modules.

-Files are processed in sorted order.  See httpd.conf(5) for more
-information.
+Files are processed in alphabetical order.
+
--- a/README.confmod
+++ b/README.confmod
@ -6,5 +6,4 @@ configuration fragments necessary only to load modules.
 Administrators should use the directory "/etc/httpd/conf.d" to modify
 the configuration of httpd, or any modules.

-Files are processed in sorted order and should have a two digit
-numeric prefix.  See httpd.conf(5) for more information.
+Files are processed in alphanumeric order.
--- a/action-configtest.sh
+++ b/action-configtest.sh
@ -1,2 +1,2 @@
 #!/bin/sh
-exec /usr/sbin/httpd -t
+exec /sbin/apachectl configtest "$@"
--- a/action-graceful.sh
+++ b/action-graceful.sh
@ -1,2 +1,2 @@
 #!/bin/sh
-exec /sbin/apachectl graceful
+exec /sbin/apachectl graceful "$@"
--- a/apache-poweredby.png
+++ b/apache-poweredby.png
--- a/apachectl.sh
+++ b/apachectl.sh
@ -1,74 +0,0 @@
-#!/usr/bin/sh
-#
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-###
-### NOTE: This is a replacement version of the "apachectl" script with
-### some differences in behaviour to the version distributed with
-### Apache httpd.  Please read the apachectl(8) man page for more
-### information.
-###
-
-if [ "x$1" = "x-k" ]; then
-    shift
-fi
-
-ACMD="$1"
-ARGV="$@"
-SVC='httpd.service'
-HTTPD='@HTTPDBIN@'
-
-if [ "x$2" != "x" ] ; then
-    echo Passing arguments to httpd using apachectl is no longer supported.
-    echo You can only start/stop/restart httpd using this script.
-    echo To pass extra arguments to httpd, see the $SVC'(8)'
-    echo man page.
-    exit 1
-fi
-
-case $ACMD in
-start|stop|restart|status)
-    /usr/bin/systemctl --no-pager $ACMD $SVC
-    ERROR=$?
-    ;;
-graceful)
-    if /usr/bin/systemctl -q is-active $SVC; then
-        /usr/bin/systemctl kill --signal=SIGUSR1 --kill-who=main $SVC
-    else
-        /usr/bin/systemctl start $SVC
-    fi
-    ERROR=$?
-    ;;
-graceful-stop)
-    /usr/bin/systemctl kill --signal=SIGWINCH --kill-who=main $SVC
-    ERROR=$?
-    ;;
-configtest|-t)
-    $HTTPD -t
-    ERROR=$?
-    ;;
-v|-V)
-    $HTTPD $ACMD
-    ERROR=$?
-    ;;
-*)
-    echo apachectl: The \"$ACMD\" option is not supported. 1>&2
-    ERROR=2
-    ;;
-esac
-
-exit $ERROR
-
--- a/apachectl.xml
+++ b/apachectl.xml
@ -1,192 +0,0 @@
-<?xml version='1.0' encoding='UTF-8' ?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
-  "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">[
-
-]>
-<!--
- Copyright 2020 Red Hat, Inc.
- Copyright 2018 Frank Dana
-
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-->
-<refentry>
-  <refentryinfo>
-    <title>apachectl</title>
-    <productname>httpd</productname>
-    <author><contrib>Apache man page</contrib><othername>Apache Software Foundation contributors</othername></author>
-    <author><contrib>Fedora man page</contrib><surname>Dana</surname><firstname>Frank</firstname></author>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>apachectl</refentrytitle>
-    <manvolnum>8</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>apachectl</refname>
-    <refpurpose>Server control interface for httpd</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv id='synopsis'>
-    <cmdsynopsis>
-      <command>apachectl</command>
-      <arg choice='opt'><replaceable>command</replaceable> </arg>
-      <sbr/>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-<!-- body begins here -->
-  <refsect1 id='description'>
-    <title>Description</title>
-
-    <para><command>apachectl</command> is a front end to the Apache HyperText
-    Transfer Protocol (HTTP) server. It is designed to help the
-    administrator control the functioning of the Apache
-    <command>httpd</command> daemon.</para>
-
-    <para>The <command>apachectl</command> script takes one-word arguments like
-    <option>start</option>,
-    <option>restart</option>, and
-    <option>stop</option>, and translates them
-    into appropriate signals to <command>httpd</command>.</para>
-
-    <para>The <command>apachectl</command> script returns a 0 exit value on
-    success, and &gt;0 if an error occurs.</para>
-
-    <refsect2 id="compatibility">
-      <title>Compatibility</title>
-
-      <para>The version of <command>apachectl</command> used on this
-      system is a replacement script intended to be mostly (but not
-      completely) compatible with the version provided with
-      <emphasis>Apache httpd</emphasis>.  This
-      <command>apachectl</command> mostly acts as a wrapper around
-      <command>systemctl</command> and manipulates the
-      <command>systemd</command> service for <command>httpd</command>.
-      The interface to the <emphasis>Apache</emphasis> version of
-      <command>apachectl</command> is described at <ulink
-      url="https://httpd.apache.org/docs/2.4/programs/apachectl.html"/>.</para>
-
-      <para>The following differences are present in the version of
-      <command>apachectl</command> present on this system:
-
-      <itemizedlist>
-        <listitem><para>Option arguments passed when starting
-        <command>httpd</command> are not allowed.  These should be
-        configured in the systemd service directly (see <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>).</para></listitem>
-
-        <listitem><para>The <command>"fullstatus"</command> option is
-        not available.</para></listitem>
-
-        <listitem><para>The <command>"status"</command> option does
-        not use or rely on the running server's
-        <emphasis>server-status</emphasis> output.</para></listitem>
-      </itemizedlist>
-
-      </para>
-    </refsect2>
-  </refsect1>
-
-  <refsect1 id='options'>
-    <title>Options</title>
-    <variablelist remap='TP'>
-      <varlistentry>
-        <term><option>start</option></term>
-        <listitem>
-          <para>Start the Apache <command>httpd</command> daemon. Gives an error if it
-          is already running. This is equivalent to <command>systemctl start httpd.service</command>.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>stop</option></term>
-        <listitem>
-          <para>Stops the Apache <command>httpd</command> daemon. This is equivalent to
-          <command>systemctl stop httpd.service</command>.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>restart</option></term>
-        <listitem>
-          <para>Restarts the Apache <command>httpd</command> daemon. If the daemon is
-          not running, it is started. This is equivalent
-          to <command>systemctl restart httpd.service</command>.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>status</option></term>
-        <listitem>
-          <para>Displays a brief status report. This is equivalent to <command>systemctl status httpd.service.</command></para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>graceful</option></term>
-        <listitem>
-          <para>Gracefully restarts the Apache <command>httpd</command> daemon. If the
-          daemon is not running, it is started. This differs from a normal
-          restart in that currently open connections are not aborted. A side
-          effect is that old log files will not be closed immediately. This
-          means that if used in a log rotation script, a substantial delay may
-          be necessary to ensure that the old log files are closed before
-          processing them. This is equivalent to
-          <command>systemctl kill --signal=SIGUSR1 --kill-who=main httpd.service</command>.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>graceful-stop</option></term>
-        <listitem>
-          <para>Gracefully stops the Apache <command>httpd</command> daemon.
-          This differs from a normal stop in that currently open connections are not
-          aborted. A side effect is that old log files will not be closed immediately.
-          This is equivalent to
-          <command>systemctl kill --signal=SIGWINCH --kill-who=main httpd.service</command>.</para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>configtest</option> | <option>-t</option></term>
-        <listitem>
-          <para>Run a configuration file syntax test. It parses the configuration
-          files and either reports <literal>Syntax OK</literal>
-          or detailed information about the particular syntax error. This is
-          equivalent to <command>httpd -t</command>.</para>
-        </listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1 id='bugs'>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
-
-    <refsect1>
-    <title>See also</title>
-
-    <para>
-    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-    </para>
-  </refsect1>
-
-</refentry>
--- a/ci.fmf
+++ b/ci.fmf
@ -1 +0,0 @@
-resultsdb-testcase: separate
--- a/config.layout
+++ b/config.layout
@ -1,24 +0,0 @@
-# Layout used in Fedora httpd packaging.
-<Layout Fedora>
-    prefix:        /etc/httpd
-    localstatedir: /var
-    exec_prefix:   /usr
-    bindir:        ${exec_prefix}/bin
-    sbindir:       ${exec_prefix}/sbin
-    libdir:        ${exec_prefix}/lib
-    libexecdir:    ${exec_prefix}/libexec
-    mandir:        ${exec_prefix}/man
-    sysconfdir:    /etc/httpd/conf
-    datadir:       ${exec_prefix}/share/httpd
-    installbuilddir: ${libdir}/httpd/build
-    errordir:      ${datadir}/error
-    iconsdir:      ${datadir}/icons
-    htdocsdir:     ${localstatedir}/www/html
-    manualdir:     ${datadir}/manual
-    cgidir:        ${localstatedir}/www/cgi-bin
-    includedir:    ${exec_prefix}/include/httpd
-    runtimedir:    ${prefix}/run
-    logfiledir:    ${localstatedir}/log/httpd
-    statedir:      ${prefix}/state
-    proxycachedir: ${localstatedir}/cache/httpd/proxy
-</Layout>     
--- a/gating.yaml
+++ b/gating.yaml
@ -1,27 +0,0 @@
--- !Policy
-product_versions:
-  - fedora-*
-decision_contexts: [bodhi_update_push_testing]
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
-
-#gating rawhide
--- !Policy
-product_versions:
-  - fedora-*
-decision_contexts: [bodhi_update_push_stable]
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
-
-#gating rhel
--- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier2.functional}
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier3.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
--- a/htcacheclean.service
+++ b/htcacheclean.service
@ -1,16 +1,10 @@
 [Unit]
-Description=Disk Cache Cleaning Daemon for the Apache HTTP Server
+Description=Disk Cache Cleaning Daemon for Apache HTTP Server
 After=httpd.service
-Documentation=man:htcacheclean.service(8)

 [Service]
 Type=forking
 User=apache
 PIDFile=/run/httpd/htcacheclean/pid
-Environment=LANG=C
 EnvironmentFile=/etc/sysconfig/htcacheclean
 ExecStart=/usr/sbin/htcacheclean -P /run/httpd/htcacheclean/pid -d $INTERVAL -p $CACHE_ROOT -l $LIMIT $OPTIONS
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
--- a/htcacheclean.service.xml
+++ b/htcacheclean.service.xml
@ -1,128 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-
-]>
-<!--
- Copyright 2018 Red Hat, Inc.
-
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements.  See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License.  You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language overning permissions and
- limitations under the License.
-->
-<refentry>
-  <refentryinfo>
-    <title>htcacheclean systemd unit</title>
-    <productname>httpd</productname>
-    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>htcacheclean.service</refentrytitle>
-    <manvolnum>8</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>htcacheclean.service</refname>
-    <refpurpose>htcacheclean unit file for systemd</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <para>
-      <filename>/usr/lib/systemd/system/htcacheclean.service</filename>
-    </para>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>Description</title>
-
-    <para>This manual page describes the <command>systemd</command>
-    unit file for the <command>htcacheclean</command> daemon.  This
-    unit file provides a service which runs
-    <command>htcacheclean</command> in daemon mode,
-    periodically cleaning the disk cache root to ensure disk space
-    usage is within configured limits.</para>
-
-  </refsect1>
-
-  <refsect1>
-    <title>Options</title>
-
-    <para>The service is configured by configuration file
-    <filename>/etc/sysconfig/htcacheclean</filename>. The following
-    variables are used, following standard <command>systemd</command>
-    <varname>EnvironmentFile=</varname> syntax:</para>
-
-    <variablelist>
-      <varlistentry>
-        <term><varname>INTERVAL=</varname></term>
-
-        <listitem><para>Sets the interval between cache clean runs, in
-        minutes.  By default this is configured as
-        <emphasis>15</emphasis>.</para></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><varname>CACHE_ROOT=</varname></term>
-
-        <listitem><para>Sets the directory name used for the cache
-        root.  By default this is configured as
-        <filename>/var/cache/httpd/proxy</filename>.</para></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><varname>LIMIT=</varname></term>
-
-        <listitem><para>Sets the total disk cache space limit, in
-        bytes.  Use a <emphasis>K</emphasis> or <emphasis>M</emphasis>
-        suffix to signify kilobytes or megabytes.  By default this is
-        set to <emphasis>100M</emphasis>.</para></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><varname>OPTIONS=</varname></term>
-
-        <listitem><para>Any other options to pass to
-        <command>htcacheclean</command>.</para></listitem>
-      </varlistentry>
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>Files</title>
-
-    <para><filename>/usr/lib/systemd/system/htcacheclean.service</filename>,
-    <filename>/etc/sysconfig/htcacheclean</filename></para>
-  </refsect1>
-
-  <refsect1>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
-
-  <refsect1>
-    <title>See also</title>
-
-    <para>
-    <citerefentry><refentrytitle>htcacheclean</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-    </para>
-  </refsect1>
-
-</refentry>
-
-<!-- LocalWords:  systemd httpd htcacheclean
-->
--- a/httpd-2.4.1-apctl.patch
+++ b/httpd-2.4.1-apctl.patch
@ -0,0 +1,94 @@
+
+- fail gracefully if links is not installed on target system
+- source sysconfig/httpd for custom env. vars etc.
+- make httpd -t work even in SELinux
+- pass $OPTIONS to all $HTTPD invocation
+
+Upstream-HEAD: vendor
+Upstream-2.0: vendor
+Upstream-Status: Vendor-specific changes for better initscript integration
+
+--- httpd-2.4.1/support/apachectl.in.apctl
+++ httpd-2.4.1/support/apachectl.in
+@@ -44,19 +44,25 @@ ARGV="$@"
+ # the path to your httpd binary, including options if necessary
+ HTTPD='@exp_sbindir@/@progname@'
+ #
+-# pick up any necessary environment variables
+-if test -f @exp_sbindir@/envvars; then
+-  . @exp_sbindir@/envvars
+-fi
+ #
+ # a command that outputs a formatted text version of the HTML at the
+ # url given on the command line.  Designed for lynx, however other
+ # programs may work.  
+-LYNX="@LYNX_PATH@ -dump"
+if [ -x "@LYNX_PATH@" ]; then
+  LYNX="@LYNX_PATH@ -dump"
+else
+  LYNX=none
+fi
+ #
+ # the URL to your server's mod_status status page.  If you do not
+ # have one, then status and fullstatus will not work.
+ STATUSURL="http://localhost:@PORT@/server-status"
+
+# Source /etc/sysconfig/httpd for $HTTPD setting, etc.
+if [ -r /etc/sysconfig/httpd ]; then
+   . /etc/sysconfig/httpd
+fi
+
+ #
+ # Set this variable to a command that increases the maximum
+ # number of file descriptors allowed per child process. This is
+@@ -76,9 +82,27 @@ if [ "x$ARGV" = "x" ] ; then 
+     ARGV="-h"
+ fi
+ 
+function checklynx() {
+if [ "$LYNX" = "none" ]; then
+   echo "The 'links' package is required for this functionality."
+   exit 8
+fi
+}
+
+function testconfig() {
+# httpd is denied terminal access in SELinux, so run in the
+# current context to get stdout from $HTTPD -t.
+if test -x /usr/sbin/selinuxenabled && /usr/sbin/selinuxenabled; then
+  runcon -- `id -Z` $HTTPD $OPTIONS -t
+else
+  $HTTPD $OPTIONS -t
+fi
+ERROR=$?
+}
+
+ case $ACMD in
+ start|stop|restart|graceful|graceful-stop)
+-    $HTTPD -k $ARGV
+    $HTTPD $OPTIONS -k $ARGV
+     ERROR=$?
+     ;;
+ startssl|sslstart|start-SSL)
+@@ -88,17 +112,18 @@ startssl|sslstart|start-SSL)
+     ERROR=2
+     ;;
+ configtest)
+-    $HTTPD -t
+-    ERROR=$?
+    testconfig
+     ;;
+ status)
+    checklynx
+     $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
+     ;;
+ fullstatus)
+    checklynx
+     $LYNX $STATUSURL
+     ;;
+ *)
+-    $HTTPD "$@"
+    $HTTPD $OPTIONS "$@"
+     ERROR=$?
+ esac
+ 
--- a/httpd-2.4.43-corelimit.patch
+++ b/httpd-2.4.43-corelimit.patch
@ -1,11 +1,13 @@

-Upstream-Status: local customisation
+Bump up the core size limit if CoreDumpDirectory is
+configured.

-diff --git a/server/core.c b/server/core.c
-index 79b2a82..dc0f17a 100644
--- a/server/core.c
-+++ b/server/core.c
-@@ -4996,6 +4996,25 @@ static int core_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *pte
+Upstream-Status: Was discussed but there are competing desires;
+	there are portability oddities here too.
+
+--- httpd-2.4.1/server/core.c.corelimit
+++ httpd-2.4.1/server/core.c
+@@ -4433,6 +4433,25 @@ static int core_post_config(apr_pool_t *
     }
     apr_pool_cleanup_register(pconf, NULL, ap_mpm_end_gen_helper,
                               apr_pool_cleanup_null);
--- a/httpd-2.4.43-deplibs.patch
+++ b/httpd-2.4.43-deplibs.patch
@ -1,11 +1,11 @@

-Upstream-Status: local customisation, not needed upstream
+Link straight against .la files.

-diff --git a/configure.in b/configure.in
-index f8f9442..f276550 100644
--- a/configure.in
-+++ b/configure.in
-@@ -786,9 +786,9 @@ APACHE_SUBST(INSTALL_SUEXEC)
+Upstream-Status: vendor specific
+
+--- httpd-2.4.1/configure.in.deplibs
+++ httpd-2.4.1/configure.in
+@@ -707,9 +707,9 @@ APACHE_HELP_STRING(--with-suexec-umask,u
 
 dnl APR should go after the other libs, so the right symbols can be picked up
 if test x${apu_found} != xobsolete; then
--- a/httpd-2.4.17-socket-activation.patch
+++ b/httpd-2.4.17-socket-activation.patch
@ -0,0 +1,300 @@
+diff --git a/server/listen.c b/server/listen.c
+index a8e9e6f..1a6c1d3 100644
+--- a/server/listen.c
+++ b/server/listen.c
+@@ -34,6 +34,10 @@
+ #include <unistd.h>
+ #endif
+ 
+#ifdef HAVE_SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
+ /* we know core's module_index is 0 */
+ #undef APLOG_MODULE_INDEX
+ #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX
+@@ -59,9 +63,12 @@ static int ap_listenbacklog;
+ static int ap_listencbratio;
+ static int send_buffer_size;
+ static int receive_buffer_size;
+#ifdef HAVE_SYSTEMD
+static int use_systemd = -1;
+#endif
+ 
+ /* TODO: make_sock is just begging and screaming for APR abstraction */
+-static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server, int do_bind_listen)
+ {
+     apr_socket_t *s = server->sd;
+     int one = 1;
+@@ -94,20 +101,6 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+         return stat;
+     }
+ 
+-#if APR_HAVE_IPV6
+-    if (server->bind_addr->family == APR_INET6) {
+-        stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
+-        if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
+-            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
+-                          "make_sock: for address %pI, apr_socket_opt_set: "
+-                          "(IPV6_V6ONLY)",
+-                          server->bind_addr);
+-            apr_socket_close(s);
+-            return stat;
+-        }
+-    }
+-#endif
+-
+     /*
+      * To send data over high bandwidth-delay connections at full
+      * speed we must force the TCP window to open wide enough to keep the
+@@ -169,21 +162,37 @@ static apr_status_t make_sock(apr_pool_t *p, ap_listen_rec *server)
+     }
+ #endif
+ 
+-    if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
+-                      "make_sock: could not bind to address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
+-    }
+    if (do_bind_listen) {
+#if APR_HAVE_IPV6
+        if (server->bind_addr->family == APR_INET6) {
+            stat = apr_socket_opt_set(s, APR_IPV6_V6ONLY, v6only_setting);
+            if (stat != APR_SUCCESS && stat != APR_ENOTIMPL) {
+                ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(00069)
+                              "make_sock: for address %pI, apr_socket_opt_set: "
+                              "(IPV6_V6ONLY)",
+                              server->bind_addr);
+                apr_socket_close(s);
+                return stat;
+            }
+        }
+#endif
+ 
+-    if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
+-        ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
+-                      "make_sock: unable to listen for connections "
+-                      "on address %pI",
+-                      server->bind_addr);
+-        apr_socket_close(s);
+-        return stat;
+        if ((stat = apr_socket_bind(s, server->bind_addr)) != APR_SUCCESS) {
+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_CRIT, stat, p, APLOGNO(00072)
+                          "make_sock: could not bind to address %pI",
+                          server->bind_addr);
+            apr_socket_close(s);
+            return stat;
+        }
+
+        if ((stat = apr_socket_listen(s, ap_listenbacklog)) != APR_SUCCESS) {
+            ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_ERR, stat, p, APLOGNO(00073)
+                          "make_sock: unable to listen for connections "
+                          "on address %pI",
+                          server->bind_addr);
+            apr_socket_close(s);
+            return stat;
+        }
+     }
+ 
+ #ifdef WIN32
+@@ -315,6 +324,123 @@ static int find_listeners(ap_listen_rec **from, ap_listen_rec **to,
+     return found;
+ }
+ 
+#ifdef HAVE_SYSTEMD
+
+static int find_systemd_socket(process_rec * process, apr_port_t port) {
+    int fdcount, fd;
+    int sdc = sd_listen_fds(0);
+
+    if (sdc < 0) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02486)
+                      "find_systemd_socket: Error parsing enviroment, sd_listen_fds returned %d",
+                      sdc);
+        return -1;
+    }
+
+    if (sdc == 0) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, sdc, process->pool, APLOGNO(02487)
+                      "find_systemd_socket: At least one socket must be set.");
+        return -1;
+    }
+
+    fdcount = atoi(getenv("LISTEN_FDS"));
+    for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + fdcount; fd++) {
+        if (sd_is_socket_inet(fd, 0, 0, -1, port) > 0) {
+            return fd;
+        }
+    }
+
+    return -1;
+}
+
+static apr_status_t alloc_systemd_listener(process_rec * process,
+                                           int fd, const char *proto,
+                                           ap_listen_rec **out_rec)
+{
+    apr_status_t rv;
+    struct sockaddr sa;
+    socklen_t len = sizeof(struct sockaddr);
+    apr_os_sock_info_t si;
+    ap_listen_rec *rec;
+    *out_rec = NULL;
+
+    memset(&si, 0, sizeof(si));
+
+    rv = getsockname(fd, &sa, &len);
+
+    if (rv != 0) {
+        rv = apr_get_netos_error();
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02489)
+                      "getsockname on %d failed.", fd);
+        return rv;
+    }
+
+    si.os_sock = &fd;
+    si.family = sa.sa_family;
+    si.local = &sa;
+    si.type = SOCK_STREAM;
+    si.protocol = APR_PROTO_TCP;
+
+    rec = apr_palloc(process->pool, sizeof(ap_listen_rec));
+    rec->active = 0;
+    rec->next = 0;
+
+
+    rv = apr_os_sock_make(&rec->sd, &si, process->pool);
+    if (rv != APR_SUCCESS) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02490)
+                      "apr_os_sock_make on %d failed.", fd);
+        return rv;
+    }
+
+    rv = apr_socket_addr_get(&rec->bind_addr, APR_LOCAL, rec->sd);
+    if (rv != APR_SUCCESS) {
+        ap_log_perror(APLOG_MARK, APLOG_CRIT, rv, process->pool, APLOGNO(02491)
+                      "apr_socket_addr_get on %d failed.", fd);
+        return rv;
+    }
+
+    rec->protocol = apr_pstrdup(process->pool, proto);
+
+    *out_rec = rec;
+
+    return make_sock(process->pool, rec, 0);
+}
+
+static const char *set_systemd_listener(process_rec *process, apr_port_t port,
+                                        const char *proto)
+{
+    ap_listen_rec *last, *new;
+    apr_status_t rv;
+    int fd = find_systemd_socket(process, port);
+    if (fd < 0) {
+        return "Systemd socket activation is used, but this port is not "
+                "configured in systemd";
+    }
+
+    last = ap_listeners;
+    while (last && last->next) {
+        last = last->next;
+    }
+
+    rv = alloc_systemd_listener(process, fd, proto, &new);
+    if (rv != APR_SUCCESS) {
+        return "Failed to setup socket passed by systemd using socket activation";
+    }
+
+    if (last == NULL) {
+        ap_listeners = last = new;
+    }
+    else {
+        last->next = new;
+        last = new;
+    }
+
+    return NULL;
+}
+
+#endif /* HAVE_SYSTEMD */
+
+ static const char *alloc_listener(process_rec *process, const char *addr,
+                                   apr_port_t port, const char* proto,
+                                   void *slave)
+@@ -495,7 +621,7 @@ static int open_listeners(apr_pool_t *pool)
+                 }
+             }
+ #endif
+-            if (make_sock(pool, lr) == APR_SUCCESS) {
+            if (make_sock(pool, lr, 1) == APR_SUCCESS) {
+                 ++num_open;
+             }
+             else {
+@@ -607,8 +733,28 @@ AP_DECLARE(int) ap_setup_listeners(server_rec *s)
+         }
+     }
+ 
+-    if (open_listeners(s->process->pool)) {
+-        return 0;
+#ifdef HAVE_SYSTEMD
+    if (use_systemd) {
+        const char *userdata_key = "ap_open_systemd_listeners";
+        void *data;
+        /* clear the enviroment on our second run
+        * so that none of our future children get confused.
+        */
+        apr_pool_userdata_get(&data, userdata_key, s->process->pool);
+        if (!data) {
+            apr_pool_userdata_set((const void *)1, userdata_key,
+                                apr_pool_cleanup_null, s->process->pool);
+        }
+        else {
+            sd_listen_fds(1);
+        }
+    }
+    else
+#endif
+    {
+        if (open_listeners(s->process->pool)) {
+            return 0;
+        }
+     }
+ 
+     for (lr = ap_listeners; lr; lr = lr->next) {
+@@ -698,7 +844,7 @@ AP_DECLARE(apr_status_t) ap_duplicate_listeners(apr_pool_t *p, server_rec *s,
+                             duplr->bind_addr);
+                 return stat;
+             }
+-            make_sock(p, duplr);
+            make_sock(p, duplr, 1);
+ #if AP_NONBLOCK_WHEN_MULTI_LISTEN
+             use_nonblock = (ap_listeners && ap_listeners->next);
+             stat = apr_socket_opt_set(duplr->sd, APR_SO_NONBLOCK, use_nonblock);
+@@ -825,6 +971,11 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+     if (argc < 1 || argc > 2) {
+         return "Listen requires 1 or 2 arguments.";
+     }
+#ifdef HAVE_SYSTEMD
+    if (use_systemd == -1) {
+        use_systemd = sd_listen_fds(0) > 0;
+    }
+#endif
+ 
+     rv = apr_parse_addr_port(&host, &scope_id, &port, argv[0], cmd->pool);
+     if (rv != APR_SUCCESS) {
+@@ -856,6 +1007,12 @@ AP_DECLARE_NONSTD(const char *) ap_set_listener(cmd_parms *cmd, void *dummy,
+         ap_str_tolower(proto);
+     }
+ 
+#ifdef HAVE_SYSTEMD
+    if (use_systemd) {
+        return set_systemd_listener(cmd->server->process, port, proto);
+    }
+#endif
+
+     return alloc_listener(cmd->server->process, host, port, proto, NULL);
+ }
+ 
--- a/httpd-2.4.2-icons.patch
+++ b/httpd-2.4.2-icons.patch
@ -0,0 +1,26 @@
+
+- Fix config for /icons/ dir to allow symlink to poweredby.png.
+- Avoid using coredump GIF for a directory called "core"
+
+Upstream-Status: vendor specific patch
+
+--- httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in.icons
+++ httpd-2.4.2/docs/conf/extra/httpd-autoindex.conf.in
+@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable Ver
+ Alias /icons/ "@exp_iconsdir@/"
+ 
+ <Directory "@exp_iconsdir@">
+-    Options Indexes MultiViews
+    Options Indexes MultiViews FollowSymlinks
+     AllowOverride None
+     Require all granted
+ </Directory>
+@@ -53,7 +53,7 @@ AddIcon /icons/dvi.gif .dvi
+ AddIcon /icons/uuencoded.gif .uu
+ AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+ AddIcon /icons/tex.gif .tex
+-AddIcon /icons/bomb.gif core
+AddIcon /icons/bomb.gif core.
+ 
+ AddIcon /icons/back.gif ..
+ AddIcon /icons/hand.right.gif README
--- a/httpd-2.4.25-detect-systemd.patch
+++ b/httpd-2.4.25-detect-systemd.patch
@ -0,0 +1,75 @@
+diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
+diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
+diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
+--- httpd-2.4.25/acinclude.m4.detectsystemd
+++ httpd-2.4.25/acinclude.m4
+@@ -604,6 +604,30 @@
+   fi
+ ])
+ 
+AC_DEFUN(APACHE_CHECK_SYSTEMD, [                                                                        
+dnl Check for systemd support for listen.c's socket activation.
+case $host in
+*-linux-*)
+   if test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd; then
+      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
+   elif test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd-daemon; then
+      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd-daemon`
+   else
+      AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon")
+   fi
+   if test -n "$SYSTEMD_LIBS"; then
+      AC_CHECK_HEADERS(systemd/sd-daemon.h)
+      if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+        AC_MSG_WARN([Your system does not support systemd.])
+      else
+        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
+        AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
+      fi
+   fi
+   ;;
+esac
+])
+
+ dnl
+ dnl APACHE_EXPORT_ARGUMENTS
+ dnl Export (via APACHE_SUBST) the various path-related variables that
+diff -uap httpd-2.4.25/configure.in.detectsystemd httpd-2.4.25/configure.in
+--- httpd-2.4.25/configure.in.detectsystemd
+++ httpd-2.4.25/configure.in
+@@ -234,6 +234,7 @@
+   AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
+   APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
+  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
+ else
+   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+ fi
+@@ -504,6 +510,8 @@
+     AC_DEFINE(HAVE_GMTOFF, 1, [Define if struct tm has a tm_gmtoff field])
+ fi
+ 
+APACHE_CHECK_SYSTEMD
+
+ dnl ## Set up any appropriate OS-specific environment variables for apachectl
+ 
+ case $host in
+@@ -668,6 +676,7 @@
+ APACHE_SUBST(BUILTIN_LIBS)
+ APACHE_SUBST(SHLIBPATH_VAR)
+ APACHE_SUBST(OS_SPECIFIC_VARS)
+APACHE_SUBST(HTTPD_LIBS)
+ 
+ PRE_SHARED_CMDS='echo ""'
+ POST_SHARED_CMDS='echo ""'
+--- httpd-2.4.25/Makefile.in.detectsystemd
+++ httpd-2.4.25/Makefile.in
+@@ -4,7 +4,7 @@
+ 
+ PROGRAM_NAME         = $(progname)
+ PROGRAM_SOURCES      = modules.c
+-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+ PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
+ PROGRAM_DEPENDENCIES = \
+   server/libmain.la \
--- a/httpd-2.4.25-selinux.patch
+++ b/httpd-2.4.25-selinux.patch
@ -0,0 +1,61 @@
+
+Log the SELinux context at startup.
+
+Upstream-Status: unlikely to be any interest in this upstream
+
+--- httpd-2.4.1/configure.in.selinux
+++ httpd-2.4.1/configure.in
+@@ -458,6 +458,11 @@ fopen64
+ dnl confirm that a void pointer is large enough to store a long integer
+ APACHE_CHECK_VOID_PTR_LEN
+ 
+AC_CHECK_LIB(selinux, is_selinux_enabled, [
+   AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
+   APR_ADDTO(HTTPD_LIBS, [-lselinux])
+])
+
+ AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
+ [AC_TRY_RUN(#define _GNU_SOURCE
+ #include <unistd.h>
+--- httpd-2.4.1/server/core.c.selinux
+++ httpd-2.4.1/server/core.c
+@@ -58,6 +58,10 @@
+ #include <unistd.h>
+ #endif
+ 
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+#endif
+
+ /* LimitRequestBody handling */
+ #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
+ #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
+@@ -4452,6 +4456,28 @@ static int core_post_config(apr_pool_t *
+     }
+ #endif
+ 
+#ifdef HAVE_SELINUX
+    {
+        static int already_warned = 0;
+        int is_enabled = is_selinux_enabled() > 0;
+        
+        if (is_enabled && !already_warned) {
+            security_context_t con;
+            
+            if (getcon(&con) == 0) {
+                
+                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
+                             "SELinux policy enabled; "
+                             "httpd running as context %s", con);
+                
+                already_warned = 1;
+                
+                freecon(con);
+            }
+        }
+    }
+#endif
+
+     return OK;
+ }
+ 
--- a/httpd-2.4.3-apctl-systemd.patch
+++ b/httpd-2.4.3-apctl-systemd.patch
@ -0,0 +1,51 @@
+
+Make apachectl run via systemctl.
+
+Note: "apachectl graceful" is documented to start httpd if not running.
+
+Upstream-Status: vendor specific patch
+
+--- httpd-2.4.18/support/apachectl.in.apctlsystemd
+++ httpd-2.4.18/support/apachectl.in
+@@ -100,9 +100,28 @@ fi
+ ERROR=$?
+ }
+ 
+if [ "x$2" != "x" ] ; then
+    echo Passing arguments to httpd using apachectl is no longer supported.
+    echo You can only start/stop/restart httpd using this script.
+    echo If you want to pass extra arguments to httpd, edit the
+    echo /etc/sysconfig/httpd config file.
+fi
+
+ case $ACMD in
+-start|stop|restart|graceful|graceful-stop)
+-    $HTTPD $OPTIONS -k $ARGV
+start|stop|restart|status)
+    /usr/bin/systemctl $ACMD httpd.service
+    ERROR=$?
+    ;;
+graceful)
+    if /usr/bin/systemctl -q is-active httpd.service; then
+        /usr/bin/systemctl reload httpd.service
+    else
+        /usr/bin/systemctl start httpd.service
+    fi
+    ERROR=$?
+    ;;
+graceful-stop)
+    /usr/bin/systemctl stop httpd.service
+     ERROR=$?
+     ;;
+ startssl|sslstart|start-SSL)
+@@ -114,10 +133,6 @@ startssl|sslstart|start-SSL)
+ configtest)
+     testconfig
+     ;;
+-status)
+-    checklynx
+-    $LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
+-    ;;
+ fullstatus)
+     checklynx
+     $LYNX $STATUSURL
--- a/httpd-2.4.33-export.patch
+++ b/httpd-2.4.33-export.patch
@ -0,0 +1,20 @@
+
+There is no need to "suck in" the apr/apr-util symbols when using
+a shared libapr{,util}, it just bloats the symbol table; so don't.
+
+Upstream-HEAD: needed
+Upstream-2.0: omit
+Upstream-Status: EXPORT_DIRS change is conditional on using shared apr
+
+--- httpd-2.4.33/server/Makefile.in.export
+++ httpd-2.4.33/server/Makefile.in
+@@ -60,9 +60,6 @@
+ 	      ls $$dir/*.h ; \
+ 	  done; \
+ 	  echo "$(top_srcdir)/server/mpm_fdqueue.h"; \
+-	  for dir in $(EXPORT_DIRS_APR); do \
+-	      ls $$dir/ap[ru].h $$dir/ap[ru]_*.h 2>/dev/null; \
+-	  done; \
+ 	) | sed -e s,//,/,g | sort -u > $@
+ 
+ exports.c: export_files
--- a/httpd-2.4.33-mddefault.patch
+++ b/httpd-2.4.33-mddefault.patch
@ -0,0 +1,21 @@
+
+Override default.
+
+--- httpd-2.4.33/modules/md/mod_md_config.c.mddefault
+++ httpd-2.4.33/modules/md/mod_md_config.c
+@@ -54,10 +54,14 @@
+ 
+ #define DEF_VAL     (-1)
+ 
+#ifndef MD_DEFAULT_STORE_DIR
+#define MD_DEFAULT_STORE_DIR "state/md"
+#endif
+
+ /* Default settings for the global conf */
+ static md_mod_conf_t defmc = {
+     NULL,
+-    "md",
+    MD_DEFAULT_STORE_DIR,
+     NULL,
+     NULL,
+     80,
--- a/httpd-2.4.33-sslmultiproxy.patch
+++ b/httpd-2.4.33-sslmultiproxy.patch
@ -0,0 +1,126 @@
+From ce2d1d7d4b2bebe34cf37fdeb30d35050092c5b5 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcrit@cow.greyoak.com>
+Date: Thu, 12 Apr 2018 14:36:28 -0400
+Subject: [PATCH] httpd-2.4.18-sslmultiproxy.patch
+
+---
+ modules/ssl/mod_ssl.c         | 24 ++++++++++++++++++++++--
+ modules/ssl/ssl_engine_vars.c | 18 +++++++++++++++++-
+ 2 files changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
+index 48d64cb..42e85a3 100644
+diff -uap httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy httpd-2.4.33/modules/ssl/mod_ssl.c
+--- httpd-2.4.33/modules/ssl/mod_ssl.c.sslmultiproxy
+++ httpd-2.4.33/modules/ssl/mod_ssl.c
+@@ -444,12 +444,19 @@
+     return OK;
+ }
+ 
+static APR_OPTIONAL_FN_TYPE(ssl_engine_disable) *othermod_engine_disable;
+static APR_OPTIONAL_FN_TYPE(ssl_engine_set) *othermod_engine_set;
+
+ static SSLConnRec *ssl_init_connection_ctx(conn_rec *c,
+                                            ap_conf_vector_t *per_dir_config)
+ {
+     SSLConnRec *sslconn = myConnConfig(c);
+     SSLSrvConfigRec *sc;
+ 
+    if (othermod_engine_disable) {
+        othermod_engine_disable(c);
+    }
+
+     if (sslconn) {
+         return sslconn;
+     }
+@@ -508,6 +515,10 @@
+ {
+     SSLConnRec *sslconn;
+     int status;
+
+    if (othermod_engine_set) {
+        return othermod_engine_set(c, per_dir_config, proxy, enable);
+    }
+     
+     if (proxy) {
+         sslconn = ssl_init_connection_ctx(c, per_dir_config);
+@@ -537,12 +548,18 @@
+ 
+ static int ssl_proxy_enable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 1, 1);
+    if (othermod_engine_set)
+        return othermod_engine_set(c, NULL, 1, 1);
+    else
+        return ssl_engine_set(c, NULL, 1, 1);
+ }
+ 
+ static int ssl_engine_disable(conn_rec *c)
+ {
+-    return ssl_engine_set(c, NULL, 0, 0);
+    if (othermod_engine_set)
+        return othermod_engine_set(c, NULL, 0, 0);
+    else
+        return ssl_engine_set(c, NULL, 0, 0);
+ }
+ 
+ int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
+@@ -730,6 +747,9 @@
+                       APR_HOOK_MIDDLE);
+ 
+     ssl_var_register(p);
+    
+    othermod_engine_disable = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_disable);
+    othermod_engine_set = APR_RETRIEVE_OPTIONAL_FN(ssl_engine_set);
+ 
+     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
+     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+diff -uap httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy httpd-2.4.33/modules/ssl/ssl_engine_vars.c
+--- httpd-2.4.33/modules/ssl/ssl_engine_vars.c.sslmultiproxy
+++ httpd-2.4.33/modules/ssl/ssl_engine_vars.c
+@@ -54,6 +54,8 @@
+ static void  ssl_var_lookup_ssl_cipher_bits(SSL *ssl, int *usekeysize, int *algkeysize);
+ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var);
+ static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl);
+static APR_OPTIONAL_FN_TYPE(ssl_is_https) *othermod_is_https;
+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *othermod_var_lookup;
+ 
+ static SSLConnRec *ssl_get_effective_config(conn_rec *c)
+ {
+@@ -68,7 +70,9 @@
+ static int ssl_is_https(conn_rec *c)
+ {
+     SSLConnRec *sslconn = ssl_get_effective_config(c);
+-    return sslconn && sslconn->ssl;
+
+    return (sslconn && sslconn->ssl)
+        || (othermod_is_https && othermod_is_https(c));
+ }
+ 
+ static const char var_interface[] = "mod_ssl/" AP_SERVER_BASEREVISION;
+@@ -137,6 +141,9 @@
+ {
+     char *cp, *cp2;
+ 
+    othermod_is_https = APR_RETRIEVE_OPTIONAL_FN(ssl_is_https);
+    othermod_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
+
+     APR_REGISTER_OPTIONAL_FN(ssl_is_https);
+     APR_REGISTER_OPTIONAL_FN(ssl_var_lookup);
+     APR_REGISTER_OPTIONAL_FN(ssl_ext_list);
+@@ -271,6 +278,15 @@
+      */
+     if (result == NULL && c != NULL) {
+         SSLConnRec *sslconn = ssl_get_effective_config(c);
+
+        if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+            && (!sslconn || !sslconn->ssl) && othermod_var_lookup) {
+            /* For an SSL_* variable, if mod_ssl is not enabled for
+             * this connection and another SSL module is present, pass
+             * through to that module. */
+            return othermod_var_lookup(p, s, c, r, var);
+        }
+
+         if (strlen(var) > 4 && strcEQn(var, "SSL_", 4)
+             && sslconn && sslconn->ssl)
+             result = ssl_var_lookup_ssl(p, sslconn, r, var+4);
--- a/httpd-2.4.33-systemd.patch
+++ b/httpd-2.4.33-systemd.patch
@ -0,0 +1,245 @@
+--- httpd-2.4.33/modules/arch/unix/config5.m4.systemd
+++ httpd-2.4.33/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
+   fi
+ ])
+ 
+APACHE_MODULE(systemd, Systemd support, , , all, [
+  if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
+    AC_MSG_WARN([Your system does not support systemd.])
+    enable_systemd="no"
+  else
+    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
+    enable_systemd="yes"
+  fi
+])
+
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
+ APACHE_MODPATH_FINISH
+--- httpd-2.4.33/modules/arch/unix/mod_systemd.c.systemd
+++ httpd-2.4.33/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,223 @@
+/* Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ */
+
+#include <stdint.h>
+#include <ap_config.h>
+#include "ap_mpm.h"
+#include <http_core.h>
+#include <httpd.h>
+#include <http_log.h>
+#include <apr_version.h>
+#include <apr_pools.h>
+#include <apr_strings.h>
+#include "unixd.h"
+#include "scoreboard.h"
+#include "mpm_common.h"
+
+#include "systemd/sd-daemon.h"
+#include "systemd/sd-journal.h"
+
+#if APR_HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+static int shutdown_timer = 0;
+static int shutdown_counter = 0;
+static unsigned long bytes_served;
+static pid_t mainpid;
+static char describe_listeners[50];
+
+static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+                              apr_pool_t *ptemp)
+{
+    sd_notify(0,
+              "RELOADING=1\n"
+              "STATUS=Reading configuration...\n");
+    ap_extended_status = 1;
+    return OK;
+}
+
+static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
+{
+    apr_sockaddr_t *sa = lr->bind_addr;
+    char addr[128];
+
+    if (apr_sockaddr_is_wildcard(sa)) {
+        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
+    }
+
+    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
+
+    return apr_psprintf(p, "%s port %u", addr, sa->port);
+}
+
+static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
+                               apr_pool_t *ptemp, server_rec *s)
+{
+    ap_listen_rec *lr;
+    apr_size_t plen = sizeof describe_listeners;
+    char *p = describe_listeners;
+
+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
+        return OK;
+
+    for (lr = ap_listeners; lr; lr = lr->next) {
+        char *s = dump_listener(lr, ptemp);
+
+        if (strlen(s) + 3 < plen) {
+            char *newp = apr_cpystrn(p, s, plen);
+            if (lr->next)
+                newp = apr_cpystrn(newp, ", ", 3);
+            plen -= newp - p;
+            p = newp;
+        }
+        else {
+            if (plen < 4) {
+                p = describe_listeners + sizeof describe_listeners - 4;
+                plen = 4;
+            }
+            apr_cpystrn(p, "...", plen);
+            break;
+        }
+    }
+
+    sd_journal_print(LOG_INFO, "Server configured, listening on: %s", describe_listeners);
+
+    return OK;
+}
+
+static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
+{
+    int rv;
+
+    mainpid = getpid();
+
+    rv = sd_notifyf(0, "READY=1\n"
+                    "STATUS=Started, listening on: %s\n"
+                    "MAINPID=%" APR_PID_T_FMT,
+                    describe_listeners, mainpid);
+    if (rv < 0) {
+        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
+                     "sd_notifyf returned an error %d", rv);
+    }
+
+    return OK;
+}
+
+static int systemd_monitor(apr_pool_t *p, server_rec *s)
+{
+    ap_sload_t sload;
+    apr_interval_time_t up_time;
+    char bps[5];
+    int rv;
+
+    if (!ap_extended_status) {
+        /* Nothing useful to report if ExtendedStatus disabled. */
+        return DECLINED;
+    }
+    
+    ap_get_sload(&sload);
+
+    if (sload.access_count == 0) {
+        rv = sd_notifyf(0, "READY=1\n"
+                        "STATUS=Running, listening on: %s\n",
+                        describe_listeners);
+    }
+    else {
+        /* up_time in seconds */
+        up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
+                                              ap_scoreboard_image->global->restart_time);
+
+        apr_strfsize((unsigned long)((float) (sload.bytes_served)
+                                     / (float) up_time), bps);
+
+        rv = sd_notifyf(0, "READY=1\n"
+                        "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
+                        "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
+                        sload.access_count, sload.idle, sload.busy,
+                        ((float) sload.access_count) / (float) up_time, bps);
+    }
+
+    if (rv < 0) {
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
+                     "sd_notifyf returned an error %d", rv);
+    }
+
+    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
+    if (sload.bytes_served == bytes_served) {
+        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
+        shutdown_counter += 10;
+        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
+            rv = sd_notifyf(0, "READY=1\n"
+                            "STATUS=Stopped as result of IdleShutdown "
+                            "timeout.");
+            if (rv < 0) {
+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804)
+                            "sd_notifyf returned an error %d", rv);
+            }
+            kill(mainpid, AP_SIG_GRACEFUL);
+        }
+    }
+    else {
+        shutdown_counter = 0;
+    }
+
+    bytes_served = sload.bytes_served;
+
+    return DECLINED;
+}
+
+static void systemd_register_hooks(apr_pool_t *p)
+{
+    /* Enable ap_extended_status. */
+    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
+    /* Grab the listener config. */
+    ap_hook_post_config(systemd_post_config, NULL, NULL, APR_HOOK_LAST);
+    /* We know the PID in this hook ... */
+    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
+    /* Used to update httpd's status line using sd_notifyf */
+    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy,
+                                      const char *arg)
+{
+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
+    if (err != NULL) {
+        return err;
+    }
+
+    shutdown_timer = atoi(arg);
+    return NULL;
+}
+
+static const command_rec systemd_cmds[] =
+{
+AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF,
+     "Number of seconds in idle-state after which httpd is shutdown"),
+    {NULL}
+};
+
+AP_DECLARE_MODULE(systemd) = {
+    STANDARD20_MODULE_STUFF,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    systemd_cmds,
+    systemd_register_hooks,
+};
--- a/httpd-2.4.34-r1555631.patch
+++ b/httpd-2.4.34-r1555631.patch
@ -0,0 +1,14 @@
+# ./pullrev.sh 1555631
+http://svn.apache.org/viewvc?view=revision&revision=1555631
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_ocsp.c
+++ httpd-2.4.34/modules/ssl/ssl_engine_ocsp.c
+@@ -61,7 +61,7 @@
+     /* Use default responder URL if forced by configuration, else use
+      * certificate-specified responder, falling back to default if
+      * necessary and possible. */
+-    if (sc->server->ocsp_force_default) {
+    if (sc->server->ocsp_force_default == TRUE) {
+         s = sc->server->ocsp_responder;
+     }
+     else {
--- a/httpd-2.4.34-r1738878.patch
+++ b/httpd-2.4.34-r1738878.patch
@ -0,0 +1,130 @@
+--- httpd-2.4.34/modules/proxy/ajp_header.c.r1738878
+++ httpd-2.4.34/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@
+ 
+ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+                                           request_rec *r,
+-                                          apr_uri_t *uri)
+                                          apr_uri_t *uri,
+                                          const char *secret)
+ {
+     int method;
+     apr_uint32_t i, num_headers = 0;
+@@ -293,17 +294,15 @@
+                    i, elts[i].key, elts[i].val);
+     }
+ 
+-/* XXXX need to figure out how to do this
+-    if (s->secret) {
+    if (secret) {
+         if (ajp_msg_append_uint8(msg, SC_A_SECRET) ||
+-            ajp_msg_append_string(msg, s->secret)) {
+            ajp_msg_append_string(msg, secret)) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(03228)
+-                   "Error ajp_marshal_into_msgb - "
+                   "ajp_marshal_into_msgb: "
+                    "Error appending secret");
+             return APR_EGENERAL;
+         }
+     }
+- */
+ 
+     if (r->user) {
+         if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
+@@ -671,7 +670,8 @@
+ apr_status_t ajp_send_header(apr_socket_t *sock,
+                              request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri)
+                             apr_uri_t *uri,
+                             const char *secret)
+ {
+     ajp_msg_t *msg;
+     apr_status_t rc;
+@@ -683,7 +683,7 @@
+         return rc;
+     }
+ 
+-    rc = ajp_marshal_into_msgb(msg, r, uri);
+    rc = ajp_marshal_into_msgb(msg, r, uri, secret);
+     if (rc != APR_SUCCESS) {
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
+                "ajp_send_header: ajp_marshal_into_msgb failed");
+--- httpd-2.4.34/modules/proxy/ajp.h.r1738878
+++ httpd-2.4.34/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
+ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
+                             apr_uri_t *uri,
+                             const char *secret);
+ 
+ /**
+  * Read the ajp message and return the type of the message.
+--- httpd-2.4.34/modules/proxy/mod_proxy_ajp.c.r1738878
+++ httpd-2.4.34/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@
+     apr_off_t content_length = 0;
+     int original_status = r->status;
+     const char *original_status_line = r->status_line;
+    const char *secret = NULL;
+ 
+     if (psf->io_buffer_size_set)
+        maxsize = psf->io_buffer_size;
+@@ -202,12 +203,15 @@
+        maxsize = AJP_MSG_BUFFER_SZ;
+     maxsize = APR_ALIGN(maxsize, 1024);
+ 
+    if (*conn->worker->s->secret)
+        secret = conn->worker->s->secret;
+
+     /*
+      * Send the AJP request to the remote server
+      */
+ 
+     /* send request headers */
+-    status = ajp_send_header(conn->sock, r, maxsize, uri);
+    status = ajp_send_header(conn->sock, r, maxsize, uri, secret);
+     if (status != APR_SUCCESS) {
+         conn->close = 1;
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+--- httpd-2.4.34/modules/proxy/mod_proxy.c.r1738878
+++ httpd-2.4.34/modules/proxy/mod_proxy.c
+@@ -319,6 +319,12 @@
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
+    else if (!strcasecmp(key, "secret")) {
+        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
+            return apr_psprintf(p, "Secret length must be < %d characters",
+                                (int)sizeof(worker->s->secret));
+        }
+    }
+     else if (!strcasecmp(key, "responsefieldsize")) {
+         long s = atol(val);
+         if (s < 0) {
+--- httpd-2.4.34/modules/proxy/mod_proxy.h.r1738878
+++ httpd-2.4.34/modules/proxy/mod_proxy.h
+@@ -357,6 +357,7 @@
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
+#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ #define PROXY_RFC1035_HOSTNAME_SIZE	256
+ 
+@@ -453,6 +454,7 @@
+     char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
+     apr_size_t   response_field_size; /* Size of proxy response buffer in bytes. */
+     unsigned int response_field_size_set:1;
+    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
--- a/httpd-2.4.34-sslciphdefault.patch
+++ b/httpd-2.4.34-sslciphdefault.patch
@ -1,8 +1,11 @@
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 97778a8..27e7a53 100644
--- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -778,9 +778,11 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1109119
+
+Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
+
+--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault
+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
+@@ -774,9 +774,11 @@
     }
     
     if (!strcmp("SSL", arg1)) {
@ -16,7 +19,7 @@ index 97778a8..27e7a53 100644
             dc->szCipherSuite = arg2;
         }
         else {
-@@ -1544,8 +1546,10 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
+@@ -1540,8 +1542,10 @@
     }
     
     if (!strcmp("SSL", arg1)) {
--- a/httpd-2.4.37-r1857129.patch
+++ b/httpd-2.4.37-r1857129.patch
@ -0,0 +1,65 @@
+# ./pullrev.sh 1857129
+http://svn.apache.org/viewvc?view=revision&revision=1857129
+
+--- httpd-2.4.37/modules/filters/mod_reqtimeout.c
+++ httpd-2.4.37/modules/filters/mod_reqtimeout.c
+@@ -31,7 +31,7 @@
+ #define UNSET                            -1
+ #define MRT_DEFAULT_handshake_TIMEOUT     0 /* disabled */
+ #define MRT_DEFAULT_handshake_MAX_TIMEOUT 0
+-#define MRT_DEFAULT_handshake_MIN_RATE    APR_INT32_MAX
+#define MRT_DEFAULT_handshake_MIN_RATE    0
+ #define MRT_DEFAULT_header_TIMEOUT       20
+ #define MRT_DEFAULT_header_MAX_TIMEOUT   40
+ #define MRT_DEFAULT_header_MIN_RATE      500
+@@ -220,7 +220,7 @@
+     if (block == APR_NONBLOCK_READ || mode == AP_MODE_INIT
+         || mode == AP_MODE_EATCRLF) {
+         rv = ap_get_brigade(f->next, bb, mode, block, readbytes);
+-        if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS) {
+        if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS) {
+             extend_timeout(ccfg, bb);
+         }
+         return rv;
+@@ -254,7 +254,7 @@
+             }
+ 
+             if (!APR_BRIGADE_EMPTY(bb)) {
+-                if (ccfg->cur_stage.rate_factor > 0) {
+                if (ccfg->cur_stage.rate_factor) {
+                     extend_timeout(ccfg, bb);
+                 }
+ 
+@@ -315,7 +315,7 @@
+          * the real (relevant) bytes to be asked later, within the
+          * currently alloted time.
+          */
+-        if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS
+        if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS
+                 && mode != AP_MODE_SPECULATIVE) {
+             extend_timeout(ccfg, bb);
+         }
+@@ -638,17 +638,17 @@
+     ap_hook_post_read_request(reqtimeout_before_body, NULL, NULL,
+                               APR_HOOK_MIDDLE);
+ 
+-#if MRT_DEFAULT_HANDSHAKE_MIN_RATE > 0
+#if MRT_DEFAULT_handshake_MIN_RATE
+     default_handshake_rate_factor = apr_time_from_sec(1) /
+-                                    MRT_DEFAULT_HANDSHAKE_MIN_RATE;
+                                    MRT_DEFAULT_handshake_MIN_RATE;
+ #endif
+-#if MRT_DEFAULT_HEADER_MIN_RATE > 0
+#if MRT_DEFAULT_header_MIN_RATE
+     default_header_rate_factor = apr_time_from_sec(1) /
+-                                 MRT_DEFAULT_HEADER_MIN_RATE;
+                                 MRT_DEFAULT_header_MIN_RATE;
+ #endif
+-#if MRT_DEFAULT_BODY_MIN_RATE > 0
+#if MRT_DEFAULT_body_MIN_RATE
+     default_body_rate_factor = apr_time_from_sec(1) /
+-                               MRT_DEFAULT_BODY_MIN_RATE;
+                               MRT_DEFAULT_body_MIN_RATE;
+ #endif
+ }
+ 
--- a/httpd-2.4.37-sslprotdefault.patch
+++ b/httpd-2.4.37-sslprotdefault.patch
@ -1,8 +1,8 @@
 diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 8fae1f8..c5dce7f 100644
+index 55c237e..5467d23 100644
 --- a/modules/ssl/ssl_engine_config.c
 +++ b/modules/ssl/ssl_engine_config.c
-@@ -127,7 +127,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
+@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
     mctx->ticket_key          = NULL;
 #endif
 
@ -11,27 +11,27 @@ index 8fae1f8..c5dce7f 100644
     mctx->protocol_set        = 0;
 
     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
-@@ -268,6 +268,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
+ {
     if (add->protocol_set) {
-         mrg->protocol_set = 1;
         mrg->protocol = add->protocol;
 +        mrg->protocol_set = 1;
     }
     else {
-         mrg->protocol_set = base->protocol_set;
+         mrg->protocol = base->protocol;
 diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 4e265b3..2fbd076 100644
+index e3f62fe..31fc0e6 100644
 --- a/modules/ssl/ssl_engine_init.c
 +++ b/modules/ssl/ssl_engine_init.c
-@@ -638,6 +638,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
     MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
     char *cp;
     int protocol = mctx->protocol;
 +    int protocol_set = mctx->protocol_set;
     SSLSrvConfigRec *sc = mySrvConfig(s);
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-     /* default is highest supported version, will be overridden below */
-@@ -652,12 +653,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+     int prot;
+@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
      *  Create the new per-server SSL context
      */
     if (protocol == SSL_PROTOCOL_NONE) {
@ -55,7 +55,7 @@ index 4e265b3..2fbd076 100644
 #ifndef OPENSSL_NO_SSL3
                      (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
 #endif
-@@ -670,7 +677,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
 #endif
 #endif
                      NULL);
@ -65,7 +65,7 @@ index 4e265b3..2fbd076 100644
 
     ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
                  "Creating new SSL context (protocols: %s)", cp);
-@@ -776,13 +784,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
         prot = SSL3_VERSION;
 #endif
     } else {
@ -87,7 +87,7 @@ index 4e265b3..2fbd076 100644
 
     /* Next we scan for the minimal protocol version we should provide,
      * but we do not allow holes between max and min */
-@@ -806,7 +816,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
+@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
         prot = SSL3_VERSION;
     }
 #endif
--- a/httpd-2.4.38-r1830819+.patch
+++ b/httpd-2.4.38-r1830819+.patch
@ -0,0 +1,677 @@
+# ./pullrev.sh 1830819 1830836 1830912 1830913 1830927 1831168 1831173
+
+http://svn.apache.org/viewvc?view=revision&revision=1830819
+http://svn.apache.org/viewvc?view=revision&revision=1830912
+http://svn.apache.org/viewvc?view=revision&revision=1830913
+http://svn.apache.org/viewvc?view=revision&revision=1830927
+http://svn.apache.org/viewvc?view=revision&revision=1831168
+http://svn.apache.org/viewvc?view=revision&revision=1831173
+http://svn.apache.org/viewvc?view=revision&revision=1835240
+http://svn.apache.org/viewvc?view=revision&revision=1835242
+
+diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
+index d276fea..5467d23 100644
+--- httpd-2.4.38/modules/ssl/ssl_engine_config.c.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_engine_config.c
+@@ -916,7 +916,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
+    /* Only check for non-ENGINE based certs. */
+    if (!modssl_is_engine_id(arg)
+        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+@@ -932,7 +934,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     const char *err;
+ 
+-    if ((err = ssl_cmd_check_file(cmd, &arg))) {
+    /* Check keyfile exists for non-ENGINE keys. */
+    if (!modssl_is_engine_id(arg)
+        && (err = ssl_cmd_check_file(cmd, &arg))) {
+         return err;
+     }
+ 
+--- httpd-2.4.38/modules/ssl/ssl_engine_init.c.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_engine_init.c
+@@ -1228,12 +1228,18 @@
+                 (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i,
+                                           const char *));
+          i++) {
+        EVP_PKEY *pkey;
+        const char *engine_certfile = NULL;
+
+         key_id = apr_psprintf(ptemp, "%s:%d", vhost_id, i);
+ 
+         ERR_clear_error();
+ 
+         /* first the certificate (public key) */
+-        if (mctx->cert_chain) {
+        if (modssl_is_engine_id(certfile)) {
+            engine_certfile = certfile;
+        }
+        else if (mctx->cert_chain) {
+             if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile,
+                                               SSL_FILETYPE_PEM) < 1)) {
+                 ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561)
+@@ -1262,12 +1268,46 @@
+ 
+         ERR_clear_error();
+ 
+-        if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+-                                         SSL_FILETYPE_PEM) < 1) &&
+-            (ERR_GET_FUNC(ERR_peek_last_error())
+-                != X509_F_X509_CHECK_PRIVATE_KEY)) {
+        if (modssl_is_engine_id(keyfile)) {
+            apr_status_t rv;
+
+            cert = NULL;
+            
+            if ((rv = modssl_load_engine_keypair(s, ptemp, vhost_id,
+                                                 engine_certfile, keyfile,
+                                                 &cert, &pkey))) {
+                return rv;
+            }
+
+            if (cert) {
+                if (SSL_CTX_use_certificate(mctx->ssl_ctx, cert) < 1) {
+                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10137)
+                                 "Failed to configure engine certificate %s, check %s",
+                                 key_id, certfile);
+                    ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+                    return APR_EGENERAL;
+                }
+
+                /* SSL_CTX now owns the cert. */
+                X509_free(cert);
+            }                    
+            
+            if (SSL_CTX_use_PrivateKey(mctx->ssl_ctx, pkey) < 1) {
+                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10130)
+                             "Failed to configure private key %s from engine",
+                             keyfile);
+                ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+                return APR_EGENERAL;
+            }
+
+            /* SSL_CTX now owns the key */
+            EVP_PKEY_free(pkey);
+        }
+        else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
+                                              SSL_FILETYPE_PEM) < 1)
+                 && (ERR_GET_FUNC(ERR_peek_last_error())
+                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
+             ssl_asn1_t *asn1;
+-            EVP_PKEY *pkey;
+             const unsigned char *ptr;
+ 
+             ERR_clear_error();
+@@ -1354,8 +1394,9 @@
+     /*
+      * Try to read DH parameters from the (first) SSLCertificateFile
+      */
+-    if ((certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *)) &&
+-        (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+    certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
+    if (certfile && !modssl_is_engine_id(certfile)
+        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
+         SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
+                      "Custom DH parameters (%d bits) for %s loaded from %s",
+@@ -1367,10 +1408,10 @@
+     /*
+      * Similarly, try to read the ECDH curve name from SSLCertificateFile...
+      */
+-    if ((certfile != NULL) && 
+-        (ecparams = ssl_ec_GetParamFromFile(certfile)) &&
+-        (nid = EC_GROUP_get_curve_name(ecparams)) &&
+-        (eckey = EC_KEY_new_by_curve_name(nid))) {
+    if (certfile && !modssl_is_engine_id(certfile)
+        && (ecparams = ssl_ec_GetParamFromFile(certfile))
+        && (nid = EC_GROUP_get_curve_name(ecparams)) 
+        && (eckey = EC_KEY_new_by_curve_name(nid))) {
+         SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
+                      "ECDH curve %s for %s specified in %s",
+--- httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c
+@@ -143,8 +143,6 @@
+     const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx);
+     EVP_PKEY *pPrivateKey = NULL;
+     ssl_asn1_t *asn1;
+-    unsigned char *ucp;
+-    long int length;
+     int nPassPhrase = (*pphrases)->nelts;
+     int nPassPhraseRetry = 0;
+     apr_time_t pkey_mtime = 0;
+@@ -221,7 +219,7 @@
+          * is not empty. */
+         ERR_clear_error();
+ 
+-        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, NULL,
+        pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file,
+                                              ssl_pphrase_Handle_CB, &ppcb_arg);
+         /* If the private key was successfully read, nothing more to
+            do here. */
+@@ -351,19 +349,12 @@
+         nPassPhrase++;
+     }
+ 
+-    /*
+-     * Insert private key into the global module configuration
+-     * (we convert it to a stand-alone DER byte sequence
+-     * because the SSL library uses static variables inside a
+-     * RSA structure which do not survive DSO reloads!)
+-     */
+-    length = i2d_PrivateKey(pPrivateKey, NULL);
+-    ucp = ssl_asn1_table_set(mc->tPrivateKey, key_id, length);
+-    (void)i2d_PrivateKey(pPrivateKey, &ucp); /* 2nd arg increments */
+    /* Cache the private key in the global module configuration so it
+     * can be used after subsequent reloads. */
+    asn1 = ssl_asn1_table_set(mc->tPrivateKey, key_id, pPrivateKey);
+ 
+     if (ppcb_arg.nPassPhraseDialogCur != 0) {
+         /* remember mtime of encrypted keys */
+-        asn1 = ssl_asn1_table_get(mc->tPrivateKey, key_id);
+         asn1->source_mtime = pkey_mtime;
+     }
+ 
+@@ -614,3 +605,288 @@
+      */
+     return (len);
+ }
+
+
+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+
+/* OpenSSL UI implementation for passphrase entry; largely duplicated
+ * from ssl_pphrase_Handle_CB but adjusted for UI API. TODO: Might be
+ * worth trying to shift pphrase handling over to the UI API
+ * completely. */
+static int passphrase_ui_open(UI *ui)
+{
+    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
+    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
+
+    ppcb->nPassPhraseDialog++;
+    ppcb->nPassPhraseDialogCur++;
+
+    /*
+     * Builtin or Pipe dialog
+     */
+    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
+        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
+        if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
+            if (!readtty) {
+                ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s,
+                             APLOGNO(10143)
+                             "Init: Creating pass phrase dialog pipe child "
+                             "'%s'", sc->server->pphrase_dialog_path);
+                if (ssl_pipe_child_create(ppcb->p,
+                            sc->server->pphrase_dialog_path)
+                        != APR_SUCCESS) {
+                    ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s,
+                                 APLOGNO(10144)
+                                 "Init: Failed to create pass phrase pipe '%s'",
+                                 sc->server->pphrase_dialog_path);
+                    return 0;
+                }
+            }
+            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10145)
+                         "Init: Requesting pass phrase via piped dialog");
+        }
+        else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
+#ifdef WIN32
+            ap_log_error(APLOG_MARK, APLOG_ERR, 0, ppcb->s, APLOGNO(10146)
+                         "Init: Failed to create pass phrase pipe '%s'",
+                         sc->server->pphrase_dialog_path);
+            return 0;
+#else
+            /*
+             * stderr has already been redirected to the error_log.
+             * rather than attempting to temporarily rehook it to the terminal,
+             * we print the prompt to stdout before EVP_read_pw_string turns
+             * off tty echo
+             */
+            apr_file_open_stdout(&writetty, ppcb->p);
+
+            ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10147)
+                         "Init: Requesting pass phrase via builtin terminal "
+                         "dialog");
+#endif
+        }
+
+        /*
+         * The first time display a header to inform the user about what
+         * program he actually speaks to, which module is responsible for
+         * this terminal dialog and why to the hell he has to enter
+         * something...
+         */
+        if (ppcb->nPassPhraseDialog == 1) {
+            apr_file_printf(writetty, "%s mod_ssl (Pass Phrase Dialog)\n",
+                            AP_SERVER_BASEVERSION);
+            apr_file_printf(writetty,
+                            "A pass phrase is required to access the private key.\n");
+        }
+        if (ppcb->bPassPhraseDialogOnce) {
+            ppcb->bPassPhraseDialogOnce = FALSE;
+            apr_file_printf(writetty, "\n");
+            apr_file_printf(writetty, "Private key %s (%s)\n",
+                            ppcb->key_id, ppcb->pkey_file);
+        }
+    }
+
+    return 1;
+}
+
+static int passphrase_ui_read(UI *ui, UI_STRING *uis)
+{
+    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
+    SSLSrvConfigRec *sc = mySrvConfig(ppcb->s);
+    const char *prompt;
+    int i;
+    int bufsize;
+    int len;
+    char *buf;
+
+    prompt = UI_get0_output_string(uis);
+    if (prompt == NULL) {
+        prompt = "Enter pass phrase:";
+    }
+
+    /*
+     * Get the maximum expected size and allocate the buffer
+     */
+    bufsize = UI_get_result_maxsize(uis);
+    buf = apr_pcalloc(ppcb->p, bufsize);
+
+    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
+        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
+        /*
+         * Get the pass phrase through a callback.
+         * Empty input is not accepted.
+         */
+        for (;;) {
+            if (sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
+                i = pipe_get_passwd_cb(buf, bufsize, "", FALSE);
+            }
+            else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
+                i = EVP_read_pw_string(buf, bufsize, "", FALSE);
+            }
+            if (i != 0) {
+                OPENSSL_cleanse(buf, bufsize);
+                return 0;
+            }
+            len = strlen(buf);
+            if (len < 1){
+                apr_file_printf(writetty, "Apache:mod_ssl:Error: Pass phrase"
+                                "empty (needs to be at least 1 character).\n");
+                apr_file_puts(prompt, writetty);
+            }
+            else {
+                break;
+            }
+        }
+    }
+    /*
+     * Filter program
+     */
+    else if (sc->server->pphrase_dialog_type == SSL_PPTYPE_FILTER) {
+        const char *cmd = sc->server->pphrase_dialog_path;
+        const char **argv = apr_palloc(ppcb->p, sizeof(char *) * 3);
+        char *result;
+
+        ap_log_error(APLOG_MARK, APLOG_INFO, 0, ppcb->s, APLOGNO(10148)
+                     "Init: Requesting pass phrase from dialog filter "
+                     "program (%s)", cmd);
+
+        argv[0] = cmd;
+        argv[1] = ppcb->key_id;
+        argv[2] = NULL;
+
+        result = ssl_util_readfilter(ppcb->s, ppcb->p, cmd, argv);
+        apr_cpystrn(buf, result, bufsize);
+        len = strlen(buf);
+    }
+
+    /*
+     * Ok, we now have the pass phrase, so give it back
+     */
+    ppcb->cpPassPhraseCur = apr_pstrdup(ppcb->p, buf);
+    UI_set_result(ui, uis, buf);
+
+    /* Clear sensitive data. */
+    OPENSSL_cleanse(buf, bufsize);
+    return 1;
+}
+
+static int passphrase_ui_write(UI *ui, UI_STRING *uis)
+{
+    pphrase_cb_arg_t *ppcb = UI_get0_user_data(ui);
+    SSLSrvConfigRec *sc;
+    const char *prompt;
+
+    sc = mySrvConfig(ppcb->s);
+
+    if (sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN
+        || sc->server->pphrase_dialog_type == SSL_PPTYPE_PIPE) {
+        prompt = UI_get0_output_string(uis);
+        apr_file_puts(prompt, writetty);
+    }
+
+    return 1;
+}
+
+static int passphrase_ui_close(UI *ui)
+{
+    /*
+     * Close the pipes if they were opened
+     */
+    if (readtty) {
+        apr_file_close(readtty);
+        apr_file_close(writetty);
+        readtty = writetty = NULL;
+    }
+    return 1;
+}
+
+static apr_status_t pp_ui_method_cleanup(void *uip)
+{
+    UI_METHOD *uim = uip;
+    
+    UI_destroy_method(uim);
+
+    return APR_SUCCESS;
+}
+
+static UI_METHOD *get_passphrase_ui(apr_pool_t *p)
+{
+    UI_METHOD *ui_method = UI_create_method("Passphrase UI");
+
+    UI_method_set_opener(ui_method, passphrase_ui_open);
+    UI_method_set_reader(ui_method, passphrase_ui_read);
+    UI_method_set_writer(ui_method, passphrase_ui_write);
+    UI_method_set_closer(ui_method, passphrase_ui_close);
+
+    apr_pool_cleanup_register(p, ui_method, pp_ui_method_cleanup,
+                              pp_ui_method_cleanup);
+    
+    return ui_method;
+}
+
+
+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
+                                        const char *vhostid,
+                                        const char *certid, const char *keyid,
+                                        X509 **pubkey, EVP_PKEY **privkey)
+{
+    SSLModConfigRec *mc = myModConfig(s);
+    ENGINE *e;
+    UI_METHOD *ui_method = get_passphrase_ui(p);
+    pphrase_cb_arg_t ppcb;
+
+    memset(&ppcb, 0, sizeof ppcb);
+    ppcb.s = s;
+    ppcb.p = p;
+    ppcb.bPassPhraseDialogOnce = TRUE;
+    ppcb.key_id = vhostid;
+    ppcb.pkey_file = keyid;
+
+    if (!mc->szCryptoDevice) {
+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10131)
+                     "Init: Cannot load private key `%s' without engine",
+                     keyid);
+        return ssl_die(s);
+    }
+
+    if (!(e = ENGINE_by_id(mc->szCryptoDevice))) {
+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10132)
+                     "Init: Failed to load Crypto Device API `%s'",
+                     mc->szCryptoDevice);
+        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+        return ssl_die(s);
+    }
+
+    if (APLOGdebug(s)) {
+        ENGINE_ctrl_cmd_string(e, "VERBOSE", NULL, 0);
+    }
+
+    if (certid) {
+        struct {
+            const char *cert_id;
+            X509 *cert;
+        } params = { certid, NULL };
+
+        if (!ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &params, NULL, 1)) {
+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10136)
+                         "Init: Unable to get the certificate");
+            ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+            return ssl_die(s);
+        }
+
+        *pubkey = params.cert;
+    }
+
+    *privkey = ENGINE_load_private_key(e, keyid, ui_method, &ppcb);
+    if (*privkey == NULL) {
+        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10133)
+                     "Init: Unable to get the private key");
+        ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
+        return ssl_die(s);
+    }
+
+    ENGINE_free(e);
+
+    return APR_SUCCESS;
+}
+#endif
+--- httpd-2.4.38/modules/ssl/ssl_private.h.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_private.h
+@@ -1002,21 +1002,28 @@
+ apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int,
+                                      const char *, apr_array_header_t **);
+ 
+/* Load public and/or private key from the configured ENGINE. Private
+ * key returned as *pkey.  certid can be NULL, in which case *pubkey
+ * is not altered.  Errors logged on failure. */
+apr_status_t modssl_load_engine_keypair(server_rec *s, apr_pool_t *p,
+                                        const char *vhostid,
+                                        const char *certid, const char *keyid,
+                                        X509 **pubkey, EVP_PKEY **privkey);
+
+ /**  Diffie-Hellman Parameter Support  */
+ DH           *ssl_dh_GetParamFromFile(const char *);
+ #ifdef HAVE_ECC
+ EC_GROUP     *ssl_ec_GetParamFromFile(const char *);
+ #endif
+ 
+-unsigned char *ssl_asn1_table_set(apr_hash_t *table,
+-                                  const char *key,
+-                                  long int length);
+-
+-ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
+-                               const char *key);
+-
+-void ssl_asn1_table_unset(apr_hash_t *table,
+-                          const char *key);
+/* Store the EVP_PKEY key (serialized into DER) in the hash table with
+ * key, returning the ssl_asn1_t structure pointer. */
+ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key,
+                               EVP_PKEY *pkey);
+/* Retrieve the ssl_asn1_t structure with given key from the hash. */
+ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, const char *key);
+/* Remove and free the ssl_asn1_t structure with given key. */
+void ssl_asn1_table_unset(apr_hash_t *table, const char *key);
+ 
+ /**  Mutex Support  */
+ int          ssl_mutex_init(server_rec *, apr_pool_t *);
+@@ -1109,6 +1116,10 @@
+ int ssl_is_challenge(conn_rec *c, const char *servername, 
+                      X509 **pcert, EVP_PKEY **pkey);
+ 
+/* Returns non-zero if the cert/key filename should be handled through
+ * the configured ENGINE. */
+int modssl_is_engine_id(const char *name);
+
+ #endif /* SSL_PRIVATE_H */
+ /** @} */
+ 
+--- httpd-2.4.38/modules/ssl/ssl_util.c.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_util.c
+@@ -192,45 +192,37 @@
+     return TRUE;
+ }
+ 
+-/*
+- * certain key data needs to survive restarts,
+- * which are stored in the user data table of s->process->pool.
+- * to prevent "leaking" of this data, we use malloc/free
+- * rather than apr_palloc and these wrappers to help make sure
+- * we do not leak the malloc-ed data.
+- */
+-unsigned char *ssl_asn1_table_set(apr_hash_t *table,
+-                                  const char *key,
+-                                  long int length)
+/* Decrypted private keys are cached to survive restarts.  The cached
+ * data must have lifetime of the process (hence malloc/free rather
+ * than pools), and uses raw DER since the EVP_PKEY structure
+ * internals may not survive across a module reload. */
+ssl_asn1_t *ssl_asn1_table_set(apr_hash_t *table, const char *key,
+                               EVP_PKEY *pkey)
+ {
+     apr_ssize_t klen = strlen(key);
+     ssl_asn1_t *asn1 = apr_hash_get(table, key, klen);
+    apr_size_t length = i2d_PrivateKey(pkey, NULL);
+    unsigned char *p;
+ 
+-    /*
+-     * if a value for this key already exists,
+-     * reuse as much of the already malloc-ed data
+-     * as possible.
+-     */
+    /* Re-use structure if cached previously. */
+     if (asn1) {
+         if (asn1->nData != length) {
+-            free(asn1->cpData); /* XXX: realloc? */
+-            asn1->cpData = NULL;
+            asn1->cpData = ap_realloc(asn1->cpData, length);
+         }
+     }
+     else {
+         asn1 = ap_malloc(sizeof(*asn1));
+         asn1->source_mtime = 0; /* used as a note for encrypted private keys */
+-        asn1->cpData = NULL;
+-    }
+-
+-    asn1->nData = length;
+-    if (!asn1->cpData) {
+         asn1->cpData = ap_malloc(length);
+
+        apr_hash_set(table, key, klen, asn1);
+     }
+ 
+-    apr_hash_set(table, key, klen, asn1);
+    asn1->nData = length;
+    p = asn1->cpData;
+    i2d_PrivateKey(pkey, &p); /* increases p by length */
+ 
+-    return asn1->cpData; /* caller will assign a value to this */
+    return asn1;
+ }
+ 
+ ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table,
+@@ -480,3 +472,13 @@
+ }
+ 
+ #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */
+
+int modssl_is_engine_id(const char *name)
+{
+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+    /* ### Can handle any other special ENGINE key names here? */
+    return strncmp(name, "pkcs11:", 7) == 0;
+#else
+    return 0;
+#endif
+}
+--- httpd-2.4.38/modules/ssl/ssl_util_ssl.c.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_util_ssl.c
+@@ -74,7 +74,7 @@
+ **  _________________________________________________________________
+ */
+ 
+-EVP_PKEY *modssl_read_privatekey(const char* filename, EVP_PKEY **key, pem_password_cb *cb, void *s)
+EVP_PKEY *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *s)
+ {
+     EVP_PKEY *rc;
+     BIO *bioS;
+@@ -83,7 +83,7 @@
+     /* 1. try PEM (= DER+Base64+headers) */
+     if ((bioS=BIO_new_file(filename, "r")) == NULL)
+         return NULL;
+-    rc = PEM_read_bio_PrivateKey(bioS, key, cb, s);
+    rc = PEM_read_bio_PrivateKey(bioS, NULL, cb, s);
+     BIO_free(bioS);
+ 
+     if (rc == NULL) {
+@@ -107,41 +107,9 @@
+             BIO_free(bioS);
+         }
+     }
+-    if (rc != NULL && key != NULL) {
+-        if (*key != NULL)
+-            EVP_PKEY_free(*key);
+-        *key = rc;
+-    }
+     return rc;
+ }
+ 
+-typedef struct {
+-    const char *pass;
+-    int pass_len;
+-} pass_ctx;
+-
+-static int provide_pass(char *buf, int size, int rwflag, void *baton)
+-{
+-    pass_ctx *ctx = baton;
+-    if (ctx->pass_len > 0) {
+-        if (ctx->pass_len < size) {
+-            size = (int)ctx->pass_len;
+-        }
+-        memcpy(buf, ctx->pass, size);
+-    }
+-    return ctx->pass_len;
+-}
+-
+-EVP_PKEY   *modssl_read_encrypted_pkey(const char *filename, EVP_PKEY **key, 
+-                                       const char *pass, apr_size_t pass_len)
+-{
+-    pass_ctx ctx;
+-    
+-    ctx.pass = pass;
+-    ctx.pass_len = pass_len;
+-    return modssl_read_privatekey(filename, key, provide_pass, &ctx);
+-}
+-
+ /*  _________________________________________________________________
+ **
+ **  Smart shutdown
+--- httpd-2.4.38/modules/ssl/ssl_util_ssl.h.r1830819+
+++ httpd-2.4.38/modules/ssl/ssl_util_ssl.h
+@@ -64,8 +64,11 @@
+ void        modssl_init_app_data2_idx(void);
+ void       *modssl_get_app_data2(SSL *);
+ void        modssl_set_app_data2(SSL *, void *);
+-EVP_PKEY   *modssl_read_privatekey(const char *, EVP_PKEY **, pem_password_cb *, void *);
+-EVP_PKEY   *modssl_read_encrypted_pkey(const char *, EVP_PKEY **, const char *, apr_size_t);
+
+/* Read private key from filename in either PEM or raw base64(DER)
+ * format, using password entry callback cb and userdata. */
+EVP_PKEY   *modssl_read_privatekey(const char *filename, pem_password_cb *cb, void *ud);
+
+ int         modssl_smart_shutdown(SSL *ssl);
+ BOOL        modssl_X509_getBC(X509 *, int *, int *);
+ char       *modssl_X509_NAME_ENTRY_to_string(apr_pool_t *p, X509_NAME_ENTRY *xsne,
--- a/httpd-2.4.43-cachehardmax.patch
+++ b/httpd-2.4.43-cachehardmax.patch
@ -1,8 +1,8 @@
 diff --git a/modules/cache/cache_util.h b/modules/cache/cache_util.h
-index 6b92151..4c42a8e 100644
+index eec38f3..1a2d5ee 100644
 --- a/modules/cache/cache_util.h
 +++ b/modules/cache/cache_util.h
-@@ -195,6 +195,9 @@ typedef struct {
+@@ -194,6 +194,9 @@ typedef struct {
     unsigned int store_nostore_set:1;
     unsigned int enable_set:1;
     unsigned int disable_set:1;
@ -13,10 +13,10 @@ index 6b92151..4c42a8e 100644
 
 /* A linked-list of authn providers. */
 diff --git a/modules/cache/mod_cache.c b/modules/cache/mod_cache.c
-index 3b9aa4f..8268503 100644
+index 4f2d3e0..30c88f4 100644
 --- a/modules/cache/mod_cache.c
 +++ b/modules/cache/mod_cache.c
-@@ -1455,6 +1455,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in)
+@@ -1299,6 +1299,11 @@ static apr_status_t cache_save_filter(ap_filter_t *f, apr_bucket_brigade *in)
             exp = date + dconf->defex;
         }
     }
@ -28,7 +28,7 @@ index 3b9aa4f..8268503 100644
     info->expire = exp;
 
     /* We found a stale entry which wasn't really stale. */
-@@ -1954,7 +1959,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy)
+@@ -1717,7 +1722,9 @@ static void *create_dir_config(apr_pool_t *p, char *dummy)
 
     /* array of providers for this URL space */
     dconf->cacheenable = apr_array_make(p, 10, sizeof(struct cache_enable));
@ -39,7 +39,7 @@ index 3b9aa4f..8268503 100644
     return dconf;
 }
 
-@@ -2004,7 +2011,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) {
+@@ -1767,7 +1774,10 @@ static void *merge_dir_config(apr_pool_t *p, void *basev, void *addv) {
     new->enable_set = add->enable_set || base->enable_set;
     new->disable = (add->disable_set == 0) ? base->disable : add->disable;
     new->disable_set = add->disable_set || base->disable_set;
@ -51,7 +51,7 @@ index 3b9aa4f..8268503 100644
     return new;
 }
 
-@@ -2332,12 +2342,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy,
+@@ -2096,12 +2106,18 @@ static const char *add_cache_disable(cmd_parms *parms, void *dummy,
 }
 
 static const char *set_cache_maxex(cmd_parms *parms, void *dummy,
@ -71,7 +71,7 @@ index 3b9aa4f..8268503 100644
     return NULL;
 }
 
-@@ -2545,7 +2561,7 @@ static const command_rec cache_cmds[] =
+@@ -2309,7 +2325,7 @@ static const command_rec cache_cmds[] =
                    "caching is enabled"),
     AP_INIT_TAKE1("CacheDisable", add_cache_disable, NULL, RSRC_CONF|ACCESS_CONF,
                   "A partial URL prefix below which caching is disabled"),
--- a/httpd-2.4.4-r1337344+.patch
+++ b/httpd-2.4.4-r1337344+.patch
@ -0,0 +1,250 @@
+# ./pullrev.sh 1337344 1341905 1342065 1341930
+
+suexec enhancements:
+
+1) use syslog for logging
+2) use capabilities not setuid/setgid root binary
+
+http://svn.apache.org/viewvc?view=revision&revision=1337344
+http://svn.apache.org/viewvc?view=revision&revision=1341905
+http://svn.apache.org/viewvc?view=revision&revision=1342065
+http://svn.apache.org/viewvc?view=revision&revision=1341930
+
+--- httpd-2.4.4/configure.in.r1337344+
+++ httpd-2.4.4/configure.in
+@@ -734,7 +734,24 @@ APACHE_HELP_STRING(--with-suexec-gidmin,
+ 
+ AC_ARG_WITH(suexec-logfile,
+ APACHE_HELP_STRING(--with-suexec-logfile,Set the logfile),[
+-  AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file] ) ] )
+  if test "x$withval" = "xyes"; then
+    AC_DEFINE_UNQUOTED(AP_LOG_EXEC, "$withval", [SuExec log file])
+  fi
+])
+
+AC_ARG_WITH(suexec-syslog,
+APACHE_HELP_STRING(--with-suexec-syslog,Set the logfile),[
+  if test $withval = "yes"; then
+    if test "x${with_suexec_logfile}" != "xno"; then
+      AC_MSG_NOTICE([hint: use "--without-suexec-logfile --with-suexec-syslog"])
+      AC_MSG_ERROR([suexec does not support both logging to file and syslog])
+    fi
+    AC_CHECK_FUNCS([vsyslog], [], [
+       AC_MSG_ERROR([cannot support syslog from suexec without vsyslog()])])
+    AC_DEFINE(AP_LOG_SYSLOG, 1, [SuExec log to syslog])
+  fi    
+])
+
+ 
+ AC_ARG_WITH(suexec-safepath,
+ APACHE_HELP_STRING(--with-suexec-safepath,Set the safepath),[
+@@ -744,6 +761,15 @@ AC_ARG_WITH(suexec-umask,
+ APACHE_HELP_STRING(--with-suexec-umask,umask for suexec'd process),[
+   AC_DEFINE_UNQUOTED(AP_SUEXEC_UMASK, 0$withval, [umask for suexec'd process] ) ] )
+ 
+INSTALL_SUEXEC=setuid
+AC_ARG_ENABLE([suexec-capabilities], 
+APACHE_HELP_STRING(--enable-suexec-capabilities,Use Linux capability bits not setuid root suexec), [
+INSTALL_SUEXEC=caps
+AC_DEFINE(AP_SUEXEC_CAPABILITIES, 1, 
+          [Enable if suexec is installed with Linux capabilities, not setuid])
+])
+APACHE_SUBST(INSTALL_SUEXEC)
+
+ dnl APR should go after the other libs, so the right symbols can be picked up
+ if test x${apu_found} != xobsolete; then
+   AP_LIBS="$AP_LIBS `$apu_config --avoid-ldap --link-libtool`"
+--- httpd-2.4.4/docs/manual/suexec.html.en.r1337344+
+++ httpd-2.4.4/docs/manual/suexec.html.en
+@@ -372,6 +372,21 @@
+       together with the <code>--enable-suexec</code> option to let
+       APACI accept your request for using the suEXEC feature.</dd>
+ 
+      <dt><code>--enable-suexec-capabilities</code></dt>
+
+      <dd><strong>Linux specific:</strong> Normally,
+      the <code>suexec</code> binary is installed "setuid/setgid
+      root", which allows it to run with the full privileges of the
+      root user.  If this option is used, the <code>suexec</code>
+      binary will instead be installed with only the setuid/setgid
+      "capability" bits set, which is the subset of full root
+      priviliges required for suexec operation.  Note that
+      the <code>suexec</code> binary may not be able to write to a log
+      file in this mode; it is recommended that the
+      <code>--with-suexec-syslog --without-suexec-logfile</code>
+      options are used in conjunction with this mode, so that syslog
+      logging is used instead.</dd>
+
+       <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+ 
+       <dd>The path to the <code>suexec</code> binary must be hard-coded
+@@ -433,6 +448,12 @@
+       "<code>suexec_log</code>" and located in your standard logfile
+       directory (<code>--logfiledir</code>).</dd>
+ 
+      <dt><code>--with-suexec-syslog</code></dt>
+
+      <dd>If defined, suexec will log notices and errors to syslog
+      instead of a logfile.  This option must be combined
+      with <code>--without-suexec-logfile</code>.</dd>
+
+       <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+ 
+       <dd>Define a safe PATH environment to pass to CGI
+@@ -550,9 +571,12 @@ Group webgroup
+ 
+     <p>The suEXEC wrapper will write log information
+     to the file defined with the <code>--with-suexec-logfile</code>
+-    option as indicated above. If you feel you have configured and
+-    installed the wrapper properly, have a look at this log and the
+-    error_log for the server to see where you may have gone astray.</p>
+    option as indicated above, or to syslog if <code>--with-suexec-syslog</code>
+    is used. If you feel you have configured and
+    installed the wrapper properly, have a look at the log and the
+    error_log for the server to see where you may have gone astray. 
+    The output of <code>"suexec -V"</code> will show the options
+    used to compile suexec, if using a binary distribution.</p>
+ 
+ </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+ <div class="section">
+@@ -640,4 +664,4 @@ if (typeof(prettyPrint) !== 'undefined')
+     prettyPrint();
+ }
+ //--><!]]></script>
+-</body></html>
+\ No newline at end of file
+</body></html>
+--- httpd-2.4.4/Makefile.in.r1337344+
+++ httpd-2.4.4/Makefile.in
+@@ -238,11 +238,22 @@ install-man:
+ 	  cd $(DESTDIR)$(manualdir) && find . -name ".svn" -type d -print | xargs rm -rf 2>/dev/null || true; \
+ 	fi
+ 
+-install-suexec:
+install-suexec: install-suexec-binary install-suexec-$(INSTALL_SUEXEC)
+
+install-suexec-binary:
+ 	@if test -f $(builddir)/support/suexec; then \
+             test -d $(DESTDIR)$(sbindir) || $(MKINSTALLDIRS) $(DESTDIR)$(sbindir); \
+             $(INSTALL_PROGRAM) $(top_builddir)/support/suexec $(DESTDIR)$(sbindir); \
+-            chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
+	fi
+
+install-suexec-setuid:
+	@if test -f $(builddir)/support/suexec; then \
+	    chmod 4755 $(DESTDIR)$(sbindir)/suexec; \
+	fi
+
+install-suexec-caps:
+	@if test -f $(builddir)/support/suexec; then \
+            setcap 'cap_setuid,cap_setgid+pe' $(DESTDIR)$(sbindir)/suexec; \
+ 	fi
+ 
+ suexec:
+--- httpd-2.4.4/modules/arch/unix/mod_unixd.c.r1337344+
+++ httpd-2.4.4/modules/arch/unix/mod_unixd.c
+@@ -284,6 +284,13 @@ unixd_set_suexec(cmd_parms *cmd, void *d
+     return NULL;
+ }
+ 
+#ifdef AP_SUEXEC_CAPABILITIES
+/* If suexec is using capabilities, don't test for the setuid bit. */
+#define SETUID_TEST(finfo) (1)
+#else
+#define SETUID_TEST(finfo) (finfo.protection & APR_USETID)
+#endif
+
+ static int
+ unixd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
+                  apr_pool_t *ptemp)
+@@ -300,7 +307,7 @@ unixd_pre_config(apr_pool_t *pconf, apr_
+     ap_unixd_config.suexec_enabled = 0;
+     if ((apr_stat(&wrapper, SUEXEC_BIN, APR_FINFO_NORM, ptemp))
+          == APR_SUCCESS) {
+-        if ((wrapper.protection & APR_USETID) && wrapper.user == 0
+        if (SETUID_TEST(wrapper) && wrapper.user == 0
+             && (access(SUEXEC_BIN, R_OK|X_OK) == 0)) {
+             ap_unixd_config.suexec_enabled = 1;
+             ap_unixd_config.suexec_disabled_reason = "";
+--- httpd-2.4.4/support/suexec.c.r1337344+
+++ httpd-2.4.4/support/suexec.c
+@@ -58,6 +58,10 @@
+ #include <grp.h>
+ #endif
+ 
+#ifdef AP_LOG_SYSLOG
+#include <syslog.h>
+#endif
+
+ #if defined(PATH_MAX)
+ #define AP_MAXPATH PATH_MAX
+ #elif defined(MAXPATHLEN)
+@@ -69,7 +73,20 @@
+ #define AP_ENVBUF 256
+ 
+ extern char **environ;
+
+#ifdef AP_LOG_SYSLOG
+/* Syslog support. */
+#if !defined(AP_LOG_FACILITY) && defined(LOG_AUTHPRIV)
+#define AP_LOG_FACILITY LOG_AUTHPRIV
+#elif !defined(AP_LOG_FACILITY)
+#define AP_LOG_FACILITY LOG_AUTH
+#endif
+
+static int log_open;
+#else
+/* Non-syslog support. */
+ static FILE *log = NULL;
+#endif
+ 
+ static const char *const safe_env_lst[] =
+ {
+@@ -137,7 +154,14 @@ static void err_output(int is_error, con
+ 
+ static void err_output(int is_error, const char *fmt, va_list ap)
+ {
+-#ifdef AP_LOG_EXEC
+#if defined(AP_LOG_SYSLOG)
+    if (!log_open) {
+        openlog("suexec", LOG_PID, AP_LOG_FACILITY);
+        log_open = 1;
+    }
+
+    vsyslog(is_error ? LOG_ERR : LOG_INFO, fmt, ap);
+#elif defined(AP_LOG_EXEC)
+     time_t timevar;
+     struct tm *lt;
+ 
+@@ -295,7 +319,9 @@ int main(int argc, char *argv[])
+ #ifdef AP_HTTPD_USER
+         fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
+ #endif
+-#ifdef AP_LOG_EXEC
+#if defined(AP_LOG_SYSLOG)
+        fprintf(stderr, " -D AP_LOG_SYSLOG\n");
+#elif defined(AP_LOG_EXEC)
+         fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
+ #endif
+ #ifdef AP_SAFE_PATH
+@@ -591,6 +617,12 @@ int main(int argc, char *argv[])
+ #endif /* AP_SUEXEC_UMASK */
+ 
+     /* Be sure to close the log file so the CGI can't mess with it. */
+#ifdef AP_LOG_SYSLOG
+    if (log_open) {
+        closelog();
+        log_open = 0;
+    }
+#else
+     if (log != NULL) {
+ #if APR_HAVE_FCNTL_H
+         /*
+@@ -612,6 +644,7 @@ int main(int argc, char *argv[])
+         log = NULL;
+ #endif
+     }
+#endif
+ 
+     /*
+      * Execute the command, replacing our image with its own.
--- a/httpd-2.4.43-enable-sslv3.patch
+++ b/httpd-2.4.43-enable-sslv3.patch
@ -1,62 +0,0 @@
-diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
-index 979489c..3d6443b 100644
--- a/modules/ssl/ssl_engine_config.c
-+++ b/modules/ssl/ssl_engine_config.c
-@@ -1485,6 +1485,10 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
- #endif
-         else if (strcEQ(w, "all")) {
-             thisopt = SSL_PROTOCOL_ALL;
-+#ifndef OPENSSL_NO_SSL3
-+            /* by default, ALL kw doesn't turn on SSLv3 */
-+            thisopt &= ~SSL_PROTOCOL_SSLV3;
-+#endif
-         }
-         else {
-             return apr_pstrcat(parms->temp_pool,
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index b0fcf81..ab6f263 100644
--- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -568,6 +568,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
- }
- #endif
- 
-+/*
-+ * Enable/disable SSLProtocol. If the mod_ssl enables protocol
-+ * which is disabled by default by OpenSSL, show a warning.
-+ * "option" is for example SSL_OP_NO_SSLv3.
-+ */
-+static void ssl_set_ctx_protocol_option(server_rec *s,
-+                                        SSL_CTX *ctx,
-+                                        long option,
-+                                        int enabled,
-+                                        const char *name)
-+{
-+      if (!enabled) {
-+                SSL_CTX_set_options(ctx, option);
-+      }
-+      else if (SSL_CTX_get_options(ctx) & option) {
-+                    SSL_CTX_clear_options(ctx, option);
-+                    ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904)
-+                                 "Allowing SSLProtocol %s even though it is disabled "
-+                                 "by OpenSSL by default on this system", name);
-+      }
-+}
-+
- static apr_status_t ssl_init_ctx_protocol(server_rec *s,
-                                           apr_pool_t *p,
-                                           apr_pool_t *ptemp,
-@@ -735,9 +757,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
-     }
-     if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
-         prot = TLS1_VERSION;
-+        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1,
-+                                    protocol & SSL_PROTOCOL_TLSV1, "TLSv1");
-     }
- #ifndef OPENSSL_NO_SSL3
-     if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) {
-+        ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3,
-+                                    protocol & SSL_PROTOCOL_SSLV3, "SSLv3");
-         prot = SSL3_VERSION;
-     }
- #endif
--- a/httpd-2.4.43-logjournal.patch
+++ b/httpd-2.4.43-logjournal.patch
@ -1,87 +0,0 @@
-diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
-index 762e773..0848d2e 100644
--- a/modules/loggers/config.m4
-+++ b/modules/loggers/config.m4
-@@ -5,6 +5,8 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
- APACHE_MODPATH_INIT(loggers)
- 	
- APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
-+APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
-+
- APACHE_MODULE(log_debug, configurable debug logging, , , most)
- APACHE_MODULE(log_forensic, forensic logging)
- 
-diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
-index 996c09c..50a056a 100644
--- a/modules/loggers/mod_log_config.c
-+++ b/modules/loggers/mod_log_config.c
-@@ -172,6 +172,10 @@
- #include <limits.h>
- #endif
- 
-+#ifdef HAVE_SYSTEMD
-+#include <systemd/sd-journal.h>
-+#endif
-+
- #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
- 
- module AP_MODULE_DECLARE_DATA log_config_module;
-@@ -1638,6 +1642,25 @@ static apr_status_t ap_default_log_writer( request_rec *r,
- 
-     return rv;
- }
-+
-+static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
-+                                        int priority)
-+{
-+#ifdef HAVE_SYSTEMD
-+    int fd;
-+
-+    fd = sd_journal_stream_fd("httpd", priority, 0);
-+    if (fd < 0) return fd;
-+
-+    /* This is an AF_UNIX socket fd so is more pipe-like than
-+     * file-like (the fd is neither seekable or readable), and use of
-+     * apr_os_pipe_put_ex() allows cleanup registration. */
-+    return apr_os_pipe_put_ex(outfd, &fd, 1, p);
-+#else
-+    return APR_ENOTIMPL;
-+#endif
-+}
-+
- static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
-                                         const char* name)
- {
-@@ -1650,6 +1673,32 @@ static void *ap_default_log_writer_init(apr_pool_t *p, server_rec *s,
-         }
-         return ap_piped_log_write_fd(pl);
-     }
-+    else if (strncasecmp(name, "journald:", 9) == 0) {
-+        int priority;
-+        const char *err = ap_parse_log_level(name + 9, &priority);
-+        apr_status_t rv;
-+        apr_file_t *fd;
-+
-+        if (err == NULL && priority > LOG_DEBUG) {
-+            err = "TRACE level debugging not supported with journald";
-+        }
-+
-+        if (err) {
-+            ap_log_error(APLOG_MARK, APLOG_ERR, APR_EBADPATH, s, 
-+                         "invalid journald log priority name %s: %s",
-+                         name, err);
-+            return NULL;
-+        }
-+
-+        rv = wrap_journal_stream(p, &fd, priority);
-+        if (rv) {
-+            ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, 
-+                         "could not open journald log stream");
-+            return NULL;
-+        }
-+
-+        return fd;
-+    }
-     else {
-         const char *fname = ap_server_root_relative(p, name);
-         apr_file_t *fd;
--- a/httpd-2.4.48-r1842929+.patch
+++ b/httpd-2.4.48-r1842929+.patch
@ -1,232 +0,0 @@
-
-Upstream-Status: in trunk, not proposed for 2.4.x
-
-diff --git a/Makefile.in b/Makefile.in
-index 6747aea..40c7076 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -233,6 +233,7 @@ install-cgi:
- install-other:
- 	@test -d $(DESTDIR)$(logfiledir) || $(MKINSTALLDIRS) $(DESTDIR)$(logfiledir)
- 	@test -d $(DESTDIR)$(runtimedir) || $(MKINSTALLDIRS) $(DESTDIR)$(runtimedir)
-+	@test -d $(DESTDIR)$(statedir) || $(MKINSTALLDIRS) $(DESTDIR)$(statedir)
- 	@for ext in dll x; do \
- 		file=apachecore.$$ext; \
- 		if test -f $$file; then \
-diff --git a/acinclude.m4 b/acinclude.m4
-index b6ef442..98f1441 100644
--- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -45,6 +45,7 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[
-   APACHE_SUBST(installbuilddir)
-   APACHE_SUBST(runtimedir)
-   APACHE_SUBST(proxycachedir)
-+  APACHE_SUBST(statedir)
-   APACHE_SUBST(other_targets)
-   APACHE_SUBST(progname)
-   APACHE_SUBST(prefix)
-@@ -665,6 +666,7 @@ AC_DEFUN([APACHE_EXPORT_ARGUMENTS],[
-   APACHE_SUBST_EXPANDED_ARG(runtimedir)
-   APACHE_SUBST_EXPANDED_ARG(logfiledir)
-   APACHE_SUBST_EXPANDED_ARG(proxycachedir)
-+  APACHE_SUBST_EXPANDED_ARG(statedir)
- ])
- 
- dnl 
-diff --git a/configure.in b/configure.in
-index 37346b2..f303784 100644
--- a/configure.in
-+++ b/configure.in
-@@ -41,7 +41,7 @@ dnl Something seems broken here.
- AC_PREFIX_DEFAULT(/usr/local/apache2)
- 
- dnl Get the layout here, so we can pass the required variables to apr
-APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir])
-+APR_ENABLE_LAYOUT(Apache, [errordir iconsdir htdocsdir cgidir statedir])
- 
- dnl reparse the configure arguments.
- APR_PARSE_ARGUMENTS
-diff --git a/include/ap_config_layout.h.in b/include/ap_config_layout.h.in
-index 2b4a70c..e076f41 100644
--- a/include/ap_config_layout.h.in
-+++ b/include/ap_config_layout.h.in
-@@ -60,5 +60,7 @@
- #define DEFAULT_REL_LOGFILEDIR "@rel_logfiledir@"
- #define DEFAULT_EXP_PROXYCACHEDIR "@exp_proxycachedir@"
- #define DEFAULT_REL_PROXYCACHEDIR "@rel_proxycachedir@"
-+#define DEFAULT_EXP_STATEDIR "@exp_statedir@"
-+#define DEFAULT_REL_STATEDIR "@rel_statedir@"
- 
- #endif /* AP_CONFIG_LAYOUT_H */
-diff --git a/include/http_config.h b/include/http_config.h
-index 77657ae..384a90f 100644
--- a/include/http_config.h
-+++ b/include/http_config.h
-@@ -757,6 +757,14 @@ AP_DECLARE(char *) ap_server_root_relative(apr_pool_t *p, const char *fname);
-  */
- AP_DECLARE(char *) ap_runtime_dir_relative(apr_pool_t *p, const char *fname);
- 
-+/**
-+ * Compute the name of a persistent state file (e.g. a database or
-+ * long-lived cache) relative to the appropriate state directory.
-+ * Absolute paths are returned as-is.  The state directory is
-+ * configured via the DefaultStateDir directive or at build time.
-+ */
-+AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *fname);
-+
- /* Finally, the hook for dynamically loading modules in... */
- 
- /**
-diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
-index addfd7e..2389f8f 100644
--- a/modules/dav/fs/mod_dav_fs.c
-+++ b/modules/dav/fs/mod_dav_fs.c
-@@ -29,6 +29,10 @@ typedef struct {
- 
- extern module AP_MODULE_DECLARE_DATA dav_fs_module;
- 
-+#ifndef DEFAULT_DAV_LOCKDB
-+#define DEFAULT_DAV_LOCKDB "davlockdb"
-+#endif
-+
- const char *dav_get_lockdb_path(const request_rec *r)
- {
-     dav_fs_server_conf *conf;
-@@ -57,6 +61,24 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
-     return newconf;
- }
- 
-+static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
-+                                       apr_pool_t *ptemp, server_rec *base_server)
-+{
-+    server_rec *s;
-+
-+    for (s = base_server; s; s = s->next) {
-+        dav_fs_server_conf *conf;
-+
-+        conf = ap_get_module_config(s->module_config, &dav_fs_module);
-+
-+        if (!conf->lockdb_path) {
-+            conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
-+        }
-+    }
-+
-+    return OK;
-+}
-+
- /*
-  * Command handler for the DAVLockDB directive, which is TAKE1
-  */
-@@ -87,6 +109,8 @@ static const command_rec dav_fs_cmds[] =
- 
- static void register_hooks(apr_pool_t *p)
- {
-+    ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
-+
-     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
-                              APR_HOOK_MIDDLE);
-     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
-diff --git a/server/core.c b/server/core.c
-index d135764..c2176b9 100644
--- a/server/core.c
-+++ b/server/core.c
-@@ -142,6 +142,8 @@ AP_DECLARE_DATA int ap_main_state = AP_SQ_MS_INITIAL_STARTUP;
- AP_DECLARE_DATA int ap_run_mode = AP_SQ_RM_UNKNOWN;
- AP_DECLARE_DATA int ap_config_generation = 0;
- 
-+static const char *core_state_dir;
-+
- static void *create_core_dir_config(apr_pool_t *a, char *dir)
- {
-     core_dir_config *conf;
-@@ -1444,13 +1446,16 @@ AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
-     return res_buf;
- }
- 
-static int reset_config_defines(void *dummy)
-+/* pconf cleanup - clear global variables set from config here. */
-+static apr_status_t reset_config(void *dummy)
- {
-     ap_server_config_defines = saved_server_config_defines;
-     saved_server_config_defines = NULL;
-     server_config_defined_vars = NULL;
-     ap_runtime_dir = NULL;
-    return OK;
-+    core_state_dir = NULL;
-+
-+    return APR_SUCCESS;
- }
- 
- /*
-@@ -3220,6 +3225,24 @@ static const char *set_runtime_dir(cmd_parms *cmd, void *dummy, const char *arg)
-     return NULL;
- }
- 
-+static const char *set_state_dir(cmd_parms *cmd, void *dummy, const char *arg)
-+{
-+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
-+
-+    if (err != NULL) {
-+        return err;
-+    }
-+
-+    if ((apr_filepath_merge((char**)&core_state_dir, NULL,
-+                            ap_server_root_relative(cmd->temp_pool, arg),
-+                            APR_FILEPATH_TRUENAME, cmd->pool) != APR_SUCCESS)
-+        || !ap_is_directory(cmd->temp_pool, core_state_dir)) {
-+        return "DefaultStateDir must be a valid directory, absolute or relative to ServerRoot";
-+    }
-+
-+    return NULL;
-+}
-+
- static const char *set_timeout(cmd_parms *cmd, void *dummy, const char *arg)
- {
-     const char *err = ap_check_cmd_context(cmd, NOT_IN_DIR_CONTEXT);
-@@ -4521,6 +4544,8 @@ AP_INIT_TAKE1("ServerRoot", set_server_root, NULL, RSRC_CONF | EXEC_ON_READ,
-   "Common directory of server-related files (logs, confs, etc.)"),
- AP_INIT_TAKE1("DefaultRuntimeDir", set_runtime_dir, NULL, RSRC_CONF | EXEC_ON_READ,
-   "Common directory for run-time files (shared memory, locks, etc.)"),
-+AP_INIT_TAKE1("DefaultStateDir", set_state_dir, NULL, RSRC_CONF | EXEC_ON_READ,
-+  "Common directory for persistent state (databases, long-lived caches, etc.)"),
- AP_INIT_TAKE1("ErrorLog", set_server_string_slot,
-   (void *)APR_OFFSETOF(server_rec, error_fname), RSRC_CONF,
-   "The filename of the error log"),
-@@ -5055,8 +5080,7 @@ static int core_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptem
- 
-     if (!saved_server_config_defines)
-         init_config_defines(pconf);
-    apr_pool_cleanup_register(pconf, NULL, reset_config_defines,
-                              apr_pool_cleanup_null);
-+    apr_pool_cleanup_register(pconf, NULL, reset_config, apr_pool_cleanup_null);
- 
-     ap_regcomp_set_default_cflags(AP_REG_DEFAULT);
- 
-@@ -5303,6 +5327,27 @@ AP_DECLARE(int) ap_state_query(int query)
-     }
- }
- 
-+AP_DECLARE(char *) ap_state_dir_relative(apr_pool_t *p, const char *file)
-+{
-+    char *newpath = NULL;
-+    apr_status_t rv;
-+    const char *state_dir;
-+
-+    state_dir = core_state_dir
-+        ? core_state_dir
-+        : ap_server_root_relative(p, DEFAULT_REL_STATEDIR);
-+
-+    rv = apr_filepath_merge(&newpath, state_dir, file, APR_FILEPATH_TRUENAME, p);
-+    if (newpath && (rv == APR_SUCCESS || APR_STATUS_IS_EPATHWILD(rv)
-+                                      || APR_STATUS_IS_ENOENT(rv)
-+                                      || APR_STATUS_IS_ENOTDIR(rv))) {
-+        return newpath;
-+    }
-+    else {
-+        return NULL;
-+    }
-+}
-+
- static apr_random_t *rng = NULL;
- #if APR_HAS_THREADS
- static apr_thread_mutex_t *rng_mutex = NULL;
--- a/httpd-2.4.53-detect-systemd.patch
+++ b/httpd-2.4.53-detect-systemd.patch
@ -1,45 +0,0 @@
-diff --git a/Makefile.in b/Makefile.in
-index a2e9c82..bd8045c 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
- 
- PROGRAM_NAME         = $(progname)
- PROGRAM_SOURCES      = modules.c
-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
-+PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
- PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
- PROGRAM_DEPENDENCIES = \
-   server/libmain.la \
-diff --git a/acinclude.m4 b/acinclude.m4
-index 97484c9..05abe18 100644
--- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -631,6 +631,7 @@ case $host in
-       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-         AC_MSG_WARN([Your system does not support systemd.])
-       else
-+        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
-         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-       fi
-    fi
-diff --git a/configure.in b/configure.in
-index cf437fe..521fc45 100644
--- a/configure.in
-+++ b/configure.in
-@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then
-   AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
-   APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
-   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`])
-+  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
- else
-   AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/])
- fi
-@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR)
- APACHE_SUBST(BUILTIN_LIBS)
- APACHE_SUBST(SHLIBPATH_VAR)
- APACHE_SUBST(OS_SPECIFIC_VARS)
-+APACHE_SUBST(HTTPD_LIBS)
- 
- PRE_SHARED_CMDS='echo ""'
- POST_SHARED_CMDS='echo ""'
--- a/httpd-2.4.53-export.patch
+++ b/httpd-2.4.53-export.patch
@ -1,59 +0,0 @@
-
-Upstream-Status: r1861685 in trunk, not proposed for 2.4.x
-
-diff --git a/Makefile.in b/Makefile.in
-index bd8045c..d6733a5 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
- 
- PROGRAM_NAME         = $(progname)
- PROGRAM_SOURCES      = modules.c
-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
-+PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) \
-+	$(PROGRAM_LDDEPS)  \
-+	$(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
- PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
-+PROGRAM_LDDEPS = \
-+  $(BUILTIN_LIBS) \
-+  $(MPM_LIB) \
-+  -Wl,--whole-archive,server/.libs/libmain.a,--no-whole-archive \
-+  os/$(OS_DIR)/libos.la
- PROGRAM_DEPENDENCIES = \
-   server/libmain.la \
-   $(BUILTIN_LIBS) \
-diff --git a/server/Makefile.in b/server/Makefile.in
-index 8111877..f00bb3f 100644
--- a/server/Makefile.in
-+++ b/server/Makefile.in
-@@ -12,7 +12,7 @@ LTLIBRARY_SOURCES = \
- 	connection.c listen.c util_mutex.c \
- 	mpm_common.c mpm_unix.c mpm_fdqueue.c \
- 	util_charset.c util_cookies.c util_debug.c util_xml.c \
-	util_filter.c util_pcre.c util_regex.c exports.c \
-+	util_filter.c util_pcre.c util_regex.c \
- 	scoreboard.c error_bucket.c protocol.c core.c request.c ssl.c provider.c \
- 	eoc_bucket.c eor_bucket.c core_filters.c \
- 	util_expr_parse.c util_expr_scan.c util_expr_eval.c
-diff --git a/server/main.c b/server/main.c
-index 7da7aa2..e63d2eb 100644
--- a/server/main.c
-+++ b/server/main.c
-@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[])
-     return !OK;
- }
- 
-#ifdef AP_USING_AUTOCONF
-/* This ugly little hack pulls any function referenced in exports.c into
- * the web server.  exports.c is generated during the build, and it
- * has all of the APR functions specified by the apr/apr.exports and
- * apr-util/aprutil.exports files.
- */
-const void *ap_suck_in_APR(void);
-const void *ap_suck_in_APR(void)
-{
-    extern const void *ap_ugly_hack;
-
-    return ap_ugly_hack;
-}
-#endif
--- a/httpd-2.4.54-icons.patch
+++ b/httpd-2.4.54-icons.patch
@ -1,49 +0,0 @@
-diff --git a/docs/conf/extra/httpd-autoindex.conf.in b/docs/conf/extra/httpd-autoindex.conf.in
-index 51b02ed..93a2b87 100644
--- a/docs/conf/extra/httpd-autoindex.conf.in
-+++ b/docs/conf/extra/httpd-autoindex.conf.in
-@@ -21,7 +21,7 @@ IndexOptions FancyIndexing HTMLTable VersionSort
- Alias /icons/ "@exp_iconsdir@/"
- 
- <Directory "@exp_iconsdir@">
-    Options Indexes MultiViews
-+    Options Indexes MultiViews FollowSymlinks
-     AllowOverride None
-     Require all granted
- </Directory>
-@@ -37,6 +37,7 @@ AddIconByType (TXT,/icons/text.gif) text/*
- AddIconByType (IMG,/icons/image2.gif) image/*
- AddIconByType (SND,/icons/sound2.gif) audio/*
- AddIconByType (VID,/icons/movie.gif) video/*
-+AddIconByType /icons/bomb.gif application/x-coredump
- 
- AddIcon /icons/binary.gif .bin .exe
- AddIcon /icons/binhex.gif .hqx
-@@ -53,7 +54,6 @@ AddIcon /icons/dvi.gif .dvi
- AddIcon /icons/uuencoded.gif .uu
- AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
- AddIcon /icons/tex.gif .tex
-AddIcon /icons/bomb.gif core
- 
- AddIcon /icons/back.gif ..
- AddIcon /icons/hand.right.gif README
-diff --git a/docs/conf/magic b/docs/conf/magic
-index bc891d9..9a41b44 100644
--- a/docs/conf/magic
-+++ b/docs/conf/magic
-@@ -383,3 +383,15 @@
- 4   string      moov        video/quicktime
- 4   string      mdat        video/quicktime
- 
-+
-+#------------------------------------------------------------------------------
-+# application/x-coredump for LE/BE ELF
-+#
-+0       string          \177ELF
-+>5      byte            1
-+>16     leshort         4               application/x-coredump
-+
-+0       string          \177ELF
-+>5      byte            2
-+>16     beshort         4               application/x-coredump
-+
--- a/httpd-2.4.63-r1912477+.patch
+++ b/httpd-2.4.63-r1912477+.patch
@ -1,383 +0,0 @@
-# ./pullrev.sh 1912477 1912571 1912718 1913654 1914438
-http://svn.apache.org/viewvc?view=revision&revision=1912477
-http://svn.apache.org/viewvc?view=revision&revision=1912571
-http://svn.apache.org/viewvc?view=revision&revision=1912718
-http://svn.apache.org/viewvc?view=revision&revision=1913654
-http://svn.apache.org/viewvc?view=revision&revision=1914438
-
-Upstream-Status: in trunk, not proposed for 2.4.x
-
-diff --git a/modules/dav/fs/config6.m4 b/modules/dav/fs/config6.m4
-index dd26ec8..72fff9a 100644
--- a/modules/dav/fs/config6.m4
-+++ b/modules/dav/fs/config6.m4
-@@ -20,4 +20,10 @@ esac
- 
- APACHE_MODULE(dav_fs, DAV provider for the filesystem.  --enable-dav also enables mod_dav_fs., $dav_fs_objects, , $dav_fs_enable,,dav)
- 
-+if test "x$enable_dav_fs" = "xshared"; then
-+    # The only symbol which needs to be exported is the module
-+    # structure, so ask libtool to hide everything else:
-+    APR_ADDTO(MOD_DAV_FS_LDADD, [-export-symbols-regex dav_fs_module])
-+fi
-+
- APACHE_MODPATH_FINISH
-diff --git a/modules/dav/fs/dbm.c b/modules/dav/fs/dbm.c
-index 39ab4ad..4551f70 100644
--- a/modules/dav/fs/dbm.c
-+++ b/modules/dav/fs/dbm.c
-@@ -47,6 +47,10 @@
- #include "http_log.h"
- #include "http_main.h"      /* for ap_server_conf */
- 
-+#ifndef DEFAULT_PROPDB_DBM_TYPE
-+#define DEFAULT_PROPDB_DBM_TYPE "default"
-+#endif
-+
- APLOG_USE_MODULE(dav_fs);
- 
- struct dav_db {
-@@ -129,10 +133,10 @@ void dav_fs_ensure_state_dir(apr_pool_t * p, const char *dirname)
- /* dav_dbm_open_direct:  Opens a *dbm database specified by path.
-  *    ro = boolean read-only flag.
-  */
-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
-                                dav_db **pdb)
-+dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
-+                                const char *dbmtype, int ro, dav_db **pdb)
- {
-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-+#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-     const apr_dbm_driver_t *driver;
-     const apu_err_t *err;
- #endif
-@@ -141,11 +145,12 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
- 
-     *pdb = NULL;
- 
-#if APU_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-    if ((status = apr_dbm_get_driver(&driver, NULL, &err, p)) != APR_SUCCESS) {
-+#if APR_MAJOR_VERSION > 1 || (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION >= 7)
-+    if ((status = apr_dbm_get_driver(&driver, dbmtype, &err, p)) != APR_SUCCESS) {
-+
-         ap_log_error(APLOG_MARK, APLOG_ERR, status, ap_server_conf, APLOGNO(10289)
-                     "mod_dav_fs: The DBM library '%s' could not be loaded: %s",
-                             err->reason, err->msg);
-+                     "mod_dav_fs: The DBM library '%s' for '%s' could not be loaded: %s",
-+                     err->reason, dbmtype, err->msg);
-         return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 1, status,
-                 "Could not load library for database.");
-     }
-@@ -156,7 +161,7 @@ dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
-         return dav_fs_dbm_error(NULL, p, status);
-     }
- #else
-    if ((status = apr_dbm_open(&file, pathname,
-+    if ((status = apr_dbm_open_ex(&file, dbmtype, pathname,
-                                ro ? APR_DBM_READONLY : APR_DBM_RWCREATE,
-                                APR_OS_DEFAULT, p))
-                 != APR_SUCCESS
-@@ -206,7 +211,7 @@ static dav_error * dav_dbm_open(apr_pool_t * p, const dav_resource *resource,
- 
-     /* ### do we need to deal with the umask? */
- 
-    return dav_dbm_open_direct(p, pathname, ro, pdb);
-+    return dav_dbm_open_direct(p, pathname, DEFAULT_PROPDB_DBM_TYPE, ro, pdb);
- }
- 
- void dav_dbm_close(dav_db *db)
-diff --git a/modules/dav/fs/lock.c b/modules/dav/fs/lock.c
-index ef18c4a..29d167d 100644
--- a/modules/dav/fs/lock.c
-+++ b/modules/dav/fs/lock.c
-@@ -181,8 +181,7 @@ struct dav_lockdb_private
- {
-     request_rec *r;                  /* for accessing the uuid state */
-     apr_pool_t *pool;                /* a pool to use */
-    const char *lockdb_path;         /* where is the lock database? */
-
-+    const dav_fs_server_conf *conf;  /* lock database config & metadata */
-     int opened;                      /* we opened the database */
-     dav_db *db;                      /* if non-NULL, the lock database */
- };
-@@ -292,6 +291,19 @@ static int dav_fs_compare_locktoken(
-     return dav_compare_locktoken(lt1, lt2);
- }
- 
-+static apr_status_t dav_fs_lockdb_cleanup(void *data)
-+{
-+    dav_lockdb *lockdb = data;
-+
-+    apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
-+
-+    if (lockdb->info->db) {
-+        dav_dbm_close(lockdb->info->db);
-+    }
-+    
-+    return APR_SUCCESS;
-+}
-+
- /*
- ** dav_fs_really_open_lockdb:
- **
-@@ -300,15 +312,27 @@ static int dav_fs_compare_locktoken(
- static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
- {
-     dav_error *err;
-+    apr_status_t rv;
- 
-     if (lockdb->info->opened)
-         return NULL;
- 
-+    rv = apr_global_mutex_lock(lockdb->info->conf->lockdb_mutex);
-+    if (rv) {
-+        return dav_new_error(lockdb->info->pool,
-+                             HTTP_INTERNAL_SERVER_ERROR,
-+                             DAV_ERR_LOCK_OPENDB, rv,
-+                             "Could not lock mutex for lock database.");
-+    }
-+    
-     err = dav_dbm_open_direct(lockdb->info->pool,
-                              lockdb->info->lockdb_path,
-+                              lockdb->info->conf->lockdb_path,
-+                              lockdb->info->conf->lockdb_type,
-                               lockdb->ro,
-                               &lockdb->info->db);
-     if (err != NULL) {
-+        apr_global_mutex_unlock(lockdb->info->conf->lockdb_mutex);
-+        
-         return dav_push_error(lockdb->info->pool,
-                               HTTP_INTERNAL_SERVER_ERROR,
-                               DAV_ERR_LOCK_OPENDB,
-@@ -316,6 +340,10 @@ static dav_error * dav_fs_really_open_lockdb(dav_lockdb *lockdb)
-                               err);
-     }
- 
-+    apr_pool_cleanup_register(lockdb->info->pool, lockdb,
-+                              dav_fs_lockdb_cleanup,
-+                              dav_fs_lockdb_cleanup);
-+
-     /* all right. it is opened now. */
-     lockdb->info->opened = 1;
- 
-@@ -341,9 +369,9 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
-     comb->pub.info = &comb->priv;
-     comb->priv.r = r;
-     comb->priv.pool = r->pool;
-
-    comb->priv.lockdb_path = dav_get_lockdb_path(r);
-    if (comb->priv.lockdb_path == NULL) {
-+    comb->priv.conf = dav_fs_get_server_conf(r);
-+    
-+    if (comb->priv.conf == NULL || comb->priv.conf->lockdb_path == NULL) {
-         return dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
-                              DAV_ERR_LOCK_NO_DB, 0,
-                              "A lock database was not specified with the "
-@@ -369,8 +397,8 @@ static dav_error * dav_fs_open_lockdb(request_rec *r, int ro, int force,
- */
- static void dav_fs_close_lockdb(dav_lockdb *lockdb)
- {
-    if (lockdb->info->db != NULL)
-        dav_dbm_close(lockdb->info->db);
-+    apr_pool_cleanup_run(lockdb->info->pool, lockdb,
-+                         dav_fs_lockdb_cleanup);
- }
- 
- /*
-diff --git a/modules/dav/fs/mod_dav_fs.c b/modules/dav/fs/mod_dav_fs.c
-index 2389f8f..4bf6c51 100644
--- a/modules/dav/fs/mod_dav_fs.c
-+++ b/modules/dav/fs/mod_dav_fs.c
-@@ -14,31 +14,35 @@
-  * limitations under the License.
-  */
- 
-+#if !defined(_MSC_VER) && !defined(NETWARE)
-+#include "ap_config_auto.h"
-+#endif
-+
- #include "httpd.h"
- #include "http_config.h"
-+#include "http_core.h"
-+#include "http_log.h"
- #include "apr_strings.h"
- 
- #include "mod_dav.h"
- #include "repos.h"
- 
-/* per-server configuration */
-typedef struct {
-    const char *lockdb_path;
-
-} dav_fs_server_conf;
-
- extern module AP_MODULE_DECLARE_DATA dav_fs_module;
- 
- #ifndef DEFAULT_DAV_LOCKDB
- #define DEFAULT_DAV_LOCKDB "davlockdb"
- #endif
-+#ifndef DEFAULT_DAV_LOCKDB_TYPE
-+#define DEFAULT_DAV_LOCKDB_TYPE "default"
-+#endif
- 
-const char *dav_get_lockdb_path(const request_rec *r)
-{
-    dav_fs_server_conf *conf;
-+static const char dav_fs_mutexid[] = "dav_fs-lockdb";
- 
-    conf = ap_get_module_config(r->server->module_config, &dav_fs_module);
-    return conf->lockdb_path;
-+static apr_global_mutex_t *dav_fs_lockdb_mutex;
-+
-+const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r)
-+{
-+    return ap_get_module_config(r->server->module_config, &dav_fs_module);
- }
- 
- static void *dav_fs_create_server_config(apr_pool_t *p, server_rec *s)
-@@ -57,15 +61,50 @@ static void *dav_fs_merge_server_config(apr_pool_t *p,
- 
-     newconf->lockdb_path =
-         child->lockdb_path ? child->lockdb_path : parent->lockdb_path;
-+    newconf->lockdb_type =
-+        child->lockdb_type ? child->lockdb_type : parent->lockdb_type;
- 
-     return newconf;
- }
- 
-+static int dav_fs_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
-+{
-+    if (ap_mutex_register(pconf, dav_fs_mutexid, NULL, APR_LOCK_DEFAULT, 0))
-+        return !OK;
-+    return OK;
-+}
-+
-+static void dav_fs_child_init(apr_pool_t *p, server_rec *s)
-+{
-+    apr_status_t rv;
-+    
-+    rv = apr_global_mutex_child_init(&dav_fs_lockdb_mutex,
-+                                     apr_global_mutex_lockfile(dav_fs_lockdb_mutex),
-+                                     p);
-+    if (rv) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
-+                     APLOGNO(10488) "child init failed for mutex");
-+    }                     
-+}
-+
- static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
-                                        apr_pool_t *ptemp, server_rec *base_server)
- {
-     server_rec *s;
-
-+    apr_status_t rv;
-+
-+    /* Ignore first pass through the config. */
-+    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-+        return OK;
-+
-+    rv = ap_global_mutex_create(&dav_fs_lockdb_mutex, NULL, dav_fs_mutexid, NULL,
-+                                base_server, p, 0);
-+    if (rv) {
-+        ap_log_error(APLOG_MARK, APLOG_ERR, rv, base_server,
-+                     APLOGNO(10489) "could not create lock mutex");
-+        return !OK;
-+    }                     
-+    
-     for (s = base_server; s; s = s->next) {
-         dav_fs_server_conf *conf;
- 
-@@ -74,6 +113,13 @@ static apr_status_t dav_fs_post_config(apr_pool_t *p, apr_pool_t *plog,
-         if (!conf->lockdb_path) {
-             conf->lockdb_path = ap_state_dir_relative(p, DEFAULT_DAV_LOCKDB);
-         }
-+        if (!conf->lockdb_type) {
-+            conf->lockdb_type = DEFAULT_DAV_LOCKDB_TYPE;
-+        }
-+
-+        /* Mutex is common across all vhosts, but could have one per
-+         * vhost if required. */
-+        conf->lockdb_mutex = dav_fs_lockdb_mutex;
-     }
- 
-     return OK;
-@@ -98,19 +144,36 @@ static const char *dav_fs_cmd_davlockdb(cmd_parms *cmd, void *config,
-     return NULL;
- }
- 
-+/*
-+ * Command handler for the DAVLockDBType directive, which is TAKE1
-+ */
-+static const char *dav_fs_cmd_davlockdbtype(cmd_parms *cmd, void *config,
-+                                        const char *arg1)
-+{
-+    dav_fs_server_conf *conf = ap_get_module_config(cmd->server->module_config,
-+                                                    &dav_fs_module);
-+    conf->lockdb_type = arg1;
-+
-+    return NULL;
-+}
-+
- static const command_rec dav_fs_cmds[] =
- {
-     /* per server */
-     AP_INIT_TAKE1("DAVLockDB", dav_fs_cmd_davlockdb, NULL, RSRC_CONF,
-                   "specify a lock database"),
-+    AP_INIT_TAKE1("DAVLockDBType", dav_fs_cmd_davlockdbtype, NULL, RSRC_CONF,
-+                  "specify a lock database DBM type"),
- 
-     { NULL }
- };
- 
- static void register_hooks(apr_pool_t *p)
- {
-+    ap_hook_pre_config(dav_fs_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
-     ap_hook_post_config(dav_fs_post_config, NULL, NULL, APR_HOOK_MIDDLE);
-
-+    ap_hook_child_init(dav_fs_child_init, NULL, NULL, APR_HOOK_MIDDLE);
-+    
-     dav_hook_gather_propsets(dav_fs_gather_propsets, NULL, NULL,
-                              APR_HOOK_MIDDLE);
-     dav_hook_find_liveprop(dav_fs_find_liveprop, NULL, NULL, APR_HOOK_MIDDLE);
-diff --git a/modules/dav/fs/repos.h b/modules/dav/fs/repos.h
-index b164611..d3a55a5 100644
--- a/modules/dav/fs/repos.h
-+++ b/modules/dav/fs/repos.h
-@@ -25,6 +25,8 @@
- #ifndef _DAV_FS_REPOS_H_
- #define _DAV_FS_REPOS_H_
- 
-+#include "util_mutex.h"
-+
- /* the subdirectory to hold all DAV-related information for a directory */
- #define DAV_FS_STATE_DIR                ".DAV"
- #define DAV_FS_STATE_FILE_FOR_DIR       ".state_for_dir"
-@@ -53,8 +55,8 @@ dav_error * dav_fs_get_locknull_members(const dav_resource *resource,
- /* DBM functions used by the repository and locking providers */
- extern const dav_hooks_db dav_hooks_db_dbm;
- 
-dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname, int ro,
-                                dav_db **pdb);
-+dav_error * dav_dbm_open_direct(apr_pool_t *p, const char *pathname,
-+                                const char *dbmtype, int ro, dav_db **pdb);
- void dav_dbm_get_statefiles(apr_pool_t *p, const char *fname,
-                             const char **state1, const char **state2);
- dav_error * dav_dbm_delete(dav_db *db, apr_datum_t key);
-@@ -64,8 +66,15 @@ void dav_dbm_freedatum(dav_db *db, apr_datum_t data);
- int dav_dbm_exists(dav_db *db, apr_datum_t key);
- void dav_dbm_close(dav_db *db);
- 
-/* where is the lock database located? */
-const char *dav_get_lockdb_path(const request_rec *r);
-+/* Per-server configuration. */
-+typedef struct {
-+    const char *lockdb_path;
-+    const char *lockdb_type;
-+    apr_global_mutex_t *lockdb_mutex;
-+} dav_fs_server_conf;
-+
-+/* Returns server configuration for the request. */
-+const dav_fs_server_conf *dav_fs_get_server_conf(const request_rec *r);
- 
- const dav_hooks_locks *dav_fs_get_lock_hooks(request_rec *r);
- const dav_hooks_propdb *dav_fs_get_propdb_hooks(request_rec *r);
--- a/httpd-2.4.64-mod_systemd.patch
+++ b/httpd-2.4.64-mod_systemd.patch
@ -1,98 +0,0 @@
-
-More verbose startup logging for mod_systemd.
-
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index 22482fd..b46d3ef 100644
--- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -34,11 +34,14 @@
- #endif
- 
- #include "systemd/sd-daemon.h"
-+#include "systemd/sd-journal.h"
- 
- #if APR_HAVE_UNISTD_H
- #include <unistd.h>
- #endif
- 
-+static char describe_listeners[30];
-+
- static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-                               apr_pool_t *ptemp)
- {
-@@ -63,6 +66,20 @@ static void log_selinux_context(void)
- }
- #endif
- 
-+static char *dump_listener(ap_listen_rec *lr, apr_pool_t *p)
-+{
-+    apr_sockaddr_t *sa = lr->bind_addr;
-+    char addr[128];
-+
-+    if (apr_sockaddr_is_wildcard(sa)) {
-+        return apr_pstrcat(p, "port ", apr_itoa(p, sa->port), NULL);
-+    }
-+
-+    apr_sockaddr_ip_getbuf(addr, sizeof addr, sa);
-+
-+    return apr_psprintf(p, "%s port %u", addr, sa->port);
-+}
-+
- /* Report the service is ready in post_config, which could be during
-  * startup or after a reload.  The server could still hit a fatal
-  * startup error after this point during ap_run_mpm(), so this is
-@@ -73,23 +90,52 @@ static void log_selinux_context(void)
- static int systemd_post_config(apr_pool_t *pconf, apr_pool_t *plog,
-                                apr_pool_t *ptemp, server_rec *main_server)
- {
-+    ap_listen_rec *lr;
-+    apr_size_t plen = sizeof describe_listeners;
-+    char *p = describe_listeners;
-+
-     if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG)
-         return OK;
- 
-+    for (lr = ap_listeners; lr; lr = lr->next) {
-+        char *s = dump_listener(lr, ptemp);
-+
-+        if (strlen(s) + 3 < plen) {
-+            char *newp = apr_cpystrn(p, s, plen);
-+            if (lr->next)
-+                newp = apr_cpystrn(newp, ", ", 3);
-+            plen -= newp - p;
-+            p = newp;
-+        }
-+        else {
-+            if (plen < 4) {
-+                p = describe_listeners + sizeof describe_listeners - 4;
-+                plen = 4;
-+            }
-+            apr_cpystrn(p, "...", plen);
-+            break;
-+        }
-+    }
-+
- #ifdef HAVE_SELINUX
-     log_selinux_context();
- #endif
- 
-     sd_notify(0, "READY=1\n"
-               "STATUS=Configuration loaded.\n");
-+
-+    sd_journal_print(LOG_INFO, "Server configured, listening on: %s",
-+                     describe_listeners);
-+
-     return OK;
- }
- 
- static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
- {
-     sd_notifyf(0, "READY=1\n"
-               "STATUS=Processing requests...\n"
-               "MAINPID=%" APR_PID_T_FMT, getpid());
-+               "STATUS=Started, listening on: %s\n"
-+               "MAINPID=%" APR_PID_T_FMT,
-+               describe_listeners, getpid());
- 
-     return OK;
- }
--- a/httpd-2.4.64-separate-systemd-fns.patch
+++ b/httpd-2.4.64-separate-systemd-fns.patch
@ -1,101 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 05abe18..97484c9 100644
--- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -631,7 +631,6 @@ case $host in
-       if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
-         AC_MSG_WARN([Your system does not support systemd.])
-       else
-        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
-         AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
-       fi
-    fi
-diff --git a/modules/arch/unix/mod_systemd.c b/modules/arch/unix/mod_systemd.c
-index af68249..7232a45 100644
--- a/modules/arch/unix/mod_systemd.c
-+++ b/modules/arch/unix/mod_systemd.c
-@@ -40,6 +40,9 @@
- #include <unistd.h>
- #endif
- 
-+APR_DECLARE_OPTIONAL_FN(int,
-+                        ap_systemd_journal_stream_fd, (const char *, int, int));
-+
- static char describe_listeners[30];
- 
- static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
-@@ -217,10 +220,15 @@ static int ap_systemd_listen_fds(int unset_environment){
-     return sd_listen_fds(unset_environment);
- }
- 
-+static int ap_systemd_journal_stream_fd(const char *identifier, int priority, int level_prefix){
-+    return sd_journal_stream_fd("httpd", priority, 0);
-+}
-+
- static void systemd_register_hooks(apr_pool_t *p)
- {
-     APR_REGISTER_OPTIONAL_FN(ap_systemd_listen_fds);
-     APR_REGISTER_OPTIONAL_FN(ap_find_systemd_socket);
-+    APR_REGISTER_OPTIONAL_FN(ap_systemd_journal_stream_fd);
- 
-     /* Enable ap_extended_status. */
-     ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
-diff --git a/modules/loggers/config.m4 b/modules/loggers/config.m4
-index 0848d2e..8af2299 100644
--- a/modules/loggers/config.m4
-+++ b/modules/loggers/config.m4
-@@ -5,7 +5,6 @@ dnl APACHE_MODULE(name, helptext[, objects[, structname[, default[, config]]]])
- APACHE_MODPATH_INIT(loggers)
- 	
- APACHE_MODULE(log_config, logging configuration.  You won't be able to log requests to the server without this module., , , yes)
-APR_ADDTO(MOD_LOG_CONFIG_LDADD, [$SYSTEMD_LIBS])
- 
- APACHE_MODULE(log_debug, configurable debug logging, , , most)
- APACHE_MODULE(log_forensic, forensic logging)
-diff --git a/modules/loggers/mod_log_config.c b/modules/loggers/mod_log_config.c
-index 694f447..a65b982 100644
--- a/modules/loggers/mod_log_config.c
-+++ b/modules/loggers/mod_log_config.c
-@@ -172,10 +172,6 @@
- #include <limits.h>
- #endif
- 
-#ifdef HAVE_SYSTEMD
-#include <systemd/sd-journal.h>
-#endif
-
- #define DEFAULT_LOG_FORMAT "%h %l %u %t \"%r\" %>s %b"
- 
- module AP_MODULE_DECLARE_DATA log_config_module;
-@@ -1640,8 +1636,15 @@ static apr_status_t wrap_journal_stream(apr_pool_t *p, apr_file_t **outfd,
- {
- #ifdef HAVE_SYSTEMD
-     int fd;
-+    APR_OPTIONAL_FN_TYPE(ap_systemd_journal_stream_fd) *systemd_journal_stream_fd;
-+    
-+    systemd_journal_stream_fd = APR_RETRIEVE_OPTIONAL_FN(ap_systemd_journal_stream_fd);
-+    if (systemd_journal_stream_fd == NULL) {
-+        return APR_ENOTIMPL;
-+    }
- 
-    fd = sd_journal_stream_fd("httpd", priority, 0);
-+    fd = systemd_journal_stream_fd("httpd", priority, 0);
-+    
-     if (fd < 0) return fd;
- 
-     /* This is an AF_UNIX socket fd so is more pipe-like than
-diff --git a/modules/loggers/mod_log_config.h b/modules/loggers/mod_log_config.h
-index 877a593..bd52a98 100644
--- a/modules/loggers/mod_log_config.h
-+++ b/modules/loggers/mod_log_config.h
-@@ -69,6 +69,10 @@ APR_DECLARE_OPTIONAL_FN(ap_log_writer_init*, ap_log_set_writer_init,(ap_log_writ
-  */
- APR_DECLARE_OPTIONAL_FN(ap_log_writer*, ap_log_set_writer, (ap_log_writer* func));
- 
-+#ifdef HAVE_SYSTEMD
-+APR_DECLARE_OPTIONAL_FN(int, ap_systemd_journal_stream_fd, (const char *, int, int));
-+#endif
-+
- #endif /* MOD_LOG_CONFIG */
- /** @} */
- 
--- a/httpd-2.4.65-hcheck-stuck.patch
+++ b/httpd-2.4.65-hcheck-stuck.patch
@ -1,66 +0,0 @@
--- a/modules/proxy/mod_proxy_hcheck.c
-+++ b/modules/proxy/mod_proxy_hcheck.c
-@@ -989,12 +989,30 @@ static apr_status_t hc_watchdog_callback(int state
-     sctx_t *ctx = (sctx_t *)data;
-     server_rec *s = ctx->s;
-     proxy_server_conf *conf;
-+    proxy_worker **workers;
-+    proxy_worker *worker;
-+    apr_time_t now;
-+    int i, n;
- 
-+    conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
-+    balancer = (proxy_balancer *)conf->balancers->elts;
-+
-     switch (state) {
-         case AP_WATCHDOG_STATE_STARTING:
-             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(03258)
-                          "%s watchdog started.",
-                          HCHECK_WATHCHDOG_NAME);
-+            /* set last update time for all workers */
-+            now = apr_time_now();
-+            for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
-+                workers = (proxy_worker **)balancer->workers->elts;
-+                for (n = 0; n < balancer->workers->nelts; n++, ++workers) {
-+                    worker = *workers;
-+                    if (worker->s->updated == 0) {
-+                        worker->s->updated = now;
-+                    }
-+                }
-+            }
- #if HC_USE_THREADS
-             if (tpsize && hctp == NULL) {
-                 rv =  apr_thread_pool_create(&hctp, tpsize,
-@@ -1020,21 +1038,13 @@ static apr_status_t hc_watchdog_callback(int state
- 
-         case AP_WATCHDOG_STATE_RUNNING:
-             /* loop thru all workers */
-            if (s) {
-                int i;
-                conf = (proxy_server_conf *) ap_get_module_config(s->module_config, &proxy_module);
-                balancer = (proxy_balancer *)conf->balancers->elts;
-                ctx->s = s;
-+            {
-+                now = apr_time_now();
-                 for (i = 0; i < conf->balancers->nelts; i++, balancer++) {
-                    int n;
-                    apr_time_t now;
-                    proxy_worker **workers;
-                    proxy_worker *worker;
-                     /* Have any new balancers or workers been added dynamically? */
-                     ap_proxy_sync_balancer(balancer, s, conf);
-                     workers = (proxy_worker **)balancer->workers->elts;
-                    now = apr_time_now();
-                    for (n = 0; n < balancer->workers->nelts; n++) {
-+                    for (n = 0; n < balancer->workers->nelts; n++, workers++) {
-                         worker = *workers;
-                         if (!PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED) &&
-                             (worker->s->method != NONE) &&
-@@ -1074,7 +1084,6 @@ static apr_status_t hc_watchdog_callback(int state
-                                 hc_check(NULL, baton);
-                             }
-                         }
-                        workers++;
-                     }
-                 }
-             }
--- a/httpd-2.4.43-apxs.patch
+++ b/httpd-2.4.43-apxs.patch
@ -1,11 +1,8 @@
-
-Upstream-Status: local customisation
-
 diff --git a/support/apxs.in b/support/apxs.in
-index b2705fa..c331631 100644
+index ad1287f..efcfcf6 100644
 --- a/support/apxs.in
 +++ b/support/apxs.in
-@@ -35,7 +35,18 @@ if ($ddi >= 0) {
+@@ -25,7 +25,18 @@ package apxs;
 
 my %config_vars = ();
 
@ -22,10 +19,10 @@ index b2705fa..c331631 100644
 +
 +my $installbuilddir = $libdir . "/httpd/build";
 +
- get_config_vars($destdir . "$installbuilddir/config_vars.mk",\%config_vars);
+ get_config_vars("$installbuilddir/config_vars.mk",\%config_vars);
 
 # read the configuration variables once
-@@ -285,7 +296,7 @@ if ($opt_g) {
+@@ -275,7 +286,7 @@ if ($opt_g) {
     $data =~ s|%NAME%|$name|sg;
     $data =~ s|%TARGET%|$CFG_TARGET|sg;
     $data =~ s|%PREFIX%|$prefix|sg;
@ -34,7 +31,7 @@ index b2705fa..c331631 100644
 
     my ($mkf, $mods, $src) = ($data =~ m|^(.+)-=#=-\n(.+)-=#=-\n(.+)|s);
 
-@@ -463,11 +474,11 @@ if ($opt_c) {
+@@ -453,11 +464,11 @@ if ($opt_c) {
     my $ldflags = "$CFG_LDFLAGS";
     if ($opt_p == 1) {
         
@ -48,7 +45,7 @@ index b2705fa..c331631 100644
             chomp($apu_libs);
         }
         
-@@ -682,8 +693,8 @@ __DATA__
+@@ -672,8 +683,8 @@ __DATA__
 
 builddir=.
 top_srcdir=%PREFIX%
--- a/httpd-init.service
+++ b/httpd-init.service
@ -8,6 +8,5 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key
 [Service]
 Type=oneshot
 RemainAfterExit=no
-PrivateTmp=true

 ExecStart=/usr/libexec/httpd-ssl-gencerts
--- a/1
+++ b/1
@ -33,7 +33,6 @@ sscg -q                                                             \
     --cert-file           /etc/pki/tls/certs/localhost.crt         \
     --cert-key-file       /etc/pki/tls/private/localhost.key       \
     --ca-file             /etc/pki/tls/certs/localhost.crt         \
-     --no-dhparams-file                                             \
     --lifetime            365                                      \
     --hostname            $FQDN                                    \
     --email               root@$FQDN
--- a/httpd.conf
+++ b/httpd.conf
@ -6,9 +6,6 @@
 # <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
 # for a discussion of each configuration directive.
 #
-# See the httpd.conf(5) man page for more information on this configuration,
-# and httpd.service(8) on using and configuring the httpd service.
-#
 # Do NOT simply read the instructions in here without understanding
 # what they do.  They're here only as hints or reminders.  If you are unsure
 # consult the online docs. You have been warned.  
@ -38,10 +35,8 @@ ServerRoot "/etc/httpd"
 # ports, instead of the default. See also the <VirtualHost>
 # directive.
 #
-# Change this to Listen on a specific IP address, but note that if
-# httpd.service is enabled to run at boot time, the address may not be
-# available when the service starts.  See the httpd.service(8) man
-# page for more information.
+# Change this to Listen on specific IP addresses as shown below to 
+# prevent Apache from glomming onto all bound IP addresses.
 #
 #Listen 12.34.56.78:80
 Listen 80
@ -151,7 +146,7 @@ DocumentRoot "/var/www/html"
    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
-    #   AllowOverride FileInfo AuthConfig Limit
+    #   Options FileInfo AuthConfig Limit
    #
    AllowOverride None

@ -199,7 +194,6 @@ LogLevel warn
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
-    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" PID: %P %{tid}P %T" combined_ext
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
@ -217,11 +211,10 @@ LogLevel warn
    #CustomLog "logs/access_log" common

    #
-    # If you prefer a logfile with access, agent, referer, and process/thread
-    # information (an extended Combined Logfile Format), you can use the
-    # following directive.
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
    #
-    CustomLog "logs/access_log" combined_ext
+    CustomLog "logs/access_log" combined
 </IfModule>

 <IfModule alias_module>
@ -265,15 +258,6 @@ LogLevel warn
    Require all granted
 </Directory>

-<IfModule headers_module>
-    #
-    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
-    # backend servers which have lingering "httpoxy" defects.
-    # 'Proxy' request header is undefined by the IETF, not listed by IANA
-    #
-    RequestHeader unset Proxy early
-</IfModule>
-
 <IfModule mime_module>
    #
    # TypesConfig points to the file containing the list of mappings from
@ -351,13 +335,6 @@ AddDefaultCharset UTF-8
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #

-#
-# MaxRanges: Maximum number of Ranges in a request before
-# returning the entire resource, or one of the special
-# values 'default', 'none' or 'unlimited'.
-# Default setting is to accept 200 Ranges.
-#MaxRanges unlimited
-
 #
 # EnableMMAP and EnableSendfile: On systems that support it, 
 # memory-mapping or the sendfile syscall may be used to deliver
--- a/httpd.conf.xml
+++ b/httpd.conf.xml
@ -1,264 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-
-]>
-<!--
- Copyright 2018 Red Hat, Inc.
-
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements.  See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License.  You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-->
-
-<refentry>
-  <refentryinfo>
-    <title>httpd.conf</title>
-    <productname>httpd</productname>
-    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>httpd.conf</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-  
-  <refnamediv>
-    <refname>httpd.conf</refname>
-    <refpurpose>Configuration files for httpd</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <para>
-      <filename>/etc/httpd/conf/httpd.conf</filename>, 
-      <filename>/etc/httpd/conf.modules.d</filename>,
-      <filename>/etc/httpd/conf.d</filename>
-    </para>
-  </refsynopsisdiv>
-  
-  <refsect1>
-    <title>Description</title>
-
-    <para>The main configuration file for the <command>httpd</command> daemon is
-    <filename>/etc/httpd/conf/httpd.conf</filename>.  The syntax of
-    this file is described at <ulink
-    url="https://httpd.apache.org/docs/2.4/configuring.html"/>, and
-    the full set of available directives is listed at <ulink
-    url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>.
-    </para>
-
-    <refsect2>
-      <title>Configuration structure</title>
-
-      <para>The main configuration file
-      (<filename>httpd.conf</filename>) sets up various defaults and
-      includes configuration files from two directories -
-      <filename>/etc/httpd/conf.modules.d</filename> and
-      <filename>/etc/httpd/conf.d</filename>.  Packages containing
-      loadable modules (like <option>mod_ssl.so</option>) place files
-      in the <filename>conf.modules.d</filename> directory with the
-      appropriate <option>LoadModule</option> directive so that module
-      is loaded by default.</para>
-
-      <para>Some notable configured defaults are:</para>
-
-      <variablelist>
-        <varlistentry>
-          <term><option>DocumentRoot @DOCROOT@/html</option></term>
-          <listitem><para>The default document root from which content
-          is served.</para></listitem>
-        </varlistentry>
-        <varlistentry>
-          <term><option>Listen 80</option></term>
-          <listitem><para>The daemon listens on TCP port 80.</para></listitem>
-        </varlistentry>
-        <varlistentry>
-          <term><option>ErrorLog "logs/error_log"</option></term>
-          <listitem><para>Error messages are logged to
-          <filename>@LOGDIR@/error_log</filename>.</para></listitem>
-        </varlistentry>
-        <varlistentry>
-          <term><option>ScriptAlias /cgi-bin/ "@DOCROOT@/cgi-bin/"</option></term>
-          <listitem><para>CGI scripts are served via the URL-path <option>/cgi-bin/</option>.</para></listitem>
-        </varlistentry>
-        
-      </variablelist>
-
-      <para>To remove any of the default configuration provided in
-      separate files covered below, replace that file with an empty
-      file rather than removing it from the filesystem, otherwise it
-      may be restored to the original when the package which provides
-      it is upgraded.</para>
-      
-    </refsect2>
-
-    <refsect2>
-      <title>MPM configuration</title>
-
-      <para>The configuration file at
-      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename> is
-      used to select the multi-processing module (MPM), which governs
-      how <command>httpd</command> divides work between processes
-      and/or threads at run-time.  Exactly one
-      <option>LoadModule</option> directive must be uncommented in
-      this file; by default the <option>@MPM@</option> MPM is enabled.
-      For more information on MPMs, see <ulink
-      url="https://httpd.apache.org/docs/2.4/mpm.html"/>.</para>
-
-      <para>If using the <emphasis>prefork</emphasis> MPM, the
-      "httpd_graceful_shutdown" SELinux boolean should also be
-      enabled, since with this MPM, httpd needs to establish TCP
-      connections to local ports to successfully complete a graceful
-      restart or shutdown. This boolean can be enabled by running the
-      command: <command>semanage boolean -m --on
-      httpd_graceful_shutdown</command></para>
-    </refsect2>
-    
-    <refsect2>
-      <title>Module configuration files</title>
-      
-      <para>Module configuration files are provided in the
-      <filename>/etc/httpd/conf.modules.d/</filename> directory.
-      Filenames in this directory are by convention prefixed with two
-      digit numeric prefix to ensure they are processed in the desired
-      order.  Core modules provided with the <command>httpd</command>
-      package are loaded by files with a <option>0x-</option> prefix
-      to ensure these load first.  Only filenames with a
-      <option>.conf</option> suffix in this directory will be
-      processed.</para>
-
-      <para>Other provided configuration files are listed below.
-      
-      <variablelist>
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.modules.d/00-base.conf</filename></term>
-          <listitem><para>The set of core modules included with
-          <command>httpd</command> which are all loaded by
-          default.</para></listitem>
-        </varlistentry>
-        
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.modules.d/00-optional.conf</filename></term>
-          <listitem><para>The set of non-core modules included with
-          <command>httpd</command> which are <emphasis>not</emphasis>
-          loaded by default.</para></listitem>
-        </varlistentry>
-        
-
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.modules.d/00-systemd.conf</filename></term>
-          <listitem><para>This file loads <option>mod_systemd</option>
-          which is necessary for the correct operation of the
-          <command>httpd.service</command> systemd unit, and should
-          not be removed or disabled.</para></listitem>
-        </varlistentry>
-      </variablelist>
-      </para>
-    </refsect2>
-        
-    <refsect2>
-      <title>Other configuration files</title>
-
-      <para>Default module configuration files and site-specific
-      configuration files are loaded from the
-      <filename>/etc/httpd/conf.d/</filename> directory.  Only files
-      with a <option>.conf</option> suffix will be loaded.  The
-      following files are provided:
-
-      <variablelist>
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.d/userdir.conf</filename></term>
-          <listitem><para>This file gives an example configuration for
-          <option>mod_userdir</option> to map URLs such as
-          <option>http://localhost/~jim/</option> to
-          <filename>/home/jim/public_html/</filename>. Userdir mapping
-          is disabled by default.</para></listitem>
-        </varlistentry>
-
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.d/autoindex.conf</filename></term>
-          <listitem><para>This file provides the default configuration
-          for <option>mod_autoindex</option> which generates HTML
-          directory listings when enabled.  It also makes file icon
-          image files available at the <option>/icons/</option>
-          URL-path.</para></listitem>
-        </varlistentry>
-
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.d/welcome.conf</filename></term>
-          <listitem><para>This file enables a "welcome page" at
-          <option>http://localhost/</option> if no content is present
-          in the default documentation root
-          <filename>/var/www/html</filename>.</para></listitem>
-        </varlistentry>
-
-        <varlistentry>
-          <term><filename>/etc/httpd/conf.d/ssl.conf</filename> (present only if <option>mod_ssl</option> is installed)</term>
-          <listitem><para>This file configures a TLS
-          <option>VirtualHost</option> listening on port
-          <option>443</option>.  If the default configuration is used,
-          the referenced test certificate and private key are
-          generated the first time <command>httpd.service</command> is
-          started; see
-          <citerefentry><refentrytitle>httpd-init.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-          for more information.</para></listitem>
-        </varlistentry>
-        
-      </variablelist></para>
-    </refsect2>
-    
-    <refsect2>
-      <title>Instantiated services</title>
-
-      <para>As an alternative to (or in addition to) the
-      <command>httpd.service</command> unit, the instantiated template
-      service <command>httpd@.service</command> unit file can be used,
-      which starts <command>httpd</command> using a different
-      configuration file to the default. For example,
-      <command>systemctl start httpd@foobar.service</command> will
-      start httpd using the configuration file
-      <filename>/etc/httpd/conf/foobar.conf</filename>.  See <citerefentry><refentrytitle>httpd@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more information.</para>
-    </refsect2>
-      
-  </refsect1>
-  <refsect1>
-    <title>Files</title>
-
-    <para>
-      <filename>/etc/httpd/conf/httpd.conf</filename>, 
-      <filename>/etc/httpd/conf.d</filename>, 
-      <filename>/etc/httpd/conf.modules.d</filename>
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
-  
-  <refsect1>
-    <title>See also</title>
-
-    <para>
-    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
-    <citerefentry><refentrytitle>httpd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <ulink url="https://httpd.apache.org/docs/2.4/configuring.html"/>,
-    <ulink url="https://httpd.apache.org/docs/2.4/mod/directives.html"/>
-    </para>
-  </refsect1>
-
-</refentry>
-
-<!-- LocalWords:  systemd PidFile
-->
--- a/httpd.logrotate
+++ b/httpd.logrotate
@ -1,5 +1,3 @@
-# Note that logs are not compressed unless "compress" is configured,
-# which can be done either here or globally in /etc/logrotate.conf.
 /var/log/httpd/*log {
    missingok
    notifempty
--- a/httpd.service
+++ b/httpd.service
@ -26,25 +26,7 @@ ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
-DevicePolicy=closed
-KeyringMode=private
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-OOMPolicy=continue
-PrivateDevices=yes
 PrivateTmp=true
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=read-only
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectSystem=yes
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native

 [Install]
 WantedBy=multi-user.target
--- a/httpd.service.xml
+++ b/httpd.service.xml
@ -56,8 +56,8 @@

    <para>This manual page describes the <command>systemd</command>
    unit files used to integrate the <command>httpd</command> daemon
-    with <command>systemd</command>. Two main unit files are
-    available: <command>httpd.service</command> allows the
+    with <command>systemd</command>. Two unit files are available:
+    <command>httpd.service</command> allows the
    <command>httpd</command> daemon to be run as a system service, and
    <command>httpd.socket</command> allows httpd to be started via
    socket-based activation. Most systems will use
@ -175,17 +175,12 @@ Wants=network-online.target</programlisting>
      <para>System packages (including the httpd package itself) may
      restart the httpd service automatically after packages are
      upgraded, installed, or removed. This is done using the
-      <command>systemctl try-restart httpd.service</command> command, which
-      stops then starts the service if it is running.</para>
+      <command>systemctl reload httpd.service</command>, which
+      produces a <emphasis>graceful</emphasis> restart by default as
+      described above.</para>

-      <para>To disable automatic restarts, create the file
-      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.
-      When <command>httpd</command> interfaces are added in an update,
-      it may not be safe to <emphasis>reload</emphasis> a running
-      service after upgrading, if updated modules require interfaces
-      only available in the updated <command>httpd</command> binary.
-      It is recommended to allow automatic restarts for this
-      reason.</para>
+      <para>To suppress automatic reloads entirely, create the file
+      <filename>/etc/sysconfig/httpd-disable-posttrans</filename>.</para>
    </refsect2>

    <refsect2>
@ -193,10 +188,17 @@ Wants=network-online.target</programlisting>

      <para>httpd offers a choice of multi-processing modules (MPMs),
      which can be configured in
-      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.
-      See
-      <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      for more information on changing the MPM.</para>
+      <filename>/etc/httpd/conf.modules.d/00-mpm.conf</filename>.  The
+      default is to use the <emphasis>@MPM@</emphasis> MPM.</para>
+
+      <para>If using the <emphasis>prefork</emphasis> MPM, the
+      "httpd_graceful_shutdown" SELinux boolean should also be
+      enabled, since with this MPM, httpd needs to establish TCP
+      connections to local ports to successfully complete a graceful
+      restart or shutdown. This boolean can be enabled by running the
+      command: <command>semanage boolean -m --on
+      httpd_graceful_shutdown</command></para>
+
    </refsect2>

    <refsect2>
@ -221,74 +223,19 @@ Wants=network-online.target</programlisting>
      to which httpd can bind (using the <literal>Listen</literal>
      directive), which parts of the filesystem can be accessed, and
      whether outgoing TCP connections are possible. Many of these
-      restrictions can be relaxed or adjusted by using
-      <command>semanage</command> to change booleans or other
-      types. See
+      restrictions can be adjusted using <command>semanage</command>
+      to change booleans or other types. See
      <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
      for more information.</para>
-    </refsect2>

-    <refsect2>
-      <title>Process policies and restrictions</title>
-
-      <para>The <command>httpd.service</command> unit enables a
-      variety of sandboxing options. Many of these prevent the service
-      from changing the system configuration or attributes of the
-      kernel - such as <emphasis>ProtectClock</emphasis> and
-      <emphasis>ProtectKernelModules</emphasis>. See
+      <para>The httpd service enables <emphasis>PrivateTmp</emphasis>
+      by default. The <filename>/tmp</filename> and
+      <filename>/var/tmp</filename> directories available within the
+      httpd process (and CGI scripts, etc) are not shared by other
+      processes. See
      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      and
-      <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      for more information on these options. Particular notice should
-      be taken of the following:
+      for more information.</para>

-      <itemizedlist>
-        <listitem><para><emphasis>PrivateTmp</emphasis> is enabled by
-        default. The <filename>/tmp</filename> and
-        <filename>/var/tmp</filename> directories available within the
-        httpd process (and CGI scripts, etc) are not shared by other
-        processes.</para></listitem>
-
-        <listitem><para><emphasis>OOMPolicy</emphasis> is set to
-        <emphasis>continue</emphasis> by default.  Under the default
-        Out-of-Memory policy, the entire service will be terminated if
-        any process is killed by the kernel OOM killer.  By setting
-        the policy to <emphasis>continue</emphasis>, httpd will
-        continue to run (and recover) if a single child is terminated
-        because of excess memory consumption.</para></listitem>
-
-        <listitem><para><emphasis>ProtectHome</emphasis> is set to
-        <emphasis>read-only</emphasis> by default. CGI scripts run via
-        <emphasis>UserDir</emphasis> will not be able modify any
-        content in <filename>/home</filename> by
-        default.</para></listitem>
-
-        <listitem><para><emphasis>ProtectSystem</emphasis> is set to
-        <emphasis>yes</emphasis> by default; this mounts various
-        system paths like <filename>/usr</filename> and
-        <filename>/boot</filename> as read-only by
-        default.</para></listitem>
-
-      </itemizedlist></para>
-
-    </refsect2>
-
-    <refsect2>
-      <title>Logging and log file rotation</title>
-
-      <para>The <command>httpd</command> daemon is configured to log
-      to the <filename>/var/log/httpd</filename> directory by default,
-      and a drop-in for <command>logrotate</command> is provided at
-      <filename>/etc/logrotate.d/httpd</filename> to enable log file
-      rotation.  The <command>httpd.service</command> systemd unit is
-      reloaded after a <command>logrotate</command> run.</para>
-
-      <para>Log file compression is not enabled by default; since
-      <command>httpd</command> can continue writing to open log files
-      for some time after a reload (graceful restart), if compression
-      is enabled the <literal>delaycompress</literal> option must be
-      present (as in the default) to delay compression of log files to
-      a later rotation run.</para>
    </refsect2>

    <refsect2>
@ -319,9 +266,9 @@ Wants=network-online.target</programlisting>
    <refsect2>
      <title>Instantiated services</title>

-      <para>The <command>httpd@.service</command> unit is a template
-      for creating instantiated services. An instance of this unit
-      will be started using the configuration file
+      <para>The <command>httpd@.service</command> unit is an
+      instantiated template service. An instance of this unit will be
+      started using the configuration file
      <filename>/etc/httpd/conf/INSTANCE.conf</filename>, where
      <emphasis>INSTANCE</emphasis> is replaced with the instance
      name.  For example, <command>systemctl start
@ -339,7 +286,7 @@ Wants=network-online.target</programlisting>
      paths, and <command>Listen</command> to choose different ports.
      The example configuration file
      <filename>/usr/share/doc/httpd/instance.conf</filename>
-      demonstrates how to make such changes using the
+      demonstrates how to make such changes using
      <option>HTTPD_INSTANCE</option> variable.</para>

      <para>It can be useful to configure instances of
@ -368,26 +315,19 @@ ReloadPropagatedFrom=httpd.service</programlisting>
    <filename>/usr/lib/systemd/system/httpd@.service</filename>,
    <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
  </refsect1>
-
-  <refsect1>
-    <title>Reporting Bugs</title>
-    <para>Please report bugs by filing an issue in @BUG_REPORT_URL@.</para>
-  </refsect1>
-
+  
  <refsect1>
    <title>See also</title>

    <para>
    <citerefentry><refentrytitle>httpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, 
-    <citerefentry><refentrytitle>httpd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
    <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
    <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>, 
    <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
    <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
    <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-    <citerefentry><refentrytitle>logrotate</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    <citerefentry><refentrytitle>semanage</refentrytitle><manvolnum>8</manvolnum></citerefentry>
    </para>
  </refsect1>

--- a/httpd.spec
+++ b/httpd.spec
--- a/httpd.sysusers
+++ b/httpd.sysusers
@ -1,2 +0,0 @@
-g apache 48
-u apache 48 "Apache" /usr/share/httpd /sbin/nologin
--- a/httpd.tmpfiles
+++ b/httpd.tmpfiles
@ -1,9 +1,2 @@
 d /run/httpd   710 root apache
 d /run/httpd/htcacheclean   700 apache apache
-d /var/log/httpd 700 root root -
-d /var/www       755 root root -
-d /var/www/html  755 root root -
-d /var/www/cgi-bin 755 root root -
-d /var/lib/httpd 700 apache apache -
-d /var/cache/httpd 700 apache apache -
-d /var/cache/httpd/proxy 700 apache apache -
--- a/httpd@.service
+++ b/httpd@.service
@ -12,32 +12,12 @@ Environment=LANG=C
 Environment=HTTPD_INSTANCE=%i
 ExecStartPre=/bin/mkdir -m 710 -p /run/httpd/instance-%i
 ExecStartPre=/bin/chown root.apache /run/httpd/instance-%i
-ExecStartPre=/bin/mkdir -m 700 -p /var/lib/httpd/instance-%i
-ExecStartPre=/bin/chown apache.apache /var/lib/httpd/instance-%i
 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND -f conf/%i.conf
 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful -f conf/%i.conf
 # Send SIGWINCH for graceful stop
 KillSignal=SIGWINCH
 KillMode=mixed
-DevicePolicy=closed
-KeyringMode=private
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-OOMPolicy=continue
-PrivateDevices=yes
 PrivateTmp=true
-ProtectClock=yes
-ProtectControlGroups=yes
-ProtectHome=read-only
-ProtectHostname=yes
-ProtectKernelLogs=yes
-ProtectKernelModules=yes
-ProtectKernelTunables=yes
-ProtectSystem=yes
-RestrictNamespaces=yes
-RestrictRealtime=yes
-RestrictSUIDSGID=yes
-SystemCallArchitectures=native

 [Install]
 WantedBy=multi-user.target
--- a/index.html
+++ b/index.html
@ -0,0 +1,132 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+	<head>
+		<title>Test Page for the Apache HTTP Server on Fedora</title>
+		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+		<style type="text/css">
+			/*<![CDATA[*/
+			body {
+				background-color: #fff;
+				color: #000;
+				font-size: 0.9em;
+				font-family: sans-serif,helvetica;
+				margin: 0;
+				padding: 0;
+			}
+			:link {
+				color: #c00;
+			}
+			:visited {
+				color: #c00;
+			}
+			a:hover {
+				color: #f50;
+			}
+			h1 {
+				text-align: center;
+				margin: 0;
+				padding: 0.6em 2em 0.4em;
+				background-color: #22437f;
+				color: #fff;
+				font-weight: normal;
+				font-size: 1.75em;
+				border-bottom: 2px solid #000;
+			}
+			h1 strong {
+				font-weight: bold;
+			}
+			h2 {
+				font-size: 1.1em;
+				font-weight: bold;
+			}
+			hr {
+				display: none;
+			}
+			.content {
+				padding: 1em 5em;
+			}
+			.content-columns {
+				/* Setting relative positioning allows for 
+				absolute positioning for sub-classes */
+				position: relative;
+				padding-top: 1em;
+			}
+			.content-column-left {
+				/* Value for IE/Win; will be overwritten for other browsers */
+				width: 47%;
+				padding-right: 3%;
+				float: left;
+				padding-bottom: 2em;
+			}
+			.content-column-left hr {
+				display: none;
+			}
+			.content-column-right {
+				/* Values for IE/Win; will be overwritten for other browsers */
+				width: 47%;
+				padding-left: 3%;
+				float: left;
+				padding-bottom: 2em;
+			}
+			.content-columns>.content-column-left, .content-columns>.content-column-right {
+				/* Non-IE/Win */
+			}
+			img {
+				border: 2px solid #fff;
+				padding: 2px;
+				margin: 2px;
+			}
+			a:hover img {
+				border: 2px solid #f50;
+			}
+			/*]]>*/
+		</style>
+	</head>
+
+	<body>
+		<h1>Fedora <strong>Test Page</strong></h1>
+
+		<div class="content">
+			<div class="content-middle">
+				<p>This page is used to test the proper operation of the Apache HTTP server after it has been installed. If you can read this page, it means that the web server installed at this site is working properly, but has not yet been configured.</p>
+			</div>
+			<hr />
+
+			<div class="content-columns">
+				<div class="content-column-left">
+					<h2>If you are a member of the general public:</h2>
+
+					<p>The fact that you are seeing this page indicates that the website you just visited is either experiencing problems, or is undergoing routine maintenance.</p>
+
+					<p>If you would like to let the administrators of this website know that you've seen this page instead of the page you expected, you should send them e-mail. In general, mail sent to the name "webmaster" and directed to the website's domain should reach the appropriate person.</p>
+
+					<p>For example, if you experienced problems while visiting www.example.com, you should send e-mail to "webmaster@example.com".</p>
+
+					<p>Fedora is a distribution of Linux, a popular computer operating system. It is commonly used by hosting companies because it is free, and includes free web server software. Many times, they do not set up their web server correctly, and it displays this "test page" instead of the expected website.</p>
+
+					<p>Accordingly, please keep these facts in mind:</p>
+					<ul>
+					<li>Neither the Fedora Project or Red Hat has any affiliation with any website or content hosted from this server (unless otherwise explicitly stated).</li>
+					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
+					</ul>
+
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
+					<hr />
+				</div>
+
+				<div class="content-column-right">
+					<h2>If you are the website administrator:</h2>
+
+					<p>You may now add content to the directory <code>/var/www/html/</code>. Note that until you do so, people visiting your website will see this page, and not your content. To prevent this page from ever being used, follow the instructions in the file <code>/etc/httpd/conf.d/welcome.conf</code>.</p>
+
+					<div class="logos">
+						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
+
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+					</div>
+				</div>
+			</div>
+		</div>
+	</body>
+</html>
--- a/instance.conf
+++ b/instance.conf
@ -1,6 +1,6 @@
 #
 # This is an example instance-specific configuration file. See the
-# httpd@.service(8) man page for detailed information on using the
+# httpd.service(8) man page for detailed information on using the
 # the httpd@.service with instances.
 #
 # To use this example, copy instance.conf to /etc/httpd/conf/foobar.conf
@ -10,7 +10,7 @@
 #   # systemctl start httpd@foobar.service
 #
 # The changes compared to the default are:
-# - DefaultRuntime, DefaultStateDir and Pidfile renamed to instance-specific
+# - DefaultRuntime and Pidfile renamed to be instance-specific
 # - default logfile names are prefixed with the instance name
 # - /etc/httpd/conf.d is NOT included by default (conf.modules.d still is)
 #
@ -20,5 +20,4 @@
 #

 DefaultRuntimeDir /run/httpd/instance-${HTTPD_INSTANCE}
-DefaultStateDir /var/lib/httpd/instance-${HTTPD_INSTANCE}
 PidFile /run/httpd/instance-${HTTPD_INSTANCE}.pid
--- a/plans/all.fmf
+++ b/plans/all.fmf
@ -1,6 +0,0 @@
-summary: Test plan with all beakerlib tests
-discover:
-    how: fmf
-    url: https://src.fedoraproject.org/tests/httpd.git
-execute:
-    how: tmt
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@ -1,7 +0,0 @@
-summary: Public (Fedora) Tier1 beakerlib tests
-discover:
-    how: fmf
-    url: https://src.fedoraproject.org/tests/httpd.git
-    filter: 'tier: 1'
-execute:
-    how: tmt
--- a/pullrev.sh
+++ b/pullrev.sh
@ -6,10 +6,10 @@ if [ $# -lt 1 ]; then
 fi

 repo="https://svn.apache.org/repos/asf/httpd/httpd/trunk"
-repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
-ver=$(rpm -q --specfile httpd.spec --qf '%{VERSION}\n' | sed 1q)
+#repo="https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x"
+ver=2.4.34
 prefix="httpd-${ver}"
-suffix="${SUFFIX:-r$1${2:++}}"
+suffix="r$1${2:++}"
 fn="${prefix}-${suffix}.patch"
 vcurl="http://svn.apache.org/viewvc?view=revision&revision="

@ -23,12 +23,8 @@ fi

 new=0
 for r in $*; do
-   case $r in
-        http*) url=$r ;;
-        *) url=${vcurl}${r} ;;
-   esac
-   if ! grep -q "^${url}" ${fn}; then
-       echo "${url}"
+   if ! grep -q "${vcurl}${r}" ${fn}; then
+       echo "${vcurl}${r}"
       new=1
   fi
 done >> ${fn}
@ -39,19 +35,10 @@ prev=/dev/null
 for r in $*; do
    echo "+ fetching ${r}"
    this=`mktemp /tmp/pullrevXXXXXX`
-    case $r in
-        http*) curl -s "$r" | filterdiff --strip=3 ;;
-        *) svn diff -c ${r} ${repo}  ;;
-    esac | filterdiff --remove-timestamps --clean \
-                      -x 'CHANGES' -x 'changes-entries/*.txt' \
-                      -x '*/next-number' -x 'STATUS' -x '*.xml' \
-                      -x '.github/*' \
-                      --addprefix="${prefix}/" > ${this}
+    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x '*/next-number' -x 'STATUS' \
+        --addprefix="${prefix}/" > ${this}
    next=`mktemp /tmp/pullrevXXXXXX`
-    if ! combinediff -w ${prev} ${this} > ${next}; then
-        echo "Failed combining previous ${prev} with ${this}";
-        exit 1
-    fi
+    combinediff --quiet ${prev} ${this} > ${next}
    rm -f "${this}"
    [ "${prev}" = "/dev/null" ] || rm -f "${prev}"
    prev=${next}
@ -64,3 +51,4 @@ echo "+ git add ${fn}"
 git add "${fn}"
 echo "+ spec template:"
 echo "PatchN: ${fn}"
+echo "%patchN -p1 -b .${suffix}"
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,22 +0,0 @@
---
-badfuncs:
-  # mod_proxy uses inet_ntoa (safely) for IPv4 address matching,
-  # and APR interfaces for IPv6 addresses.
-  allowed:
-    /usr/lib*/httpd/modules/mod_proxy.so:
-      - inet_ntoa
-upstream:
-  ignore:
-    - '*.xml'
-    - '*.service'
-    - '*.socket'
-    - '*.conf'
-    - '*.sysconf'
-    - '*.tmpfiles'
-    - 'README.*'
-    - '*.sysusers'
-    - '*.png'
-    - 'httpd-ssl-*'
-    - config.layout
-    - 'action*.sh'
-    - 'apachectl.*'
--- a/4
+++ b/4
@ -1,3 +1 @@
-SHA512 (httpd-2.4.66.tar.bz2) = 49031a3465d956ee3b755e65810b6c35561ddd5fac2c624a273b733c238e115b914cd7b246837e5a3090ccfded6e0b8b3059bfd1f8ce4419081c805a38d05a4b
-SHA512 (httpd-2.4.66.tar.bz2.asc) = 3fc7a4c6c0705adc3f8223ed3d6ebc45f09b7a19ab63a8b4d359835d2b592cf11f0fd0438a40b5a43c0684b36602484bb908bf46b0c068dd22bacc2c194e7fbd
-SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192
+SHA512 (httpd-2.4.39.tar.bz2) = 9742202040b3dc6344b301540f54b2d3f8e36898410d24206a7f8dcecb1bea7d7230fabc7256752724558af249facf64bffe2cf678b8f7cccb64076737abfda7
--- a/ssl.conf
+++ b/ssl.conf
@ -70,10 +70,11 @@ LogLevel warn
 SSLEngine on

 #   List the protocol versions which clients are allowed to connect with.
-#   The OpenSSL system profile is configured by default.  See
-#   update-crypto-policies(8) for more details.
-#SSLProtocol all -SSLv3
-#SSLProxyProtocol all -SSLv3
+#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
+#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
+#   protocol or later should remain in use.
+SSLProtocol all -SSLv3
+SSLProxyProtocol all -SSLv3

 #   User agents such as web browsers are not configured for the user's
 #   own preference of either security or performance, therefore this
@ -82,10 +83,10 @@ SSLEngine on
 SSLHonorCipherOrder on

 #   SSL Cipher Suite:
-#   List the ciphers that the client is permitted to negotiate.
-#   See the mod_ssl documentation for a complete list.
-#   The OpenSSL system profile is configured by default.  See
-#   update-crypto-policies(8) for more details.
+# List the ciphers that the client is permitted to negotiate.
+# See the mod_ssl documentation for a complete list.
+# The OpenSSL system profile is configured by default.  See
+# update-crypto-policies(8) for more details.
 SSLCipherSuite PROFILE=SYSTEM
 SSLProxyCipherSuite PROFILE=SYSTEM

--- a/tests/httpd-php-mysql-sanity-test/Makefile
+++ b/tests/httpd-php-mysql-sanity-test/Makefile
@ -1,12 +1,12 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Makefile of /CoreOS/httpd/Sanity/smoke
-#   Description: Simple check of httpd test page
-#   Author: Branislav Nater <bnater@redhat.com>
+#   Makefile of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Copyright (c) 2021 Red Hat, Inc.
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
 #
 #   This copyrighted material is made available to anyone wishing
 #   to use, modify, copy, or redistribute it subject to the terms
@ -24,12 +24,12 @@
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-export TEST=/CoreOS/httpd/Sanity/smoke
+export TEST=/CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
 export TESTVERSION=1.0

 BUILT_FILES=

-FILES=$(METADATA) runtest.sh Makefile PURPOSE
+FILES=$(METADATA) runtest.sh Makefile PURPOSE new_mysql.php old_mysql.php php_mysql_test.sql php_mysql_test.conf

 .PHONY: all install download clean

@ -43,23 +43,25 @@ clean:
 	rm -f *~ $(BUILT_FILES)


-include /usr/share/rhts/lib/rhts-make.include
+-include /usr/share/rhts/lib/rhts-make.include

 $(METADATA): Makefile
-	@echo "Owner:           Branislav Nater <bnater@redhat.com>" > $(METADATA)
+	@echo "Owner:           Karel Srot <ksrot@redhat.com>" > $(METADATA)
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Simple check of httpd test page" >> $(METADATA)
+	@echo "Description:     test fetching data from mysqldb/mariadb through php" >> $(METADATA)
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          httpd" >> $(METADATA)
-	@echo "Requires:        httpd mod_ssl" >> $(METADATA)
+	@echo "Requires:        httpd php php-zts php-mysqlnd mysql-server mariadb-server" >> $(METADATA)
 	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mysql/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(mariadb55/basic)" >> $(METADATA)
+	@echo "RhtsRequires:    library(php/utils)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)

 	rhts-lint $(METADATA)
--- a/tests/httpd-php-mysql-sanity-test/PURPOSE
+++ b/tests/httpd-php-mysql-sanity-test/PURPOSE
@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+Description: test fetching data from mysqldb/mariadb through php
+Author: Karel Srot <ksrot@redhat.com>
--- a/tests/httpd-php-mysql-sanity-test/new_mysql.php
+++ b/tests/httpd-php-mysql-sanity-test/new_mysql.php
@ -0,0 +1,12 @@
+<?php
+$db = mysqli_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysqli_select_db($db, "php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysqli_query($db, "SELECT * from foobar");
+$row = mysqli_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
--- a/tests/httpd-php-mysql-sanity-test/old_mysql.php
+++ b/tests/httpd-php-mysql-sanity-test/old_mysql.php
@ -0,0 +1,12 @@
+<?php
+$db = mysql_connect("localhost", "root");
+if (!$db) {
+    die("Could not connect");
+}
+if (!mysql_select_db("php_mysql_test")) {
+    die("Could not select database");
+}
+$res = mysql_query("SELECT * from foobar");
+$row = mysql_fetch_assoc($res);
+printf("%s is %d\n", $row['name'], $row['value']);
+?>
--- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.conf
@ -0,0 +1,5 @@
+
+Alias /php_mysql_test /var/www/php_mysql_test
+
+<Directory /var/www/php_mysql_test>
+</Directory>
--- a/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
+++ b/tests/httpd-php-mysql-sanity-test/php_mysql_test.sql
@ -0,0 +1,6 @@
+
+CREATE DATABASE php_mysql_test;
+USE php_mysql_test;
+
+CREATE TABLE foobar (name VARCHAR(10), value INTEGER);
+INSERT INTO foobar VALUES("fish", 42);
--- a/tests/httpd-php-mysql-sanity-test/runtest.sh
+++ b/tests/httpd-php-mysql-sanity-test/runtest.sh
@ -0,0 +1,102 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test
+#   Description: test fetching data from mysqldb/mariadb through php
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2013 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+[ -e /usr/bin/rhts-environment.sh ] && . /usr/bin/rhts-environment.sh
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES="${PACKAGES:-httpd}"
+REQUIRES="${REQUIRES:-php $DB}"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport httpd/http" 0 "Import httpd library"
+        if rlIsRHEL 5 6 && [ $httpCOLLECTION = 0 ]; then
+            DB="mysql-server"
+            rlRun "rlImport mysql/basic" 0 "Import mysqld library"
+            SERVICE=${mysqlServiceName}
+        else
+            DB="mariadb-server"
+            rlRun "rlImport mariadb55/basic" 0 "Import mariadb library"
+            SERVICE=${mariadbServiceName}
+        fi
+	# install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7)
+        rlRun "rlImport php/utils"
+        phpPdoPhpMysqlSetup
+        rlAssertRpm --all
+        rlRun "rlServiceStart $SERVICE" 0
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root" 0,1
+        rlRun "mysql --verbose -u root < php_mysql_test.sql"
+        rlRun "httpStop" 0 "Stop httpd if running"
+        rlRun "> $httpLOGDIR/error_log"
+        rlRun "rm -rvf $httpROOTDIR/php_mysql_test"
+        rlRun "mkdir -v $httpROOTDIR/php_mysql_test"
+        rlRun "cp -v php_mysql_test.conf $httpCONFDIR/conf.d/"
+        php_version=`rlCheckRpm php`
+        if [[ $php_version =~ php-7* ]] || [[ $php_version =~ php-5.[5-6]* ]]; then
+            rlRun "cp -v new_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        else
+            rlRun "cp -v old_mysql.php $httpROOTDIR/php_mysql_test/mysql.php"
+        fi
+        rlRun "sed -i 's|/var/www|$httpROOTDIR|' $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "chown -R apache:  $httpROOTDIR/php_mysql_test"
+        #rlRun "restorecon  $httpROOTDIR/php_mysql_test"
+        selinuxenabled && rlRun "chcon -Rv -t httpd_sys_content_t $httpROOTDIR/php_mysql_test"
+        rlRun "httpStart" 0 "Start httpd"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        URL="http://localhost/php_mysql_test/"
+        RETVAL=0
+        tries=`seq 1 10`
+
+        for n in ${tries}; do
+            output=`curl -s $URL/mysql.php`
+            rv=$?
+            echo "PHP output ${n}: ${rv} x${output}y"
+            [ ${rv} -ne 0 -o "x${output}y" != "xfish is 42y" ] && RETVAL=66
+        done
+
+        if [ $RETVAL -ne 0 ]; then
+            rlFail
+        else
+            rlPass
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -f $httpCONFDIR/conf.d/php_mysql_test.conf"
+        rlRun "rm -rf $httpROOTDIR/php_mysql_test"
+        rlRun "echo DROP DATABASE php_mysql_test | mysql -u root"
+        rlRun "rlServiceRestore ${SERVICE}" 0
+        rlRun "httpStop" 0 "Stop httpd if running"
+	# uninstall php-mysql on rhel-6 if it was installed during setup
+        phpPdoPhpMysqlCleanup
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
--- a/tests/smoke/PURPOSE
+++ b/tests/smoke/PURPOSE
@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/httpd/Sanity/smoke
-Description: Simple check of httpd
-Author: Branislav Nater <bnater@redhat.com>
--- a/tests/smoke/runtest.sh
+++ b/tests/smoke/runtest.sh
@ -1,64 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/httpd/Sanity/smoke
-#   Description: Simple check of httpd test page
-#   Author: Branislav Nater <bnater@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2021 Red Hat, Inc.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include rhts environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGES="${PACKAGES:-httpd}"
-REQUIRES=${REQUIRES:-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie
-        rlAssertRpm --all
-        rlFileBackup --clean ${httpCONFDIR}/conf/
-        rlFileBackup --clean ${httpCONFDIR}/conf.d/
-        rlFileBackup --clean ${httpCONFDIR}/conf.modules.d/
-        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
-        rlRun "pushd $TmpDir"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "httpStart" 0 "Start httpd"
-        rlRun "httpStatus" 0 "Check status"
-        rlRun "httpStop" 0 "Stop httpd"
-
-        rlRun "httpSecureStart" 0 "Start httpd with ssl"
-        rlRun "httpInstallCa $(hostname)" 0 "Install CA"
-        rlRun "httpSecureStatus" 0 "Check status"
-        rlRun "httpRemoveCa" 0 "Remove CA"
-        rlRun "httpSecureStop" 0 "Stop httpd with ssl"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rlFileRestore" 0 "Restoring original configuration"
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
-    rlPhaseEnd
-rlJournalEnd
-rlJournalPrintText
--- a/tests/ignore_tests.yml
+++ b/tests/ignore_tests.yml
@ -6,7 +6,7 @@
    tags:
    - classic
    tests:
-    - smoke
+    - httpd-php-mysql-sanity-test
    required_packages:
    - findutils         # beakerlib needs find command
    - which             # smoke requires which command
--- a/welcome.conf
+++ b/welcome.conf
@ -16,5 +16,3 @@
 </Directory>

 Alias /.noindex.html /usr/share/httpd/noindex/index.html
-Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png
-Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png
Author	SHA1	Message	Date
Joe Orton	1b9efda9a7	mod_reqtimeout: fix default values regression (PR 63325)	2019-05-03 10:02:09 +01:00
Lubos Uhliarik	4f4d0e09fd	new version 2.4.39	2019-04-02 17:16:12 +00:00
Lubos Uhliarik	76e73730f5	Resolves: #1652678 - TLS connection allowed while all protocols are forbidden	2018-11-26 12:03:39 +00:00
				`@ -1 +0,0 @@`
				`LoadModule brotli_module modules/mod_brotli.so`